paint.toys Open in urlscan Pro
3.33.186.135 Public Scan

Software

Netlify /

Resource Hash

70883a9270d54ca9914810ee600c39f62c1147243374c8b93b7095f9c78b4b66

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://sse6.kwach.org/r/a1NuZEQ2Vkt1MEZ4T3RqY01Mc08tMzk3OC0yNTg4OTkxMS0xMDhlMDI4Ny02NjQ0LXpoM1Y4c2Jwajl3RTk2Y2s2MXBi
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 126222
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-encoding: br
content-length: 1632
content-type: text/html; charset=UTF-8
date: Thu, 14 Aug 2025 16:41:02 GMT
etag: "7afa2eee23cef4ed7f87aab76b5bc74d-ssl-df"
server: Netlify
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-nf-request-id: 01K2MQ9MHWNNG8R6JX7AXPF0SH

Redirect headers

cache-status: "Netlify Edge"; fwd=miss
content-length: 98
content-type: text/html
date: Thu, 14 Aug 2025 16:41:02 GMT
location: /oil/
server: Netlify
strict-transport-security: max-age=31536000
x-nf-request-id: 01K2MQ9M9XHQPAJT3FCDXAPVEE

GET
H2 200 ramp_config.js Show response
cdn.intergient.com/1024872/74068/ 36 KB
6 KB 444ms
167ms Script
application/javascript 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/1024872/74068/ramp_config.js
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.21.56 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2b7245503e4ce3f62cd53413e1a6e0464ba16c0e76b0fd47904d329aac946abf

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: CA
cache-control: max-age=600, public, must-revalidate
content-encoding: br
cf-ray: 96f1e5bf980aa3fe-EWR
alt-svc: h3=":443"; ma=86400
date: Thu, 14 Aug 2025 16:41:02 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

GET
H2 200 apps.css
paint.toys/ 5 KB
1 KB 121ms
118ms Stylesheet
text/css 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://paint.toys/apps.css

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

2ff696f311f1afa7aafddb260becd45331aab7ce1741821b0f3e2d9e683382b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
content-encoding: br
etag: "58d01e65c6625681e8891f6fbc8c18f5-ssl-df"
age: 240626
accept-ranges: bytes
content-length: 1394
x-nf-request-id: 01K2MQ9MNYKD5B7NNYYGAZ4VFB
cache-status: "Netlify Edge"; hit
date: Thu, 14 Aug 2025 16:41:02 GMT
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: Netlify

GET
H2 200 index.js Show response
paint.toys/oil/ 4 KB
1 KB 335ms
332ms Script
application/javascript 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://paint.toys/oil/index.js

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

c91c09319c4b0a24c72c0036cef74c17b85d3c4e2a4abf8153f5710421fe5b4c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
content-encoding: br
etag: "687211e2ced405124b38663a13c97091-ssl-df"
age: 126222
accept-ranges: bytes
content-length: 1205
x-nf-request-id: 01K2MQ9MNY8KP01S85K6NESWBJ
cache-status: "Netlify Edge"; hit
date: Thu, 14 Aug 2025 16:41:02 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Netlify

GET
H2 200 art-icon.png
paint.toys/assets/ 33 KB
33 KB 120ms
117ms Image
image/png 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/art-icon.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

f4d368e4230539c778afbb020e0ea611b3e1d984179f5b3769b44081d6703f3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "1394f8469f2ca5750397e3d7b6ec70a1-ssl"
age: 240626
accept-ranges: bytes
content-length: 33562
x-nf-request-id: 01K2MQ9MNYXKD7YT9RC8VAA6ZG
cache-status: "Netlify Edge"; hit
date: Thu, 14 Aug 2025 16:41:02 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-hand.png
paint.toys/assets/ 27 KB
27 KB 121ms
118ms Image
image/png 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-hand.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

32aa05a5648678542ab9044647f0bf5549c0b53a070585edb773f0e92b72b97d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "a0822110a4671ffdf710da1467460fba-ssl"
age: 240626
accept-ranges: bytes
content-length: 27394
x-nf-request-id: 01K2MQ9MNYT4S77S3WF38M4TQ5
cache-status: "Netlify Edge"; hit
date: Thu, 14 Aug 2025 16:41:02 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-disk.png
paint.toys/assets/ 13 KB
14 KB 105ms
97ms Image
image/png 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-disk.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

436814c2374a6d92a42a02d39969ef7c56b5f225667abecb218e692c5569943c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "26852fa1548a91e004629b01e4abf1dd-ssl"
age: 240626
accept-ranges: bytes
content-length: 13766
x-nf-request-id: 01K2MQ9N026Z8GSR01MH1YFK2D
cache-status: "Netlify Edge"; hit
date: Thu, 14 Aug 2025 16:41:02 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-trash.png
paint.toys/assets/ 50 KB
51 KB 106ms
98ms Image
image/png 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-trash.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

6ceb226c487cb85243545e768944e0e1ae0944be8fde6c1c43c7314a9287e6d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "e91ef5e34b5154d392e8560031eaaa4c-ssl"
age: 240626
accept-ranges: bytes
content-length: 51680
x-nf-request-id: 01K2MQ9N02NX0M83YRW2934W7R
cache-status: "Netlify Edge"; hit
date: Thu, 14 Aug 2025 16:41:02 GMT
content-type: image/png
server: Netlify

GET
H2 200 ramp_core.js Show response
cdn.intergient.com/ 3 KB
2 KB 129ms
121ms Script
application/javascript 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/ramp_core.js
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.21.56 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: da1757bd1a42fcd2e8d8ce475d55306bc68983aa5e5df9753898bc029c48793b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: CA
cache-control: max-age=600, public, must-revalidate
content-encoding: br
cf-ray: 96f1e5c0095ea3fe-EWR
alt-svc: h3=":443"; ma=86400
date: Thu, 14 Aug 2025 16:41:02 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 389 KB
134 KB 427ms
149ms Script
application/javascript 142.250.65.168
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.65.168 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s71-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

a7068110b7234473e83ffbc7157e8144e1d5ef47b9062e95ffc5205f892dc42d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: zstd
report-to: {"group":"ascgcycc:1099:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1099:0"}],}
expires: Thu, 14 Aug 2025 16:41:03 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 14 Aug 2025 16:41:03 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1099:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1099:0
content-length: 136147
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 art-icon.png
paint.toys/assets/ 33 KB
40 B 307ms
305ms Image
image/png 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/art-icon.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

186.176.8.34.bc.googleusercontent.com

Software

Netlify /

Resource Hash

f4d368e4230539c778afbb020e0ea611b3e1d984179f5b3769b44081d6703f3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "1394f8469f2ca5750397e3d7b6ec70a1-ssl"
age: 240626
accept-ranges: bytes
content-length: 33562
x-nf-request-id: 01K2MQ9N03EQ8DX31WVD5S4HW8
cache-status: "Netlify Edge"; hit
date: Thu, 14 Aug 2025 16:41:02 GMT
content-type: image/png
server: Netlify

GET
H2 200 o4u_au6aai7bi Show response
faucetfoot.com/public/js/ 88 KB
31 KB 414ms
159ms Script
text/javascript 34.8.176.186
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL

https://faucetfoot.com/public/js/o4u_au6aai7bi

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.8.176.186 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

hoothoot/1955601531 /

Resource Hash

1bb47ff16bbec9486ab7a09291b11a2bbea5103d5c420ec536afd928e1718cc7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=15724800; preload
cache-control: private, must-revalidate, max-age=21600
timing-allow-origin: *
content-encoding: zstd
etag: W/"a5d96bfac1dd3d728aa8a6df7f505e511b520b3889ce5810b6628070f38f6e2c"
via: fen-hoothoot-us-east1-spot-fl45.gce-us-east1, 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 14 Aug 2025 16:41:03 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding, Accept-Language
server: hoothoot/1955601531

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 113 KB
34 KB 382ms
148ms Script
text/javascript 142.250.81.226
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.81.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

367251d5aa6943e185610f07b6697b35c3c1a440ee1b48683e86892957bdfb63

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 810 / 20314 / m202508110101 / config-hash: 10187134902402663645
x-content-type-options: nosniff
expires: Thu, 14 Aug 2025 16:41:03 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 14 Aug 2025 16:41:03 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 34817
x-xss-protection: 0
server: cafe

GET
H2 200 prebid.ae6790c95efdb5dcce9e.js Show response
cdn.intergient.com/prebid/ 616 KB
187 KB 131ms
129ms Script
text/javascript 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/prebid/prebid.ae6790c95efdb5dcce9e.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.21.56 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 480cf34bb7125233486e3d17eafb6e55e01099dd22f7af4fa894efbeb6a788ba

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: CA
cache-control: public, max-age=31536000, immutable
content-encoding: br
cf-cache-status: HIT
etag: W/"ecab9224c94bc76e048c82c0ab0e0fcb"
age: 621772
cf-ray: 96f1e5c0dbb7a3fe-EWR
alt-svc: h3=":443"; ma=86400
date: Thu, 14 Aug 2025 16:41:02 GMT
content-type: text/javascript
last-modified: Thu, 31 Jul 2025 19:09:24 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 pageos.js Show response
cdn.intergient.com/pageos/V.20250811.1/ 411 B
360 B 234ms
233ms Script
text/javascript 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250811.1/pageos.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/ramp_core.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.21.56 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f652f768de62ed54e14e75c31f2ab14a6e710e040d4baedeb464320a93335652

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: CA
content-encoding: br
cf-cache-status: HIT
etag: W/"ab275b14780baab0f2aa192611a9f424"
age: 789
cf-ray: 96f1e5c21fb6a3fe-EWR
alt-svc: h3=":443"; ma=86400
date: Thu, 14 Aug 2025 16:41:03 GMT
content-type: text/javascript
last-modified: Tue, 12 Aug 2025 13:35:27 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 paint.toys Show response
cdn.intergi.com/bot_score/publisher/74068/domain/ 22 B
414 B 308ms
142ms Script
application/javascript 104.18.25.242
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergi.com/bot_score/publisher/74068/domain/paint.toys?path=%2Foil%2F
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/ramp_core.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.25.242 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: de46c4398776e7c7dee8b73f675e57137e64cdead7879d7e7b9c8db7f12a0764

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache
cf-ray: 96f1e5c31e3aac2a-YYZ
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
content-length: 22
date: Thu, 14 Aug 2025 16:41:03 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare
priority: u=3,i=?0

GET
H2 200 runtime.8e36e221cb800d41bcab.js Show response
cdn.intergient.com/pageos/V.20250811.1/ 3 KB
2 KB 146ms
144ms Script
text/javascript 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250811.1/runtime.8e36e221cb800d41bcab.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250811.1/pageos.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.21.56 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1c5583238ca1c7d3ede2bb946e2f88f5de04c87e69ef39de5b75d38bc499e6b0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: CA
content-encoding: br
cf-cache-status: HIT
etag: W/"d183be3262f38a99fae715801a13214d"
age: 2793
cf-ray: 96f1e5c38c93a3fe-EWR
alt-svc: h3=":443"; ma=86400
date: Thu, 14 Aug 2025 16:41:03 GMT
content-type: text/javascript
last-modified: Tue, 12 Aug 2025 13:35:29 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 main.9b44c978684fc999f334.js Show response
cdn.intergient.com/pageos/V.20250811.1/ 537 KB
162 KB 138ms
136ms Script
text/javascript 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250811.1/main.9b44c978684fc999f334.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250811.1/pageos.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.21.56 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b4ed473deb6cbbaffca1e8bd7620b955a42091ca3eceb33335d81598c06abda7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: CA
content-encoding: br
cf-cache-status: HIT
etag: W/"8aeced016d74576ae6428b25866b0f18"
age: 789
cf-ray: 96f1e5c38c9aa3fe-EWR
alt-svc: h3=":443"; ma=86400
date: Thu, 14 Aug 2025 16:41:03 GMT
content-type: text/javascript
last-modified: Tue, 12 Aug 2025 13:35:25 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202508110101/ 577 KB
183 KB 107ms
106ms Script
text/javascript 142.250.81.226
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202508110101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.81.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

cdn-185-199-110-133.github.com

Software

cafe /

Resource Hash

9121bb992efb0ed2ddf63d4e7fbcce69013cc12ce58ba5842c699008e5d1d425

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 12304107057498924566
age: 23282
x-content-type-options: nosniff
expires: Fri, 14 Aug 2026 10:13:01 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 14 Aug 2025 10:13:01 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 187037
x-xss-protection: 0
server: cafe

GET
H2 200 skeleton.gif
static.adsafeprotected.com/ 43 B
481 B 901ms
118ms Image
image/gif 18.173.132.108
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://static.adsafeprotected.com/skeleton.gif?service=ad&adid=mjoqz&adnum=177735
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.132.108 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-132-108.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: "45cf913e5d9d3c9b2058033056d3dd23"
x-amz-version-id: iiN8XkcmZQdDIQeKkzAiegPwcD.5WPja
age: 6311643
x-cache: Hit from cloudfront
x-amz-cf-id: hexOYrbneiDEppSDNNo2j557-5WvqSGm0Quy62Fih6hazn-mE3vD5A==
date: Mon, 02 Jun 2025 15:27:02 GMT
content-type: image/gif
last-modified: Mon, 17 Aug 2020 23:55:15 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 15b20cdc545f9b56059a7fe493f5451a.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 43
x-amz-cf-pop: JFK52-P2
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 videoCard.5ed8eb34c11835040def.js Show response
cdn.intergient.com/pageos/V.20250811.1/ 559 B
444 B 131ms
131ms Script
text/javascript 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250811.1/videoCard.5ed8eb34c11835040def.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250811.1/runtime.8e36e221cb800d41bcab.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.21.56 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 795041923e6338abe450ff9524ef70fd40432f278f32c9c35cdbb08239574fb1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: CA
content-encoding: br
cf-cache-status: HIT
etag: W/"6880c1609e3243c11c7b4f1285e14d89"
age: 2712
cf-ray: 96f1e5c60d2fa3fe-EWR
alt-svc: h3=":443"; ma=86400
date: Thu, 14 Aug 2025 16:41:03 GMT
content-type: text/javascript
last-modified: Tue, 12 Aug 2025 13:35:32 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 iframe.html Show response
cdn.intergient.com/pageos/V.20250811.1/iframe/ Frame E0CB 503 B
427 B 520ms
150ms Document
text/html 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250811.1/iframe/iframe.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250811.1/main.9b44c978684fc999f334.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f29f1b37d4bdc0ca36752d8b70c7a31c2ab9bfcbeb22ba1bb3c83556911ecf70

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

age: 2838
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
cf-ray: 96f1e5c87a07aa95-YYZ
content-encoding: br
content-type: text/html
date: Thu, 14 Aug 2025 16:41:04 GMT
hw-country-code: CA
last-modified: Tue, 12 Aug 2025 13:35:22 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 iframe.html Show response
cdn.intergient.com/pageos/V.20250811.1/iframe/ Frame 8F0D 503 B
0 498ms
498ms Document
text/html 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250811.1/iframe/iframe.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250811.1/main.9b44c978684fc999f334.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f29f1b37d4bdc0ca36752d8b70c7a31c2ab9bfcbeb22ba1bb3c83556911ecf70

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

age: 2838
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
cf-ray: 96f1e5c87a07aa95-YYZ
content-encoding: br
content-type: text/html
date: Thu, 14 Aug 2025 16:41:04 GMT
hw-country-code: CA
last-modified: Tue, 12 Aug 2025 13:35:22 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 TIER_1 Show response
impression-inferences-edge-prod.playwire.com/websites/74068/v1/Thu/12/desktop/Chrome/ 584 B
913 B 1542ms
508ms XHR
application/json 108.138.128.82
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://impression-inferences-edge-prod.playwire.com/websites/74068/v1/Thu/12/desktop/Chrome/TIER_1
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250811.1/main.9b44c978684fc999f334.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.128.82 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-128-82.jfk50.r.cloudfront.net
Software: CloudFront /
Resource Hash: 4e660ef98fbe417a3636b4b6374fd7427c3f7ba2bcfd6b9eedc429ccd36994ec

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=3600, public, must-revalidate
access-control-expose-headers: *
via: 1.1 e5f49cd65618fc548cd417b060a75e76.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Miss from cloudfront
content-length: 584
x-amz-cf-id: 0c3mlZJAyZIBmxwwglgrti9r4BcNWqgN2u5henkRCf_8JHjxq8_Svw==
date: Thu, 14 Aug 2025 16:41:05 GMT
content-type: application/json
x-amz-cf-pop: JFK50-P4
server: CloudFront

GET
H2 200 tag Show response
btloader.com/ 166 KB
45 KB 867ms
136ms Script
application/javascript 104.20.20.189
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250811.1/main.9b44c978684fc999f334.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.20.189 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 124feea3adf6870b4a07d3447d8f5c0797592f14b7719b5bc3ef021aed2bb962

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-robots-tag: noindex, nofollow
cache-control: public, max-age=300, stale-if-error=3600, stale-while-revalidate=300
content-encoding: gzip
cf-cache-status: HIT
etag: "4625f43664221f8d928b4e8efee3629f"
via: 1.1 google
cf-ray: 96f1e5caea54c64a-EWR
access-control-allow-origin: *
content-length: 45940
date: Thu, 14 Aug 2025 16:41:04 GMT
content-type: application/javascript
last-modified: Thu, 14 Aug 2025 16:25:55 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 331 KB
83 KB 845ms
134ms Script
application/javascript 108.138.112.90
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250811.1/main.9b44c978684fc999f334.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.112.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-112-90.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 856fbabc6c5ab42cee6104b14b6bfebc9dc5e91b44bedd5038e94632b69e9731

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: max-age=3600
content-encoding: gzip
etag: W/"37debc9b7d063fec2c484dd9812c1170"
age: 3117
via: 1.1 58f689028f521999dd25fa234ad8a3f4.cloudfront.net (CloudFront), 1.1 7225c7fb64d09bab64bc17e314ef26a2.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: hG_w-a0xzrJ842E8EMTkwQI37eThe2_7RljEakdLEg4rBF9EWJ8Riw==
date: Thu, 14 Aug 2025 15:49:08 GMT
content-type: application/javascript
x-amz-cf-pop: IAD55-P7, JFK50-P3
server: AmazonS3
last-modified: Mon, 11 Aug 2025 20:14:23 GMT
x-amz-server-side-encryption: AES256

GET
H2 200 1x1.gif
raw.githubusercontent.com/easylist/easylist/master/docs/ 43 B
584 B 1236ms
275ms Image
image/gif 185.199.110.133
FASTLY

General

Check archive.org

Download Go to Show image

Full URL

https://raw.githubusercontent.com/easylist/easylist/master/docs/1x1.gif

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.199.110.133 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; style-src 'unsafe-inline'; sandbox
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-fastly-request-id: d39390de8e69b4e34636133c76215372279c77e9
etag: W/"0c4a5773f7e435c57c40bd270aef756513eba26bd7ba5317b5bd765569a7325d"
x-content-type-options: nosniff
x-github-request-id: 8204:2C67BE:760144:970A56:689C3CC7
expires: Thu, 14 Aug 2025 16:46:04 GMT
x-cache: HIT
date: Thu, 14 Aug 2025 16:41:04 GMT
content-type: image/gif
x-served-by: cache-yul1970042-YUL
x-cache-hits: 22
source-age: 284
x-frame-options: deny
strict-transport-security: max-age=31536000
vary: Authorization,Accept-Encoding
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
cache-control: max-age=300
x-timer: S1755189665.855837,VS0,VE0
cross-origin-resource-policy: cross-origin
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
content-length: 43
x-xss-protection: 1; mode=block

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/17138/ 43 KB
13 KB 835ms
128ms Script
text/javascript 108.138.128.34
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/17138/sync.min.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250811.1/main.9b44c978684fc999f334.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.128.34 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-128-34.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 9237a85a654c88926ceffd84a008cc5c4dac7bf2ad264acc479d3584c3bbd39a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"393e5698257df4f28d8dd23fd78851f2"
age: 37621
via: 1.1 820b14719bf91dbc846cab9728bc3fe6.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: Vt-Gdoy0hsAI4HBKkXurGJkY83eM3PUE6J_-XPNhWwgnUAl3BDtDow==
date: Thu, 14 Aug 2025 06:14:04 GMT
content-type: text/javascript
last-modified: Wed, 06 Aug 2025 15:30:02 GMT
server: AmazonS3
x-amz-cf-pop: JFK50-P4
x-amz-server-side-encryption: AES256

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 329 KB
118 KB 202ms
200ms Script
application/javascript 142.250.65.168
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-CEFZJ359V8&cx=c&gtm=45je58d0v9101576445za200&tag_exp=101509157~103116026~103200004~103233427~104684208~104684211~105033763~105033765~105103161~105103163~105231383~105231385

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.65.168 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s71-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

b2ef1908984105c70053c42bb898a033d657fa7fe18c104e3ab4c4c4a534e6ab

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: zstd
report-to: {"group":"ascgcycc:1099:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1099:0"}],}
expires: Thu, 14 Aug 2025 16:41:03 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 14 Aug 2025 16:41:03 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1099:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1099:0
content-length: 120744
x-xss-protection: 0
server: Google Tag Manager

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 756ms
286ms Fetch
text/plain 142.250.65.174
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-VJBRK9986D&gtm=45je58d0v9101576445za200zd9101576445&_p=1755189662328&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101509157~103116026~103200004~103233427~104684208~104684211~105033763~105033765~105103161~105103163~105231383~105231385&cid=2142931288.1755189664&ul=en-ca&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1755189663&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Fsse6.kwach.org%2F&dt=Paint%20with%20Oils&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=3635
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.65.174 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga25s71-in-f14.1e100.net
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:102:0
report-to: {"group":"ascnsrsggc:102:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:102:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:102:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 14 Aug 2025 16:41:04 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 154013155 Show response
fundingchoicesmessages.google.com/i/ 205 KB
66 KB 948ms
357ms Script
application/javascript 142.251.40.174
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/154013155?ers=3

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202508110101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.174 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

698b4ec24a81e26d04c0c7b4f21c1d43d5838aafd8743caf05d875702383af83

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-bK7q0HWX5kms45If-qs7YQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 14 Aug 2025 16:41:04 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjStDikmLw05BiaL15jnU6EBsqXGJ1BuIP9ZdZfwBxkcQV1hYg_lR1g1Wk-gZrEvtN1hIg3rXxFuthIDbzu81qB8SSr2-zKgJx5JS7rElA_HvNXVaWtXdZhXg4Fiz-cYRN4MOW8zeZlTSS8gvjk_PzSooyk0pL8ovSktNSi1OLylKL4o0MjEwNLAyN9QwM4gsMANXcPb4"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-bK7q0HWX5kms45If-qs7YQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H2 200 iframe.js Show response
cdn.intergient.com/pageos/V.20250811.1/iframe/ Frame E0CB 17 KB
7 KB 144ms
142ms Script
text/javascript 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250811.1/iframe/iframe.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250811.1/iframe/iframe.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3cf4e88b472433e2273c4de0a7fceb430f0f3ac49425ec77a99697a944d53ec4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://cdn.intergient.com/pageos/V.20250811.1/iframe/iframe.html

Response headers

hw-country-code: CA
content-encoding: br
cf-cache-status: HIT
etag: W/"31bb1614c114425ef27f97d72f81a6e3"
age: 3153
cf-ray: 96f1e5c9db29aa95-YYZ
alt-svc: h3=":443"; ma=86400
date: Thu, 14 Aug 2025 16:41:04 GMT
content-type: text/javascript
last-modified: Tue, 12 Aug 2025 13:35:23 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 iframe.js Show response
cdn.intergient.com/pageos/V.20250811.1/iframe/ Frame 8F0D 17 KB
0 133ms
133ms Script
text/javascript 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250811.1/iframe/iframe.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250811.1/iframe/iframe.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3cf4e88b472433e2273c4de0a7fceb430f0f3ac49425ec77a99697a944d53ec4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://cdn.intergient.com/pageos/V.20250811.1/iframe/iframe.html

Response headers

hw-country-code: CA
content-encoding: br
cf-cache-status: HIT
etag: W/"31bb1614c114425ef27f97d72f81a6e3"
age: 3153
cf-ray: 96f1e5c9db29aa95-YYZ
alt-svc: h3=":443"; ma=86400
date: Thu, 14 Aug 2025 16:41:04 GMT
content-type: text/javascript
last-modified: Tue, 12 Aug 2025 13:35:23 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 gpt
securepubads.g.doubleclick.net/pagead/managed/dict/m202508140101/ 63 KB
23 KB 141ms
137ms Other
text/plain 142.250.81.226
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/dict/m202508140101/gpt

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.81.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s37-in-f10.1e100.net

Software

cafe /

Resource Hash

78920a58aad6e189b7eb6254181dc9b05014f4c8aca325fc1949a1d2e4973ef7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 15235745983449116911
age: 11380
x-content-type-options: nosniff
expires: Thu, 21 Aug 2025 13:31:24 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 14 Aug 2025 13:31:24 GMT
content-type: text/plain; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=604800, stale-while-revalidate=7200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 23658
x-xss-protection: 0
server: cafe
use-as-dictionary: match="/gampad/ads", id="m202508140101"

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 418ms
279ms Fetch
text/plain 142.250.65.174
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-CEFZJ359V8&gtm=45je58d0v9102396898za200zb9101576445zd9101576445&_p=1755189662328&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101509157~102015666~103116026~103200004~103233427~104684208~104684211~105033763~105033765~105103161~105103163~105231383~105231385&cid=2142931288.1755189664&ul=en-ca&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1755189664&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Fsse6.kwach.org%2F&dt=Paint%20with%20Oils&en=ramp_js&_fv=1&_ss=1&_ee=1&ep.pageview_id=1755189662328&tfd=4154
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-CEFZJ359V8&cx=c&gtm=45je58d0v9101576445za200&tag_exp=101509157~103116026~103200004~103233427~104684208~104684211~105033763~105033765~105103161~105103163~105231383~105231385
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.65.174 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga25s71-in-f14.1e100.net
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:102:0
report-to: {"group":"ascnsrsggc:102:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:102:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:102:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 14 Aug 2025 16:41:04 GMT
content-type: text/plain
server: Golfe2

GET b221f992-8dbc-49dd-8937-34c0030c9e2c
https://paint.toys/ 0
0

GET
H3 200 config.json Show response
config.playwire.com/audience_segments/ 331 KB
57 KB 527ms
130ms XHR
application/json 104.18.11.207
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://config.playwire.com/audience_segments/config.json

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250811.1/main.9b44c978684fc999f334.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.11.207 , Ascension Island, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

06054a5018fe288f775e1c5840612e4a04a47e1b0a11036db29081f8cbf32f3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-max-age: 7200
access-control-expose-headers: hw-country-code
content-encoding: gzip
cf-cache-status: HIT
age: 4075
access-control-allow-methods: GET
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 14 Aug 2025 16:41:04 GMT
content-type: application/json
vary: Origin, Accept-Encoding
last-modified: Thu, 14 Aug 2025 15:07:45 GMT
priority: u=1,i
strict-transport-security: max-age=31536000; includeSubDomains
hw-country-code: CA
cache-control: public, max-age=86400
cf-ray: 96f1e5ce0f55ebb4-YYZ
access-control-allow-origin: *
server: cloudflare

GET
H2 200 474.9e5e7d94b0ad365e11fa.js Show response
cdn.intergient.com/pageos/V.20250811.1/ 3 KB
1 KB 145ms
143ms Script
text/javascript 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250811.1/474.9e5e7d94b0ad365e11fa.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250811.1/runtime.8e36e221cb800d41bcab.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.21.56 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1f0769b6ec00799d55c116b89a5b71d923e5ea0d9f0d7e1fac3fe1914599e658

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: CA
content-encoding: br
cf-cache-status: HIT
etag: W/"f32f7966b1a24d5db4c7e8891271dc87"
age: 2797
cf-ray: 96f1e5cc6bd4a3fe-EWR
alt-svc: h3=":443"; ma=86400
date: Thu, 14 Aug 2025 16:41:04 GMT
content-type: text/javascript
last-modified: Tue, 12 Aug 2025 13:35:16 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 script Show response
carbon-cdn.ccgateway.net/ 37 KB
9 KB 532ms
232ms Script
text/javascript 18.212.140.196
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Requested by: Host: sse6.kwach.org
URL: https://sse6.kwach.org/r/a1NuZEQ2Vkt1MEZ4T3RqY01Mc08tMzk3OC0yNTg4OTkxMS0xMDhlMDI4Ny02NjQ0LXpoM1Y4c2Jwajl3RTk2Y2s2MXBi
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.212.140.196 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-212-140-196.compute-1.amazonaws.com
Software: /
Resource Hash: 3ccf662592d11c011bdfa7e63351edbd0b4aa9648537386119dac5720c873f4a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=900
content-encoding: gzip
date: Thu, 14 Aug 2025 16:41:04 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 ima3.js Show response
imasdk.googleapis.com/js/sdkloader/ 456 KB
144 KB 1558ms
165ms Script
text/javascript 142.250.176.202
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/ima3.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250811.1/main.9b44c978684fc999f334.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.176.202 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0bb4dec1505e5535bd71f9efeab49b2f31e1b410a867edd32ae11a41a6785462

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 7579280642962434520
x-content-type-options: nosniff
expires: Thu, 14 Aug 2025 16:41:06 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 14 Aug 2025 16:41:06 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 147048
x-xss-protection: 0
server: cafe

POST
H2 200 prebid Show response
id5-sync.com/api/config/ 194 B
649 B 607ms
189ms Fetch
application/json 162.19.138.119
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.ae6790c95efdb5dcce9e.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.119 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ns31533570.ip-162-19-138.eu

Software

Resource Hash

1526f7f540b829baf0e6d1b491aa7b26b5e49fa160abca67c11695ccfa2cee82

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
content-encoding: gzip
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Thu, 14 Aug 2025 16:41:05 GMT
content-type: application/json;charset=UTF-8
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding

GET
H2 200 id5PrebidModule.js Show response
cdn.id5-sync.com/api/1.0/ 92 KB
27 KB 439ms
131ms Script
text/javascript 172.66.169.55
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/id5PrebidModule.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.ae6790c95efdb5dcce9e.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.66.169.55 , Ascension Island, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a6cb45ea7814e6ac7230621d5fff9cf48e7a7b4b935b8963c895dcc94740ee75

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-amz-id-2: XFLWeHEPAZJ+XoQR/kzdJUU0Y14sAfj0H71eOIwa3OI/PGwUxzoFUasqyPmov6DJVVicMZZa+SM=
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: public, max-age=3600
content-encoding: br
cf-cache-status: HIT
etag: W/"7b9d1ba408d6a19e7061eda9bb44771f"
age: 3361
x-amz-request-id: 3RJWAQRKAG774NZV
cf-ray: 96f1e5ceace7d954-EWR
date: Thu, 14 Aug 2025 16:41:05 GMT
content-type: text/javascript;charset=utf-8
last-modified: Tue, 29 Jul 2025 12:29:41 GMT
vary: accept-encoding
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 id Show response
id.crwdcntrl.net/ 152 B
904 B 442ms
136ms Fetch
application/json 3.220.65.116
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://id.crwdcntrl.net/id?c=17262

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.ae6790c95efdb5dcce9e.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.220.65.116 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-220-65-116.compute-1.amazonaws.com

Software

Resource Hash

0f1d17c0e2e34b36a409c9c0d5e23561e8fd86eb277a059fe360f79e03739723

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains
cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 152
date: Thu, 14 Aug 2025 16:41:05 GMT
content-type: application/json;charset=utf-8

GET
H2 200 f Show response
fid.agkn.com/ 0
364 B 431ms
124ms Fetch 52.4.69.113
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://fid.agkn.com/f?apiKey=2104320612&r=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.ae6790c95efdb5dcce9e.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.4.69.113 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-4-69-113.compute-1.amazonaws.com
Software: AAWebServer /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
expires: 0
access-control-allow-origin: https://paint.toys
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
date: Thu, 14 Aug 2025 16:41:05 GMT
vary: Origin
server: AAWebServer
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type

GET
H2 200 envelope Show response
lexicon.33across.com/v1/ 2 KB
2 KB 416ms
120ms Fetch
application/json 35.244.193.51
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0014000001YrMoYAAV&gdpr=0&src=pbjs&ver=9.51.0&coppa=0
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.ae6790c95efdb5dcce9e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.193.51 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 51.193.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 9df40a3d1362dc7c556cc355829ce5da552f98525c5013ddf719a9038daeda92

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1636
date: Thu, 14 Aug 2025 16:41:04 GMT
content-type: application/json
vary: origin

GET
H2 200 any Show response
idx.liadm.com/idex/did-0046/ 483 B
894 B 419ms
123ms Fetch
text/plain 44.219.88.186
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://idx.liadm.com/idex/did-0046/any?duid=8e413bd09c43--01k2mq9pwmjtgz8mh0x8ggfs11&did=did-0046&cd=.paint.toys&pu=https%3A%2F%2Fpaint.toys&resolve=nonId&resolve=uid2&resolve=index&resolve=bidswitch&resolve=pubmatic&resolve=magnite&resolve=openx&resolve=sorvrn&resolve=thetradedesk&resolve=medianet&resolve=vidazoo&resolve=sonobi&resolve=sharethrough&resolve=triplelift

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.ae6790c95efdb5dcce9e.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

44.219.88.186 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-219-88-186.compute-1.amazonaws.com

Software

Resource Hash

0ab183843c16c18b2ef0d4f311e95e2c0a3e0381fbb7776a20174ea59463ad40

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: max-age=86399, private
trace-id: d6c5d95aa45312d9
request-time: 4
access-control-allow-credentials: true
expires: Fri, 15 Aug 2025 16:41:05 GMT
access-control-allow-origin: https://paint.toys
content-length: 483
date: Thu, 14 Aug 2025 16:41:05 GMT
content-type: text/plain; charset=UTF-8
vary: Origin

GET
H2 200 json Show response
gum.criteo.com/sid/ 365 B
945 B 719ms
133ms Fetch
application/json 74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&cw=1&lsw=1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.ae6790c95efdb5dcce9e.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

7b624de121841b5a9d0a32afe32370f8b54fb2ee3e3bec49f31d5ac8df2f3a65

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
content-type: application/json
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 489236
expires: 0
access-control-allow-origin: https://paint.toys
date: Thu, 14 Aug 2025 16:41:05 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

POST
H3 200 leyj7apjjj5oxvfy9s9_ywdmm Show response
faucetfoot.com/post/ 295 B
319 B 479ms
342ms Fetch
application/json 34.8.176.186
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL

https://faucetfoot.com/post/leyj7apjjj5oxvfy9s9_ywdmm

Requested by

Host: faucetfoot.com
URL: https://faucetfoot.com/public/js/o4u_au6aai7bi

Protocol

Security

QUIC, , AES_128_GCM

Server

34.8.176.186 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

186.176.8.34.bc.googleusercontent.com

Software

hoothoot/1955601531 /

Resource Hash

1a8a776ebdb7bf7f827772c7da4f786a9bf837472722fb383987b224d421d6a0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=15724800; preload
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: POST, OPTIONS
via: fen-hoothoot-us-east1-spot-fl45.gce-us-east1, 1.1 google
expires: Thu, 14 Aug 2025 16:41:03 GMT
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
date: Thu, 14 Aug 2025 16:41:04 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding, Origin
server: hoothoot/1955601531
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Cookie

GET
H/1.1

200
OK

/ Show response
ps.eyeota.net/pixel/bounce/
Redirect Chain

https://ps.eyeota.net/pixel?pid=m51mh00&t=ajs&uid=user_a79bdf49-d4be-40f1-bd06-450a96e62d46_1755189664469
https://ps.eyeota.net/pixel/bounce/?pid=m51mh00&t=ajs&uid=user_a79bdf49-d4be-40f1-bd06-450a96e62d46_1755189664469

1 KB
2 KB

220ms
218ms

Script
application/javascript

44.205.65.132
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://ps.eyeota.net/pixel/bounce/?pid=m51mh00&t=ajs&uid=user_a79bdf49-d4be-40f1-bd06-450a96e62d46_1755189664469
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 44.205.65.132 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-205-65-132.compute-1.amazonaws.com
Software: /
Resource Hash: 34cba3f8923b66e9b7e20cddf28925b3267df8ea8e20ed6b347a485a668ac231

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 1247
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 14 Aug 2025 16:41:05 GMT
Content-Type: application/javascript

Redirect headers

Location: /pixel/bounce/?pid=m51mh00&t=ajs&uid=user_a79bdf49-d4be-40f1-bd06-450a96e62d46_1755189664469
Content-Length: 0
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 14 Aug 2025 16:41:05 GMT

GET
H2 200 dns Show response
ag.dns-finder.com/meta/ 2 B
233 B 392ms
143ms Fetch
text/plain 34.36.200.111
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://ag.dns-finder.com/meta/dns
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.36.200.111 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 111.200.36.34.bc.googleusercontent.com
Software: /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private, max-age=180, stale-if-error=180, stale-while-revalidate=180
access-control-expose-headers: X-Resolver
x-resolver: default
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
date: Thu, 14 Aug 2025 16:41:05 GMT
content-type: text/plain; charset=utf-8
vary: Origin

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
110 B 665ms
231ms Fetch
image/gif 172.66.148.140
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=2
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.66.148.140 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 1915167
x-goog-stored-content-encoding: identity
expires: Fri, 15 Aug 2025 16:41:05 GMT
x-goog-stored-content-length: 43
date: Thu, 14 Aug 2025 16:41:05 GMT
content-type: image/gif
vary: accept-encoding
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH896O_WH3q6Q1Gl8980oVbueTO9uQpVEI-tUeHKlZS3QPGmA0pfQR2ex52oMkPl_kv2rwIk7qQo
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 96f1e5d02ea9b3b1-MAN
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
628 B 646ms
212ms Fetch
image/gif 172.66.148.140
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.30056865674924826
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.66.148.140 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 1915167
x-goog-stored-content-encoding: identity
expires: Fri, 15 Aug 2025 16:41:05 GMT
x-goog-stored-content-length: 43
date: Thu, 14 Aug 2025 16:41:05 GMT
content-type: image/gif
vary: accept-encoding
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH896O_WH3q6Q1Gl8980oVbueTO9uQpVEI-tUeHKlZS3QPGmA0pfQR2ex52oMkPl_kv2rwIk7qQo
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 96f1e5d02ea7b3b1-MAN
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H2 200 px.gif
ad-delivery.net/ 43 B
47 B 893ms
226ms Image
image/gif 172.66.148.140
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=2
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.66.148.140 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 120950
x-goog-stored-content-encoding: identity
expires: Fri, 15 Aug 2025 16:41:05 GMT
x-goog-stored-content-length: 43
date: Thu, 14 Aug 2025 16:41:05 GMT
last-modified: Wed, 05 May 2021 19:25:32 GMT
vary: accept-encoding
content-type: image/gif
x-guploader-uploadid: ABgVH8-muCt29ZZNsgpjc2r5kMavULB6Yxxx5WNwP3jqrLhvZiC8857T_PGyDS_qtr7Zsbi5
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 96f1e5d1ef86f834-EWR
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico
ad.doubleclick.net/ 1 KB
130 B 290ms
129ms Image
image/x-icon 172.217.165.134
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.165.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
age: 84988
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Thu, 14 Aug 2025 17:04:36 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 13 Aug 2025 17:04:36 GMT
last-modified: Tue, 08 May 2012 13:08:06 GMT
content-type: image/x-icon
vary: Accept-Encoding
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 px.gif
ad-delivery.net/ 43 B
46 B 811ms
165ms Image
image/gif 172.66.148.140
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.30056865674924826
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.66.148.140 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 120950
x-goog-stored-content-encoding: identity
expires: Fri, 15 Aug 2025 16:41:05 GMT
x-goog-stored-content-length: 43
date: Thu, 14 Aug 2025 16:41:05 GMT
last-modified: Wed, 05 May 2021 19:25:32 GMT
vary: accept-encoding
content-type: image/gif
x-guploader-uploadid: ABgVH8-muCt29ZZNsgpjc2r5kMavULB6Yxxx5WNwP3jqrLhvZiC8857T_PGyDS_qtr7Zsbi5
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 96f1e5d15dcaf834-EWR
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H2 200 px.gif
ad-delivery.net/ 43 B
622 B 809ms
319ms Image
image/gif 172.66.148.140
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=2&e=0.1599881025498563
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.66.148.140 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 120950
x-goog-stored-content-encoding: identity
expires: Fri, 15 Aug 2025 16:41:05 GMT
x-goog-stored-content-length: 43
date: Thu, 14 Aug 2025 16:41:05 GMT
content-type: image/gif
vary: accept-encoding
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH8-muCt29ZZNsgpjc2r5kMavULB6Yxxx5WNwP3jqrLhvZiC8857T_PGyDS_qtr7Zsbi5
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 96f1e5d15dbdf834-EWR
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico
ad.doubleclick.net/ 1 KB
129 B 164ms
153ms Image
image/x-icon 172.217.165.134
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.15380850590218553

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.165.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-3-220-65-116.compute-1.amazonaws.com

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Fri, 15 Aug 2025 16:41:04 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 14 Aug 2025 16:41:04 GMT
content-type: image/x-icon
vary: Accept-Encoding
last-modified: Tue, 08 May 2012 13:08:06 GMT
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 px.gif
ad-delivery.net/ 43 B
111 B 518ms
318ms Image
image/gif 172.66.148.140
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.7653504369173035
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.66.148.140 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 120950
x-goog-stored-content-encoding: identity
expires: Fri, 15 Aug 2025 16:41:05 GMT
x-goog-stored-content-length: 43
date: Thu, 14 Aug 2025 16:41:05 GMT
content-type: image/gif
vary: accept-encoding
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH8-muCt29ZZNsgpjc2r5kMavULB6Yxxx5WNwP3jqrLhvZiC8857T_PGyDS_qtr7Zsbi5
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 96f1e5d15dc2f834-EWR
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 410ms
116ms Preflight
application/json 74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&cw=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://paint.toys
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Thu, 14 Aug 2025 16:41:04 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 181999
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 344ms
110ms XHR
application/javascript 108.138.112.90
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.112.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-112-90.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-max-age: 3000
content-encoding: gzip
x-amz-version-id: r5.lR.LJ66XEXzxUUVo7iMemjL_F_GoE
etag: W/"a4d296427fc806b21335359e398c025c"
age: 75886
access-control-allow-methods: GET
x-cache: Hit from cloudfront
x-amz-cf-id: SqKy36BldW9j_OgyMCk_Turfoo9DtK_v-wykyNpG3zTUvbDjTj0JQQ==
date: Wed, 13 Aug 2025 19:36:20 GMT
content-type: application/javascript
vary: Origin,accept-encoding
last-modified: Thu, 29 Feb 2024 02:13:08 GMT
cache-control: public, max-age=86400
via: 1.1 1dd1e483fa41d512929f44790f141972.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: JFK50-P3
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 bd056b42-51db-43ce-9a8e-3b11319b5d1f Show response
config.aps.amazon-adsystem.com/configs/ 563 B
830 B 1066ms
125ms Script
application/javascript 108.138.106.59
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://config.aps.amazon-adsystem.com/configs/bd056b42-51db-43ce-9a8e-3b11319b5d1f
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.106.59 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-106-59.jfk50.r.cloudfront.net
Software: CloudFront /
Resource Hash: 49abaa85c5deba189aed627d20598003159c74478ec1ef492cfff2bf98c5eec9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=3600
age: 2904
via: 1.1 7225c7fb64d09bab64bc17e314ef26a2.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
content-length: 563
x-amz-cf-id: DJki02fIQz5CGJwYt0qmsKLoHSFqI2DMaNe-vo1nJhHPX3TpqKpqug==
date: Thu, 14 Aug 2025 15:52:42 GMT
content-type: application/javascript
x-amz-cf-pop: JFK50-P3
server: CloudFront

GET
H2 200 config Show response
c.amazon-adsystem.com/cdn/prod/ 4 KB
4 KB 134ms
133ms XHR
application/json 108.138.112.90
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fpaint.toys&pubid=bd056b42-51db-43ce-9a8e-3b11319b5d1f
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.112.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-112-90.jfk50.r.cloudfront.net
Software: Server /
Resource Hash: 4343f6616e0f326733eb2ef5decbb7161c8c6c58fb4e77e72b05a7f101b2cf87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=21550, s-maxage=21600
age: 4075
access-control-allow-credentials: true
via: 1.1 7225c7fb64d09bab64bc17e314ef26a2.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Hit from cloudfront
content-length: 4168
x-amz-cf-id: FaGsSNJDO1HptiHK8-c60KYvcUejznr28K4Bdmm6og-Ke0DcB51pTQ==
date: Thu, 14 Aug 2025 15:33:08 GMT
content-type: application/json;charset=UTF-8
x-amz-cf-pop: JFK50-P3
server: Server

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 25 B
374 B 1137ms
275ms Fetch
application/json 13.226.100.198
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fpaint.toys%2Foil%2F&pr=https%3A%2F%2Fsse6.kwach.org%2F&pid=KkX1ZVBw7lgzk&cb=0&ws=1600x1200&v=25.806.025&t=2500&slots=%5B%7B%22sd%22%3A%22pw-160x600_atf%22%2C%22s%22%3A%5B%22160x600%22%2C%22120x600%22%5D%2C%22sn%22%3A%22%2F154013155%2C21762409181%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600%22%2C%22ext%22%3A%7B%22gpid%22%3A%22%2F154013155%2C21762409181%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600%22%7D%7D%2C%7B%22sd%22%3A%22pw-160x600_btf%22%2C%22s%22%3A%5B%22160x600%22%2C%22120x600%22%5D%2C%22sn%22%3A%22%2F154013155%2C21762409181%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600%22%7D%2C%7B%22sd%22%3A%22leaderboard_atf%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%2C%22970x90%22%5D%2C%22sn%22%3A%22%2F154013155%2C21762409181%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-desktop_leaderboard%22%7D%2C%7B%22sd%22%3A%22leaderboard_btf%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%2C%22970x90%22%5D%2C%22sn%22%3A%22%2F154013155%2C21762409181%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-desktop_leaderboard%22%7D%5D&pj=%7B%22device%22%3A%7B%22sua%22%3A%7B%22mobile%22%3A0%2C%22source%22%3A1%2C%22platform%22%3A%7B%22brand%22%3A%22%22%7D%2C%22browsers%22%3A%5B%5D%7D%7D%7D&sg=%7B%22ortb2%22%3A%7B%22site%22%3A%7B%22cattax%22%3A6%2C%22cat%22%3A%5B%22693%22%5D%2C%22sectioncat%22%3A%5B%22693%22%5D%2C%22pagecat%22%3A%5B%22693%22%5D%7D%7D%7D&schain=1.0%2C1%21playwire.com%2C1024872%2C1%2C%2C%2C&sm=70447765-2a58-4f81-b8c9-e5189824a4ef&pubid=bd056b42-51db-43ce-9a8e-3b11319b5d1f&gdprl=%7B%22status%22%3A%22no-cmp%22%7D&rt=j
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.226.100.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-100-198.jfk52.r.cloudfront.net
Software: Server /
Resource Hash: 7dc78c5c119373b361b76d7e9c1b2759725163789661df908ee4cd8faf842676

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
access-control-allow-credentials: true
via: 1.1 be0c2da195113bc0385ed0faca92ed64.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Miss from cloudfront
content-length: 45
x-amz-cf-id: mexVElUGdHHrs6Qdc12ukSatTTbM-MRljF4wmJXuwk7Vncoi9vqT4w==
date: Thu, 14 Aug 2025 16:41:05 GMT
content-type: application/json;charset=UTF-8
x-amz-cf-pop: JFK52-P10
server: Server

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 115 B
491 B 212ms
172ms XHR
application/json 3.220.65.116
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://bcp.crwdcntrl.net/6/map

Requested by

Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/17138/sync.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.220.65.116 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

023a01b4c4392b24ee1c8f09ec356c8eea3ffb55922a30e8dae13b4e723356fa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains
cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 115
date: Thu, 14 Aug 2025 16:41:05 GMT
content-type: application/json;charset=utf-8

POST
H2 200 cookie_sync Show response
prebid.intergient.com/ 2 KB
1 KB 1159ms
161ms Fetch
application/json 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://prebid.intergient.com/cookie_sync
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.ae6790c95efdb5dcce9e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8501804a6dfccaccf2d798453ef096040bb7abef9e8c6e02072b06b7bf48c374

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","endpoints":[{"url":"https://nel.heroku.com/reports?s=zJ3kPxX36BeG%2FGTGBLCEhWf02%2F9jDYpJUzWM5u44tWE%3D\u0026sid=1b10b0ff-8a76-4548-befa-353fc6c6c045\u0026ts=1755189666"}],"max_age":3600}
expires: 0
alt-svc: h3=":443"; ma=86400
date: Thu, 14 Aug 2025 16:41:06 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding, Origin
reporting-endpoints: heroku-nel="https://nel.heroku.com/reports?s=zJ3kPxX36BeG%2FGTGBLCEhWf02%2F9jDYpJUzWM5u44tWE%3D&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&ts=1755189666"
cache-control: no-cache, no-store, must-revalidate
nel: {"report_to":"heroku-nel","response_headers":["Via"],"max_age":3600,"success_fraction":0.01,"failure_fraction":0.1}
pragma: no-cache
access-control-allow-credentials: true
via: 2.0 heroku-router
cf-ray: 96f1e5d519c639f2-YYZ
access-control-allow-origin: https://paint.toys
server: cloudflare

POST
H2 200 auction Show response
prebid.intergient.com/openrtb2/ 420 B
403 B 1481ms
514ms Fetch
application/json 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://prebid.intergient.com/openrtb2/auction
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.ae6790c95efdb5dcce9e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d0dc7a6dfcace171b5b160245f5dd7efc8d8d87acd93fdc1580b1c1c58ba9823

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","endpoints":[{"url":"https://nel.heroku.com/reports?s=zJ3kPxX36BeG%2FGTGBLCEhWf02%2F9jDYpJUzWM5u44tWE%3D\u0026sid=1b10b0ff-8a76-4548-befa-353fc6c6c045\u0026ts=1755189666"}],"max_age":3600}
observe-browsing-topics: ?1
expires: 0
alt-svc: h3=":443"; ma=86400
date: Thu, 14 Aug 2025 16:41:06 GMT
content-type: application/json
vary: Accept-Encoding, Origin
reporting-endpoints: heroku-nel="https://nel.heroku.com/reports?s=zJ3kPxX36BeG%2FGTGBLCEhWf02%2F9jDYpJUzWM5u44tWE%3D&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&ts=1755189666"
cache-control: no-cache, no-store, must-revalidate
nel: {"report_to":"heroku-nel","response_headers":["Via"],"max_age":3600,"success_fraction":0.01,"failure_fraction":0.1}
pragma: no-cache
access-control-allow-credentials: true
via: 2.0 heroku-router
cf-ray: 96f1e5d519c939f2-YYZ
access-control-allow-origin: https://paint.toys
x-prebid: pbs-go/pw-3.18.0
server: cloudflare

POST
H2 200 hb-multi Show response
hb.yellowblue.io/ 83 B
441 B 1102ms
140ms Fetch
application/json 35.212.119.236
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://hb.yellowblue.io/hb-multi
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.ae6790c95efdb5dcce9e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.212.119.236 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 236.119.212.35.bc.googleusercontent.com
Software: istio-envoy /
Resource Hash: 8200edb5bd66d8dcaefd02bd7f0ecdea814e9d2d54a4740c655dd54a01bc0fe6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-envoy-upstream-service-time: 4
access-control-allow-credentials: true
access-control-allow-methods: GET, OPTIONS
via: 1.1 google
access-control-allow-origin: https://paint.toys
content-length: 108
date: Thu, 14 Aug 2025 16:41:06 GMT
content-type: application/json
server: istio-envoy
x-reason: maxmind hosting provider
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
1 KB 1386ms
448ms Fetch 138.197.60.198
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.ae6790c95efdb5dcce9e.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 138.197.60.198 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Thu, 14 Aug 2025 16:41:06 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
1 KB 1331ms
395ms Fetch 138.197.60.198
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.ae6790c95efdb5dcce9e.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 138.197.60.198 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Thu, 14 Aug 2025 16:41:06 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
1 KB 1225ms
290ms Fetch 138.197.60.198
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.ae6790c95efdb5dcce9e.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 138.197.60.198 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Thu, 14 Aug 2025 16:41:06 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
1 KB 1258ms
323ms Fetch 138.197.60.198
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.ae6790c95efdb5dcce9e.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 138.197.60.198 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Thu, 14 Aug 2025 16:41:06 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H2 200 playwire Show response
direct.adsrvr.org/bid/bidder/ 0
243 B 1077ms
127ms Fetch
application/json 199.250.161.129
TTD-ASN-01

General

Check archive.org

Download Go to

Full URL: https://direct.adsrvr.org/bid/bidder/playwire
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.ae6790c95efdb5dcce9e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 199.250.161.129 , United States, ASN26459 (TTD-ASN-01, US),
Reverse DNS
Software: Kestrel /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-openrtb-version: 2.3
cache-control: private
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
content-length: 0
date: Thu, 14 Aug 2025 16:41:05 GMT
content-type: application/json
server: Kestrel
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept, x-integration-type

POST
H2 200 prebidjs Show response
rtb.openx.net/openrtbb/ 53 B
269 B 1069ms
121ms Fetch
text/plain 35.186.253.211
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://rtb.openx.net/openrtbb/prebidjs
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.ae6790c95efdb5dcce9e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.253.211 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: /
Resource Hash: 7022ad93c8696f4ad3ddd7253b936d8be1348f4c7262b15235c18c63176222ff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-forwarded-for: 89.238.156.126
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 77
date: Thu, 14 Aug 2025 16:41:05 GMT
content-type: text/plain
vary: Origin

GET imp
g2.gumgum.com/hbid/ 0
0

POST pbjs
htlb.casalemedia.com/openrtb/ 0
0

POST
H2 200 v1 Show response
btlr.sharethrough.com/universal/ 869 B
850 B 4060ms
266ms Fetch
application/json 3.239.253.217
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.ae6790c95efdb5dcce9e.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.239.253.217 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

081a5bc8e24773ceb4dc73e6a9536458e133a688cbd4bbf68298380f5f22e1fa

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-openrtb-version: 2.5
strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
content-encoding: gzip
content-length: 493
content-type: application/json; charset=utf-8
access-control-allow-credentials: true

POST
H2 200 v1 Show response
btlr.sharethrough.com/universal/ 672 B
770 B 4057ms
266ms Fetch
application/json 3.239.253.217
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.ae6790c95efdb5dcce9e.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.239.253.217 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

b4db9de139d60fd1f381e72c910d85c7dadc468fafa403171241a1b138bf0fb0

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-openrtb-version: 2.5
strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
content-encoding: gzip
content-length: 414
content-type: application/json; charset=utf-8
access-control-allow-credentials: true

POST
H2 200 v1 Show response
btlr.sharethrough.com/universal/ 654 B
727 B 4160ms
370ms Fetch
application/json 3.239.253.217
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.ae6790c95efdb5dcce9e.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.239.253.217 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

e05a03539f893c51cd04920fd989900c42c4479821725547c90253646922bb20

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-openrtb-version: 2.5
strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
content-encoding: gzip
content-length: 371
content-type: application/json; charset=utf-8
access-control-allow-credentials: true

POST
H2 200 v1 Show response
btlr.sharethrough.com/universal/ 795 B
808 B 4054ms
265ms Fetch
application/json 3.239.253.217
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.ae6790c95efdb5dcce9e.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.239.253.217 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

634.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

Resource Hash

5894a2d81e6ce1d91de234cc114c6cb33b02f1772e73b7c813d21f55b31cdf14

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-openrtb-version: 2.5
strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
content-encoding: gzip
content-length: 452
content-type: application/json; charset=utf-8
access-control-allow-credentials: true

POST
H2 204 hbjson Show response
grid.bidswitch.net/ 0
226 B 1195ms
278ms Fetch 74.119.117.5
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://grid.bidswitch.net/hbjson

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.ae6790c95efdb5dcce9e.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.5 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-store, must-revalidate, no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
date: Thu, 14 Aug 2025 16:41:06 GMT
vary: Origin
server: Kestrel

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 472 B
1 KB 1917ms
203ms Fetch
application/json 68.67.178.10
ASN-APPNEX

General

Check archive.org

Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.ae6790c95efdb5dcce9e.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.178.10 North Bergen, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.25.5 /

Resource Hash

4290440efddc0dfef3167ebbe08700d3936ce816a959a5983c7ec6b93d77bf83

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 89.238.156.126; 89.238.156.126; 634.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: https://paint.toys
an-x-request-uuid: 54a92def-c356-468f-bec3-f1e538d7390e
content-length: 472
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 14 Aug 2025 16:41:06 GMT
x-xss-protection: 0
content-type: application/json; charset=utf-8
server: nginx/1.25.5

POST request
grid-bidder.criteo.com/openrtb_2_5/pbjs/auction/ 0
0

POST auction
tlx.3lift.com/header/ 0
0

GET fastlane.json
fastlane.rubiconproject.com/a/api/ 0
0

GET pubcid.min.js
secure.cdn.fastclick.net/js/pubcid/latest/ 0
0

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16576/ 43 KB
13 KB 139ms
130ms Script
text/javascript 108.138.128.34
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Requested by: Host: sse6.kwach.org
URL: https://sse6.kwach.org/r/a1NuZEQ2Vkt1MEZ4T3RqY01Mc08tMzk3OC0yNTg4OTkxMS0xMDhlMDI4Ny02NjQ0LXpoM1Y4c2Jwajl3RTk2Y2s2MXBi
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.128.34 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-128-34.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0112a49b64f28c6cd08c2cf9a692d0d5455d585010329b59bf84cbf9ede8fa7a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"f9c27abb935f20b032ddcea538357fad"
age: 32709
via: 1.1 820b14719bf91dbc846cab9728bc3fe6.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: aQzTiyIyUhsWxpUMbgXkftx8n2VsNFOhD_3_60309W9hPU_CFzKtuw==
date: Thu, 14 Aug 2025 07:35:57 GMT
content-type: text/javascript
last-modified: Wed, 06 Aug 2025 15:21:32 GMT
server: AmazonS3
x-amz-cf-pop: JFK50-P4
x-amz-server-side-encryption: AES256

GET
H2 200 hadron.js Show response
cdn.hadronid.net/ 11 B
315 B 1837ms
207ms Script
application/javascript 172.66.166.119
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fsse6.kwach.org%2F&_it=amazon&partner_id=403
Requested by: Host: sse6.kwach.org
URL: https://sse6.kwach.org/r/a1NuZEQ2Vkt1MEZ4T3RqY01Mc08tMzk3OC0yNTg4OTkxMS0xMDhlMDI4Ny02NjQ0LXpoM1Y4c2Jwajl3RTk2Y2s2MXBi
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.66.166.119 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a73f5986eb985871284e6e216372de3505634a97229de643216728d0fbfd6227

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=432000
content-encoding: br
cf-cache-status: HIT
etag: W/"ba4f7a703ea78ac1b72b5fe1be4fb407"
age: 4377
x-amz-request-id: 30ESW1W2ZK679RV0
cf-ray: 96f1e5da3d4da122-MAN
date: Thu, 14 Aug 2025 16:41:06 GMT
content-type: application/javascript
vary: accept-encoding
server: cloudflare
last-modified: Thu, 05 Dec 2024 20:48:49 GMT
x-amz-id-2: vUR56U4dT+uBLcfsQJPOy5zt8YY70QBqRK79jcTJYD4WF5y07NSxKqBZ9MkC3NxK2u5wo1slGAE=

GET
H2 200 id5-api.js Show response
cdn.id5-sync.com/api/1.0/ 106 KB
30 KB 129ms
121ms Script
text/javascript 172.66.169.55
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/id5-api.js

Requested by

Host: sse6.kwach.org
URL: https://sse6.kwach.org/r/a1NuZEQ2Vkt1MEZ4T3RqY01Mc08tMzk3OC0yNTg4OTkxMS0xMDhlMDI4Ny02NjQ0LXpoM1Y4c2Jwajl3RTk2Y2s2MXBi

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.66.169.55 , Ascension Island, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4e054e8ba11b0c11c9443970118657c6dfc43e76ae01f75246efeb1f80ebe7e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"eea3e91e904db177468d4bef91dcdf05"
age: 6
expires: Thu, 14 Aug 2025 17:41:05 GMT
date: Thu, 14 Aug 2025 16:41:05 GMT
content-type: text/javascript;charset=utf-8
vary: accept-encoding
last-modified: Tue, 29 Jul 2025 12:29:41 GMT
x-amz-id-2: QPA35pvubnYvGXqIM2/xodnpxW1uDgWBBjLQwy+PwF/20ymAMAtkPDgRHpnjj9DBReJNUjyiAag1cEUoP+BaqMF1CmM9RDeIO1TzSi9h4TY=
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: public, max-age=3600
x-amz-request-id: 16S69BBGK7C63NYH
cf-ray: 96f1e5cf9805d954-EWR
server: cloudflare
x-amz-server-side-encryption: AES256

GET launcher-stub.min.js
secure.cdn.fastclick.net/js/cnvr-launcher/latest/ 0
0

POST translator
hbopenbid.pubmatic.com/ 0
0

GET
H2 200 location Show response
privacy-location-edge.ccgateway.net/privacy/ 2 B
188 B 984ms
137ms XHR
text/plain 18.212.140.196
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://privacy-location-edge.ccgateway.net/privacy/location
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.212.140.196 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-212-140-196.compute-1.amazonaws.com
Software: /
Resource Hash: e7d529decf2effa45e405e83edd0d9b4b82f6ad2a1b95d59feb3874e61c0a619

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-origin: *
content-encoding: gzip
date: Thu, 14 Aug 2025 16:41:06 GMT
content-type: text/plain; charset=utf-8
vary: Accept-Encoding
access-control-allow-credentials: true

GET classification
pogo.ccgateway.net/v1/p/5bb3e20859/ 0
0

GET j
rp.liadm.com/ 0
0

POST
H3 204 AGSKWxXhTqd2TxGIWEUkb7mcXqWdQOdSX3lLSTyEadfpgyPnsoAjB-ZXUEZEbKN66rplCaMwOCs4TtSwe9x1eP0NoO6BS0696TnyMjF68zF06lKj7rAZISCu6hpdHbR92ul8wyxDb6n9OQ== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 432ms
168ms XHR
text/html 142.251.40.174
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxXhTqd2TxGIWEUkb7mcXqWdQOdSX3lLSTyEadfpgyPnsoAjB-ZXUEZEbKN66rplCaMwOCs4TtSwe9x1eP0NoO6BS0696TnyMjF68zF06lKj7rAZISCu6hpdHbR92ul8wyxDb6n9OQ==

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.63tTrANs21s.es5.O/d=1/rs=AJlcJMwHC2NlO1TwZGJPQADSt9_w4--XXA/m=kernel_loader,loader_js_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.174 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-pWq94lE7TDfbeGiarZebbQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 14 Aug 2025 16:41:05 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjUtDikmLw1ZBi-FB_mfUHEJv53Wa1A2LJ17dZFYFYiIdj4eIfR9gEfmx7vZtJySUpvzA-OT-vJDWvRDcxpVgXxC7KTCotyS9CYaeWgVTk5KenZ-alxxsZGJkaWBga6xmYxBcYAABgCivv"
content-security-policy: script-src 'report-sample' 'nonce-pWq94lE7TDfbeGiarZebbQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H2 200 AGSKWxXTg27aUhpv7aIIU6VNfDIVmdfUKcFz6rguZ0eJnn6m1wJZlW3QZEM87_7IWyxavk1prz8pwia-psLxLEZ3lgiXmc_xzO_v-O9GRMH4YiJ0dBVlNPBA8NrX-CY3pTmFiTRdCfWPdg== Show response
fundingchoicesmessages.google.com/f/ 2 KB
2 KB 295ms
293ms Script
application/javascript 142.251.40.174
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxXTg27aUhpv7aIIU6VNfDIVmdfUKcFz6rguZ0eJnn6m1wJZlW3QZEM87_7IWyxavk1prz8pwia-psLxLEZ3lgiXmc_xzO_v-O9GRMH4YiJ0dBVlNPBA8NrX-CY3pTmFiTRdCfWPdg==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzU1MTg5NjY1LDMyOTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzddXSwiaHR0cHM6Ly9wYWludC50b3lzL29pbC8iLG51bGwsW1s4LCI2M3RUckFOczIxcyJdLFs5LCJlbi1VUyJdLFsxOSwiMiJdLFsxNywiWzBdIl0sWzI0LCJzc2U2Lmt3YWNoLm9yZyJdLFsyOSwiZmFsc2UiXV1d

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.174 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

server-108-138-128-56.jfk50.r.cloudfront.net

Software

ESF /

Resource Hash

1214f0435f0e01096393eb9f6c2baf5d807b59da607badb3b2da2fec71c6f13a

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-XdU6fQB-ZsLYzCUG6964ZQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 14 Aug 2025 16:41:05 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjytDikmJw1JBiOHHrNtMFIG69eY51OhAbKlxidQbiD_WXWX8AcZHEFdYWIP5UdYNVpPoGaxL7TdYSIF6z8RbrViA287vNagfEkq9vsyoCcfqUu6wFQPx7zV1WlrV3WYV4OBYu_nGETeBE07QrjEoaSfmF8cn5eSVFmUmlJflFaclpqcWpRWWpRfFGBkamBhaGxnoGBvEFBgCrv0Im"
content-security-policy: script-src 'report-sample' 'nonce-XdU6fQB-ZsLYzCUG6964ZQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 topics_frame.html Show response
securepubads.g.doubleclick.net/static/topics/ Frame 2AB9 101 KB
28 KB 401ms
143ms Document
text/html 142.251.40.194
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/static/topics/topics_frame.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202508110101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s38-in-f2.1e100.net

Software

sffe /

Resource Hash

7feb8c059403c0e1f327f3155c8179eeb04cbb50650633c201e8bf7b86cf7d9a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 2866
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000, stale-while-revalidate=3600
content-encoding: br
content-length: 28946
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 14 Aug 2025 15:53:20 GMT
expires: Thu, 14 Aug 2025 16:43:20 GMT
last-modified: Mon, 11 Aug 2025 19:43:01 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 connectId-gpt.js Show response
connectid.analytics.yahoo.com/ 9 KB
9 KB 741ms
139ms Script
application/javascript 108.138.128.56
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://connectid.analytics.yahoo.com/connectId-gpt.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202508110101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

108.138.128.56 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

56351c084d8d56437d41f1e58b7eb184b563871e88bab60f6b15486c39f13996

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: "faa388a163b1b6d0377ee77a861591e5"
age: 3161
x-cache: Hit from cloudfront
x-amz-cf-id: tcWR8CRYCaiQ04UbfrSCIsuX03ydxar1wwVEDfPcWWdI2ZprBdqBiQ==
date: Thu, 14 Aug 2025 15:48:26 GMT
content-type: application/javascript
last-modified: Mon, 22 Apr 2024 18:18:45 GMT
x-amz-expiration: expiry-date="Mon, 23 Apr 2029 00:00:00 GMT", rule-id="webapp-standard-lifecycle"
content-security-policy: default-src 'self'
cache-control: max-age=3600
via: 1.1 820b14719bf91dbc846cab9728bc3fe6.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 8729
x-amz-cf-pop: JFK50-P4
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 esp.js Show response
oa.openxcdn.net/ 24 KB
8 KB 1128ms
601ms Script
application/javascript 34.102.146.192
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://oa.openxcdn.net/esp.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202508110101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.146.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 192.146.102.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 1
content-encoding: gzip
x-goog-hash: crc32c=f21hYg==, md5=31VCuIvA42jGmZdUpbniug==
etag: "df5542b88bc0e368c6999754a5b9e2ba"
age: 702083
x-goog-stored-content-encoding: gzip
expires: Thu, 06 Aug 2026 13:39:43 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 7927
date: Wed, 06 Aug 2025 13:39:43 GMT
last-modified: Thu, 27 May 2021 18:30:51 GMT
content-type: application/javascript
x-guploader-uploadid: ABgVH899vQw69TunS3gesS0HwN3lei1CQ8ut4g3AkAEHLcmuA5g51cy4qNycKdGOhJqkynu9
cache-control: no-transform
x-goog-storage-class: MULTI_REGIONAL
accept-ranges: bytes
x-goog-generation: 1622140251693895
content-length: 7927
server: UploadServer

GET
H2 200 encrypted-tag-g.js Show response
invstatic101.creativecdn.com/encrypted-signals/ 3 KB
3 KB 1490ms
220ms Script
text/javascript 34.96.70.87
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202508110101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.70.87 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 87.70.96.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 2e5f5cb912c0619933ea6c3ad8ac1466a005f792e3338d96a8432d144c63520f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: 861bdaf24bda5c0db45c6ebe1c94a9eb
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2729
date: Thu, 14 Aug 2025 16:41:06 GMT
content-type: text/javascript; charset=utf-8
last-modified: Wed, 05 Feb 2025 14:45:21 GMT
server: Google Frontend
x-cloud-trace-context: 2306958fc7923efff000e30e8375be31

GET
H2 200 ob.js Show response
cdn-ima.33across.com/ 17 KB
7 KB 724ms
145ms Script
application/javascript 104.18.28.101
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn-ima.33across.com/ob.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202508110101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.28.101 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 72223c20f8ad08445b32a2b4843a0f04fe33cee40811ade04b21598cf67fbea3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: public, max-age=259200
content-encoding: gzip
cf-cache-status: HIT
etag: W/"678fc4ec-4599"
age: 172789
cf-ray: 96f1e5d618e8ebb5-YYZ
expires: Sun, 17 Aug 2025 16:41:06 GMT
date: Thu, 14 Aug 2025 16:41:06 GMT
content-type: application/javascript
last-modified: Tue, 21 Jan 2025 16:01:48 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 publishertag.ids.js Show response
static.criteo.net/js/ld/ 42 KB
13 KB 646ms
177ms Script
text/javascript 74.119.117.47
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.ids.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202508110101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.47 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

c0490ecc02570b13a5399298c660abe517bdee07653099b20a327cc320586396

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: max-age=86400, public
timing-allow-origin: *
content-encoding: gzip
cross-origin-resource-policy: cross-origin
expires: Fri, 15 Aug 2025 16:41:06 GMT
access-control-allow-origin: *
date: Thu, 14 Aug 2025 16:41:06 GMT
content-type: text/javascript
vary: x-geo-country
server: nginx

GET
H3 200 favicon.ico
ad.doubleclick.net/ 1 KB
129 B 163ms
163ms Image
image/x-icon 172.217.165.134
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.9906249697687401

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.165.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Fri, 15 Aug 2025 16:41:05 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 14 Aug 2025 16:41:05 GMT
content-type: image/x-icon
vary: Accept-Encoding
last-modified: Tue, 08 May 2012 13:08:06 GMT
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=eyeota&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmb/generic?ttd_pid=eyeota&ttd_tpi=1&gdpr=0&gdpr_consent=
https://ps.eyeota.net/match?uid=d361044d-0ef5-4930-9f3e-bd0acfe3bdfd&bid=1e2n4ou

70 B
440 B

434ms
189ms

Image
image/gif

44.205.65.132
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?uid=d361044d-0ef5-4930-9f3e-bd0acfe3bdfd&bid=1e2n4ou
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 44.205.65.132 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-205-65-132.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 14 Aug 2025 16:41:08 GMT
Content-Type: image/gif

Redirect headers

location: https://ps.eyeota.net/match?uid=d361044d-0ef5-4930-9f3e-bd0acfe3bdfd&bid=1e2n4ou
content-length: 191
date: Thu, 14 Aug 2025 16:41:07 GMT
server: Kestrel

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm&google_sc&google_hm=MkFWWWhWMks0VkllV0NXNmVSdVNnM0oxVjh0VHB0SV9Ubk5GYkI5TUNfdHc&gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer...
https://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm=&google_sc=&google_hm=MkFWWWhWMks0VkllV0NXNmVSdVNnM0oxVjh0VHB0SV9Ubk5GYkI5TUNfdHc&gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referr...
https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_gid=CAESEL4iJ83cQzg-9EmEX_oTbTI&google_cver=1

70 B
440 B

293ms
293ms

Image
image/gif

44.205.65.132
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_gid=CAESEL4iJ83cQzg-9EmEX_oTbTI&google_cver=1
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 44.205.65.132 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-205-65-132.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 14 Aug 2025 16:41:08 GMT
Content-Type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_gid=CAESEL4iJ83cQzg-9EmEX_oTbTI&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
report-to: {"group":"ad-exchange-cookie-matcher","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/httpsserver2/ad-exchange-cookie-matcher"}]}
content-security-policy-report-only: script-src 'none';form-action 'none';frame-src 'none'; report-uri https://csp.withgoogle.com/csp/httpsserver2/ad-exchange-cookie-matcher
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 375
date: Thu, 14 Aug 2025 16:41:07 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET cms
ups.analytics.yahoo.com/ups/58773/ 0
0

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMjg0NTA1NDYvdC8w/url/https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=$!{TURN_UUID}&newuser=1&referrer_pid=m51mh00
https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=2847152338484062188&newuser=1&referrer_pid=m51mh00

70 B
440 B

169ms
168ms

Image
image/gif

44.205.65.132
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=2847152338484062188&newuser=1&referrer_pid=m51mh00
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 44.205.65.132 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-205-65-132.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 14 Aug 2025 16:41:08 GMT
Content-Type: image/gif

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=2847152338484062188&newuser=1&referrer_pid=m51mh00
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Thu, 14 Aug 2025 16:41:28 GMT

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fuid%3D%24UID%26bid%3D2cr76e1%26referrer_pid%3Dm51mh00
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fps.eyeota.net%252Fmatch%253Fuid%253D%2524UID%2526bid%253D2cr76e1%2526referrer_pid%253Dm51mh00
https://ps.eyeota.net/match?uid=3319751135918167931&bid=2cr76e1&referrer_pid=m51mh00

70 B
440 B

197ms
197ms

Image
image/gif

44.205.65.132
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?uid=3319751135918167931&bid=2cr76e1&referrer_pid=m51mh00
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 44.205.65.132 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-205-65-132.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 14 Aug 2025 16:41:07 GMT
Content-Type: image/gif

Redirect headers

cache-control: no-store, no-cache, private
location: https://ps.eyeota.net/match?uid=3319751135918167931&bid=2cr76e1&referrer_pid=m51mh00
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 89.238.156.126; 89.238.156.126; 634.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 5da793eb-a759-4678-8002-cb1bdaa1042f
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 14 Aug 2025 16:41:07 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.25.5

POST
H2 200 fb87a4ea41 Show response
cd836371f1d.cdn.intergient.com/ 0
95 B 3858ms
260ms XHR
application/octet-stream 54.81.166.120
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://cd836371f1d.cdn.intergient.com/fb87a4ea41
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250811.1/main.9b44c978684fc999f334.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.81.166.120 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-81-166-120.compute-1.amazonaws.com
Software: nginx/1.24.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

access-control-allow-origin: *
date: Thu, 14 Aug 2025 16:41:09 GMT
content-type: application/octet-stream
server: nginx/1.24.0

GET
H3 200 AGSKWxX3-LDWDjgs1iEtYMi1d4YIWAGXrq2SpCh4jVa3X4URoyFJMdtUQptG0OZn6brfVHGxbzpUTdbIJSzHayfBmttXg7ypbN8-tu6DvgZko9tzrV1UoqUPxKLI6WinmnFlIpGxI_fu2Q== Show response
fundingchoicesmessages.google.com/f/ 10 KB
4 KB 206ms
206ms Script
application/javascript 142.251.40.174
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxX3-LDWDjgs1iEtYMi1d4YIWAGXrq2SpCh4jVa3X4URoyFJMdtUQptG0OZn6brfVHGxbzpUTdbIJSzHayfBmttXg7ypbN8-tu6DvgZko9tzrV1UoqUPxKLI6WinmnFlIpGxI_fu2Q==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzU1MTg5NjY1LDc0OTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOV0sbnVsbCwyLG51bGwsImVuIl0sImh0dHBzOi8vcGFpbnQudG95cy9vaWwvIixudWxsLFtbOCwiNjN0VHJBTnMyMXMiXSxbOSwiZW4tVVMiXSxbMTksIjIiXSxbMTcsIlswXSJdLFsyNCwic3NlNi5rd2FjaC5vcmciXSxbMjksImZhbHNlIl1dXQ

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.174 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c0adacd08aa8838af80a9a380d9d513d85516bafbf25c2edf139c272144dc7ca

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-n83p61YcUXjX4XIb6rSU4Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 14 Aug 2025 16:41:05 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjStDikmJw1pBiaL15jnU6EBsqXGJ1BuIP9ZdZfwBxkcQV1hYg_lR1g1Wk-gZrEvtN1hIg3rXxFuthIDbzu81qB8SSr2-zKgJx-pS7rAVA_HvNXVaWtXdZhXg4Fi7-cYRNoOPV7DXMShpJ-YXxyfl5JUWZSaUl-UVpyWmpxalFZalF8UYGRqYGFobGegYG8QUGAL0ZPT0"
content-security-policy: script-src 'report-sample' 'nonce-n83p61YcUXjX4XIb6rSU4Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H2 200 px.gif
ad-delivery.net/ 43 B
111 B 132ms
131ms Image
image/gif 172.66.148.140
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=2&e=0.16735408980051325
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.66.148.140 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 120950
x-goog-stored-content-encoding: identity
expires: Fri, 15 Aug 2025 16:41:05 GMT
x-goog-stored-content-length: 43
date: Thu, 14 Aug 2025 16:41:05 GMT
content-type: image/gif
vary: accept-encoding
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH8-muCt29ZZNsgpjc2r5kMavULB6Yxxx5WNwP3jqrLhvZiC8857T_PGyDS_qtr7Zsbi5
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 96f1e5d3ee5af834-EWR
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico
ad.doubleclick.net/ 1 KB
129 B 152ms
150ms Image
image/x-icon 172.217.165.134
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.051174742328930156

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.165.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ns31533569.ip-162-19-138.eu

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Fri, 15 Aug 2025 16:41:05 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 14 Aug 2025 16:41:05 GMT
content-type: image/x-icon
vary: Accept-Encoding
last-modified: Tue, 08 May 2012 13:08:06 GMT
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET bounce
id5-sync.com/ 0
0

GET v1
lbs.eu-1-id5-sync.com/lbs/ 0
0

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
320 B 1750ms
198ms Fetch
application/json 162.19.138.118
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.118 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

3d90f4c017450ecbf40b53219533298b479ee61167b20d307d09ff07c8feba32

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
content-encoding: gzip
date: Thu, 14 Aug 2025 16:41:07 GMT
content-type: application/json;charset=UTF-8
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding

GET
H2 200 pbs_sync Show response
sync.cootlogix.com/api/user/html/ Frame 0A8D 4 KB
5 KB 673ms
146ms Document
text/html 157.230.83.84
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D&gpp=&gpp_sid=
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.ae6790c95efdb5dcce9e.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 157.230.83.84 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: 5f2d2c56527e1ef3cd6ef684a2802c2416c49c737d3dec4cfb6e423e748431d7

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
content-length: 4264
content-type: text/html
date: Thu, 14 Aug 2025 16:41:06 GMT
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"

GET
H2 200 px.gif
ad-delivery.net/ 43 B
162 B 491ms
491ms Image
image/gif 172.66.148.140
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=2&e=0.49702972535274603
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.66.148.140 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 120951
x-goog-stored-content-encoding: identity
expires: Fri, 15 Aug 2025 16:41:06 GMT
x-goog-stored-content-length: 43
date: Thu, 14 Aug 2025 16:41:06 GMT
content-type: image/gif
vary: accept-encoding
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH8-muCt29ZZNsgpjc2r5kMavULB6Yxxx5WNwP3jqrLhvZiC8857T_PGyDS_qtr7Zsbi5
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 96f1e5d89da1f834-EWR
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame A134 15 KB
6 KB 649ms
131ms Document
text/html 74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=paint.toys&gdpr=0&gdpr_consent=

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.ids.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

0b96855e780057f73465081f56971f30c152233048e4af1bc2b1437b07d8b597

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 14 Aug 2025 16:41:06 GMT
server: Kestrel
server-processing-duration-in-ticks: 536166
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding
x-robots-tag: noindex

POST
H3 204 ping
pagead2.googlesyndication.com/pagead/ 0
0 388ms
142ms Fetch
text/html 142.250.80.34
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://pagead2.googlesyndication.com/pagead/ping?e=1
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202508110101/pubads_impl.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.80.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga34s34-in-f2.1e100.net
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

GET
H3 200 miva_ads. Show response
fundingchoicesmessages.google.com/f/AGSKWxXrsSSwQUN5l79rgdlANQA0JDBauT_H90CMdgvFohj7KboH1fZgTbhQn_N_B8r1QZsEV_onMMHaVNNJnKkEg9sPAhyURgM_UkI9B5JIR4kdMU7evjnLax9ZHzb_Z5GSro1TT1FAOr8PjCFCy3TNn8fLDB7qJ... 54 B
109 B 148ms
147ms Script
application/javascript 142.251.40.174
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxXrsSSwQUN5l79rgdlANQA0JDBauT_H90CMdgvFohj7KboH1fZgTbhQn_N_B8r1QZsEV_onMMHaVNNJnKkEg9sPAhyURgM_UkI9B5JIR4kdMU7evjnLax9ZHzb_Z5GSro1TT1FAOr8PjCFCy3TNn8fLDB7qJ-81vFmxnv_yvE-esXxDw_yxgoviSiJM/_/bbad5./ads-2.-advert-100x100./300x250px_/miva_ads.

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.63tTrANs21s.es5.O/d=1/exm=kernel_loader,loader_js_executable,web_iab_tcf_v2_signal_executable/ed=1/rs=AJlcJMwHC2NlO1TwZGJPQADSt9_w4--XXA/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.174 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

5890484b672a513ca76113dbc69f40bb177a6959945c1fb022e16d0c806b5e00

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-cA1A0--svTBDvChRr6Ie2A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 14 Aug 2025 16:41:06 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjStDikmII1JBiaL15jnU6EBsqXGJ1BuIP9ZdZfwBxkcQV1hYg_lR1g1Wk-gZrEvtN1hIgXrPxFutWIDbzu81qB8SSr2-zKgJx-pS7rAVAzLn2LqsQCPNwLFr84wibwI7fj54zKWkk5RfGJ-fnlRRlJpWW5BelJaelFqcWlaUWxRsZGJkaWBga6xkYxBcYAACkdz0P"
content-security-policy: script-src 'report-sample' 'nonce-cA1A0--svTBDvChRr6Ie2A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 lidar.js Show response
pagead2.googlesyndication.com/pagead/js/ 251 KB
79 KB 373ms
124ms Script
text/javascript 142.250.80.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/lidar.js?fcd=true

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.63tTrANs21s.es5.O/d=1/exm=kernel_loader,loader_js_executable,web_iab_tcf_v2_signal_executable/ed=1/rs=AJlcJMwHC2NlO1TwZGJPQADSt9_w4--XXA/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9360c26e0423f8b75689d2abbf148971b6e1405b6833d55d569615b84f4ee337

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 5106572335893990721
age: 1384
x-content-type-options: nosniff
expires: Thu, 14 Aug 2025 17:18:03 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 14 Aug 2025 16:18:03 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 80849
x-xss-protection: 0
server: cafe

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxXhTqd2TxGIWEUkb7mcXqWdQOdSX3lLSTyEadfpgyPnsoAjB-ZXUEZEbKN66rplCaMwOCs4TtSwe9x1eP0NoO6BS0696TnyMjF68zF06lKj7rAZISCu6hpdHbR92ul8wyxDb6n9OQ==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.174 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-56ZQZiBc7bAmRDfidNQSSw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 14 Aug 2025 16:41:06 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjUtDikmJw0ZBi-FB_mfUHEJv53Wa1A2LJ17dZFYFYiIdj0eIfR9gEfjzZ-JRJySUpvzA-OT-vJDWvRDcxpVgXxC7KTCotyS9CYaeWgVTk5KenZ-alxxsZGJkaWBga6xmYxBcYAABk_SwF"
content-security-policy: script-src 'report-sample' 'nonce-56ZQZiBc7bAmRDfidNQSSw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxXhTqd2TxGIWEUkb7mcXqWdQOdSX3lLSTyEadfpgyPnsoAjB-ZXUEZEbKN66rplCaMwOCs4TtSwe9x1eP0NoO6BS0696TnyMjF68zF06lKj7rAZISCu6hpdHbR92ul8wyxDb6n9OQ==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.174 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-kWzEuDfzYIFCQOh56pKzPg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 14 Aug 2025 16:41:06 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjUtDikmII1pBi-FB_mfUHEJv53Wa1A2LJ17dZFYFYiIdj0eIfR9gEOs7t3Mys5JKUXxifnJ9XkppXopuYUqwLYhdlJpWW5BehsFPLQCpy8tPTM_PS440MjEwNLAyN9QxM4gsMADjgK2U"
content-security-policy: script-src 'report-sample' 'nonce-kWzEuDfzYIFCQOh56pKzPg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H3 200 setuid
prebid.intergient.com/ Frame 0A8D 0
864 B 349ms
177ms Image
text/html 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://prebid.intergient.com/setuid?bidder=vidazoo&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=b&uid=71804c84-3bb9-3075-0fbd-56b36e352495
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D&gpp=&gpp_sid=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.21.56 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","endpoints":[{"url":"https://nel.heroku.com/reports?s=Pk%2FktIlh9oatIwZtkibwKXcCOw%2Fif7P2B2isvpTicqs%3D\u0026sid=1b10b0ff-8a76-4548-befa-353fc6c6c045\u0026ts=1755189667"}],"max_age":3600}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 14 Aug 2025 16:41:07 GMT
content-type: text/html
vary: Accept-Encoding, Origin
priority: u=2,i
reporting-endpoints: heroku-nel="https://nel.heroku.com/reports?s=Pk%2FktIlh9oatIwZtkibwKXcCOw%2Fif7P2B2isvpTicqs%3D&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&ts=1755189667"
cache-control: no-cache, no-store, must-revalidate
nel: {"report_to":"heroku-nel","response_headers":["Via"],"max_age":3600,"success_fraction":0.01,"failure_fraction":0.1}
pragma: no-cache
via: 2.0 heroku-router
cf-ray: 96f1e5dbddb1abe5-YYZ
server: cloudflare

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 0A8D
Redirect Chain

https://secure.adnxs.com/getuid?https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dappnexus%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D&gdpr=&gdpr_consent=
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fsync.cootlogix.com%252Fapi%252Fcookie%253FpartnerId%253Dappnexus%2526userId%253D%2524UID%2526gdpr%253D%2526gdpr_consent%253D%2526us_p...
https://sync.cootlogix.com/api/cookie?partnerId=appnexus&userId=1404641057160437695&gdpr=&gdpr_consent=&us_privacy=&gdpr=&gdpr_consent=
https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us...
https://x.bidswitch.net/ul_cb/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_conse...
https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=6fc985bd-ce5a-4ae9-8754-a8a2309e397c&gdpr=&gdpr_consent=&us_privacy=

43 B
496 B

149ms
148ms

Image
image/avif

157.230.83.84
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=6fc985bd-ce5a-4ae9-8754-a8a2309e397c&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D&gpp=&gpp_sid=
Protocol: H2
Server: 157.230.83.84 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 14 Aug 2025 16:41:17 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=6fc985bd-ce5a-4ae9-8754-a8a2309e397c&gdpr=&gdpr_consent=&us_privacy=
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 14 Aug 2025 16:41:17 GMT

GET
H2 200 ImgSync
image8.pubmatic.com/AdServer/ Frame 0A8D 0
40 B 5330ms
146ms Image
text/plain 8.28.7.82
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL

https://image8.pubmatic.com/AdServer/ImgSync?p=159988&gdpr=&gdpr_consent=&us_privacy=&pu=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dpubmatics2s%26userId%3D%23PMUID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D

Requested by

Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D&gpp=&gpp_sid=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

8.28.7.82 , United States, ASN62713 (AS-PUBMATIC, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

date: Thu, 14 Aug 2025 16:41:12 GMT
strict-transport-security: max-age=16070400; includeSubDomains
content-length: 0

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 0A8D
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=vidazoo&us_privacy=&gdpr=&gdpr_consent=
https://sync.cootlogix.com/api/cookie?partnerId=unruly&userId=OPTOUT

43 B
496 B

146ms
146ms

Image
image/avif

157.230.83.84
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=unruly&userId=OPTOUT
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D&gpp=&gpp_sid=
Protocol: H2
Server: 157.230.83.84 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 14 Aug 2025 16:41:15 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

expires: 0
cache-control: no-store, no-cache, must-revalidate
location: https://sync.cootlogix.com/api/cookie?partnerId=unruly&userId=OPTOUT
date: Thu, 14 Aug 2025 16:41:15 GMT
pragma: no-cache
content-type: text/html
etag: OPTOUT

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 0A8D
Redirect Chain

https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D&sovrn_retry=true
https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=LKnpALZH_XisoHP6S-aQYhai&gdpr=&gdpr_consent=&us_privacy=

43 B
496 B

147ms
146ms

Image
image/avif

157.230.83.84
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=LKnpALZH_XisoHP6S-aQYhai&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D&gpp=&gpp_sid=
Protocol: H2
Server: 157.230.83.84 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 14 Aug 2025 16:41:13 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

location: https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=LKnpALZH_XisoHP6S-aQYhai&gdpr=&gdpr_consent=&us_privacy=
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, DELETE, PUT
access-control-allow-origin: *
content-length: 0
date: Thu, 14 Aug 2025 16:41:13 GMT
vary: Accept-Encoding
access-control-allow-headers: X-Requested-With, Content-Type

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 0A8D
Redirect Chain

https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us...
https://x.bidswitch.net/ul_cb/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_conse...
https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=6fc985bd-ce5a-4ae9-8754-a8a2309e397c&gdpr=&gdpr_consent=&us_privacy=

43 B
496 B

142ms
142ms

Image
image/avif

157.230.83.84
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=6fc985bd-ce5a-4ae9-8754-a8a2309e397c&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D&gpp=&gpp_sid=
Protocol: H2
Server: 157.230.83.84 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 14 Aug 2025 16:41:17 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=6fc985bd-ce5a-4ae9-8754-a8a2309e397c&gdpr=&gdpr_consent=&us_privacy=
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 14 Aug 2025 16:41:17 GMT

GET
H2 200 getuid
eb2.3lift.com/ Frame 0A8D 37 B
140 B 665ms
111ms Image
image/gif 52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/getuid?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dtriplelift%26userId%3D$UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D&gpp=&gpp_sid=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
date: Thu, 14 Aug 2025 16:41:07 GMT
content-type: image/gif

GET
H2 200 ImgSync
image8.pubmatic.com/AdServer/ Frame 0A8D 0
40 B 5324ms
143ms Image
text/plain 8.28.7.82
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL

https://image8.pubmatic.com/AdServer/ImgSync?p=160318&gdpr=&gdpr_consent=&us_privacy=&pu=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dpubmaticut%26userId%3D%23PMUID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

8.28.7.82 , United States, ASN62713 (AS-PUBMATIC, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

date: Thu, 14 Aug 2025 16:41:12 GMT
strict-transport-security: max-age=16070400; includeSubDomains
content-length: 0

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 0A8D
Redirect Chain

https://match.sharethrough.com/universal/v1?supply_id=TAEWcTBw&gdpr=&gdpr_consent=
https://sync.cootlogix.com/api/cookie?partnerId=sharthrough&userId=d6214c0d-320c-464c-8dee-f8d9c63f28f7

43 B
496 B

138ms
138ms

Image
image/avif

157.230.83.84
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=sharthrough&userId=d6214c0d-320c-464c-8dee-f8d9c63f28f7
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D&gpp=&gpp_sid=
Protocol: H2
Server: 157.230.83.84 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 14 Aug 2025 16:41:22 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
location: https://sync.cootlogix.com/api/cookie?partnerId=sharthrough&userId=d6214c0d-320c-464c-8dee-f8d9c63f28f7
content-length: 0

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 0A8D
Redirect Chain

https://sync.inmobi.com/oRTB?&gdpr_consent=&gdpr=&redirect=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D%26userId%3D%7BID5UID%7D
https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D%26userId%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us...
https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D%26userId%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us...
https://sync.cootlogix.com/api/cookie?partnerId=inmobi&gdpr=&gdpr_consent=&us_privacy=&userId=ID5-5-9624b504-ce19-428e-befc-d4845df42d41

43 B
496 B

153ms
151ms

Image
image/avif

157.230.83.84
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=inmobi&gdpr=&gdpr_consent=&us_privacy=&userId=ID5-5-9624b504-ce19-428e-befc-d4845df42d41
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D&gpp=&gpp_sid=
Protocol: H2
Server: 157.230.83.84 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 14 Aug 2025 16:41:12 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

via: 1.1 google
location: https://sync.cootlogix.com/api/cookie?partnerId=inmobi&gdpr=&gdpr_consent=&us_privacy=&userId=ID5-5-9624b504-ce19-428e-befc-d4845df42d41
content-length: 0
date: Thu, 14 Aug 2025 16:41:11 GMT
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 0A8D
Redirect Chain

https://sync.ottadvisors.com/6f0476ca45e1d6b67e3ee8d57532a022.gif?&us_privacy=&gdpr=&gdpr_consent=&gpp=&gpp_sid=&puid=71804c84-3bb9-3075-0fbd-56b36e352495&redir=https%3A%2F%2Fsync.cootlogix.com%2Fa...
https://sync.cootlogix.com/api/cookie?partnerId=ott&userId=d974e078-0dfb-4b4d-a3f2-f8bf26211897&gdpr=[GDPR]&gdpr_consent=[GDPR_CONSENT]&us_privacy=[CCPA]&coppa=[COPPA]&gpp=[GPP]&gpp_sid=[GPP_SID]
https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us...
https://x.bidswitch.net/ul_cb/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_conse...
https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=6fc985bd-ce5a-4ae9-8754-a8a2309e397c&gdpr=&gdpr_consent=&us_privacy=

43 B
496 B

152ms
150ms

Image
image/avif

157.230.83.84
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=6fc985bd-ce5a-4ae9-8754-a8a2309e397c&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D&gpp=&gpp_sid=
Protocol: H2
Server: 157.230.83.84 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 14 Aug 2025 16:41:17 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=6fc985bd-ce5a-4ae9-8754-a8a2309e397c&gdpr=&gdpr_consent=&us_privacy=
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 14 Aug 2025 16:41:17 GMT

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 0A8D
Redirect Chain

https://ads.stickyadstv.com/user-matching?id=3442&_fw_gdpr=&_fw_gdpr_consent=
https://sync.cootlogix.com/api/cookie?partnerId=freewheel&userId=1ce5fcee3dc79b215d6f9a63608e0&_fw_gdpr=&_fw_gdpr_consent=
https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us...
https://x.bidswitch.net/ul_cb/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_conse...
https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=2f732770-6e05-442d-bc50-515af63a06d6&gdpr=&gdpr_consent=&us_privacy=

43 B
496 B

146ms
146ms

Image
image/avif

157.230.83.84
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=2f732770-6e05-442d-bc50-515af63a06d6&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D&gpp=&gpp_sid=
Protocol: H2
Server: 157.230.83.84 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 14 Aug 2025 16:41:17 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=2f732770-6e05-442d-bc50-515af63a06d6&gdpr=&gdpr_consent=&us_privacy=
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 14 Aug 2025 16:41:17 GMT

GET
H2

200

usync.html Show response
eus.rubiconproject.com/ Frame BBCD
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=vidazoo&endpoint=us-east
https://eus.rubiconproject.com/usync.html?p=vidazoo&endpoint=us-east

269 B
379 B

1463ms
142ms

Document
text/html

23.200.198.128
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=vidazoo&endpoint=us-east
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D&gpp=&gpp_sid=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.200.198.128 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-200-198-128.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) /
Resource Hash: e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer: https://sync.cootlogix.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Thu, 14 Aug 2025 16:41:10 GMT
etag: "10d-629840acea280-gzip"
last-modified: Wed, 18 Dec 2024 04:42:34 GMT
server: Apache/2.4.62 (Debian)
vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Thu, 14 Aug 2025 16:41:08 GMT
location: https://eus.rubiconproject.com/usync.html?p=vidazoo&endpoint=us-east
server: AkamaiGHost

GET
H2 200 cm Show response
u.openx.net/w/1.0/ Frame DEB0 199 B
252 B 3855ms
118ms Document
text/html 35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://u.openx.net/w/1.0/cm?cc=1&id=4241c706-9fd2-4ae4-b2d7-c9f8d34e773c&ph=f4cc9fb1-057b-4e7a-b393-325ee9109574&gdpr=&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenx%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D&gpp=&gpp_sid=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: de259eb7ba7a0e45575deb33946f1fbc695c97c33145ae4e49af0069d010868e

Request headers

Referer: https://sync.cootlogix.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 199
content-type: text/html
date: Thu, 14 Aug 2025 16:41:10 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 89.238.156.126

GET
H2 200 cm Show response
us-u.openx.net/w/1.0/ Frame 10C1 199 B
424 B 3683ms
201ms Document
text/html 35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://us-u.openx.net/w/1.0/cm?id=fba3d144-1026-4d31-a758-943b9545e305&gdpr=&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenxut%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D&gpp=&gpp_sid=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: de259eb7ba7a0e45575deb33946f1fbc695c97c33145ae4e49af0069d010868e

Request headers

Referer: https://sync.cootlogix.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 199
content-type: text/html
date: Thu, 14 Aug 2025 16:41:09 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 89.238.156.126

GET
H2

200

usync.html Show response
eus.rubiconproject.com/ Frame C519
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=12776
https://eus.rubiconproject.com/usync.html?p=12776

269 B
379 B

1463ms
143ms

Document
text/html

23.200.198.128
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=12776
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D&gpp=&gpp_sid=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.200.198.128 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-200-198-128.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) /
Resource Hash: e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer: https://sync.cootlogix.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Thu, 14 Aug 2025 16:41:10 GMT
etag: "10d-629840acea280-gzip"
last-modified: Wed, 18 Dec 2024 04:42:34 GMT
server: Apache/2.4.62 (Debian)
vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Thu, 14 Aug 2025 16:41:08 GMT
location: https://eus.rubiconproject.com/usync.html?p=12776
server: AkamaiGHost

GET trustedIframe.html
btloader.com/ Frame 45EC 0
0

GET
H2 200 country Show response
api.btloader.com/ 37 B
153 B 588ms
145ms Fetch
application/json 130.211.23.194
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://api.btloader.com/country?o=5150306120761344
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.23.194 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 194.23.211.130.bc.googleusercontent.com
Software: /
Resource Hash: b8f0ca68362cf245f891fc09ddfa50806d195e78e196cf96ac5d9cf72be2577a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private, max-age=300, stale-while-revalidate=600, stale-if-error=600
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37
date: Thu, 14 Aug 2025 16:41:07 GMT
content-type: application/json
vary: Origin

POST
H2 204 pv
api.btloader.com/ 0
0 529ms
139ms Fetch 130.211.23.194
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://api.btloader.com/pv?nlf=false&tid=svqva4Q4E-CDQ9ppMj-98a974dbe5&sid=1cxHclwNSJ-XMtAkioM6-98a974dbe6&cv=2.1.135&upapi=true
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.23.194 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 194.23.211.130.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

via: 1.1 google
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 14 Aug 2025 16:41:07 GMT
vary: Origin

POST
H2 200 encrypt Show response
esp.rtbhouse.com/ 265 B
530 B 834ms
457ms Fetch
application/json 35.190.39.111
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://esp.rtbhouse.com/encrypt
Requested by: Host: invstatic101.creativecdn.com
URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.39.111 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 111.39.190.35.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 7490ae2c7f860a1067a76ab3663b3ea2efda262485e4996a1bfc50df020234cf

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: POST
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 265
date: Thu, 14 Aug 2025 16:41:07 GMT
content-type: application/json
x-cloud-trace-context: bba32a8214563acb77a2e513d15d8dc5
server: Google Frontend
access-control-allow-headers: X-Requested-With

GET
H2 200 json Show response
gum.criteo.com/sid/ Frame A134 457 B
909 B 136ms
136ms Fetch
application/json 74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=publishertagids&domain=paint.toys&sn=ChromeSyncframe&so=3&topUrl=paint.toys&bundle=0Oz7_19rZHhyJTJGVFglMkZxWUlVenklMkZrcDlQeTd4cjBzNnlXYmVEZGhOMFklMkJqUDNJbG93bm9zaFNZemIza3NkbER3ZzR4Zk9zZVBCTTJyR3FIS1ZGMFJlWk9LT3VzbzNnaEp2T09MSXBiOGg0eEV3MnZ5d0JGa2RzRUtWalJwWVVwJTJGJTJCeUxSaA&topicsavail=1&fledgeavail=1

Requested by

Host: gum.criteo.com
URL: https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=paint.toys&gdpr=0&gdpr_consent=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

b45cd6a04847843f5059618b173c7b51890e52d9b638633d3e052aeb5617c960

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=paint.toys&gdpr=0&gdpr_consent=

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
server-processing-duration-in-ticks: 1005887
expires: 0
date: Thu, 14 Aug 2025 16:41:06 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

GET
H2

200

usync.html Show response
eus.rubiconproject.com/ Frame C075
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=
https://eus.rubiconproject.com/usync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=

269 B
379 B

1465ms
145ms

Document
text/html

23.200.198.128
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.ae6790c95efdb5dcce9e.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.200.198.128 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-200-198-128.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) /
Resource Hash: e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Thu, 14 Aug 2025 16:41:10 GMT
etag: "10d-629840acea280-gzip"
last-modified: Wed, 18 Dec 2024 04:42:34 GMT
server: Apache/2.4.62 (Debian)
vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Thu, 14 Aug 2025 16:41:08 GMT
location: https://eus.rubiconproject.com/usync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=
server: AkamaiGHost

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxXhTqd2TxGIWEUkb7mcXqWdQOdSX3lLSTyEadfpgyPnsoAjB-ZXUEZEbKN66rplCaMwOCs4TtSwe9x1eP0NoO6BS0696TnyMjF68zF06lKj7rAZISCu6hpdHbR92ul8wyxDb6n9OQ==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.174 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-X8Xe5JXY1lFHsGFGMBGV7g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 14 Aug 2025 16:41:07 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjUtDikmLw15Bi-FB_mfUHEJv53Wa1A2LJ17dZFYFYiIdj8eIfR9gEfuzZc5ZRySUpvzA-OT-vJDWvRDcxpVgXxC7KTCotyS9CYaeWgVTk5KenZ-alxxsZGJkaWBga6xmYxBcYAABaqivb"
content-security-policy: script-src 'report-sample' 'nonce-X8Xe5JXY1lFHsGFGMBGV7g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxXhTqd2TxGIWEUkb7mcXqWdQOdSX3lLSTyEadfpgyPnsoAjB-ZXUEZEbKN66rplCaMwOCs4TtSwe9x1eP0NoO6BS0696TnyMjF68zF06lKj7rAZISCu6hpdHbR92ul8wyxDb6n9OQ==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.174 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-whh-1HNzS3bN0iO8nF3DHg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 14 Aug 2025 16:41:07 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjUtDikmLw05Bi-FB_mfUHEJv53Wa1A2LJ17dZFYFYiIdj8eIfR9gEJuxZfYRRySUpvzA-OT-vJDWvRDcxpVgXxC7KTCotyS9CYaeWgVTk5KenZ-alxxsZGJkaWBga6xmYxBcYAAA0YStY"
content-security-policy: script-src 'report-sample' 'nonce-whh-1HNzS3bN0iO8nF3DHg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H3 200 AGSKWxXzeP9k1OE769ALGL5slWyXclPybjfnqiOvfEF-tknCW56I9hm0MZ14o-hOnY-ou4Y4ST-eIJhQ-SNY46j1-m9NOBeNG_AKNWpPCcslrja_IguYPjsRU2ThsmGYFNMg35-SRDzizg== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 157ms
156ms Script
application/javascript 142.251.40.174
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxXzeP9k1OE769ALGL5slWyXclPybjfnqiOvfEF-tknCW56I9hm0MZ14o-hOnY-ou4Y4ST-eIJhQ-SNY46j1-m9NOBeNG_AKNWpPCcslrja_IguYPjsRU2ThsmGYFNMg35-SRDzizg==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzU1MTg5NjY3LDMyMzAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOSw2XSxudWxsLDIsbnVsbCwiZW4iLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCwxXSwiaHR0cHM6Ly9wYWludC50b3lzL29pbC8iLG51bGwsW1s4LCI2M3RUckFOczIxcyJdLFs5LCJlbi1VUyJdLFsxOSwiMiJdLFsxNywiWzBdIl0sWzI0LCJzc2U2Lmt3YWNoLm9yZyJdLFsyOSwiZmFsc2UiXV1d

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.174 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

04f413bb76eba2a4ee30592972e979944a7fd7eebae5eb4e73828bfe31d626ac

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-P28QKSOPKS3v4tKblwMaRA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 14 Aug 2025 16:41:07 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjStDikmJw1ZBiaL15jnU6EBsqXGJ1BuIP9ZdZfwBxkcQV1hYg_lR1g1Wk-gZrEvtN1hIg3rXxFuthIDbzu81qB8SSr2-zKgJx-pS7rAVAzLn2LqsQCPNwLF784wibwIOu_6cZlTSS8gvjk_PzSooyk0pL8ovSktNSi1OLylKL4o0MjEwNLAyN9QwM4gsMAJssPNc"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-P28QKSOPKS3v4tKblwMaRA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

POST
H3 204 AGSKWxWCEZyO9Ew-Lo4qz7vCsyPdJEbVSrsjZ97_bFmanUwNh3O3v8Zt56Vf-J3eD-7e24bpDykGIBmYlNrntbuA8Le_-yFN2earAVvWXbqWLx4bpE7nMbv6jh6gK9XE2VPbI91GB9xvaQ== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 135ms
134ms XHR
text/html 142.251.40.174
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWCEZyO9Ew-Lo4qz7vCsyPdJEbVSrsjZ97_bFmanUwNh3O3v8Zt56Vf-J3eD-7e24bpDykGIBmYlNrntbuA8Le_-yFN2earAVvWXbqWLx4bpE7nMbv6jh6gK9XE2VPbI91GB9xvaQ==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.174 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-Omy1wEZyD6pc2lbX2WSc3g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 14 Aug 2025 16:41:07 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjUtDikmJw1JBi-FB_mfUHEJv53Wa1A2LJ17dZFYFYiIdj8eIfR9gEfpya0c-k5JKUXxifnJ9XkppXopuYUqwLYhdlJpWW5BehsFPLQCpy8tPTM_PS440MjEwNLAyN9QxM4gsMAD0pK3o"
content-security-policy: script-src 'report-sample' 'nonce-Omy1wEZyD6pc2lbX2WSc3g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 127 KB
43 KB 910ms
910ms Fetch
text/plain 142.250.81.226
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4840316396701380&correlator=2537722859563177&eid=31094017%2C83321073%2C31086810&output=ldjh&gdfp_req=1&vrg=202508110101&ptt=17&impl=fifs&gdpr=0&iu_parts=154013155%3A21762409181%2C1024872%2C74068%2Cpublisher%3A1024872-website%3A74068-160x600%2Cpublisher%3A1024872-website%3A74068-160x600-CP%2Cpublisher%3A1024872-website%3A74068-160x600-CP-160x600&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4%2F5&prev_iu_szs=160x600%7C120x600&ifi=1&dids=pw-160x600_atf&adfs=3640230632&sfv=1-0-45&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1755189667549&lmt=1755189667&adxs=20&adys=613&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fsse6.kwach.org%2F&vis=1&psz=180x1096&msz=160x-1&fws=4&ohw=180&topics=1&tps=1&htps=10&a3p=EjQKCnB1YmNpZC5vcmcSJGIwOGRlNDY4LWYxNWUtNDA0Ni05NzA5LTM4Yzk5MGRkZWFmYVgBEjcKDWJpZHN3aXRjaC5uZXQSJDRhYjZhZWY1LTE4MzAtNDdkNy05NTgyLTFhZDEzOWVlYmYwMlgBEj8KHGxpdmVpbnRlbnQuaW5kZXhleGNoYW5nZS5jb20SHWFDZVJOZEhNNGFvQUhRTm5BS25PQkFBQSYyNDg4WAESJwoScnViaWNvbnByb2plY3QuY29tEg9MWlVEQldONC1LLTNYNkJYARI2CgxwdWJtYXRpYy5jb20SJDg2NTQyNzI3LTFDRjQtNDk4QS05QTdCLTAxQzJGMUI3RDVDQ1gBEt4BCg5lc3AuY3JpdGVvLmNvbRLCATBPejdfMTlyWkhoeUpUSkdWRmdsTWtaeFdVbFZlbmtsTWtacmNEbFFlVGQ0Y2pCek5ubFhZbVZFWkdoT01Ga2xNa0pxVUROSmJHOTNibTl6YUZOWmVtSXphM05rYkVSM1p6UjRaazl6WlZCQ1RUSnlSM0ZJUzFaR01GSmxXazlMVDNWemJ6Tm5hRXAyVDA5TVNYQmlPR2cwZUVWM01uWjVkMEpHYTJSelJVdFdhbEp3V1ZWd0pUSkdKVEpDZVV4U2FBGIbE08uKM0gAEhgKCXlhaG9vLmNvbRiNxNPLijNIAFICCG8SFAoFb3BlbngYnsfTy4ozSABSAghvEhsKDDMzYWNyb3NzLmNvbRjJvNPLijNIAFICCGQSFwoIcnRiaG91c2UYyLzTy4ozSABSAghkElMKDWNyd2RjbnRybC5uZXQSQDc1NjNkZGM4ZmYzNzdjNWZlOGE5YWViNGFiMTMxODVjYTAyY2IwOTMwYTNlZTc0ODY5NWJhOWQ5OTczY2E2NzdYARIzCglvcGVueC5uZXQSJDhmMTJmZWQzLWZmMTgtMGJhNC0yNWY1LTk3M2QyM2E2MzE2NFgBEocBCg5saXZlaW50ZW50LmNvbRJzMTktcmFwZTBWTW9MUW5GNlBtOXpFTlFtQmRpN0JodHdDZlRJL0RKTmxhMko3Q0VaUk9CUHNKbUxvQUdvRkZWTEFoVnZyWFJ6VVpUSHo1d05YTjBlSjFrOUh1U2lJcTVNT2J1elZ3YXRiZ0tVQm4xMnc9PVgBEjUKGWxpdmVpbnRlbnQudHJpcGxlbGlmdC5jb20SFjE0MDU4OTM5OTI0MDU4NjQzOTU3NzRYAQ..&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1755189662316&idt=1660&prev_scp=pos%3Datf%26slot_id%3Dpw-160x600_atf%26refresh%3Dfalse%26amazonBid%3Dfalse%26custom_path%3D160x600%26lld_id%3Dda6426831cbe4c17a69b270305bd17df89664862%26price_floor%3Dna%26amznbid%3D2%26amznp%3D2&cust_params=pf_src%3Dml%26li-module-enabled%3Dt1-e0%26salad%3Dchef%26dd%3Draspberry%26di%3Dpineapple%26vd%3Draspberry%26vi%3Dpineapple%26sitecont_cat%3Dgames_casual%26referrer%3Dhttps%253A%252F%252Fsse6.kwach.org%252F%26tyche_code%3DV.20250811.1%26pageos_code%3DV.20250811.1%26config_id%3D1024872_74068_primary_config%26hour%3D9%26day%3DThursday%26referrer_domain%3Dsse6.kwach.org%26OS%3DLinux%2520null%26browser%3DChrome%2520138%26pagecount%3D1%26window_width%3D1600%26window_height%3D1200%26screen_orientation%3Dlandscape%26website_id%3D74068%26pub_id%3D1024872%26refresh_count%3D0%26tyche_version%3DV.20250811.1%26ab_test%3Dna_A%26ad_clicker%3Dfalse%26dmp_ids%3D65%26page_focus%3Dtrue&adks=2652516820&frm=20&eoidce=1&gblpids=%2F154013155%2C21762409181%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-websi&pb_szs=160x600%7C120x600&pbbce=1&td=1&egid=24249&tan=34d317d0-4117-474a-8846-a71cf0638ddc&tdf=2

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202508110101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.81.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ns31533570.ip-162-19-138.eu

Software

cafe /

Resource Hash

baa7650238244710f63f463ce8e84bf8c56eab91b9cb2f107e2ee33a547a04f8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: dcb
google-lineitem-id: -1
observe-browsing-topics: ?1
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 14 Aug 2025 16:41:08 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -1
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
content-length: 44278
x-xss-protection: 0
server: cafe

GET
H3 200 container.html Show response
459b190c75fc3706badce91489ac4d5d.safeframe.googlesyndication.com/safeframe/1-0-45/html/ Frame 95A1 7 KB
3 KB 596ms
138ms Document
text/html 142.250.65.193
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://459b190c75fc3706badce91489ac4d5d.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202508110101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s72-in-f1.1e100.net

Software

sffe /

Resource Hash

f1a68bf826c55985468304f4284a09cb8a68e82503d764166e611a7c58a85a4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 3121
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 14 Aug 2025 16:41:08 GMT
expires: Thu, 14 Aug 2025 16:41:08 GMT
last-modified: Thu, 08 May 2025 23:15:48 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 200 fb87a4ea41 Show response
cd836371f1d.cdn.intergient.com/ 0
96 B 1857ms
260ms XHR
application/octet-stream 54.81.166.120
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://cd836371f1d.cdn.intergient.com/fb87a4ea41
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250811.1/main.9b44c978684fc999f334.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.81.166.120 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-81-166-120.compute-1.amazonaws.com
Software: nginx/1.24.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

access-control-allow-origin: *
date: Thu, 14 Aug 2025 16:41:09 GMT
content-type: application/octet-stream
server: nginx/1.24.0

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame EB65 20 KB
7 KB 1478ms
145ms Document
text/html 23.45.193.13
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.ae6790c95efdb5dcce9e.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.45.193.13 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-45-193-13.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: a88123f7890e58349e3a64226c716be9d346a42ba76e542a8ebdd30026a89604

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=63111
content-encoding: gzip
content-length: 6694
content-type: text/html
date: Thu, 14 Aug 2025 16:41:09 GMT
expires: Fri, 15 Aug 2025 10:13:00 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

POST
H3 204 ping
pagead2.googlesyndication.com/pagead/ 0
0 133ms
131ms Fetch
text/html 142.250.80.34
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://pagead2.googlesyndication.com/pagead/ping?e=1
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202508110101/pubads_impl.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.80.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga34s34-in-f2.1e100.net
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

GET
H3 200 container.html Show response
459b190c75fc3706badce91489ac4d5d.safeframe.googlesyndication.com/safeframe/1-0-45/html/ Frame 9A85 7 KB
0 0ms
0ms Document
text/html 142.250.65.193
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://459b190c75fc3706badce91489ac4d5d.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202508110101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s72-in-f1.1e100.net

Software

sffe /

Resource Hash

f1a68bf826c55985468304f4284a09cb8a68e82503d764166e611a7c58a85a4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 3121
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 14 Aug 2025 16:41:08 GMT
expires: Thu, 14 Aug 2025 16:41:08 GMT
last-modified: Thu, 08 May 2025 23:15:48 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 / Show response
sync.cootlogix.com/api/sync/iframe/ Frame 0991 3 KB
4 KB 142ms
142ms Document
text/html 157.230.83.84
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://sync.cootlogix.com/api/sync/iframe/?cid=&gdpr=0&gdpr_consent=&us_privacy=&coppa=0
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.ae6790c95efdb5dcce9e.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 157.230.83.84 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: 0f10fb0c68835aa01a4bcaf858bb0fed58309a710f9b23f819282a55db9afb6c

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
content-length: 2603
content-type: text/html
date: Thu, 14 Aug 2025 16:41:08 GMT
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 0FC2 52 KB
17 KB 656ms
265ms Document
text/html 151.101.193.108
FASTLY

General

Check archive.org

Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.ae6790c95efdb5dcce9e.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.193.108 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 32772
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Thu, 14 Aug 2025 16:41:09 GMT
ETag: W/"623de86a-cf34"
Expires: Thu, 23 Jan 2025 21:34:45 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish, 1.1 varnish
X-Cache: HIT, HIT
X-Cache-Hits: 684416, 46573
X-Served-By: cache-lga21993-LGA, cache-yul1970063-YUL
X-Timer: S1755189669.474041,VS0,VE0

GET
H2 200 pd Show response
playwire-d.openx.net/w/1.0/ Frame BB59 199 B
424 B 3587ms
196ms Document
text/html 35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://playwire-d.openx.net/w/1.0/pd
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.ae6790c95efdb5dcce9e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: de259eb7ba7a0e45575deb33946f1fbc695c97c33145ae4e49af0069d010868e

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 199
content-type: text/html
date: Thu, 14 Aug 2025 16:41:12 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 89.238.156.126

POST
H2 200 prebid Show response
id5-sync.com/api/config/ 195 B
460 B 191ms
190ms Fetch
application/json 162.19.138.119
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.ae6790c95efdb5dcce9e.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.119 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

7e4d2c9111e1ca31b5e2e4bfd5a66925f07c0c232672f31481c6b66a89b26f16

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
content-encoding: gzip
date: Thu, 14 Aug 2025 16:41:08 GMT
content-type: application/json;charset=UTF-8
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding
access-control-allow-credentials: true

GET
H2 200 f Show response
fid.agkn.com/ 0
363 B 120ms
120ms Fetch 52.4.69.113
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://fid.agkn.com/f?apiKey=2104320612&r=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.ae6790c95efdb5dcce9e.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.4.69.113 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-4-69-113.compute-1.amazonaws.com
Software: AAWebServer /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
expires: 0
access-control-allow-origin: https://paint.toys
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
date: Thu, 14 Aug 2025 16:41:08 GMT
vary: Origin
server: AAWebServer
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type

GET
H2 200 envelope Show response
lexicon.33across.com/v1/ 2 KB
2 KB 121ms
119ms Fetch
application/json 35.244.193.51
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0014000001YrMoYAAV&gdpr=0&src=pbjs&ver=9.51.0&coppa=0&tp=4q4ej6LKJ8N7UwkGX56pxEIOCs1L65COBPFCd33qIvA%3D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.ae6790c95efdb5dcce9e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.193.51 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 51.193.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 9df40a3d1362dc7c556cc355829ce5da552f98525c5013ddf719a9038daeda92

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1636
date: Thu, 14 Aug 2025 16:41:08 GMT
content-type: application/json
vary: origin

GET
H2 200 any Show response
idx.liadm.com/idex/did-0046/ 483 B
0 0ms
0ms Fetch
text/plain 44.219.88.186
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://idx.liadm.com/idex/did-0046/any?duid=8e413bd09c43--01k2mq9pwmjtgz8mh0x8ggfs11&did=did-0046&cd=.paint.toys&pu=https%3A%2F%2Fpaint.toys&resolve=nonId&resolve=uid2&resolve=index&resolve=bidswitch&resolve=pubmatic&resolve=magnite&resolve=openx&resolve=sorvrn&resolve=thetradedesk&resolve=medianet&resolve=vidazoo&resolve=sonobi&resolve=sharethrough&resolve=triplelift
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.ae6790c95efdb5dcce9e.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.219.88.186 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-219-88-186.compute-1.amazonaws.com
Software: /
Resource Hash: 0ab183843c16c18b2ef0d4f311e95e2c0a3e0381fbb7776a20174ea59463ad40

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: max-age=86399, private
trace-id: d6c5d95aa45312d9
request-time: 4
access-control-allow-credentials: true
expires: Fri, 15 Aug 2025 16:41:05 GMT
access-control-allow-origin: https://paint.toys
content-length: 483
date: Thu, 14 Aug 2025 16:41:05 GMT
content-type: text/plain; charset=UTF-8
vary: Origin

GET
H2 200 json Show response
gum.criteo.com/sid/ 428 B
1 KB 126ms
126ms Fetch
application/json 74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&bundle=qZfzPF9rZHhyJTJGVFglMkZxWUlVenklMkZrcDlQeTclMkZSbnNmTWhER3RHZ3lnJTJCYnI3QVlJN0VmN3NSZ3pGQWlKelZWTHZWZzZteExZVlFEMmFmZkkySDZVYm1tVHBXU1lRd1RVcVR0c2laU1cxSGFFN1pRZ1AlMkJQRG9oTEFjOVZTbWFmOW1lYjclMkI2eFd0REhPJTJGSXJ3TFM4eDVQYVklMkJUNHclM0QlM0Q&cw=1&pbt=1&lsw=1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.ae6790c95efdb5dcce9e.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

c775e03821fcdcedb81f1ce1ef67e34f490483e77a42317144bf60f1c42ac875

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
content-type: application/json
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 1158975
expires: 0
access-control-allow-origin: https://paint.toys
date: Thu, 14 Aug 2025 16:41:08 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

GET

receive
pixel.tapad.com/idsync/ex/
Redirect Chain

https://match.adsrvr.org/track/usersync?us_privacy=&gdpr=0&gdpr_consent=undefined&ust=image
https://dpm.demdex.net/ibs:dpid=903&dpuuid=d361044d-0ef5-4930-9f3e-bd0acfe3bdfd&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=903&dpuuid=d361044d-0ef5-4930-9f3e-bd0acfe3bdfd&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam
https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam
https://ib.adnxs.com/getuid?https%3a%2f%2fmatch.adsrvr.org%2ftrack%2fcmf%2fappnexus%3fttd%3d1%26anid%3d%24UID&ttd_tdid=d361044d-0ef5-4930-9f3e-bd0acfe3bdfd
https://match.adsrvr.org/track/cmf/appnexus?ttd=1&anid=1404641057160437695&ttd_tdid=d361044d-0ef5-4930-9f3e-bd0acfe3bdfd
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=d361044d-0ef5-4930-9f3e-bd0acfe3bdfd&gdpr=0&gdpr_consent=&expires=30&next=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Frubicon
https://match.adsrvr.org/track/cmf/rubicon?gdpr=0
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm&google_sc&google_hm=ZDM2MTA0NGQtMGVmNS00OTMwLTlmM2UtYmQwYWNmZTNiZGZk&gdpr=0&gdpr_consent=&ttd_tdid=d361044d-0ef5-4930-9f3e-bd0ac...
https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=d361044d-0ef5-4930-9f3e-bd0acfe3bdfd&google_gid=CAESEHQwt3UeHpOqBeGHrLczbZI&google_cver=1
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=d361044d-0ef5-4930-9f3e-bd0acfe3bdfd&partner_url=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dtapad

0
0

GET
H2 200 sync
x.bidswitch.net/ 43 B
183 B 7969ms
257ms Image
image/gif 35.211.202.130
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=themediagrid
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.211.202.130 North Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 130.202.211.35.bc.googleusercontent.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
date: Thu, 14 Aug 2025 16:41:16 GMT
content-type: image/gif

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame FA5B 652 B
257 B 469ms
149ms Document
text/html 142.250.80.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJeVmwEQ-bW9AhiUv5TAAjAB&v=APEucNXalD1AX1IxN71K8hFRRU7Nv9AHqPMFJC29R535m0wSpb2a4pkvttZIr__OSW0lbuFppHgNREhnobS-ZXle2W7FKYfer2GhHc9CDcxLA5plV8Fvs00

Requested by

Host: 459b190c75fc3706badce91489ac4d5d.safeframe.googlesyndication.com
URL: https://459b190c75fc3706badce91489ac4d5d.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s36-in-f2.1e100.net

Software

cafe /

Resource Hash

8c04e118bdd5757192be2a1eb360786f9fa1c4b398806430b7f41f203f64d8e6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://459b190c75fc3706badce91489ac4d5d.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 234
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 14 Aug 2025 16:41:09 GMT
expires: Thu, 14 Aug 2025 16:41:09 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 express_html_inpage_rendering_lib_200_281.js Show response
s0.2mdn.net/879366/ Frame 9A85 117 KB
41 KB 3612ms
213ms Script
text/javascript 142.250.80.38
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_281.js

Requested by

Host: sse6.kwach.org
URL: https://sse6.kwach.org/r/a1NuZEQ2Vkt1MEZ4T3RqY01Mc08tMzk3OC0yNTg4OTkxMS0xMDhlMDI4Ny02NjQ0LXpoM1Y4c2Jwajl3RTk2Y2s2MXBi

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.80.38 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d0d116b21c9ac496c162f9074c75ce227719d025422a1794a57f497718f87cee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Origin: https://459b190c75fc3706badce91489ac4d5d.safeframe.googlesyndication.com
Referer: https://459b190c75fc3706badce91489ac4d5d.safeframe.googlesyndication.com/

Response headers

content-encoding: gzip
age: 15266
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Fri, 15 Aug 2025 12:26:46 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 14 Aug 2025 12:26:46 GMT
last-modified: Tue, 29 Oct 2024 21:00:00 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=86400
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 41319
x-xss-protection: 0
server: sffe

GET
H3 200 omrhp_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20250813/r20110914/elements/html/ Frame 9A85 8 KB
3 KB 511ms
282ms Script
text/javascript 142.250.80.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20250813/r20110914/elements/html/omrhp_fy2021.js

Requested by

Host: sse6.kwach.org
URL: https://sse6.kwach.org/r/a1NuZEQ2Vkt1MEZ4T3RqY01Mc08tMzk3OC0yNTg4OTkxMS0xMDhlMDI4Ny02NjQ0LXpoM1Y4c2Jwajl3RTk2Y2s2MXBi

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

62e911060496b1240d8aaa3d952501659ca64045e4d64ff03ba7b28f579b5282

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://459b190c75fc3706badce91489ac4d5d.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 16281929459725229329
age: 3796
x-content-type-options: nosniff
expires: Thu, 28 Aug 2025 15:37:53 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 14 Aug 2025 15:37:53 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 3199
x-xss-protection: 0
server: cafe

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20250813/r20110914/ Frame 9A85 22 KB
9 KB 498ms
282ms Script
text/javascript 142.250.80.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20250813/r20110914/abg_lite_fy2021.js

Requested by

Host: sse6.kwach.org
URL: https://sse6.kwach.org/r/a1NuZEQ2Vkt1MEZ4T3RqY01Mc08tMzk3OC0yNTg4OTkxMS0xMDhlMDI4Ny02NjQ0LXpoM1Y4c2Jwajl3RTk2Y2s2MXBi

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b84253a0c7e064366e9b8b44a07bba55321c6afbc758d56dc43e774b744ad114

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://459b190c75fc3706badce91489ac4d5d.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 9398024079471245774
age: 3796
x-content-type-options: nosniff
expires: Thu, 28 Aug 2025 15:37:53 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 14 Aug 2025 15:37:53 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 8763
x-xss-protection: 0
server: cafe

GET
H2 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 9A85 41 KB
14 KB 1439ms
159ms Script
text/javascript 142.251.40.225
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: sse6.kwach.org
URL: https://sse6.kwach.org/r/a1NuZEQ2Vkt1MEZ4T3RqY01Mc08tMzk3OC0yNTg4OTkxMS0xMDhlMDI4Ny02NjQ0LXpoM1Y4c2Jwajl3RTk2Y2s2MXBi

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://459b190c75fc3706badce91489ac4d5d.safeframe.googlesyndication.com/

Response headers

content-encoding: br
age: 2834
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
x-content-type-options: nosniff
expires: Thu, 14 Aug 2025 16:43:56 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 14 Aug 2025 15:53:56 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=3000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 13937
x-xss-protection: 0
server: sffe

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20250813/r20110914/client/ Frame 9A85 3 KB
1 KB 1545ms
266ms Script
text/javascript 142.251.40.225
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20250813/r20110914/client/window_focus_fy2021.js

Requested by

Host: 459b190c75fc3706badce91489ac4d5d.safeframe.googlesyndication.com
URL: https://459b190c75fc3706badce91489ac4d5d.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fec5a361dec923efe92848ca27b02b158b164380a9eaf6cc1625e08e0d9c101e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://459b190c75fc3706badce91489ac4d5d.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 6020003950853699975
age: 84804
x-content-type-options: nosniff
expires: Wed, 27 Aug 2025 17:07:46 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Wed, 13 Aug 2025 17:07:46 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 1241
x-xss-protection: 0
server: cafe

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20250813/r20110914/client/ Frame 9A85 20 KB
9 KB 1422ms
143ms Script
text/javascript 142.251.40.225
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20250813/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 459b190c75fc3706badce91489ac4d5d.safeframe.googlesyndication.com
URL: https://459b190c75fc3706badce91489ac4d5d.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

628f08a2f97abce9ac8096b80885f7fff234650eda2fd8d6f6c29fbbbfbf7376

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://459b190c75fc3706badce91489ac4d5d.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 17669492043215330189
age: 3797
x-content-type-options: nosniff
expires: Thu, 28 Aug 2025 15:37:53 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 14 Aug 2025 15:37:53 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 8494
x-xss-protection: 0
server: cafe

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9A85 42 B
63 B 500ms
287ms Image
image/gif 142.250.80.34
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AUI4U1QgtEBZTUBMP6DBgiPEIV5zN1h_g7sbvf49nFqU_AWc6TBmItGcKCGE7XhfEAC2KxkAGvXX_yx0JgV3rV7dTbGO6e8h4Zy9a_WlbRXvPyI84

Requested by

Host: 459b190c75fc3706badce91489ac4d5d.safeframe.googlesyndication.com
URL: https://459b190c75fc3706badce91489ac4d5d.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://459b190c75fc3706badce91489ac4d5d.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Thu, 14 Aug 2025 16:41:09 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 9A85 222 KB
68 KB 318ms
106ms Script
text/javascript 142.250.80.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: 459b190c75fc3706badce91489ac4d5d.safeframe.googlesyndication.com
URL: https://459b190c75fc3706badce91489ac4d5d.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ns31533569.ip-162-19-138.eu

Software

cafe /

Resource Hash

236c34aed623ea7a65d75d7e3e0bac4bfcd6dc070ea1abbdb3db3ea5be4a1061

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://459b190c75fc3706badce91489ac4d5d.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 5776204965252557975
age: 2905
x-content-type-options: nosniff
expires: Thu, 14 Aug 2025 16:52:44 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 14 Aug 2025 15:52:44 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=ISO-8859-1
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 69782
x-xss-protection: 0
server: cafe

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 131ms
130ms Fetch
text/plain 142.250.65.174
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-VJBRK9986D&gtm=45je58d0v9101576445za200zd9101576445&_p=1755189662328&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101509157~103116026~103200004~103233427~104684208~104684211~105033763~105033765~105103161~105103163~105231383~105231385&cid=2142931288.1755189664&ul=en-ca&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=AEAAAAQ&_s=2&sid=1755189663&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Fsse6.kwach.org%2F&dt=Paint%20with%20Oils&en=scroll&epn.percent_scrolled=90&_et=25&tfd=8707
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.65.174 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga25s71-in-f14.1e100.net
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:102:0
report-to: {"group":"ascnsrsggc:102:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:102:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:102:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 14 Aug 2025 16:41:09 GMT
content-type: text/plain
server: Golfe2

POST v3
id5-sync.com/gm/ 0
0

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 114ms
113ms Preflight
application/json 74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://paint.toys
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Thu, 14 Aug 2025 16:41:08 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 261969
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 0991
Redirect Chain

https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3D?gdpr=0&gdpr_consent=&...
https://x.bidswitch.net/ul_cb/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3D?gdpr=0&gdpr_con...
https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=6fc985bd-ce5a-4ae9-8754-a8a2309e397c&gdpr=0&gdpr_consent=&us_privacy=

43 B
496 B

151ms
150ms

Image
image/avif

157.230.83.84
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=6fc985bd-ce5a-4ae9-8754-a8a2309e397c&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/sync/iframe/?cid=&gdpr=0&gdpr_consent=&us_privacy=&coppa=0
Protocol: H2
Server: 157.230.83.84 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 14 Aug 2025 16:41:16 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=6fc985bd-ce5a-4ae9-8754-a8a2309e397c&gdpr=0&gdpr_consent=&us_privacy=
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 14 Aug 2025 16:41:16 GMT

POST v3
id5-sync.com/gm/ 0
0

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
319 B 209ms
194ms Fetch
application/json 162.19.138.118
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.ae6790c95efdb5dcce9e.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.118 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

42c32b5b6573f8a1fbe13cfd3df7228f93c7d62c7e89f4b0c1001c6fd9be96fd

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
content-encoding: gzip
date: Thu, 14 Aug 2025 16:41:09 GMT
content-type: application/json;charset=UTF-8
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
328 B 425ms
214ms Fetch
application/json 162.19.138.118
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.ae6790c95efdb5dcce9e.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.118 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ns31533569.ip-162-19-138.eu

Software

Resource Hash

42c32b5b6573f8a1fbe13cfd3df7228f93c7d62c7e89f4b0c1001c6fd9be96fd

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
content-encoding: gzip
date: Thu, 14 Aug 2025 16:41:09 GMT
content-type: application/json;charset=UTF-8
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding

GET
H3

200

usermatch Show response
ssum-sec.casalemedia.com/ Frame 6BB7
Redirect Chain

https://ssum-sec.casalemedia.com/usermatch?s=184674&gdpr=&gdpr_consent=&us_privacy=&gpp=&gppsid=&cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%2...
https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_conse...

2 KB
1 KB

148ms
147ms

Document
text/html

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=&C=1
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.ae6790c95efdb5dcce9e.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.26.193 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7fc3b93b698394c10da41e3856aa1d242cf15ff3695780c86c5f56b12b7aa27e

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 96f1e5ece98fab9a-YYZ
content-encoding: br
content-type: text/html
date: Thu, 14 Aug 2025 16:41:09 GMT
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
priority: u=0,i
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=c0Djzha%2BGL%2BHgFE2RB0Xh5bq4Ail14bb9vR9d2T5NMmknL4H4FsGXmwACLssCfQJJcgetX6Du4M%2BmJHWlX%2FxgiDTEXTy31KAFPInIXdSkrmqziJ5BMh3Kba7NmDTsNf5osRUJAXT5lTTgA%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfExtPri
vary: Accept-Encoding

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 96f1e5eb5fd6ab9a-YYZ
content-length: 0
date: Thu, 14 Aug 2025 16:41:09 GMT
expires: 0
location: /usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=&C=1
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
priority: u=0,i
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BDqjFfjuoEEoOqKf3IPAHSDfgoc8JSB1BoamXLKHrW%2BwhcCDxMnK5dlbvYkYY8N89B435gRsqgX5OJOBXRgZbI4ep1QP0c0%2Fj7xkT33QXqv7ys%2B%2BwR3yCSh7qp3YSGJ%2BVLDh%2BOJ5G0%2Ff5A%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfExtPri
vary: Accept-Encoding

POST 483.json
id5-sync.com/g/v2/ 0
0

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame FA5B
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm&gdpr=0
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMl7WqKpGcrgNnq1K-I75Fk&google_cver=1&gdpr=0

43 B
766 B

177ms
175ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMl7WqKpGcrgNnq1K-I75Fk&google_cver=1&gdpr=0
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJeVmwEQ-bW9AhiUv5TAAjAB&v=APEucNXalD1AX1IxN71K8hFRRU7Nv9AHqPMFJC29R535m0wSpb2a4pkvttZIr__OSW0lbuFppHgNREhnobS-ZXle2W7FKYfer2GhHc9CDcxLA5plV8Fvs00
Protocol: H3
Server: 104.18.27.193 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WFBj395Qo07oxs2%2BxHt5cjGcI%2B1HCZVd9gUVDFMw3yXXkCiJ5T%2F7zh9NoWMM3qHr5%2BDakCLoPpuHycSoSYTEBZdWJTq9hpasjZSG0A4NFfEp0tXZUk4I7eemdX4WE%2FmvQAgpnVb253XP4Q%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Thu, 14 Aug 2025 16:41:10 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=2,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 96f1e5ee4ff8b406-YYZ
content-length: 43
server: cloudflare

Redirect headers

cache-control: no-cache, must-revalidate
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMl7WqKpGcrgNnq1K-I75Fk&google_cver=1&gdpr=0
pragma: no-cache
cross-origin-resource-policy: cross-origin
report-to: {"group":"ad-exchange-cookie-matcher","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/httpsserver2/ad-exchange-cookie-matcher"}]}
content-security-policy-report-only: script-src 'none';form-action 'none';frame-src 'none'; report-uri https://csp.withgoogle.com/csp/httpsserver2/ad-exchange-cookie-matcher
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 324
date: Thu, 14 Aug 2025 16:41:09 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame FA5B
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&gdpr=0&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&gdpr=0&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=aJ4RpdHM6dAAA3RpAAqsQwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMl7WqKpGcrgNnq1K-I75Fk&google_cver=1

43 B
766 B

164ms
163ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMl7WqKpGcrgNnq1K-I75Fk&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJeVmwEQ-bW9AhiUv5TAAjAB&v=APEucNXalD1AX1IxN71K8hFRRU7Nv9AHqPMFJC29R535m0wSpb2a4pkvttZIr__OSW0lbuFppHgNREhnobS-ZXle2W7FKYfer2GhHc9CDcxLA5plV8Fvs00
Protocol: H3
Server: 104.18.27.193 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=S%2BwOzTDSPMVIb%2BiwzHv22CXWo%2BCVpHO8vkBdK8F3jFuDy2A9XhuNOxM7AemsXmmKJk%2Bm3pw0WEk4mmHaXkU3umamtUqdSuYy9aXoNh5%2FRO4wg2y9fCTe2mvFnvImnCVHkc5jSnn5aua9UA%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Thu, 14 Aug 2025 16:41:10 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=2,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 96f1e5eeb85ab406-YYZ
content-length: 43
server: cloudflare

Redirect headers

cache-control: no-cache, must-revalidate
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMl7WqKpGcrgNnq1K-I75Fk&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
report-to: {"group":"ad-exchange-cookie-matcher","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/httpsserver2/ad-exchange-cookie-matcher"}]}
content-security-policy-report-only: script-src 'none';form-action 'none';frame-src 'none'; report-uri https://csp.withgoogle.com/csp/httpsserver2/ad-exchange-cookie-matcher
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 313
date: Thu, 14 Aug 2025 16:41:10 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

setuid
ib.adnxs.com/ Frame FA5B
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm&gdpr=0
https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEBDFp6_1OpSaPMtsOrIsUtw&google_cver=1

43 B
1 KB

173ms
170ms

Image
image/gif

68.67.160.26
ASN-APPNEX

General

Check archive.org

Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEBDFp6_1OpSaPMtsOrIsUtw&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJeVmwEQ-bW9AhiUv5TAAjAB&v=APEucNXalD1AX1IxN71K8hFRRU7Nv9AHqPMFJC29R535m0wSpb2a4pkvttZIr__OSW0lbuFppHgNREhnobS-ZXle2W7FKYfer2GhHc9CDcxLA5plV8Fvs00

Protocol

Server

68.67.160.26 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

567.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.25.5 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin: 89.238.156.126; 89.238.156.126; 567.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid: 6236d9fd-f67a-4e30-948e-44a0e9ccae34
content-length: 43
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 14 Aug 2025 16:41:10 GMT
x-xss-protection: 0
content-type: image/gif
server: nginx/1.25.5

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEBDFp6_1OpSaPMtsOrIsUtw&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
report-to: {"group":"ad-exchange-cookie-matcher","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/httpsserver2/ad-exchange-cookie-matcher"}]}
content-security-policy-report-only: script-src 'none';form-action 'none';frame-src 'none'; report-uri https://csp.withgoogle.com/csp/httpsserver2/ad-exchange-cookie-matcher
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 301
date: Thu, 14 Aug 2025 16:41:09 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame FA5B
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}&gdpr=0
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTQwNDY0MTA1NzE2MDQzNzY5NQ%3D%3D&gdpr=0

170 B
246 B

359ms
125ms

Image
image/png

142.250.65.194
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTQwNDY0MTA1NzE2MDQzNzY5NQ%3D%3D&gdpr=0

Requested by

Protocol

Server

142.250.65.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

567.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
report-to: {"group":"ad-exchange-cookie-matcher","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/httpsserver2/ad-exchange-cookie-matcher"}]}
content-security-policy-report-only: script-src 'none';form-action 'none';frame-src 'none'; report-uri https://csp.withgoogle.com/csp/httpsserver2/ad-exchange-cookie-matcher
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 170
date: Thu, 14 Aug 2025 16:41:09 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cache-control: no-store, no-cache, private
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTQwNDY0MTA1NzE2MDQzNzY5NQ%3D%3D&gdpr=0
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 89.238.156.126; 89.238.156.126; 567.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: ade928f5-a026-40ba-a031-b0d807911746
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 14 Aug 2025 16:41:09 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.25.5

GET
H2 200 async_usersync Show response
ib.adnxs.com/ Frame 0FC2 0
796 B 220ms
220ms Script
text/html 68.67.160.26
ASN-APPNEX

General

Check archive.org

Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.26 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.25.5 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://acdn.adnxs.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin: 89.238.156.126; 89.238.156.126; 567.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid: 1726df32-1da3-4039-a5f8-f4f5905b4f62
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 14 Aug 2025 16:41:09 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.25.5

GET
H2

200

usync.html Show response
eus.rubiconproject.com/ Frame B396
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=vidazoo&endpoint=us-east
https://eus.rubiconproject.com/usync.html?p=vidazoo&endpoint=us-east

269 B
0

702ms
701ms

Document
text/html

23.200.198.128
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=vidazoo&endpoint=us-east
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/sync/iframe/?cid=&gdpr=0&gdpr_consent=&us_privacy=&coppa=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.200.198.128 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-200-198-128.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) /
Resource Hash: e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer: https://sync.cootlogix.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Thu, 14 Aug 2025 16:41:10 GMT
etag: "10d-629840acea280-gzip"
last-modified: Wed, 18 Dec 2024 04:42:34 GMT
server: Apache/2.4.62 (Debian)
vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Thu, 14 Aug 2025 16:41:08 GMT
location: https://eus.rubiconproject.com/usync.html?p=vidazoo&endpoint=us-east
server: AkamaiGHost

POST 483.json
id5-sync.com/g/v2/ 0
0

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame EB65 0
69 B 1485ms
130ms Script
text/plain 207.65.37.181
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL

https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=85746228&p=0&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

207.65.37.181 , United States, ASN62713 (AS-PUBMATIC, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

date: Thu, 14 Aug 2025 16:41:11 GMT
strict-transport-security: max-age=16070400; includeSubDomains
content-length: 0

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame 6BB7
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=aJ4RpdHM6dAAA3RpAAqsQwAA
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEMl7WqKpGcrgNnq1K-I75Fk&google_cver=1

43 B
761 B

161ms
160ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEMl7WqKpGcrgNnq1K-I75Fk&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=&C=1
Protocol: H3
Server: 104.18.27.193 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TWJvDEbA3Dz3f590ka0OdD2tkRFsnvcZ8WF%2F2Xwd585WpYljl2nxYc4B61dMi3dOXJ8d0wXy0iozLk3M55LXEhPwoCejQrimzCEVGf9OTVsjkGK1fAzV%2F11IgBvSnD4J7ItTwZ4cL882YQ%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Thu, 14 Aug 2025 16:41:10 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 96f1e5f01992b406-YYZ
content-length: 43
server: cloudflare

Redirect headers

cache-control: no-cache, must-revalidate
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEMl7WqKpGcrgNnq1K-I75Fk&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
report-to: {"group":"ad-exchange-cookie-matcher","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/httpsserver2/ad-exchange-cookie-matcher"}]}
content-security-policy-report-only: script-src 'none';form-action 'none';frame-src 'none'; report-uri https://csp.withgoogle.com/csp/httpsserver2/ad-exchange-cookie-matcher
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 314
date: Thu, 14 Aug 2025 16:41:10 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H/1.1

200

dcm
s.amazon-adsystem.com/ Frame 6BB7
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=aJ4RpdHM6dAAA3RpAAqsQwAADjQAAAAB&gpp=&gpp_sid=
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=aJ4RpdHM6dAAA3RpAAqsQwAADjQAAAAB&gpp=&gpp_sid=&dcc=t

43 B
853 B

390ms
148ms

Image
image/gif

98.82.157.137
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=aJ4RpdHM6dAAA3RpAAqsQwAADjQAAAAB&gpp=&gpp_sid=&dcc=t

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=&C=1

Protocol

HTTP/1.1

Server

98.82.157.137 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: PV0RWZETYXT9H3SNZRXN
Content-Length: 43
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Thu, 14 Aug 2025 16:41:14 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

Redirect headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Location: https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=aJ4RpdHM6dAAA3RpAAqsQwAADjQAAAAB&gpp=&gpp_sid=&dcc=t
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: GKK7014KCE4GJDT4JJ6J
Content-Length: 0
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Thu, 14 Aug 2025 16:41:14 GMT
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6BB7
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=aJ4RpdHM6dAAA3RpAAqsQwAADjQAAAAB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEB9zG1B2O...
https://cm.g.doubleclick.net/pixel?gdpr=&gdpr_consent=&google_cver=1&google_gid=CAESEB9zG1B2OwilSSBGe0d2t_4&google_hm=aJ4RpdHM6dAAA3RpAAqsQwAADjQAAAAB&google_nid=index&gpp=&gpp=&gpp_sid=&gpp_sid=

170 B
191 B

132ms
130ms

Image
image/png

142.250.65.194
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?gdpr=&gdpr_consent=&google_cver=1&google_gid=CAESEB9zG1B2OwilSSBGe0d2t_4&google_hm=aJ4RpdHM6dAAA3RpAAqsQwAADjQAAAAB&google_nid=index&gpp=&gpp=&gpp_sid=&gpp_sid=

Requested by

Protocol

Server

142.250.65.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-98-83-226-216.compute-1.amazonaws.com

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
report-to: {"group":"ad-exchange-cookie-matcher","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/httpsserver2/ad-exchange-cookie-matcher"}]}
content-security-policy-report-only: script-src 'none';form-action 'none';frame-src 'none'; report-uri https://csp.withgoogle.com/csp/httpsserver2/ad-exchange-cookie-matcher
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 170
date: Thu, 14 Aug 2025 16:41:10 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BrEq3U2bTfxsNPpqJSEhKBIlotSRfwmY2o2zTl1Vcw85QBB2xDki%2FKenZuS11V4S8nEFteJsplvfDt4OUDx1yUiiIJHMwso%2FenE2aldUX8EerkZ0qNHgXd3Y%2BYXYRfRi9RyKF0Q4UR39jQ%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Thu, 14 Aug 2025 16:41:10 GMT
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
location: https://cm.g.doubleclick.net/pixel?gdpr=&gdpr_consent=&google_cver=1&google_gid=CAESEB9zG1B2OwilSSBGe0d2t_4&google_hm=aJ4RpdHM6dAAA3RpAAqsQwAADjQAAAAB&google_nid=index&gpp=&gpp=&gpp_sid=&gpp_sid=
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 96f1e5ef3c48ab9a-YYZ
content-length: 0
server: cloudflare

GET 31327
i.liadm.com/s/ Frame 6BB7 0
0

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame 6BB7
Redirect Chain

https://beacon.lynx.cognitivlabs.com/ix.gif
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=8&external_user_id=2e23f280-9945-4ab8-9b0a-3a8c2d43bda1&expiration=1786725677

43 B
772 B

185ms
184ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=8&external_user_id=2e23f280-9945-4ab8-9b0a-3a8c2d43bda1&expiration=1786725677
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=&C=1
Protocol: H3
Server: 104.18.27.193 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LGD%2FdUuIEhnrTbU%2BX%2BrInkl5rykBNl1uya%2B335ORkcw5oQNKP%2FlSYAQo%2BkUDr8Q8he9El0MxzuqUTCBotj1wWowrJ%2B%2FZ%2Bk63catzZ5f38QVjy1rj9mtRXSX2CFC1kGaTEo8oDTU7MjayCA%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Thu, 14 Aug 2025 16:41:18 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 96f1e6204966b406-YYZ
content-length: 43
server: cloudflare

Redirect headers

Location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=8&external_user_id=2e23f280-9945-4ab8-9b0a-3a8c2d43bda1&expiration=1786725677
Content-Length: 0
Date: Thu, 14 Aug 2025 16:41:17 GMT
Connection: keep-alive
Server: Kestrel

GET
H2 200 aJ4RpdHM6dAAA3RpAAqsQwAADjQAAAAB
pr-bh.ybp.yahoo.com/sync/casale/ Frame 6BB7 43 B
520 B 511ms
122ms Image
image/gif 98.83.226.216
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/casale/aJ4RpdHM6dAAA3RpAAqsQwAADjQAAAAB?gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

98.83.226.216 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 43
date: Thu, 14 Aug 2025 16:41:10 GMT
content-type: image/gif
server: ATS
x-frame-options: DENY

GET cm
p.rfihub.com/ Frame 6BB7 0
0

GET match
c1.adform.net/serving/cookie/ Frame 6BB7 0
0

GET
H3 200 setuid
prebid.intergient.com/ Frame 6BB7 0
935 B 176ms
173ms Image
text/html 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://prebid.intergient.com/setuid?gpp=&gpp=&bidder=ix&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=b&uid=aJ4RpdHM6dAAA3RpAAqsQwAA%263636
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=&C=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.21.56 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","endpoints":[{"url":"https://nel.heroku.com/reports?s=F1ktIJK1wgOdBGHNRnQVODLpRC0GP%2B%2FgvTkdvybikxo%3D\u0026sid=1b10b0ff-8a76-4548-befa-353fc6c6c045\u0026ts=1755189670"}],"max_age":3600}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 14 Aug 2025 16:41:10 GMT
content-type: text/html
vary: Accept-Encoding, Origin
priority: u=3,i
reporting-endpoints: heroku-nel="https://nel.heroku.com/reports?s=F1ktIJK1wgOdBGHNRnQVODLpRC0GP%2B%2FgvTkdvybikxo%3D&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&ts=1755189670"
cache-control: no-cache, no-store, must-revalidate
nel: {"report_to":"heroku-nel","response_headers":["Via"],"max_age":3600,"success_fraction":0.01,"failure_fraction":0.1}
pragma: no-cache
via: 2.0 heroku-router
cf-ray: 96f1e5ee493aabe5-YYZ
server: cloudflare

GET
H2 200 cm Show response
u.openx.net/w/1.0/ Frame 4D68 199 B
252 B 656ms
118ms Document
text/html 35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://u.openx.net/w/1.0/cm?cc=1&id=4241c706-9fd2-4ae4-b2d7-c9f8d34e773c&ph=f4cc9fb1-057b-4e7a-b393-325ee9109574&gdpr=0&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenx%26userId%3D%7BOPENX_ID%7D%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3D
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/sync/iframe/?cid=&gdpr=0&gdpr_consent=&us_privacy=&coppa=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: de259eb7ba7a0e45575deb33946f1fbc695c97c33145ae4e49af0069d010868e

Request headers

Referer: https://sync.cootlogix.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 199
content-type: text/html
date: Thu, 14 Aug 2025 16:41:10 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 89.238.156.126

GET
H2

200

setuid
prebid.intergient.com/
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dappnexus%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%24UID
https://prebid.intergient.com/setuid?bidder=appnexus&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=1404641057160437695

86 B
850 B

149ms
147ms

Image
image/png

104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://prebid.intergient.com/setuid?bidder=appnexus&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=1404641057160437695
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

reporting-endpoints: heroku-nel="https://nel.heroku.com/reports?s=F1ktIJK1wgOdBGHNRnQVODLpRC0GP%2B%2FgvTkdvybikxo%3D&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&ts=1755189670"
cache-control: no-cache, no-store, must-revalidate
nel: {"report_to":"heroku-nel","response_headers":["Via"],"max_age":3600,"success_fraction":0.01,"failure_fraction":0.1}
content-encoding: br
cf-cache-status: DYNAMIC
pragma: no-cache
report-to: {"group":"heroku-nel","endpoints":[{"url":"https://nel.heroku.com/reports?s=F1ktIJK1wgOdBGHNRnQVODLpRC0GP%2B%2FgvTkdvybikxo%3D\u0026sid=1b10b0ff-8a76-4548-befa-353fc6c6c045\u0026ts=1755189670"}],"max_age":3600}
via: 2.0 heroku-router
cf-ray: 96f1e5f0888339f2-YYZ
expires: 0
alt-svc: h3=":443"; ma=86400
date: Thu, 14 Aug 2025 16:41:10 GMT
content-type: image/png
vary: Accept-Encoding, Origin
server: cloudflare

Redirect headers

cache-control: no-store, no-cache, private
location: https://prebid.intergient.com/setuid?bidder=appnexus&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=1404641057160437695
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 89.238.156.126; 89.238.156.126; 634.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: a533637b-54b4-47ce-9a2a-cda5f1442bbb
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 14 Aug 2025 16:41:10 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.25.5

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9A85 0
0 141ms
137ms Fetch
image/gif 142.250.80.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=fle-fetch-start2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://459b190c75fc3706badce91489ac4d5d.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 14 Aug 2025 16:41:10 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9A85 0
0 132ms
131ms Fetch
image/gif 142.250.80.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://459b190c75fc3706badce91489ac4d5d.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 14 Aug 2025 16:41:10 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
DATA 200
OK truncated
/ Frame 9A85 216 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ef68a461dbf65df4b5127798a707d3760caeb35797a7e1e08bffd13784ec7c6b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9A85 0
0 130ms
129ms Fetch
image/gif 142.250.80.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://459b190c75fc3706badce91489ac4d5d.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 14 Aug 2025 16:41:10 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 usync.js Show response
eus.rubiconproject.com/ Frame BBCD 45 KB
11 KB 257ms
257ms Script
text/html 23.200.198.128
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=vidazoo&endpoint=us-east
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.200.198.128 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-200-198-128.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) / PHP/8.3.13
Resource Hash: f7ed71321130d801efc364af8374857d86a9c55c8601828f1f4b151d33eb1722

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/usync.html?p=vidazoo&endpoint=us-east

Response headers

cache-control: max-age=12074
content-encoding: gzip
expires: Thu, 14 Aug 2025 20:02:24 GMT
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
content-length: 11507
date: Thu, 14 Aug 2025 16:41:10 GMT
last-modified: Wed, 13 Aug 2025 20:02:24 GMT
x-powered-by: PHP/8.3.13
server: Apache/2.4.62 (Debian)
content-type: text/html;charset=UTF-8
vary: Accept-Encoding

GET
H2 200 usync.js Show response
eus.rubiconproject.com/ Frame C519 45 KB
0 246ms
246ms Script
text/html 23.200.198.128
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=12776
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.200.198.128 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-200-198-128.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) / PHP/8.3.13
Resource Hash: f7ed71321130d801efc364af8374857d86a9c55c8601828f1f4b151d33eb1722

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/usync.html?p=12776

Response headers

cache-control: max-age=12074
content-encoding: gzip
expires: Thu, 14 Aug 2025 20:02:24 GMT
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
content-length: 11507
date: Thu, 14 Aug 2025 16:41:10 GMT
last-modified: Wed, 13 Aug 2025 20:02:24 GMT
x-powered-by: PHP/8.3.13
server: Apache/2.4.62 (Debian)
content-type: text/html;charset=UTF-8
vary: Accept-Encoding

GET
H2 200 usync.js Show response
eus.rubiconproject.com/ Frame C075 45 KB
0 234ms
234ms Script
text/html 23.200.198.128
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.200.198.128 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-200-198-128.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) / PHP/8.3.13
Resource Hash: f7ed71321130d801efc364af8374857d86a9c55c8601828f1f4b151d33eb1722

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/usync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=

Response headers

cache-control: max-age=12074
content-encoding: gzip
expires: Thu, 14 Aug 2025 20:02:24 GMT
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
content-length: 11507
date: Thu, 14 Aug 2025 16:41:10 GMT
last-modified: Wed, 13 Aug 2025 20:02:24 GMT
x-powered-by: PHP/8.3.13
server: Apache/2.4.62 (Debian)
content-type: text/html;charset=UTF-8
vary: Accept-Encoding

GET
H2 200 usync.js Show response
eus.rubiconproject.com/ Frame B396 45 KB
0 223ms
222ms Script
text/html 23.200.198.128
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=vidazoo&endpoint=us-east
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.200.198.128 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-200-198-128.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) / PHP/8.3.13
Resource Hash: f7ed71321130d801efc364af8374857d86a9c55c8601828f1f4b151d33eb1722

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/usync.html?p=vidazoo&endpoint=us-east

Response headers

cache-control: max-age=12074
content-encoding: gzip
expires: Thu, 14 Aug 2025 20:02:24 GMT
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
content-length: 11507
date: Thu, 14 Aug 2025 16:41:10 GMT
last-modified: Wed, 13 Aug 2025 20:02:24 GMT
x-powered-by: PHP/8.3.13
server: Apache/2.4.62 (Debian)
content-type: text/html;charset=UTF-8
vary: Accept-Encoding

GET
H2 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 0DD1 38 KB
13 KB 127ms
125ms Document
text/html 142.251.40.225
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://459b190c75fc3706badce91489ac4d5d.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 57
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 14 Aug 2025 16:40:13 GMT
expires: Thu, 14 Aug 2025 17:30:13 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 usersync.html Show response
cdn.undertone.com/js/ Frame 0F34 13 KB
4 KB 3663ms
213ms Document
text/html 18.238.49.48
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.undertone.com/js/usersync.html?partnerid=59&gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dundertonenew%26userId%3D%24%7BUIDENC%7D%26gdpr%3D%24%7Bgdpr%7D%26gdpr_consent%3D%24%7Bgdpr_consent%7D%26us_privacy%3D%24%7Bus_privacy%7D
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/sync/iframe/?cid=&gdpr=0&gdpr_consent=&us_privacy=&coppa=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.238.49.48 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-238-49-48.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 09243d4b2e2c60a9c68fdb114caea8f64f74d231b9d1162a23555d9227cc4692

Request headers

Referer: https://sync.cootlogix.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

age: 32700
content-encoding: gzip
content-type: text/html
date: Thu, 14 Aug 2025 07:36:15 GMT
etag: W/"3af44066cfecd60369001ebdc2bd7e99"
last-modified: Sun, 02 Feb 2025 17:23:12 GMT
server: AmazonS3
vary: accept-encoding
via: 1.1 ff278a71a35448622a3b931c58f6a0ae.cloudfront.net (CloudFront)
x-amz-cf-id: BilRzvcblZChhJp7Y-eeVMaxTbcuQPd3W7DVEpjeVkaU3l-U-h3vxQ==
x-amz-cf-pop: JFK52-P3
x-amz-replication-status: COMPLETED
x-amz-server-side-encryption: AES256
x-amz-version-id: NqL_IFt0LsBFvwomCEjhjZem3vPHN2RJ
x-cache: Hit from cloudfront

GET
H2 200 cm Show response
u.openx.net/w/1.0/ Frame 6A48 199 B
252 B 121ms
120ms Document
text/html 35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.ae6790c95efdb5dcce9e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: de259eb7ba7a0e45575deb33946f1fbc695c97c33145ae4e49af0069d010868e

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 199
content-type: text/html
date: Thu, 14 Aug 2025 16:41:10 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 89.238.156.126

GET
H/1.1 200
OK pixel Show response
ps.eyeota.net/ 1 KB
2 KB 396ms
395ms Script
application/javascript 44.205.65.132
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://ps.eyeota.net/pixel?e_rc=1&pid=m51mh00&t=ajs&uid=user_a79bdf49-d4be-40f1-bd06-450a96e62d46_1755189664469
Requested by: Host: ps.eyeota.net
URL: https://ps.eyeota.net/pixel?pid=m51mh00&t=ajs&uid=user_a79bdf49-d4be-40f1-bd06-450a96e62d46_1755189664469
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 44.205.65.132 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-205-65-132.compute-1.amazonaws.com
Software: /
Resource Hash: 16678f07dc3b2dc9964da992e300a2b7355bf8c8104c3cd7a3da2b03b9671d8e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 1280
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 14 Aug 2025 16:41:10 GMT
Content-Type: application/javascript

POST
H2 200 fb87a4ea41 Show response
cd836371f1d.cdn.intergient.com/ 0
95 B 134ms
131ms XHR
application/octet-stream 54.81.166.120
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://cd836371f1d.cdn.intergient.com/fb87a4ea41
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250811.1/main.9b44c978684fc999f334.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.81.166.120 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-81-166-120.compute-1.amazonaws.com
Software: nginx/1.24.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

access-control-allow-origin: *
date: Thu, 14 Aug 2025 16:41:10 GMT
content-type: application/octet-stream
server: nginx/1.24.0

GET
H2 200 pbs-iframe Show response
pbs-cs.yellowblue.io/ Frame 747B 4 KB
4 KB 485ms
141ms Document
text/html 35.212.27.211
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.ae6790c95efdb5dcce9e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.212.27.211 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.27.212.35.bc.googleusercontent.com
Software: istio-envoy /
Resource Hash: 54ead0610ac64946787c87d8fabe202e774186b73a4b1bf7df2381a5f56c4ade

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://paint.toys/
access-control-expose-headers: X-Reason
content-type: text/html
date: Thu, 14 Aug 2025 16:41:11 GMT
server: istio-envoy
via: 1.1 google
x-envoy-upstream-service-time: 4

GET
H3 200 OlbC2D9p8E9MekCHL2foZW6_qh6hptBFqYjdgIzTkQI.js Show response
pagead2.googlesyndication.com/bg/ Frame 0DD1 54 KB
21 KB 135ms
135ms Script
text/javascript 142.250.80.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/OlbC2D9p8E9MekCHL2foZW6_qh6hptBFqYjdgIzTkQI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-3-215-125-234.compute-1.amazonaws.com

Software

sffe /

Resource Hash

3a56c2d83f69f04f4c7a40872f67e8656ebfaa1ea1a6d045a988dd808cd39102

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://tpc.googlesyndication.com/

Response headers

content-encoding: br
age: 71212
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
x-content-type-options: nosniff
expires: Thu, 13 Aug 2026 20:54:18 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 13 Aug 2025 20:54:18 GMT
last-modified: Mon, 11 Aug 2025 19:18:00 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=31536000
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
accept-ranges: bytes
content-length: 21076
x-xss-protection: 0
server: sffe

GET
H2

200

lons7jax
sync-tm.everesttech.net/ct/upi/pid/
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/lons7jax?redir=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fuid%3D%24%7BTM_USER_ID%7D%26bid%3D0rijhbu%26referrer_pid%3Dm51mh00
https://sync-tm.everesttech.net/ct/upi/pid/lons7jax?redir=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fuid%3D%24%7BTM_USER_ID%7D%26bid%3D0rijhbu%26referrer_pid%3Dm51mh00&_test=aJ4RrgAAAielFABN

85 B
169 B

119ms
117ms

Image
image/png

151.101.66.49
FASTLY

General

Check archive.org

Download Go to Show image

Full URL: https://sync-tm.everesttech.net/ct/upi/pid/lons7jax?redir=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fuid%3D%24%7BTM_USER_ID%7D%26bid%3D0rijhbu%26referrer_pid%3Dm51mh00&_test=aJ4RrgAAAielFABN
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 151.101.66.49 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-robots-tag: noindex
cache-control: no-cache
x-timer: S1755189679.917566,VS0,VE0
age: 18
pragma: no-cache
via: 1.1 varnish
accept-ranges: bytes
x-cache: HIT
content-length: 85
date: Thu, 14 Aug 2025 16:41:18 GMT
content-type: image/png
x-served-by: cache-yul1970044-YUL
server: Jetty(9.4.35.v20201120)
x-cache-hits: 34

Redirect headers

x-robots-tag: noindex
cache-control: no-cache
location: https://sync-tm.everesttech.net/ct/upi/pid/lons7jax?redir=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fuid%3D%24%7BTM_USER_ID%7D%26bid%3D0rijhbu%26referrer_pid%3Dm51mh00&_test=aJ4RrgAAAielFABN
x-timer: S1755189679.756421,VS0,VE28
pragma: no-cache
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
content-length: 0
date: Thu, 14 Aug 2025 16:41:18 GMT
x-served-by: cache-yul1970044-YUL
server: Jetty(9.4.35.v20201120)
x-cache-hits: 0

GET
H/1.1

200
OK

59742
i6.liadm.com/s/
Redirect Chain

https://i.liadm.com/s/59742?bidder_id=220889&bidder_uuid=2dCwxLn1gO33Pxce2ph7pr-atfnxFxh7wRW89W6MHYg4
https://i6.liadm.com/s/59742?bidder_id=220889&bidder_uuid=2dCwxLn1gO33Pxce2ph7pr-atfnxFxh7wRW89W6MHYg4

43 B
302 B

1542ms
130ms

Image
image/gif

3.215.125.234
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://i6.liadm.com/s/59742?bidder_id=220889&bidder_uuid=2dCwxLn1gO33Pxce2ph7pr-atfnxFxh7wRW89W6MHYg4

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

HTTP/1.1

Server

3.215.125.234 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Cache-Control: no-store
trace-id: 25cda6e064f310df
Request-Time: 0
Connection: keep-alive
Content-Length: 43
Date: Thu, 14 Aug 2025 16:41:13 GMT
Content-Type: image/gif

Redirect headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Location: https://i6.liadm.com/s/59742?bidder_id=220889&bidder_uuid=2dCwxLn1gO33Pxce2ph7pr-atfnxFxh7wRW89W6MHYg4
Content-Length: 0
Date: Thu, 14 Aug 2025 16:41:11 GMT
trace-id: c64579074ad29772
Request-Time: 2
Connection: keep-alive

GET 423476.gif
idsync.rlcdn.com/ 0
0

GET pushpull
ws.rqtrk.eu/ 0
0

GET sync
sync.srv.stackadapt.com/ 0
0

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 0991
Redirect Chain

https://sync.adtelligent.com/csync?redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Daudienceconnect%26userId%3D%7Buid%7D
https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=fe5b773ab1ad2e72

43 B
496 B

138ms
137ms

Image
image/avif

157.230.83.84
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=fe5b773ab1ad2e72
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/sync/iframe/?cid=&gdpr=0&gdpr_consent=&us_privacy=&coppa=0
Protocol: H2
Server: 157.230.83.84 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 14 Aug 2025 16:41:11 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

Location: https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=fe5b773ab1ad2e72
Content-Length: 0
Date: Thu, 14 Aug 2025 16:41:11 GMT
Etag: fe5b773ab1ad2e72
Server: Adtelligent

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0DD1 0
20 B 144ms
143ms Image
image/gif 142.250.80.34
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=Bi1YpoxGeaPm3Kb6Mrr4PvI-3uQ8AAAAAOAHgBAI&bg=!YmGlYS7NAAZ_cPrpX3A7ADQBe5WfOA8zVaDhMK9vOOwq4H2lXxQQm8E85F2hzUd8tgjjSpqTZq7Bex2hworKm_S0CclUAgAAAHRSAAAACGgBB34ANVUZeBvZeq2BgR_0_sce5Y05pYaGhUVBNLZH9Y0AjkWulIyHdTralNiI7Is-oldpkIVZDZ2pCgCCQjTP8JOFfMHnXC-KdNBVzrdDURite6lximBCiBBlGXF31LZCC_DIVzsWGO0L66Bs-uY5Ams6aGtYa0b2N4JLwFTGRka0cAKoDb4-Uge5_AsI1Xylr73oMkPVDxxpGpGhtr-haPHSlOxqtinkojxTG5tlzeNO-1U1VZNk5Dwp0RVgLpkCoEpAa-DjR2_K7yQzdaa6gTVCfZzr3cRc83-TlcgjOhF8wPd_wxeoFbdS9LiPdqwQp-2qbJT7r-uXihK1ixAFk_Jmt6mwmsbGIQOPKUl2mXat7s610-zRdz_ITujTAUkbRPCYPaXgXxNnN_FOgchZ1JcEILPBEQc2mAog8G8zJFc9ySC6MYkGxnzhFQw4b-kW3xl7wCDr5lantFwcsS_YYsXZHh5n5Nwv9feRTBmPFk3atGDhFoWe5J6boSuct3JHboxeWvvAZLJsO0CmbYKIQELl8qBpyxAncBtYH2cGzjCi-Zybu2wpkubVLyLFVh4qEHFFPTaKaKP0bgt7sgNKdi2PHutykzMiwCuERfk0EUKPR9GHQNjhr7RmCwO3P5Hhc7VHlq3QAkfcvTiQPELqnifwVToXakF8Eqth6guaO4tp1mxKnZWscLIbz7B8vogSaxniBeppM3KE1mTOcFFeX3_SvA3E4R_YVQKFedg8Dj4ZWlzemiTsTisnpSfi8ZfAc8_92yjXOHAVro5LYNrG9cEvKYfQ_eCEfPOtVXrYeKWwFvaZAyiwOdf-B6NkzAyKGsTkvkS5kKfm2uKUUWpapwnxW4aPq5FHxcSuaj_89WZMdOLWjKeWPrHoH8PgAutgCFGQrP6rkBTOobdGGelZuXw_mz2I6gqMZjRXJFVO0R-I9RM58-EVTYg5DbbkyJoHiZUi4bfUmpOA3kJGFEFZiA4Vfae_M6bGbu2uSmlqkPG_O31s_APU1UskWoXnHt6sadR_k4GqNFnP7uP0L16rucajCRWyH5lAXqdpIBEKuZzvy8KXhy8iUjAjpt7ypq4tdluX4zic3tza_AintqiwckGN_BXNSv6pkDHnePLXCkf3nD-bxpm6rMiyFLsn2ns4Hw

Requested by

Host: 459b190c75fc3706badce91489ac4d5d.safeframe.googlesyndication.com
URL: https://459b190c75fc3706badce91489ac4d5d.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-3-81-30-180.compute-1.amazonaws.com

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://tpc.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 14 Aug 2025 16:41:11 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame B396 7 B
2 KB 692ms
140ms XHR
application/json 69.173.151.100
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Cache-Control: no-cache,no-store,must-revalidate
Pragma: no-cache
access-control-allow-credentials: true
Expires: 0
access-control-allow-origin: https://eus.rubiconproject.com
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: c1df09169f58a071f2a391dff1b3307b
content-length: 7
content-type: application/json; charset=UTF-8

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame BBCD 7 B
2 KB 828ms
135ms XHR
application/json 69.173.151.100
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Cache-Control: no-cache,no-store,must-revalidate
Pragma: no-cache
access-control-allow-credentials: true
Expires: 0
access-control-allow-origin: https://eus.rubiconproject.com
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 78008fe701b681dce86a72fc23cacc40
content-length: 7
content-type: application/json; charset=UTF-8

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame C075 7 B
2 KB 973ms
147ms XHR
application/json 69.173.151.100
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Cache-Control: no-cache,no-store,must-revalidate
Pragma: no-cache
access-control-allow-credentials: true
Expires: 0
access-control-allow-origin: https://eus.rubiconproject.com
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 0228ab361cece0438ff9eb16e4e5890e
content-length: 7
content-type: application/json; charset=UTF-8

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame C519 7 B
2 KB 1106ms
133ms XHR
application/json 69.173.151.100
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Cache-Control: no-cache,no-store,must-revalidate
Pragma: no-cache
access-control-allow-credentials: true
Expires: 0
access-control-allow-origin: https://eus.rubiconproject.com
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: ffef7c53154b04a892ce1f9531c32cb1
content-length: 7
content-type: application/json; charset=UTF-8

GET
H2

200

sync
odr.mookie1.com/t/v2/ Frame 747B
Redirect Chain

https://ssp-sync.criteo.com/user-sync/redirect?gdpr=0&gdpr_consent=&profile=342&redir=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11614%26id%3D%24%7BCRITEO_USER_ID%7D
https://x.bidswitch.net/sync?ssp=criteo&custom_data=PgpAXl9HZkNWd1RZVjcwc2olMkJwWkpoWmlkM3RJM2s4biUyRkFuOGZHMFpDcHl0dno2QmN6TlNGQ1N5QldWQXRGNGhpeFUlMkZvJTJCN2JiVGdrQmlJZXNDbFAlMkYlMkJEdE5hYXpQRW1SV...
https://x.bidswitch.net/ul_cb/sync?ssp=criteo&custom_data=PgpAXl9HZkNWd1RZVjcwc2olMkJwWkpoWmlkM3RJM2s4biUyRkFuOGZHMFpDcHl0dno2QmN6TlNGQ1N5QldWQXRGNGhpeFUlMkZvJTJCN2JiVGdrQmlJZXNDbFAlMkYlMkJEdE5hYXp...
https://odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=6fc985bd-ce5a-4ae9-8754-a8a2309e397c&ssp=criteo&gdpr=0&gdpr_consent=

43 B
631 B

7618ms
225ms

Image
image/gif

35.190.90.30
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=6fc985bd-ce5a-4ae9-8754-a8a2309e397c&ssp=criteo&gdpr=0&gdpr_consent=
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 35.190.90.30 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 30.90.190.35.bc.googleusercontent.com
Software: Apache /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 google
expires: Thu, 01 Jan 1970 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-application-context: application
p3p: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
date: Thu, 14 Aug 2025 16:41:24 GMT
content-length: 43
content-type: image/gif;charset=UTF-8
server: Apache

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: //odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=6fc985bd-ce5a-4ae9-8754-a8a2309e397c&ssp=criteo&gdpr=0&gdpr_consent=
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 14 Aug 2025 16:41:16 GMT

GET
H2

200

cs
cs.yellowblue.io/ Frame 747B
Redirect Chain

https://sync.inmobi.com/oRTB?gdpr=0&gdpr_consent=&redirect=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11595%26id%3D%7BID5UID%7D
https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11595%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=0&us_privacy=&gdpr_pd=&source=5&google_push=&retry=
https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11595%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=0&us_privacy=&gdpr_pd=&source=5&google_push=&retry=true
https://cs.yellowblue.io/cs?fwrd=1&aid=11595&id=ID5-5-9fe49c44-12bf-4ab1-9ed8-a4a197fdb7e9

0
47 B

148ms
147ms

Image
application/javascript

35.212.27.211
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=11595&id=ID5-5-9fe49c44-12bf-4ab1-9ed8-a4a197fdb7e9
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 35.212.27.211 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.27.212.35.bc.googleusercontent.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
via: 1.1 google
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Thu, 14 Aug 2025 16:41:12 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

via: 1.1 google
location: https://cs.yellowblue.io/cs?fwrd=1&aid=11595&id=ID5-5-9fe49c44-12bf-4ab1-9ed8-a4a197fdb7e9
content-length: 0
date: Thu, 14 Aug 2025 16:41:11 GMT
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers

GET
H2

200

cs
cs.yellowblue.io/ Frame 747B
Redirect Chain

https://s.ad.smaato.net/c/?adExInit=rise&gdpr=%5BGDPR%5D&gdpr_consent=%5BUSER_CONSENT%5D&redir=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11574%26id%3D%24UID
https://cs.yellowblue.io/cs?fwrd=1&aid=11574&id=69a2810017

0
24 B

133ms
132ms

Image
application/javascript

35.212.27.211
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=11574&id=69a2810017
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 35.212.27.211 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.27.212.35.bc.googleusercontent.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
via: 1.1 google
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Thu, 14 Aug 2025 16:41:11 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

via: 1.1 google
cache-control: no-cache, must-revalidate
location: https://cs.yellowblue.io/cs?fwrd=1&aid=11574&id=69a2810017
content-length: 5
date: Thu, 14 Aug 2025 16:41:11 GMT
content-type: text/plain; charset=utf-8

GET rtset
bh.contextweb.com/bh/ Frame 747B 0
0

GET
H2

200

cs
cs.yellowblue.io/ Frame 747B
Redirect Chain

https://match.sharethrough.com/universal/v1?gdpr=0&gdpr_consent=&supply_id=5926d422
https://cs.yellowblue.io/cs?aid=11587&uid=b2f2b5a4-a547-4084-98e0-c6c4d282b087&gdpr=0

0
47 B

141ms
140ms

Image
application/javascript

35.212.27.211
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?aid=11587&uid=b2f2b5a4-a547-4084-98e0-c6c4d282b087&gdpr=0
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 35.212.27.211 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.27.212.35.bc.googleusercontent.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
via: 1.1 google
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Thu, 14 Aug 2025 16:41:22 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
location: https://cs.yellowblue.io/cs?aid=11587&uid=b2f2b5a4-a547-4084-98e0-c6c4d282b087&gdpr=0
content-length: 0

GET
H2

200

cs
cs.yellowblue.io/ Frame 747B
Redirect Chain

https://ads.stickyadstv.com/user-matching?gdpr=0&gdpr_consent=&id=3663
https://cs.yellowblue.io/cs?aid=11601&id=1ce5fcee3dc79b215d6f9a63608e0&gdpr_consent=&gdpr=0

0
66 B

164ms
159ms

Image
application/javascript

35.212.27.211
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?aid=11601&id=1ce5fcee3dc79b215d6f9a63608e0&gdpr_consent=&gdpr=0
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 35.212.27.211 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.27.212.35.bc.googleusercontent.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
via: 1.1 google
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Thu, 14 Aug 2025 16:41:11 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

Cache-Control: no-cache
Location: https://cs.yellowblue.io/cs?aid=11601&id=1ce5fcee3dc79b215d6f9a63608e0&gdpr_consent=&gdpr=0
Pragma: no-cache
x-sticky-vk: 1755189671469028-1158
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Content-Length: 0
Date: Thu, 14 Aug 2025 16:41:11 GMT
Server: nginx

GET us
sync.go.sonobi.com/ Frame 747B 0
0

GET cm-notify
creativecdn.com/ Frame 747B 0
0

GET
H2

200

cs
cs.yellowblue.io/ Frame 747B
Redirect Chain

https://x.bidswitch.net/check_uuid/https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Faid%3D11603%26gdpr%3D%5BGDPR%5D%26gdpr_consent%3D%5BUSER_CONSENT%5D%26uid%3D$%7BBSW_UUID%7D
https://x.bidswitch.net/ul_cb/check_uuid/https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Faid%3D11603%26gdpr%3D%5BGDPR%5D%26gdpr_consent%3D%5BUSER_CONSENT%5D%26uid%3D$%7BBSW_UUID%7D
https://cs.yellowblue.io/cs?aid=11603&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&uid=6fc985bd-ce5a-4ae9-8754-a8a2309e397c

0
47 B

140ms
139ms

Image
application/javascript

35.212.27.211
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?aid=11603&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&uid=6fc985bd-ce5a-4ae9-8754-a8a2309e397c
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 35.212.27.211 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.27.212.35.bc.googleusercontent.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
via: 1.1 google
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Thu, 14 Aug 2025 16:41:17 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: https://cs.yellowblue.io/cs?aid=11603&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&uid=6fc985bd-ce5a-4ae9-8754-a8a2309e397c
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 14 Aug 2025 16:41:17 GMT

GET /
csync.loopme.me/ Frame 747B 0
0

GET
H2 200 cm
us-u.openx.net/w/1.0/ Frame 747B 43 B
107 B 129ms
108ms Image
image/gif 35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/cm?gdpr=0&gdpr_consent=&id=58ceaaf5-c766-4c17-869a-d76e43401714&r=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11563%26id%3D
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 89.238.156.126
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 14 Aug 2025 16:41:11 GMT
content-type: image/gif
vary: Accept, Accept-Encoding

GET
H2

200

cs
cs.yellowblue.io/ Frame 747B
Redirect Chain

https://secure.adnxs.com/getuid?https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11596%26id%3D%24UID&gdpr=0&gdpr_consent=
https://cs.yellowblue.io/cs?fwrd=1&aid=11596&id=1404641057160437695&gdpr=0&gdpr_consent=

0
24 B

163ms
158ms

Image
application/javascript

35.212.27.211
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=11596&id=1404641057160437695&gdpr=0&gdpr_consent=
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 35.212.27.211 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.27.212.35.bc.googleusercontent.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
via: 1.1 google
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Thu, 14 Aug 2025 16:41:11 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

cache-control: no-store, no-cache, private
location: https://cs.yellowblue.io/cs?fwrd=1&aid=11596&id=1404641057160437695&gdpr=0&gdpr_consent=
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 89.238.156.126; 89.238.156.126; 567.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: d9ab103e-5d32-441a-9cd1-c5388c613196
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 14 Aug 2025 16:41:11 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.25.5

GET
H2 200 ImgSync
image8.pubmatic.com/AdServer/ Frame 747B 0
69 B 533ms
143ms Image
text/plain 8.28.7.82
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL

https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr=0&gdpr_consent=&gdpr_consent=&p=160295&pu=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11576%26id%3D%23PMUID

Requested by

Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

8.28.7.82 , United States, ASN62713 (AS-PUBMATIC, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

date: Thu, 14 Aug 2025 16:41:12 GMT
strict-transport-security: max-age=16070400; includeSubDomains
content-length: 0

GET
H2

200

cs
cs.yellowblue.io/ Frame 747B
Redirect Chain

https://sync.adkernel.com/user-sync?gdpr=0&gdpr_consent=&r=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11615%26id%3D%7BUID%7D&t=image&zone=267896
https://visitor-waardex.omnitagjs.com/visitor/bsync?uid=f9f79c63be893b97a3364690a09d0b8d&name=WAARDEX_SSP&url=https%3A%2F%2Fsync.adkernel.com%2Fuser-sync%3Fzone%3D267896%26dsp%3D688143%26t%3Dimage%...
https://sync.adkernel.com/user-sync?zone=267896&dsp=688143&t=image&uid=PARTNER_USER_ID
https://cs.yellowblue.io/cs?fwrd=1&aid=11615&id=A1758901828115850574

0
24 B

530ms
529ms

Image
application/javascript

35.212.27.211
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=11615&id=A1758901828115850574
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 35.212.27.211 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.27.212.35.bc.googleusercontent.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
via: 1.1 google
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Thu, 14 Aug 2025 16:41:13 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

Cache-Control: no-store
Location: https://cs.yellowblue.io/cs?fwrd=1&aid=11615&id=A1758901828115850574
Content-Length: 0
Date: Thu, 14 Aug 2025 16:41:13 GMT
Server: nginx
Connection: keep-alive

GET
H2

200

cs
cs.yellowblue.io/ Frame 747B
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?gdpr=%5BGDPR%5D&gdpr_consent=%5BUSER_CONSENT%5D&sub=typeaholdings
https://cs.yellowblue.io/cs?aid=11599&id=OPTOUT

0
47 B

146ms
146ms

Image
application/javascript

35.212.27.211
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?aid=11599&id=OPTOUT
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 35.212.27.211 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.27.212.35.bc.googleusercontent.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
via: 1.1 google
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Thu, 14 Aug 2025 16:41:15 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

expires: 0
cache-control: no-store, no-cache, must-revalidate
location: https://cs.yellowblue.io/cs?aid=11599&id=OPTOUT
date: Thu, 14 Aug 2025 16:41:15 GMT
pragma: no-cache
content-type: text/html
etag: OPTOUT

GET
H2

200

cs
cs.yellowblue.io/ Frame 747B
Redirect Chain

https://contextual.media.net/cksync.php?cs=25&gdpr=0&gdpr_consent=&ovsid=%7B%7BAPID%7D%7D&redirect=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11585%26id%3D%3Cvsid%3E&type=ris
https://cs.yellowblue.io/cs?fwrd=1&aid=11585&id=3981912722672039000V10

0
50 B

166ms
148ms

Image
application/javascript

35.212.27.211
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=11585&id=3981912722672039000V10
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 35.212.27.211 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.27.212.35.bc.googleusercontent.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
via: 1.1 google
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Thu, 14 Aug 2025 16:41:13 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

strict-transport-security: max-age=31536000
cache-control: max-age=0, no-cache, no-store
location: https://cs.yellowblue.io/cs?fwrd=1&aid=11585&id=3981912722672039000V10
content-encoding: gzip
pragma: no-cache
timing-allow-origin: *
expires: Thu, 14 Aug 2025 16:41:12 GMT
alt-svc: h3=":443"; ma=93600
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA"
date: Thu, 14 Aug 2025 16:41:12 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding

GET
H3 200 setuid
prebid.intergient.com/ Frame 747B 0
1 KB 160ms
150ms Image
text/html 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://prebid.intergient.com/setuid?bidder=rise&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=b&uid=WEt5he_rk
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.21.56 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","endpoints":[{"url":"https://nel.heroku.com/reports?s=Y8tK7SYv1LnHRKwUzosXKKeNeayt7YKltmjnFnCgX%2B0%3D\u0026sid=1b10b0ff-8a76-4548-befa-353fc6c6c045\u0026ts=1755189671"}],"max_age":3600}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 14 Aug 2025 16:41:11 GMT
content-type: text/html
vary: Accept-Encoding, Origin
priority: u=3,i
reporting-endpoints: heroku-nel="https://nel.heroku.com/reports?s=Y8tK7SYv1LnHRKwUzosXKKeNeayt7YKltmjnFnCgX%2B0%3D&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&ts=1755189671"
cache-control: no-cache, no-store, must-revalidate
nel: {"report_to":"heroku-nel","response_headers":["Via"],"max_age":3600,"success_fraction":0.01,"failure_fraction":0.1}
pragma: no-cache
via: 2.0 heroku-router
cf-ray: 96f1e5f6c995abe5-YYZ
server: cloudflare

GET
H2

200

cs Show response
cs.yellowblue.io/ Frame 042C
Redirect Chain

https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11607%26uid%3D%24UID
https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11607%26uid%3D%24UID&sovrn_retry=true
https://cs.yellowblue.io/cs?fwrd=1&aid=11607&uid=LKnpALZH_XisoHP6S-aQYhai

0
24 B

146ms
145ms

Document
application/javascript

35.212.27.211
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=11607&uid=LKnpALZH_XisoHP6S-aQYhai
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.212.27.211 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.27.212.35.bc.googleusercontent.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://pbs-cs.yellowblue.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
access-control-expose-headers: X-Reason
content-length: 0
content-type: application/javascript
date: Thu, 14 Aug 2025 16:41:13 GMT
server: istio-envoy
via: 1.1 google
x-envoy-upstream-service-time: 0

Redirect headers

access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With, Content-Type
access-control-allow-methods: GET, POST, DELETE, PUT
access-control-allow-origin: *
content-length: 0
date: Thu, 14 Aug 2025 16:41:13 GMT
location: https://cs.yellowblue.io/cs?fwrd=1&aid=11607&uid=LKnpALZH_XisoHP6S-aQYhai
vary: Accept-Encoding

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame B01A 2 KB
881 B 4136ms
374ms Document
text/html 51.222.239.230
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://onetag-sys.com/usync/?gdpr=0&gdpr_consent=&pubId=69f48c2160c8113

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.239.230 , Canada, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ip230.ip-51-222-239.net

Software

Resource Hash

d6b9ac8ccff69f2de32254b96a2bb180535f809c2d8059d40be5844a8cbad026

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://pbs-cs.yellowblue.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
cache-control: no-transform, no-cache
content-encoding: br
content-length: 750
content-type: text/html
strict-transport-security: max-age=15552000

GET
H2

200

usync.html Show response
eus.rubiconproject.com/ Frame FEB9
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?endpoint=us-east&p=rise_engage
https://eus.rubiconproject.com/usync.html?endpoint=us-east&p=rise_engage

269 B
379 B

520ms
519ms

Document
text/html

23.200.198.128
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?endpoint=us-east&p=rise_engage
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.200.198.128 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-200-198-128.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) /
Resource Hash: e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer: https://pbs-cs.yellowblue.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Thu, 14 Aug 2025 16:41:12 GMT
etag: "10d-629840acea280-gzip"
last-modified: Wed, 18 Dec 2024 04:42:34 GMT
server: Apache/2.4.62 (Debian)
vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Thu, 14 Aug 2025 16:41:11 GMT
location: https://eus.rubiconproject.com/usync.html?endpoint=us-east&p=rise_engage
server: AkamaiGHost

GET userIframe
measureadv.com/ Frame 0258 0
0

GET
H2

200

cs Show response
cs.yellowblue.io/ Frame 2861
Redirect Chain

https://ssp.disqus.com/redirectuser?consent_string=&gdpr=0&r=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11612%26id%3D%24UID&sid=716
https://sync.adkernel.com/user-sync?zone=176971&t=image&gdpr=0&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fssp.disqus.com%2Fmatch%3Fbidder%3D27%26buyeruid%3D%7BUID%7D%26r%3DCid1YS04ZDE0MzdiNy1lZGEzLT...
https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=null&redir=https%3A%2F%2Fsync.adkernel.com%2Fuser-sync%3Fzone%3D176971%26dsp%3D763610%26t%3Dimage%26uid%3D%24UID
https://sync.adkernel.com/user-sync?zone=176971&dsp=763610&t=image&uid=LKnpALZH_XisoHP6S-aQYhai
https://ssp.disqus.com/match?bidder=27&buyeruid=A1758901828115850574&r=Cid1YS04ZDE0MzdiNy1lZGEzLTM5YjItYjY4NC1iZDdiMTU0YmU5N2IqV2h0dHBzOi8vY3MueWVsbG93Ymx1ZS5pby9jcz9md3JkPTEmYWlkPTExNjEyJmlkPXVhLT...
https://sync.1rx.io/usersync2/rmpssp?sub=zeta&gdpr=0&gdpr_consent=&us_privacy=&redir=https%3A%2F%2Fssp.disqus.com%2Fmatch%3Fbidder%3D37%26buyeruid%3D%5BRX_UUID%5D%26r%3DCid1YS04ZDE0MzdiNy1lZGEzLTM5...
https://ssp.disqus.com/match?bidder=37&buyeruid=OPTOUT&r=Cid1YS04ZDE0MzdiNy1lZGEzLTM5YjItYjY4NC1iZDdiMTU0YmU5N2IqV2h0dHBzOi8vY3MueWVsbG93Ymx1ZS5pby9jcz9md3JkPTEmYWlkPTExNjEyJmlkPXVhLThkMTQzN2I3LWVk...
https://cs.yellowblue.io/cs?fwrd=1&aid=11612&id=ua-8d1437b7-eda3-39b2-b684-bd7b154be97b

0
24 B

162ms
162ms

Document
application/javascript

35.212.27.211
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=11612&id=ua-8d1437b7-eda3-39b2-b684-bd7b154be97b
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.212.27.211 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.27.212.35.bc.googleusercontent.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://pbs-cs.yellowblue.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
access-control-expose-headers: X-Reason
content-length: 0
content-type: application/javascript
date: Thu, 14 Aug 2025 16:41:15 GMT
server: istio-envoy
via: 1.1 google
x-envoy-upstream-service-time: 4

Redirect headers

cache-control: no-store
content-length: 0
expires: 0
location: https://cs.yellowblue.io/cs?fwrd=1&aid=11612&id=ua-8d1437b7-eda3-39b2-b684-bd7b154be97b
pragma: no-cache

GET 16112
rtb.gumgum.com/usync/ Frame C3E4 0
0

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 0991
Redirect Chain

https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3D
https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3D&sovrn_retry=...
https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=LKnpALZH_XisoHP6S-aQYhai&gdpr=0&gdpr_consent=&us_privacy=

43 B
496 B

147ms
146ms

Image
image/avif

157.230.83.84
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=LKnpALZH_XisoHP6S-aQYhai&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/sync/iframe/?cid=&gdpr=0&gdpr_consent=&us_privacy=&coppa=0
Protocol: H2
Server: 157.230.83.84 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 14 Aug 2025 16:41:12 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

location: https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=LKnpALZH_XisoHP6S-aQYhai&gdpr=0&gdpr_consent=&us_privacy=
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, DELETE, PUT
access-control-allow-origin: *
content-length: 0
date: Thu, 14 Aug 2025 16:41:13 GMT
vary: Accept-Encoding
access-control-allow-headers: X-Requested-With, Content-Type

GET
H2 422 v1
match.sharethrough.com/FGMrCMMc/ 0
228 B 408ms
126ms Image
text/plain 3.81.30.180
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://match.sharethrough.com/FGMrCMMc/v1?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirectUri=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dsharethrough%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%24UID

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.81.30.180 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
content-length: 0

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame B396
Redirect Chain

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=vidazoo&khaos=MEBMM1OU-24-3AAH
https://sync.cootlogix.com/api/cookie?partnerId=rubicon&userId=MEBMM1OU-24-3AAH

43 B
496 B

131ms
131ms

Image
image/avif

157.230.83.84
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=rubicon&userId=MEBMM1OU-24-3AAH
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/sync/iframe/?cid=&gdpr=0&gdpr_consent=&us_privacy=&coppa=0
Protocol: H2
Server: 157.230.83.84 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 14 Aug 2025 16:41:14 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://sync.cootlogix.com/api/cookie?partnerId=rubicon&userId=MEBMM1OU-24-3AAH
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: ae15fb9f2d0fe3b37e79e50d571d0464
content-length: 0
Content-Type: text/html

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B396
Redirect Chain

https://token.rubiconproject.com/token?pid=25470
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TUVCTU0xT1UtMjQtM0FBSA==
https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEHA-GIavtF_8WVzsuc50Ocw&google_cver=1
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TUVCTU0xT1UtMjQtM0FBSA==&google_push=

170 B
191 B

124ms
122ms

Image
image/png

142.250.65.194
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TUVCTU0xT1UtMjQtM0FBSA==&google_push=

Requested by

Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/sync/iframe/?cid=&gdpr=0&gdpr_consent=&us_privacy=&coppa=0

Protocol

Server

142.250.65.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
report-to: {"group":"ad-exchange-cookie-matcher","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/httpsserver2/ad-exchange-cookie-matcher"}]}
content-security-policy-report-only: script-src 'none';form-action 'none';frame-src 'none'; report-uri https://csp.withgoogle.com/csp/httpsserver2/ad-exchange-cookie-matcher
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 170
date: Thu, 14 Aug 2025 16:41:14 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TUVCTU0xT1UtMjQtM0FBSA==&google_push=
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 82a6cabd8b3f0d2d2ae6e86e2699f0ba
content-length: 0
Content-Type: text/html

GET

dcm
aax-eu.amazon-adsystem.com/s/ Frame B396
Redirect Chain

https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=
https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=&dcc=t

0
0

GET
H2

200

setuid
px.ads.linkedin.com/ Frame B396
Redirect Chain

https://token.rubiconproject.com/token?pid=36584
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=MEBMM1OU-24-3AAH

0
676 B

1555ms
347ms

Image
text/plain

150.171.22.12
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=MEBMM1OU-24-3AAH
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/sync/iframe/?cid=&gdpr=0&gdpr_consent=&us_privacy=&coppa=0
Protocol: H2
Server: 150.171.22.12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: BD249055FFB948E49EAE417584D16C76 Ref B: YMQ31EDGE0110 Ref C: 2025-08-14T16:41:13Z
x-li-fabric: prod-ltx1
x-li-uuid: AAY8VfEHX9cCuk9yJsbQPw==
x-li-proto: http/2
alt-svc: h3=":443"; ma=86400
x-cache: CONFIG_NOCACHE
content-length: 0
date: Thu, 14 Aug 2025 16:41:13 GMT

Redirect headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
Location: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=MEBMM1OU-24-3AAH
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: d3682eda7e5cb79782b1d5475f50e8fc
Pragma: no-cache
content-length: 0

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame B396
Redirect Chain

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1
https://pr-bh.ybp.yahoo.com/sync/rubicon/2j2ZAKc23f__W6GJ3vpdg8n5EUdSAgOZEtemQ7w0kco?csrc=
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-IxqZNWBE2oLekb4AlP7hRl.EZXisOmgNOeK0cA--~A

42 B
2 KB

1473ms
133ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-IxqZNWBE2oLekb4AlP7hRl.EZXisOmgNOeK0cA--~A
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/sync/iframe/?cid=&gdpr=0&gdpr_consent=&us_privacy=&coppa=0
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: f72efbd84733ea5ba734e4e8fe0395a3
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
location: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-IxqZNWBE2oLekb4AlP7hRl.EZXisOmgNOeK0cA--~A
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 0
date: Thu, 14 Aug 2025 16:41:12 GMT
server: ATS
x-frame-options: DENY

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame B396
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc&process_consent=T
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEDmYVWYgOfFSoQwQ5eMmaQE&google_cver=1

42 B
2 KB

1570ms
134ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEDmYVWYgOfFSoQwQ5eMmaQE&google_cver=1
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/sync/iframe/?cid=&gdpr=0&gdpr_consent=&us_privacy=&coppa=0
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 19ea072139d67f7022c6e463249c998e
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEDmYVWYgOfFSoQwQ5eMmaQE&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
report-to: {"group":"ad-exchange-cookie-matcher","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/httpsserver2/ad-exchange-cookie-matcher"}]}
content-security-policy-report-only: script-src 'none';form-action 'none';frame-src 'none'; report-uri https://csp.withgoogle.com/csp/httpsserver2/ad-exchange-cookie-matcher
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 326
date: Thu, 14 Aug 2025 16:41:12 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H/1.1

200

ecm3
s.amazon-adsystem.com/ Frame B396
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=a9us
https://s.amazon-adsystem.com/ecm3?id=MEBMM1OU-24-3AAH&ex=d-rubiconproject.com&status=ok

43 B
477 B

644ms
117ms

Image
image/gif

98.82.157.137
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?id=MEBMM1OU-24-3AAH&ex=d-rubiconproject.com&status=ok

Requested by

Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/sync/iframe/?cid=&gdpr=0&gdpr_consent=&us_privacy=&coppa=0

Protocol

HTTP/1.1

Server

98.82.157.137 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: EG3SF37T5Q9JCNG3X0GH
Content-Length: 43
Date: Thu, 14 Aug 2025 16:41:14 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://s.amazon-adsystem.com/ecm3?id=MEBMM1OU-24-3AAH&ex=d-rubiconproject.com&status=ok
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 314e432eb2d967cf733b82bdbbe35231
content-length: 0
Content-Type: text/html

GET
H2 200 rubicon
match.adsrvr.org/track/cmf/ Frame B396 70 B
472 B 598ms
123ms Image
image/gif 52.223.40.198
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/rubicon
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/sync/iframe/?cid=&gdpr=0&gdpr_consent=&us_privacy=&coppa=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.223.40.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

content-length: 70
date: Thu, 14 Aug 2025 16:41:12 GMT
content-type: image/gif
server: Kestrel

GET
H/1.1

200

dcm
s.amazon-adsystem.com/ Frame B396
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=
https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&dcc=t

43 B
853 B

394ms
160ms

Image
image/gif

98.82.157.137
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&dcc=t

Requested by

Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/sync/iframe/?cid=&gdpr=0&gdpr_consent=&us_privacy=&coppa=0

Protocol

HTTP/1.1

Server

98.82.157.137 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: GB604EKJDMPDZN7J28EK
Content-Length: 43
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Thu, 14 Aug 2025 16:41:14 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

Redirect headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Location: https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&dcc=t
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: 056NN4XQTVAP9BAKMYB2
Content-Length: 0
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Thu, 14 Aug 2025 16:41:14 GMT
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B396
Redirect Chain

https://token.rubiconproject.com/token?pid=2249&pt=n
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=YWQ0YmUzNTk4MjNhZTMxMGY1YWQ5MjhlZDhkMGQyMzdmMDNhNjMyNw

170 B
191 B

139ms
138ms

Image
image/png

142.250.65.194
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=YWQ0YmUzNTk4MjNhZTMxMGY1YWQ5MjhlZDhkMGQyMzdmMDNhNjMyNw

Requested by

Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/sync/iframe/?cid=&gdpr=0&gdpr_consent=&us_privacy=&coppa=0

Protocol

Server

142.250.65.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-52-200-58-34.compute-1.amazonaws.com

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
report-to: {"group":"ad-exchange-cookie-matcher","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/httpsserver2/ad-exchange-cookie-matcher"}]}
content-security-policy-report-only: script-src 'none';form-action 'none';frame-src 'none'; report-uri https://csp.withgoogle.com/csp/httpsserver2/ad-exchange-cookie-matcher
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 170
date: Thu, 14 Aug 2025 16:41:12 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
Location: https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=YWQ0YmUzNTk4MjNhZTMxMGY1YWQ5MjhlZDhkMGQyMzdmMDNhNjMyNw
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: c1df09169f58a071f2a391dff1b3307b
Pragma: no-cache
content-length: 0

GET
H/1.1 200
OK rp
match.prod.bidr.io/cookie-sync/ Frame B396 43 B
433 B 8097ms
131ms Image
image/gif 52.200.58.34
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://match.prod.bidr.io/cookie-sync/rp?bee_sync_partners=rp

Requested by

Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/sync/iframe/?cid=&gdpr=0&gdpr_consent=&us_privacy=&coppa=0

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.200.58.34 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

gunicorn /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

strict-transport-security: max-age=2592000; includeSubDomains
cache-control: no-cache, must-revalidate
pragma: no-cache
Connection: keep-alive
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
Content-Length: 43
Date: Thu, 14 Aug 2025 16:41:20 GMT
content-type: image/gif
Server: gunicorn

GET
H2

200

v1
match.sharethrough.com/sync/ Frame B396
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=18694
https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=MEBMM1OU-24-3AAH

68 B
323 B

7869ms
262ms

Image
image/png

3.81.30.180
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=MEBMM1OU-24-3AAH

Requested by

Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/sync/iframe/?cid=&gdpr=0&gdpr_consent=&us_privacy=&coppa=0

Protocol

Server

3.81.30.180 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-81-30-180.compute-1.amazonaws.com

Software

Resource Hash

6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=MEBMM1OU-24-3AAH
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: b5ba23d75d0dcd35432b720d73e3149b
content-length: 0
Content-Type: text/html

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame B396
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=${ADELPHIC_CUID}&expires=30
https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=16479783-c724-491b-ad64-0139bf43cda3&expires=30

42 B
2 KB

578ms
112ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=16479783-c724-491b-ad64-0139bf43cda3&expires=30
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/sync/iframe/?cid=&gdpr=0&gdpr_consent=&us_privacy=&coppa=0
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 44e748b6247b033344ab4f6b8c0f8cbb
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

X-CI-RTID: 8db73eeb-ea39-4676-97de-3a67d8cc679d
Location: https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=16479783-c724-491b-ad64-0139bf43cda3&expires=30
Content-Length: 144
Date: Thu, 14 Aug 2025 16:41:13 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H2

200

check
pixel.tapad.com/idsync/ex/receive/ Frame B396
Redirect Chain

https://token.rubiconproject.com/token?pid=37556&a=1
https://pixel.tapad.com/idsync/ex/receive?partner_id=3355&partner_device_id=MEBMM1OU-24-3AAH
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3355&partner_device_id=MEBMM1OU-24-3AAH

95 B
428 B

158ms
156ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3355&partner_device_id=MEBMM1OU-24-3AAH

Requested by

Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/sync/iframe/?cid=&gdpr=0&gdpr_consent=&us_privacy=&coppa=0

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

62.113.111.34.bc.googleusercontent.com

Software

Jetty(11.0.25) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

strict-transport-security: max-age=31536000
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 95
date: Thu, 14 Aug 2025 16:41:15 GMT
content-type: image/png
server: Jetty(11.0.25)

Redirect headers

strict-transport-security: max-age=31536000
location: https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3355&partner_device_id=MEBMM1OU-24-3AAH
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 0
date: Thu, 14 Aug 2025 16:41:15 GMT
server: Jetty(11.0.25)

GET
H2

200

ProfilesEngineServlet
syncv4.intentiq.com/profiles_engine/ Frame B396
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=primis
https://live.primis.tech/live/liveCS.php?source=external&advId=100&advUuid=MEBMM1OU-24-3AAH
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1725065545&3rdpcid=MEBMM1OU-24-3AAH
https://syncv4.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1725065545&3rdpcid=MEBMM1OU-24-3AAH&ckls=true&ci=x44h1oqAU0&nc=false&trid=-1140132362

43 B
1 KB

267ms
251ms

Image
image/gif

3.168.122.31
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://syncv4.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1725065545&3rdpcid=MEBMM1OU-24-3AAH&ckls=true&ci=x44h1oqAU0&nc=false&trid=-1140132362
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/sync/iframe/?cid=&gdpr=0&gdpr_consent=&us_privacy=&coppa=0
Protocol: H2
Server: 3.168.122.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-168-122-31.jfk52.r.cloudfront.net
Software: /
Resource Hash: caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 16ef2ce41ee63b7d045e809201991b04.cloudfront.net (CloudFront)
expires: Thu, 01 Jan 1970 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
content-length: 43
date: Thu, 14 Aug 2025 16:41:16 GMT
content-type: image/gif
x-amz-cf-pop: JFK52-P7
x-amz-cf-id: VVhxA_e47Xvm_8gKhweOBreBxgjYbk3JnYdUO3KH9LqgU2oJfVij7Q==

Redirect headers

patent: https://www.almondnet.com/ip
cache-control: no-cache, no-store, must-revalidate
location: https://syncv4.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1725065545&3rdpcid=MEBMM1OU-24-3AAH&ckls=true&ci=x44h1oqAU0&nc=false&trid=-1140132362
pragma: no-cache
via: 1.1 16ef2ce41ee63b7d045e809201991b04.cloudfront.net (CloudFront)
expires: Thu, 01 Jan 1970 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
content-length: 43
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 14 Aug 2025 16:41:16 GMT
content-type: image/gif
x-amz-cf-pop: JFK52-P7
x-amz-cf-id: RhJzcbJmoW4xvbpSByUHz7TAJt5d6495iSXRKYfJpGnox3MSTlUYXw==

GET
H2

200

merge
ce.lijit.com/ Frame B396
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=sovrn
https://ce.lijit.com/merge?pid=80&3pid=MEBMM1OU-24-3AAH

43 B
500 B

985ms
318ms

Image
image/gif

100.24.137.239
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=80&3pid=MEBMM1OU-24-3AAH
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/sync/iframe/?cid=&gdpr=0&gdpr_consent=&us_privacy=&coppa=0
Protocol: H2
Server: 100.24.137.239 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-100-24-137-239.compute-1.amazonaws.com
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

cache-control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
pragma: no-cache
expires: Fri, 20 Mar 2009 00:00:00 GMT
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 14 Aug 2025 16:41:15 GMT
content-type: image/gif
vary: Accept-Encoding

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://ce.lijit.com/merge?pid=80&3pid=MEBMM1OU-24-3AAH
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: cdd55fb02049ca8b9389527f6c1a1194
content-length: 0
Content-Type: text/html

GET
H2

200

setuid
ib.adnxs.com/prebid/ Frame B396
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-apn
https://ib.adnxs.com/prebid/setuid?bidder=rubicon&uid=MEBMM1OU-24-3AAH

43 B
1 KB

234ms
231ms

Image
image/gif

68.67.160.26
ASN-APPNEX

General

Check archive.org

Download Go to Show image

Full URL

https://ib.adnxs.com/prebid/setuid?bidder=rubicon&uid=MEBMM1OU-24-3AAH

Requested by

Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/sync/iframe/?cid=&gdpr=0&gdpr_consent=&us_privacy=&coppa=0

Protocol

Server

68.67.160.26 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

567.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.25.5 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin: 89.238.156.126; 89.238.156.126; 567.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid: 99606ab5-4ab7-49fa-8747-a6d57670e022
content-length: 43
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 14 Aug 2025 16:41:14 GMT
x-xss-protection: 0
content-type: image/gif
server: nginx/1.25.5

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://ib.adnxs.com/prebid/setuid?bidder=rubicon&uid=MEBMM1OU-24-3AAH
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 83041abbe8494cb29eff3083edd6dff6
content-length: 0
Content-Type: text/html

GET 6f0476ca45e1d6b67e3ee8d57532a022.gif
cs.iqzone.com/ Frame 0991 0
0

GET
H2 200 usync.js Show response
eus.rubiconproject.com/ Frame FEB9 45 KB
0 223ms
222ms Script
text/html 23.200.198.128
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?endpoint=us-east&p=rise_engage
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.200.198.128 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-200-198-128.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) / PHP/8.3.13
Resource Hash: f7ed71321130d801efc364af8374857d86a9c55c8601828f1f4b151d33eb1722

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/usync.html?endpoint=us-east&p=rise_engage

Response headers

cache-control: max-age=12074
content-encoding: gzip
expires: Thu, 14 Aug 2025 20:02:24 GMT
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
content-length: 11507
date: Thu, 14 Aug 2025 16:41:10 GMT
last-modified: Wed, 13 Aug 2025 20:02:24 GMT
x-powered-by: PHP/8.3.13
server: Apache/2.4.62 (Debian)
content-type: text/html;charset=UTF-8
vary: Accept-Encoding

GET
H3

200

setuid
prebid.intergient.com/ Frame C075
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=&khaos=MEBMM1OU-24-3AAH
https://prebid.intergient.com/setuid?bidder=rubicon&uid=MEBMM1OU-24-3AAH

0
1 KB

164ms
164ms

Image
text/html

104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://prebid.intergient.com/setuid?bidder=rubicon&uid=MEBMM1OU-24-3AAH
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H3
Server: 104.18.21.56 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","endpoints":[{"url":"https://nel.heroku.com/reports?s=L5LAhNyNJzf1MOkPJZlXYsHRccKJ2N5LgzNe6sizL7A%3D\u0026sid=1b10b0ff-8a76-4548-befa-353fc6c6c045\u0026ts=1755189674"}],"max_age":3600}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 14 Aug 2025 16:41:14 GMT
content-type: text/html
vary: Accept-Encoding, Origin
priority: u=3,i
reporting-endpoints: heroku-nel="https://nel.heroku.com/reports?s=L5LAhNyNJzf1MOkPJZlXYsHRccKJ2N5LgzNe6sizL7A%3D&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&ts=1755189674"
cache-control: no-cache, no-store, must-revalidate
nel: {"report_to":"heroku-nel","response_headers":["Via"],"max_age":3600,"success_fraction":0.01,"failure_fraction":0.1}
pragma: no-cache
via: 2.0 heroku-router
cf-ray: 96f1e6068b43abe5-YYZ
server: cloudflare

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://prebid.intergient.com/setuid?bidder=rubicon&uid=MEBMM1OU-24-3AAH
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 8bab65602db075726861004da5629947
content-length: 0
Content-Type: text/html

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame C519
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=12776&khaos=MEBMM1OU-24-3AAH
https://usr.undertone.com/userPixel/sync?partner=rubicon&uid=MEBMM1OU-24-3AAH
https://sync.cootlogix.com/api/cookie?partnerId=rubiconut&userId=MEBMM1OU-24-3AAH

43 B
496 B

150ms
147ms

Image
image/avif

157.230.83.84
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=rubiconut&userId=MEBMM1OU-24-3AAH
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D&gpp=&gpp_sid=
Protocol: H2
Server: 157.230.83.84 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 14 Aug 2025 16:41:14 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

via: 1.1 29117767a034875a8b49afd641f25d82.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
location: https://sync.cootlogix.com/api/cookie?partnerId=rubiconut&userId=MEBMM1OU-24-3AAH
content-length: 0
date: Thu, 14 Aug 2025 16:41:14 GMT
x-amz-cf-pop: JFK52-P2
x-amz-cf-id: K8CB1lFOVN_SCK6VEbR-f9jyo6i8f61TyRBEufU0j_ozmkP_6KivxQ==

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/16922826921261822974/ Frame 22C8 8 KB
3 KB 249ms
121ms Document
text/html 142.250.80.38
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://s0.2mdn.net/sadbundle/16922826921261822974/index.html?ev=01_253

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_281.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.38 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9d86fea068d0262f036d783cb36b97fa093ff033260c64aeac672533541cde03

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://459b190c75fc3706badce91489ac4d5d.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 85694
allow-fenced-frame-automatic-beacons: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 2613
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Wed, 13 Aug 2025 16:52:58 GMT
expires: Thu, 13 Aug 2026 16:52:58 GMT
last-modified: Wed, 06 Aug 2025 11:14:04 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 view
ad.doubleclick.net/pcs/ Frame 9A85 0
0 365ms
235ms Fetch
image/png 172.217.165.134
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjstJdcsvNng709N6KG8phZ5JG53mMfrE3z1FfANRApQzvbaO_xUOEAsEh--kvI5EOdE96zxBRuiYuZCEDj6IGMRIjL4V5e_1ET8f2AYkqmhdm3lu7jyphi1_C5AVRgXMNXdvHNahD-V8R4wrX4Un2148SkO-id27Mib9q-zdMEORUOm5kgVcifENlu4UbqQ-boeb4c2XKHgE-qef1iwsHLXYEaywR9NnDdiw8jVxHHUPcC6q67e2DHGAU4AQgCcBu0l6ncb-u_9tsJEKLgyeDXuYVjTDq-1ebrchAhABUH8ztDxDSeHhO61Hl5jWqtArpb0bC55fX9zA7rpW_v9i-evOGOU4h90FuT5eOwdymKT7EOdoPnBwWttDfWiQX_4P4_WpLFR0tr2nahINtd8wW4Nji-inuQBFgDXMtY7Vfa6GbgJjroE9wP3eXP9mRBM8zR6Uh2GEydAZZqvqUUq0tsNAUiJH3hTqFf3sxBR-cg4jE32Hpn6gu5xiL9BcaQxy4VqUivWhCq8mSAsryYxHTR0vs4aVgl86rV8DKiCJ855et2N0orhdNReqIuGyRDOTS79S2ZHjHHiRj1Vmm3kYIYbw3OODvWCsDrLJbwDKJ2HJfAKIxIgu6sHxy3vqdFTkRDTILR95NkbvfapZWaXmJT0QzPi73CwFH_DUO6LVbFRskvD76gu4jV48odLA8g93Q9W7YCEyCLWNpmg6EI74jbCwkG-NYbdbAsm7lE9_1eSOIGrMqotKb0WcnbY1ESfshx0JCnSzed4QamuyFhs7BZjBwr6IgrRUBhyasYV35SqyI_Xj1rl-hS4XN5LTZYyxanhObw38yb6732RxavH7_5ECtRnfXXZ1nsyIzCHajubYvEPbp4gN0KQerZZSM0uL06q4GQp6pPFnP5v3I6CIhEdXnLs990BEeZiqxlq2vozhTr8mMtbjVtu5VspbFD9D7ra_lcpmK_4SMIrMLlk1qA7Vb8CqOq2mnJu9RuX0giroM42cuaZoQYBkxMb0zemxXULfoly_KOSG_eN_Tlh046Vd23p8tRecKi3bVq3QSc9PGt8WMyNrMLskkdY9Jw5pJ5rR_To49M6dsA2EllzIQlrfXuHpS7HLDa7gT5FDOl4yDeRWQtWFtTrk-a6kLo1TCeNQV1M67K99SIe-Rn1Q_aw09e49o888xTiKB7Xvl30P91OhGHMavtf4HS18a4lk8CxLvyb3Z-tejOixmurdd3QkJCNx3MghE8_X7ocuok3kHUWDSx4dVAO448Ud89duwjU7BZnEutfGNpz2UMjIEUTYhkFhpL-tRr0TyYYlMrLr6_4YoFQxflQM1BWkzKYFrA3dBfE15SFCaoAQnky5OQsP6QI4STUpmxcz_LoogtIlH2mvpKKRAoK83KVoNt0edBtzzKbA4lHTtX16lxXIZg6QNalF9SJuxuTpLYPwFhpAzyBd2m8-jE_K97yIgq-gUDVJfC3fpoI-dBdHmFSw2P18pj1JT6RsKpGGklysLVZO1clOYktup55PxojnovbY9DacRyvs-5uhsZ_hAMcRPpeksxtLTcwtWdOAfySARVI_CiMKmuT2HUnPqHqL0L8Jut9wTDqNHjswXChsQ5myv0CnXj5XxREaCYkCguTotNITAUdMv-z1wYnrHTpN0Rb70UeuzB5J89b4fcucP_DkSCQx4v57u2oxxMCDrFWUMDfA2XNZmEQs5tV6ou5al31kz3aiBRoPlcmK5ct5ujtFaRPaAAxwN_2T6oHQQKrTNg3Bc5eX4O_bkgYpeKV5yTEEUknxL2mQYr28kNNs5nNKnrT53WUmYg0rdiMIDyaCu_-YoL49t9UEIrMRwI_utGM4qtMePFolzCrdOrGe__WNdQC0RBACJNLWOaP9BQ&sai=AMfl-YQFcUwoLTkgsb0Ufnj2P3QxDSRMfTxkVwiiBVF4Vq5Kcvkc21MKYlrYk4U8eZ-WnEke2cwyvnxixL9OPel0eMY62mihfPebM3Rj-_uHTeTXDNnwUqaMGkVEa-Hw7VmR9X0s1mJ5zWTHrpP5hwMgvr5rTsuoZW4IEEsABaHUcbQuBJWnDnRIIFYyHOHAmj2ZIcSWXvMhEcgHe1AOiAMeZpsowYS71Fh6veRJ0F8j5703PiOBg2H2WCCej8gPx0Dvd5qrqwU31pAZJX7l_xz1yoPzSACQSulvTxe4Jm3APw80xIE0FzfdgvwYf49aSyFhYfVoS8JduA_IWYkJdfJzYUqtFIrXdFUGssRu-Y_0ioHAbbXUWXdqUMGrCRb5D3QOZLQQakEDHU0cQ8lFRkYQ1mUECpJF5gR9DCLeYX8HpdunaPS2lE_LYd1pg66RZQbE4GYPEDwXl8HPnAbxpHP4NhKgYppUlqUbGocjA-aOS6vPEoyeYTfv7lHH35-wBlO-0A-RPpmfMdeQzlwtbwHUPnMjPb9GkHbteHRvmj2jLQowykXBoBva1OrpauGLiVnLiqMbtCNt4VUQbJgCF7EjD-vixfiV1cIjXqRpZL4hV4XkghYUYo6GoCV4QAPEFAc50o-COYr0YZOqXsIGysqoWyD35WVKWRNr4eIAswGKJ97w6oLLXRi-ovjcgj0VdYLAf919eWQ6_DXe6WfHk_d_iGdG94baMfLDupF2lCfHGAoLbm17NLvemZ5c04ZvXbkfSL77d9OSEWXTqE1A1sr_6atzJ8iuOAlbX5H2pRiy5A5uYaHVr2B2zAh389WvYIIO2RJLJwEAEBqO3YcOc6q4v245PibYXSZKNrZZYPqcDX5QodhCDxpnYFheafJ9MCTbCxMEqD38b0TJJOWVO904czZ3zFci9xD2Xb5XUyXghravdwOBTvDKow7YKj8VJnxGf5GlXZGQvEpluiyrbw9p8xCReWSTTJ_TMvv0g3N0&sig=Cg0ArKJSzHV_c8ZgFvYjEAE&uach_m=%5BUACH%5D&crd=aHR0cHM6Ly9maW5hbGZhbnRhc3l4aXYuY29t&pr=missingexchangepricemacro&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=3763&cbvp=1&cstd=3759&cisv=r20250813.70564&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=1&ftch=1&adurl=

Requested by

Host: sse6.kwach.org
URL: https://sse6.kwach.org/r/a1NuZEQ2Vkt1MEZ4T3RqY01Mc08tMzk3OC0yNTg4OTkxMS0xMDhlMDI4Ny02NjQ0LXpoM1Y4c2Jwajl3RTk2Y2s2MXBi

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.165.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://459b190c75fc3706badce91489ac4d5d.safeframe.googlesyndication.com/

Response headers

x-content-type-options: nosniff
expires: Thu, 14 Aug 2025 16:41:12 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 14 Aug 2025 16:41:12 GMT
content-type: image/png
content-security-policy: script-src 'none'; object-src 'none'
cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
x-xss-protection: 0
attribution-reporting-register-source: {"aggregation_keys":{"647425044":"0x84a5c40867e59ebe0000000000000000","647425045":"0x7a1a41a947d165250000000000000000","647425046":"0x971f8f74175b78010000000000000000"},"debug_key":"16048748275391653972","debug_reporting":true,"destination":["https://square-enix.com","https://square-enix-games.com","https://finalfantasyxiv.com"],"event_report_windows":{"end_times":[86400,345600]},"expiry":"1296000","filter_data":{"14":["10837766"],"21":[],"23":[],"24":[],"25":[],"26":[],"27":[],"28":[],"29":[],"8":["9685871"]},"max_event_level_reports":2,"priority":"0","source_event_id":"15018259197700450503"}
server: cafe

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame FEB9 7 B
2 KB 143ms
143ms XHR
application/json 69.173.151.100
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?khaos=MEBMM1OU-24-3AAH
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Cache-Control: no-cache,no-store,must-revalidate
Pragma: no-cache
access-control-allow-credentials: true
Expires: 0
access-control-allow-origin: https://eus.rubiconproject.com
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: a0d1cefc91c6f8b22fd2adf3abe06a61
content-length: 7
content-type: application/json; charset=UTF-8

GET
H2

200

cs
cs.yellowblue.io/ Frame FEB9
Redirect Chain

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=rise_engage&khaos=MEBMM1OU-24-3AAH
https://cs.yellowblue.io/cs?aid=11590&id=MEBMM1OU-24-3AAH

0
70 B

150ms
150ms

Image
application/javascript

35.212.27.211
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?aid=11590&id=MEBMM1OU-24-3AAH
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 35.212.27.211 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.27.212.35.bc.googleusercontent.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
via: 1.1 google
access-control-allow-origin: https://eus.rubiconproject.com/
content-length: 0
date: Thu, 14 Aug 2025 16:41:14 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://cs.yellowblue.io/cs?aid=11590&id=MEBMM1OU-24-3AAH
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: ae15fb9f2d0fe3b37e79e50d571d0464
content-length: 0
Content-Type: text/html

GET
H3 200 createjs_2019.11.15_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 22C8 236 KB
63 KB 159ms
158ms Script
text/javascript 142.250.80.38
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/createjs_2019.11.15_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16922826921261822974/index.html?ev=01_253

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.38 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bc12347103da4da2ac30f8b4defd567679284e0bad691a54fad78ad804fc9c27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://s0.2mdn.net/sadbundle/16922826921261822974/index.html?ev=01_253

Response headers

content-encoding: gzip
age: 0
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Thu, 14 Aug 2025 16:41:13 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 14 Aug 2025 16:41:13 GMT
last-modified: Fri, 15 Nov 2019 19:16:20 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=0
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 64275
x-xss-protection: 0
server: sffe

GET
H3 200 index.js Show response
s0.2mdn.net/sadbundle/16922826921261822974/ Frame 22C8 110 KB
21 KB 134ms
133ms Script
application/x-javascript 142.250.80.38
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://s0.2mdn.net/sadbundle/16922826921261822974/index.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16922826921261822974/index.html?ev=01_253

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.38 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2f8766200dd3624e4f137d17f60a0aa8d3d5e1c2873aed8b4c8f87055307a92c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://s0.2mdn.net/sadbundle/16922826921261822974/index.html?ev=01_253

Response headers

content-encoding: gzip
age: 86214
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Thu, 13 Aug 2026 16:44:19 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Wed, 13 Aug 2025 16:44:19 GMT
last-modified: Wed, 06 Aug 2025 11:14:04 GMT
content-type: application/x-javascript
vary: Accept-Encoding
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 21927
x-xss-protection: 0
server: sffe

GET
H3 200 index_atlas_P_1.png
s0.2mdn.net/sadbundle/16922826921261822974/images/ Frame 22C8 111 KB
111 KB 130ms
130ms Image
image/png 142.250.80.38
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/16922826921261822974/images/index_atlas_P_1.png?1754299309944

Requested by

Host: 459b190c75fc3706badce91489ac4d5d.safeframe.googlesyndication.com
URL: https://459b190c75fc3706badce91489ac4d5d.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.38 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a2f5d0e8385eb83d206f72ea126f7351bf976fa353d413cbade5c59bb1717499

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://s0.2mdn.net/sadbundle/16922826921261822974/index.html?ev=01_253

Response headers

age: 85115
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Thu, 13 Aug 2026 17:02:38 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Wed, 13 Aug 2025 17:02:38 GMT
last-modified: Wed, 06 Aug 2025 11:14:04 GMT
content-type: image/png
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 113870
x-xss-protection: 0
server: sffe

GET
H3 200 view
ad.doubleclick.net/pcs/ Frame 9A85 0
0 232ms
231ms Fetch
image/png 172.217.165.134
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjstJdcsvNng709N6KG8phZ5JG53mMfrE3z1FfANRApQzvbaO_xUOEAsEh--kvI5EOdE96zxBRuiYuZCEDj6IGMRIjL4V5e_1ET8f2AYkqmhdm3lu7jyphi1_C5AVRgXMNXdvHNahD-V8R4wrX4Un2148SkO-id27Mib9q-zdMEORUOm5kgVcifENlu4UbqQ-boeb4c2XKHgE-qef1iwsHLXYEaywR9NnDdiw8jVxHHUPcC6q67e2DHGAU4AQgCcBu0l6ncb-u_9tsJEKLgyeDXuYVjTDq-1ebrchAhABUH8ztDxDSeHhO61Hl5jWqtArpb0bC55fX9zA7rpW_v9i-evOGOU4h90FuT5eOwdymKT7EOdoPnBwWttDfWiQX_4P4_WpLFR0tr2nahINtd8wW4Nji-inuQBFgDXMtY7Vfa6GbgJjroE9wP3eXP9mRBM8zR6Uh2GEydAZZqvqUUq0tsNAUiJH3hTqFf3sxBR-cg4jE32Hpn6gu5xiL9BcaQxy4VqUivWhCq8mSAsryYxHTR0vs4aVgl86rV8DKiCJ855et2N0orhdNReqIuGyRDOTS79S2ZHjHHiRj1Vmm3kYIYbw3OODvWCsDrLJbwDKJ2HJfAKIxIgu6sHxy3vqdFTkRDTILR95NkbvfapZWaXmJT0QzPi73CwFH_DUO6LVbFRskvD76gu4jV48odLA8g93Q9W7YCEyCLWNpmg6EI74jbCwkG-NYbdbAsm7lE9_1eSOIGrMqotKb0WcnbY1ESfshx0JCnSzed4QamuyFhs7BZjBwr6IgrRUBhyasYV35SqyI_Xj1rl-hS4XN5LTZYyxanhObw38yb6732RxavH7_5ECtRnfXXZ1nsyIzCHajubYvEPbp4gN0KQerZZSM0uL06q4GQp6pPFnP5v3I6CIhEdXnLs990BEeZiqxlq2vozhTr8mMtbjVtu5VspbFD9D7ra_lcpmK_4SMIrMLlk1qA7Vb8CqOq2mnJu9RuX0giroM42cuaZoQYBkxMb0zemxXULfoly_KOSG_eN_Tlh046Vd23p8tRecKi3bVq3QSc9PGt8WMyNrMLskkdY9Jw5pJ5rR_To49M6dsA2EllzIQlrfXuHpS7HLDa7gT5FDOl4yDeRWQtWFtTrk-a6kLo1TCeNQV1M67K99SIe-Rn1Q_aw09e49o888xTiKB7Xvl30P91OhGHMavtf4HS18a4lk8CxLvyb3Z-tejOixmurdd3QkJCNx3MghE8_X7ocuok3kHUWDSx4dVAO448Ud89duwjU7BZnEutfGNpz2UMjIEUTYhkFhpL-tRr0TyYYlMrLr6_4YoFQxflQM1BWkzKYFrA3dBfE15SFCaoAQnky5OQsP6QI4STUpmxcz_LoogtIlH2mvpKKRAoK83KVoNt0edBtzzKbA4lHTtX16lxXIZg6QNalF9SJuxuTpLYPwFhpAzyBd2m8-jE_K97yIgq-gUDVJfC3fpoI-dBdHmFSw2P18pj1JT6RsKpGGklysLVZO1clOYktup55PxojnovbY9DacRyvs-5uhsZ_hAMcRPpeksxtLTcwtWdOAfySARVI_CiMKmuT2HUnPqHqL0L8Jut9wTDqNHjswXChsQ5myv0CnXj5XxREaCYkCguTotNITAUdMv-z1wYnrHTpN0Rb70UeuzB5J89b4fcucP_DkSCQx4v57u2oxxMCDrFWUMDfA2XNZmEQs5tV6ou5al31kz3aiBRoPlcmK5ct5ujtFaRPaAAxwN_2T6oHQQKrTNg3Bc5eX4O_bkgYpeKV5yTEEUknxL2mQYr28kNNs5nNKnrT53WUmYg0rdiMIDyaCu_-YoL49t9UEIrMRwI_utGM4qtMePFolzCrdOrGe__WNdQC0RBACJNLWOaP9BQ&sai=AMfl-YQFcUwoLTkgsb0Ufnj2P3QxDSRMfTxkVwiiBVF4Vq5Kcvkc21MKYlrYk4U8eZ-WnEke2cwyvnxixL9OPel0eMY62mihfPebM3Rj-_uHTeTXDNnwUqaMGkVEa-Hw7VmR9X0s1mJ5zWTHrpP5hwMgvr5rTsuoZW4IEEsABaHUcbQuBJWnDnRIIFYyHOHAmj2ZIcSWXvMhEcgHe1AOiAMeZpsowYS71Fh6veRJ0F8j5703PiOBg2H2WCCej8gPx0Dvd5qrqwU31pAZJX7l_xz1yoPzSACQSulvTxe4Jm3APw80xIE0FzfdgvwYf49aSyFhYfVoS8JduA_IWYkJdfJzYUqtFIrXdFUGssRu-Y_0ioHAbbXUWXdqUMGrCRb5D3QOZLQQakEDHU0cQ8lFRkYQ1mUECpJF5gR9DCLeYX8HpdunaPS2lE_LYd1pg66RZQbE4GYPEDwXl8HPnAbxpHP4NhKgYppUlqUbGocjA-aOS6vPEoyeYTfv7lHH35-wBlO-0A-RPpmfMdeQzlwtbwHUPnMjPb9GkHbteHRvmj2jLQowykXBoBva1OrpauGLiVnLiqMbtCNt4VUQbJgCF7EjD-vixfiV1cIjXqRpZL4hV4XkghYUYo6GoCV4QAPEFAc50o-COYr0YZOqXsIGysqoWyD35WVKWRNr4eIAswGKJ97w6oLLXRi-ovjcgj0VdYLAf919eWQ6_DXe6WfHk_d_iGdG94baMfLDupF2lCfHGAoLbm17NLvemZ5c04ZvXbkfSL77d9OSEWXTqE1A1sr_6atzJ8iuOAlbX5H2pRiy5A5uYaHVr2B2zAh389WvYIIO2RJLJwEAEBqO3YcOc6q4v245PibYXSZKNrZZYPqcDX5QodhCDxpnYFheafJ9MCTbCxMEqD38b0TJJOWVO904czZ3zFci9xD2Xb5XUyXghravdwOBTvDKow7YKj8VJnxGf5GlXZGQvEpluiyrbw9p8xCReWSTTJ_TMvv0g3N0&sig=Cg0ArKJSzHV_c8ZgFvYjEAE&uach_m=%5BUACH%5D&crd=aHR0cHM6Ly9maW5hbGZhbnRhc3l4aXYuY29t&pr=missingexchangepricemacro&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=4416&vt=11&dtpt=653&dett=3&cstd=3759&cisv=r20250813.70564&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=1&ftch=1&adurl=

Requested by

Host: sse6.kwach.org
URL: https://sse6.kwach.org/r/a1NuZEQ2Vkt1MEZ4T3RqY01Mc08tMzk3OC0yNTg4OTkxMS0xMDhlMDI4Ny02NjQ0LXpoM1Y4c2Jwajl3RTk2Y2s2MXBi

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.165.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://459b190c75fc3706badce91489ac4d5d.safeframe.googlesyndication.com/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Thu, 14 Aug 2025 16:41:13 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Thu, 14 Aug 2025 16:41:13 GMT
x-xss-protection: 0
content-type: image/png
attribution-reporting-register-source: {"aggregation_keys":{"647425044":"0x84a5c40867e59ebe0000000000000000","647425045":"0x7a1a41a947d165250000000000000000","647425046":"0x971f8f74175b78010000000000000000"},"debug_key":"13407633576928781855","debug_reporting":true,"destination":["https://square-enix.com","https://square-enix-games.com","https://finalfantasyxiv.com"],"event_report_windows":{"end_times":[86400,345600]},"expiry":"1296000","filter_data":{"14":["10837766"],"21":[],"23":[],"24":[],"25":[],"26":[],"27":[],"28":[],"29":[],"8":["9685871"]},"max_event_level_reports":2,"priority":"0","source_event_id":"14969486547767747332"}
server: cafe

GET
H3 200 index_atlas_NP_1.jpg
s0.2mdn.net/sadbundle/16922826921261822974/images/ Frame 22C8 96 KB
96 KB 121ms
120ms Image
image/jpeg 142.250.80.38
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/16922826921261822974/images/index_atlas_NP_1.jpg?1754299309945

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.38 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

84043a95abd5d52ca0d42b76ba3446caaaeb6702e62a92532ababf678713a529

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://s0.2mdn.net/sadbundle/16922826921261822974/index.html?ev=01_253

Response headers

age: 84658
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Thu, 13 Aug 2026 17:10:15 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Wed, 13 Aug 2025 17:10:15 GMT
last-modified: Wed, 06 Aug 2025 11:14:04 GMT
content-type: image/jpeg
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 97947
x-xss-protection: 0
server: sffe

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 9A85 42 B
65 B 150ms
149ms Fetch
image/gif 142.250.80.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstMQygSUCBU2eOHuQKoxOhcRo1Y1_B9LnaPiTUWnILS0B5Ne42CjrAcO26-h9fPAx8w-2nhAZ2CowZ-Ake1iRr2SRAl8sHS8Wy3zCHENnRbycnotJh8x8VYmZjxdT58PJC1EdftCLe_LwTUPk3_0AMMz8FUJxxVJf9qQIYrVnSfAxN0l2oUD789iRFGUsoJpqWkniCZ0h4K&sai=AMfl-YSzzsPIerfhV5Wvhhg8x3YqnJM8oBo48SyFFdNCyk4RAszNah42BUxiU4CaUWYwkX5hXXGeqJ7xjEp_tBKNgKqs7zD9_lG3xLHk2YtO4nkdNO8Bo5-H5GCGp0opKjaY74gbnQgw5klHia6mz6oYPAV3SjK1Xlce9JdIns504ICGu7alOAaXqdZfS4Q7StRHSCwdNFWFcdTyIX87ZzjcqUGMkdRX7r3acblEhnrrhweqZafCeasjpMPebCGj32uugQ5eXwRswleS0mFtauhzglK0__E&sig=Cg0ArKJSzHf8Ub3XnMhdEAE&cid=CAQSrwEA2abss_4aXve7u0ymQ33Cz5VPXJLByb_7TUHA3Sj6r4OGTqc4H4rgsSXy2TfxF0j6zLizwfDmUJa9CkI2SHpRgqgM6_JkC7YOK9J6yhEgly2baC-_kDGfjUJxF8aISqeys36dyPdAcQanQNE6NtS3lNCaxdh6p8Fg-9a1GSEzH3959f3Pnj-eDHnBhlJHqLr2n3V3CbVuJKyIrOwAPvFLyFKPsAUWR2GTGD35cycHGAE&id=lidar2&mcvt=1000&p=313,139,353,180&tm=3271.2000007629395&tu=2271.2999992370605&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20250806&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=2652516820&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=5112247000&rst=1755189668615&rpt=1788&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&fle=0&vae=0&spb=0&sfl=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-3-220-65-116.compute-1.amazonaws.com

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://459b190c75fc3706badce91489ac4d5d.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Thu, 14 Aug 2025 16:41:13 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2

200

usync.html Show response
eus.rubiconproject.com/ Frame A4DC
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=12776
https://eus.rubiconproject.com/usync.html?p=12776

269 B
0

0ms
0ms

Document
text/html

23.200.198.128
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=12776
Requested by: Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html?partnerid=59&gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dundertonenew%26userId%3D%24%7BUIDENC%7D%26gdpr%3D%24%7Bgdpr%7D%26gdpr_consent%3D%24%7Bgdpr_consent%7D%26us_privacy%3D%24%7Bus_privacy%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.200.198.128 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-200-198-128.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) /
Resource Hash: e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer: https://cdn.undertone.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Thu, 14 Aug 2025 16:41:10 GMT
etag: "10d-629840acea280-gzip"
last-modified: Wed, 18 Dec 2024 04:42:34 GMT
server: Apache/2.4.62 (Debian)
vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Thu, 14 Aug 2025 16:41:08 GMT
location: https://eus.rubiconproject.com/usync.html?p=12776
server: AkamaiGHost

GET
H3 200 cm
us-u.openx.net/w/1.0/ Frame 0F34 43 B
60 B 132ms
116ms Image
image/gif 35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/cm?id=fba3d144-1026-4d31-a758-943b9545e305&r=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D39%26uid%3D%7BOPENX_ID%7D
Requested by: Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html?partnerid=59&gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dundertonenew%26userId%3D%24%7BUIDENC%7D%26gdpr%3D%24%7Bgdpr%7D%26gdpr_consent%3D%24%7Bgdpr_consent%7D%26us_privacy%3D%24%7Bus_privacy%7D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://cdn.undertone.com/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 89.238.156.126
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 14 Aug 2025 16:41:14 GMT
content-type: image/gif
vary: Accept, Accept-Encoding

GET
H2

200

sync
usr.undertone.com/userPixel/ Frame 0F34
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=sirnsvg&ttd_tpi=1&gdpr=0&gdpr_consent=
https://usr.undertone.com/userPixel/sync?partnerId=46&uid=d361044d-0ef5-4930-9f3e-bd0acfe3bdfd&ttl=1757781674

0
307 B

134ms
131ms

Image
text/plain

18.173.132.84
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://usr.undertone.com/userPixel/sync?partnerId=46&uid=d361044d-0ef5-4930-9f3e-bd0acfe3bdfd&ttl=1757781674
Requested by: Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html?partnerid=59&gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dundertonenew%26userId%3D%24%7BUIDENC%7D%26gdpr%3D%24%7Bgdpr%7D%26gdpr_consent%3D%24%7Bgdpr_consent%7D%26us_privacy%3D%24%7Bus_privacy%7D
Protocol: H2
Server: 18.173.132.84 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-132-84.jfk52.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://cdn.undertone.com/

Response headers

via: 1.1 29117767a034875a8b49afd641f25d82.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
content-length: 0
x-amz-cf-id: knh0y7MpDRZVi5Qxot_D7yP1S3pGRbIw5KCZV22jrxa5hgT5IE4sBQ==
date: Thu, 14 Aug 2025 16:41:14 GMT
x-amz-cf-pop: JFK52-P2

Redirect headers

location: https://usr.undertone.com/userPixel/sync?partnerId=46&uid=d361044d-0ef5-4930-9f3e-bd0acfe3bdfd&ttl=1757781674
content-length: 249
date: Thu, 14 Aug 2025 16:41:14 GMT
server: Kestrel

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 0F34
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=12776
https://usr.undertone.com/userPixel/sync?partner=rubicon&uid=MEBMM1OU-24-3AAH
https://sync.cootlogix.com/api/cookie?partnerId=rubiconut&userId=MEBMM1OU-24-3AAH

43 B
496 B

144ms
143ms

Image
image/avif

157.230.83.84
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=rubiconut&userId=MEBMM1OU-24-3AAH
Requested by: Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html?partnerid=59&gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dundertonenew%26userId%3D%24%7BUIDENC%7D%26gdpr%3D%24%7Bgdpr%7D%26gdpr_consent%3D%24%7Bgdpr_consent%7D%26us_privacy%3D%24%7Bus_privacy%7D
Protocol: H2
Server: 157.230.83.84 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://cdn.undertone.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 14 Aug 2025 16:41:14 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

via: 1.1 29117767a034875a8b49afd641f25d82.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
location: https://sync.cootlogix.com/api/cookie?partnerId=rubiconut&userId=MEBMM1OU-24-3AAH
content-length: 0
date: Thu, 14 Aug 2025 16:41:14 GMT
x-amz-cf-pop: JFK52-P2
x-amz-cf-id: VCrnSLmDLde-7AKFJ82V49kjHEMMFfbqtw7m1PzzFOziTacgXY9y8g==

GET
H2 200 ImgSync
image8.pubmatic.com/AdServer/ Frame 0F34 0
40 B 147ms
142ms Image
text/plain 8.28.7.82
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL

https://image8.pubmatic.com/AdServer/ImgSync?p=160318&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D160318%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fusr.undertone.com%252FuserPixel%252Fsync%253FpartnerId%253D53%2526uid%253D%2523PMUID

Requested by

Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html?partnerid=59&gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dundertonenew%26userId%3D%24%7BUIDENC%7D%26gdpr%3D%24%7Bgdpr%7D%26gdpr_consent%3D%24%7Bgdpr_consent%7D%26us_privacy%3D%24%7Bus_privacy%7D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

8.28.7.82 , United States, ASN62713 (AS-PUBMATIC, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://cdn.undertone.com/

Response headers

date: Thu, 14 Aug 2025 16:41:14 GMT
strict-transport-security: max-age=16070400; includeSubDomains
content-length: 0

GET
H2

200

sync
usr.undertone.com/userPixel/ Frame 0F34
Redirect Chain

https://sync.cootlogix.com/api/user/image/55537adc33d1b40300987e8e?gdpr=&gdpr_consent=&redirect=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D59%26uid%3D%24%7BvdzUserSyncMacro%7D
https://usr.undertone.com/userPixel/sync?partnerId=59&uid=71804c84-3bb9-3075-0fbd-56b36e352495

0
193 B

137ms
137ms

Image
text/plain

18.173.132.84
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://usr.undertone.com/userPixel/sync?partnerId=59&uid=71804c84-3bb9-3075-0fbd-56b36e352495
Requested by: Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html?partnerid=59&gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dundertonenew%26userId%3D%24%7BUIDENC%7D%26gdpr%3D%24%7Bgdpr%7D%26gdpr_consent%3D%24%7Bgdpr_consent%7D%26us_privacy%3D%24%7Bus_privacy%7D
Protocol: H2
Server: 18.173.132.84 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-132-84.jfk52.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://cdn.undertone.com/

Response headers

via: 1.1 29117767a034875a8b49afd641f25d82.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
content-length: 0
x-amz-cf-id: _VslapJY4-gWu5kMkBf5xEmmbNz6hv5AJVrXb-6QbgmoX4uTTwooBw==
date: Thu, 14 Aug 2025 16:41:14 GMT
x-amz-cf-pop: JFK52-P2

Redirect headers

location: https://usr.undertone.com/userPixel/sync?partnerId=59&uid=71804c84-3bb9-3075-0fbd-56b36e352495
access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 0
date: Thu, 14 Aug 2025 16:41:14 GMT
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

GET occ
ups.analytics.yahoo.com/ups/58545/ Frame 0F34 0
0

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 0F34
Redirect Chain

https://usr.undertone.com/userPixel/syncr?gdpr=&gdprstr=&partnerId=59&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dundertonenew%26userId%3D%24UIDENC%26gdpr%3D%26gdpr_consent%3D%2...
https://sync.cootlogix.com/api/cookie?partnerId=undertonenew&userId=cuyaak63whb8b4uv7rp72y2p1&gdpr=&gdpr_consent=&us_privacy=

43 B
496 B

159ms
158ms

Image
image/avif

157.230.83.84
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=undertonenew&userId=cuyaak63whb8b4uv7rp72y2p1&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html?partnerid=59&gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dundertonenew%26userId%3D%24%7BUIDENC%7D%26gdpr%3D%24%7Bgdpr%7D%26gdpr_consent%3D%24%7Bgdpr_consent%7D%26us_privacy%3D%24%7Bus_privacy%7D
Protocol: H2
Server: 157.230.83.84 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://cdn.undertone.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 14 Aug 2025 16:41:14 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

via: 1.1 29117767a034875a8b49afd641f25d82.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
location: https://sync.cootlogix.com/api/cookie?partnerId=undertonenew&userId=cuyaak63whb8b4uv7rp72y2p1&gdpr=&gdpr_consent=&us_privacy=
content-length: 0
date: Thu, 14 Aug 2025 16:41:14 GMT
x-amz-cf-pop: JFK52-P2
x-amz-cf-id: b_02UqttYgnYnZdfYWiOTC-C7tDD6CHIYbw3Mt-sqH3NtAVNfYC1Eg==

GET
H2 200 usync.js Show response
eus.rubiconproject.com/ Frame A4DC 45 KB
0 223ms
222ms Script
text/html 23.200.198.128
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=12776
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.200.198.128 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-200-198-128.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) / PHP/8.3.13
Resource Hash: f7ed71321130d801efc364af8374857d86a9c55c8601828f1f4b151d33eb1722

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/usync.html?p=12776

Response headers

cache-control: max-age=12074
content-encoding: gzip
expires: Thu, 14 Aug 2025 20:02:24 GMT
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
content-length: 11507
date: Thu, 14 Aug 2025 16:41:10 GMT
last-modified: Wed, 13 Aug 2025 20:02:24 GMT
x-powered-by: PHP/8.3.13
server: Apache/2.4.62 (Debian)
content-type: text/html;charset=UTF-8
vary: Accept-Encoding

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame A4DC 7 B
2 KB 151ms
150ms XHR
application/json 69.173.151.100
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?khaos=MEBMM1OU-24-3AAH
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Cache-Control: no-cache,no-store,must-revalidate
Pragma: no-cache
access-control-allow-credentials: true
Expires: 0
access-control-allow-origin: https://eus.rubiconproject.com
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 83041abbe8494cb29eff3083edd6dff6
content-length: 7
content-type: application/json; charset=UTF-8

GET
H/1.1 200
OK pixel Show response
ps.eyeota.net/ 925 B
1 KB 342ms
341ms Script
application/javascript 44.205.65.132
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://ps.eyeota.net/pixel?e_rc=2&pid=m51mh00&t=ajs&uid=user_a79bdf49-d4be-40f1-bd06-450a96e62d46_1755189664469
Requested by: Host: ps.eyeota.net
URL: https://ps.eyeota.net/pixel?e_rc=1&pid=m51mh00&t=ajs&uid=user_a79bdf49-d4be-40f1-bd06-450a96e62d46_1755189664469
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 44.205.65.132 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-205-65-132.compute-1.amazonaws.com
Software: /
Resource Hash: f8f1fc74b874c62a906bd0d0c9e834fb2817ad6f61a350b37bd3f06442dbbb4b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 925
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 14 Aug 2025 16:41:16 GMT
Content-Type: application/javascript

GET
H2 200 qmap
sync.crwdcntrl.net/ 49 B
267 B 128ms
116ms Image
image/gif 3.220.65.116
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://sync.crwdcntrl.net/qmap?c=6387&gdpr=0&gdpr_consent=

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.220.65.116 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains
cache-control: no-cache
pragma: no-cache
expires: 0
access-control-allow-origin: *
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 49
date: Thu, 14 Aug 2025 16:41:16 GMT
content-type: image/gif

GET
H2 200 UCookieSetPug
image6.pubmatic.com/AdServer/ 0
193 B 394ms
134ms Image
text/html 207.65.37.181
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL

https://image6.pubmatic.com/AdServer/UCookieSetPug?gdpr=0&gdpr_consent=&rd=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fbid%3D7ri0rgu%26uid%3D%23PM_USER_ID

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

207.65.37.181 , United States, ASN62713 (AS-PUBMATIC, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16070400; includeSubDomains
content-length: 0
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 14 Aug 2025 16:41:16 GMT
content-type: text/html; charset=UTF-8

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://p.rfihub.com/cm?pub=24472&in=1
https://ps.eyeota.net/match?uid=2810035114880805478&bid=omt9pi0

70 B
440 B

563ms
562ms

Image
image/gif

44.205.65.132
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?uid=2810035114880805478&bid=omt9pi0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 44.205.65.132 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-205-65-132.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 14 Aug 2025 16:41:17 GMT
Content-Type: image/gif

Redirect headers

Location: https://ps.eyeota.net/match?uid=2810035114880805478&bid=omt9pi0
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Date: Thu, 14 Aug 2025 16:41:16 GMT
Server: Jetty(9.4.51.v20230217)

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://dmp.adform.net/serving/cookie/match/?party=1009
https://dmp.adform.net/serving/cookie/match/?CC=1&party=1009
https://ps.eyeota.net/match?uid=6724730401656193188&bid=9gdtmu1

70 B
440 B

184ms
182ms

Image
image/gif

44.205.65.132
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?uid=6724730401656193188&bid=9gdtmu1
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 44.205.65.132 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-205-65-132.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 14 Aug 2025 16:41:18 GMT
Content-Type: image/gif

Redirect headers

strict-transport-security: max-age=31536000; includeSubDomains
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
location: https://ps.eyeota.net/match?uid=6724730401656193188&bid=9gdtmu1
pragma: no-cache
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-methods: GET
expires: -1
access-control-allow-origin: *
content-length: 0
date: Thu, 14 Aug 2025 16:41:18 GMT
server: nginx
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With

GET
H2 200 cm
trc.taboola.com/sg/eyeota/1/ 43 B
409 B 467ms
147ms Image
image/gif 151.101.193.44
FASTLY

General

Check archive.org

Download Go to Show image

Full URL: https://trc.taboola.com/sg/eyeota/1/cm
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.193.44 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 0d9762a1a60deef8aa093c473ad27c38eed77184d6940e7df06d89d77cbd3e94

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
date: Thu, 14 Aug 2025 16:41:17 GMT
x-served-by: cache-yul1970025-YUL
x-cache-hits: 0
cache-control: no-cache, no-store
x-fastly-to-nlb-rtt: 25214
pragma: no-cache
x-timer: S1755189677.017176,VS0,VE27
x-vcl-time-ms: 27
access-control-allow-credentials: true
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
x-service-version: v1
server: nginx

GET
H/1.1 200
OK pixel Show response
ps.eyeota.net/ 1 KB
2 KB 521ms
519ms Script
application/javascript 44.205.65.132
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://ps.eyeota.net/pixel?e_rc=3&pid=m51mh00&t=ajs&uid=user_a79bdf49-d4be-40f1-bd06-450a96e62d46_1755189664469
Requested by: Host: ps.eyeota.net
URL: https://ps.eyeota.net/pixel?e_rc=2&pid=m51mh00&t=ajs&uid=user_a79bdf49-d4be-40f1-bd06-450a96e62d46_1755189664469
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 44.205.65.132 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-205-65-132.compute-1.amazonaws.com
Software: /
Resource Hash: e0774f8b869da1bfa382e6b16c7bc88453b8c6a2d478f1afd6a257c05a4915cb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 1285
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 14 Aug 2025 16:41:21 GMT
Content-Type: application/javascript

GET
H/1.1 200 dcm
s.amazon-adsystem.com/ 43 B
853 B 1413ms
118ms Image
image/gif 98.82.157.137
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=05d425ec-398a-44ad-b86d-773a0766ce18&id=2j7i-giYbF24fB6RDqdl4guEcPEx13C6c_QV0qupYMGs

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

98.82.157.137 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS