paint.toys
3.33.186.135 Public Scan Open in urlscan Pro

Software

Netlify /

Resource Hash

5764e7bbfaef797512a8c208ebbcc104a98e69605f5fa934138bbb831dafbf88

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://dfhwqd.fundacaoromeningh.pt/vjr7m1x97eaRSkJiNDVUV1BmWllmRmFUcDQ0SEstNTE5MC0yNjc2ODk3MS0xMDE5MDI3ZS04ODI0LWp2TVlmZHkweG1JWTFWSlV2bDla/bvsshelwxkrpvncmfzyjl/e8w1jzrmqtsffg6gqnnec9/1916688557497744563
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 28230
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-encoding: br
content-length: 2515
content-type: text/html; charset=UTF-8
date: Mon, 16 Mar 2026 01:26:55 GMT
etag: "c67a260f5c15298102f0d3906cf59d86-ssl-df"
server: Netlify
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-nf-request-id: 01KKT41N3WDKCZWFY94B7Z250T

Redirect headers

cache-status: "Netlify Edge"; fwd=miss
content-length: 98
content-type: text/html
date: Mon, 16 Mar 2026 01:26:55 GMT
location: /oil/
server: Netlify
strict-transport-security: max-age=31536000
x-nf-request-id: 01KKT41MY7P5F9G1ND84Z7AAPZ

GET
H2 200 ramp_config.js Show response
cdn.intergient.com/1024872/74068/ 39 KB
7 KB 250ms
108ms Script
application/javascript 104.18.20.56
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/1024872/74068/ramp_config.js
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6d84abab7dbc8e547e855da5023c97e519ad9040d633645ce66b177261f5c915

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: PT
cache-control: max-age=600, public, must-revalidate
content-encoding: br
cf-ray: 9dcff8f58e9293a7-LIS
alt-svc: h3=":443"; ma=86400
date: Mon, 16 Mar 2026 01:26:55 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

GET
H2 200 apps.css
paint.toys/ 6 KB
2 KB 156ms
156ms Stylesheet
text/css 3.33.186.135
Amazon.com

General

Check archive.org

Download Go to

Full URL

https://paint.toys/apps.css

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

Software

Netlify /

Resource Hash

98db09da3e1109288620e5f78abf4769bb160bb5d505ba03f683edd1227a4a53

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
content-encoding: br
etag: "56a5025fbb6b2d9217c0c90816b2fee9-ssl-df"
age: 90530
accept-ranges: bytes
content-length: 1643
x-nf-request-id: 01KKT41N8XYFPEZSN590TSCJH8
cache-status: "Netlify Edge"; hit
date: Mon, 16 Mar 2026 01:26:55 GMT
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: Netlify

GET
H2 200 index.js Show response
paint.toys/oil/ 4 KB
1 KB 161ms
161ms Script
application/javascript 3.33.186.135
Amazon.com

General

Check archive.org

Download Go to

Full URL

https://paint.toys/oil/index.js

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

Software

Netlify /

Resource Hash

1afce4631b4f1dcc9f08ca5b89182fa0e68307e0df60b096646ce66296354ae1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
content-encoding: br
etag: "94ae9b9ed2162106abf0e8e5295e04e0-ssl-df"
age: 85369
accept-ranges: bytes
content-length: 1263
x-nf-request-id: 01KKT41N8X5K5KGMZ5ZAA30SWF
cache-status: "Netlify Edge"; hit
date: Mon, 16 Mar 2026 01:26:55 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Netlify

GET
H2 200 art-icon.png
paint.toys/assets/ 33 KB
33 KB 157ms
156ms Image
image/png 3.33.186.135
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/art-icon.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

Software

Netlify /

Resource Hash

f4d368e4230539c778afbb020e0ea611b3e1d984179f5b3769b44081d6703f3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "1394f8469f2ca5750397e3d7b6ec70a1-ssl"
age: 69885
accept-ranges: bytes
content-length: 33562
x-nf-request-id: 01KKT41N8X95E62ATBQN3Z3AF1
cache-status: "Netlify Edge"; hit
date: Mon, 16 Mar 2026 01:26:55 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-hand.png
paint.toys/assets/ 27 KB
27 KB 377ms
376ms Image
image/png 3.33.186.135
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-hand.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

Software

Netlify /

Resource Hash

32aa05a5648678542ab9044647f0bf5549c0b53a070585edb773f0e92b72b97d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "a0822110a4671ffdf710da1467460fba-ssl"
age: 33372
accept-ranges: bytes
content-length: 27394
x-nf-request-id: 01KKT41N8XTVGFEMM3Z0S45E2Z
cache-status: "Netlify Edge"; hit
date: Mon, 16 Mar 2026 01:26:55 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-disk.png
paint.toys/assets/ 13 KB
14 KB 155ms
155ms Image
image/png 3.33.186.135
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-disk.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

Software

Netlify /

Resource Hash

436814c2374a6d92a42a02d39969ef7c56b5f225667abecb218e692c5569943c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "26852fa1548a91e004629b01e4abf1dd-ssl"
age: 33372
accept-ranges: bytes
content-length: 13766
x-nf-request-id: 01KKT41NMRVZM4QXETCQJQ1SZK
cache-status: "Netlify Edge"; hit
date: Mon, 16 Mar 2026 01:26:55 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-trash.png
paint.toys/assets/ 50 KB
51 KB 155ms
155ms Image
image/png 3.33.186.135
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-trash.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

Software

Netlify /

Resource Hash

6ceb226c487cb85243545e768944e0e1ae0944be8fde6c1c43c7314a9287e6d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "e91ef5e34b5154d392e8560031eaaa4c-ssl"
age: 33372
accept-ranges: bytes
content-length: 51680
x-nf-request-id: 01KKT41NNEY4TW63FCF0Y1JNSD
cache-status: "Netlify Edge"; hit
date: Mon, 16 Mar 2026 01:26:55 GMT
content-type: image/png
server: Netlify

GET
H2 200 ramp_core.js Show response
cdn.intergient.com/ 3 KB
1 KB 120ms
119ms Script
application/javascript 104.18.20.56
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/ramp_core.js
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 78d3a2a1cf35ea51af672bcede514218f0919687b848ffc1c12615c0b21cf9ff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: PT
cache-control: max-age=600, public, must-revalidate
content-encoding: br
cf-ray: 9dcff8f73f6793a7-LIS
alt-svc: h3=":443"; ma=86400
date: Mon, 16 Mar 2026 01:26:55 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 442 KB
151 KB 263ms
95ms Script
application/javascript 172.217.168.72
Google LLC

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.168.72 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

186.176.8.34.bc.googleusercontent.com

Software

Google Tag Manager /

Resource Hash

21a80e9697448eef68c562c4efd52525ff22dbf810e569d1911b6e53a0e349e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
content-encoding: zstd
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Mon, 16 Mar 2026 01:26:56 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 153878
date: Mon, 16 Mar 2026 01:26:56 GMT
x-xss-protection: 0
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Google Tag Manager
access-control-allow-headers: Cache-Control

GET
H2 200 css2
fonts.googleapis.com/ 3 KB
968 B 254ms
89ms Stylesheet
text/css 142.250.129.95
Google LLC

General

Check archive.org

Download Go to

Full URL

https://fonts.googleapis.com/css2?family=DM+Sans:wght@300;400;500&family=DM+Serif+Display&display=swap

Requested by

Host: paint.toys
URL: https://paint.toys/apps.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

142.250.129.95 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

lclhrb-in-f95.1e100.net

Software

ESF /

Resource Hash

0e43e66404ff234d0d874c9422542a2e6442c73246650d680490f46bedd60898

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 16 Mar 2026 01:26:55 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 16 Mar 2026 01:26:55 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Mon, 16 Mar 2026 01:26:55 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 m1mg4_ciexcc0.vendor.js Show response
faucetfoot.com/assets/ 97 KB
34 KB 210ms
79ms Script
text/javascript 34.8.176.186
Google LLC

General

Check archive.org

Download Go to

Full URL

https://faucetfoot.com/assets/m1mg4_ciexcc0.vendor.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.8.176.186 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),

Reverse DNS

Software

hoothoot/2276946183 /

Resource Hash

5fbaaef00156629b5959d3256eb30b5f98a0256125872cb917d4a4c28de3f847

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=15724800; preload
cache-control: private, must-revalidate, max-age=21600
timing-allow-origin: *
content-encoding: zstd
etag: W/"1f49bac3bdd7173da0952015ebb22c423d8621363dc0fe9e169c893e70aefc42"
via: fen-hoothoot-europe-west1-spot-k56t.gce-europe-west1, 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 16 Mar 2026 01:26:56 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding, Accept-Language
server: hoothoot/2276946183

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 106 KB
34 KB 254ms
95ms Script
text/javascript 142.250.129.155
Google LLC

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.129.155 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

lclhrb-in-f155.1e100.net

Software

cafe /

Resource Hash

b09acb336ab47e44d0ad80540dbb55dfc1392e343de32e47b30673604aa2e727

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 193 / 20528 / 31097189 / config-hash: 11956288090494106881
x-content-type-options: nosniff
expires: Mon, 16 Mar 2026 01:26:56 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Mon, 16 Mar 2026 01:26:56 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 34477
x-xss-protection: 0
server: cafe

GET
H2 200 prebid.522c7429775e32795ec4.js Show response
cdn.intergient.com/prebid/ 691 KB
209 KB 58ms
58ms Script
text/javascript 104.18.20.56
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/prebid/prebid.522c7429775e32795ec4.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 31991f4ab5a8d3cf78d72f880ee085feda12cf7a6eaa1f54ab6db2f924bcd002

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: PT
cache-control: public, max-age=31536000, immutable
content-encoding: br
cf-cache-status: HIT
etag: W/"54f5e14845de2539cc42d07339b335d1"
age: 1655362
cf-ray: 9dcff8f73f6a93a7-LIS
alt-svc: h3=":443"; ma=86400
date: Mon, 16 Mar 2026 01:26:55 GMT
content-type: text/javascript
last-modified: Tue, 24 Feb 2026 21:27:43 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 rP2Yp2ywxg089UriI5-g4vlH9VoD8Cmcqbu0-K4.woff2
fonts.gstatic.com/s/dmsans/v17/ 36 KB
36 KB 168ms
83ms Font
font/woff2 142.251.30.94
Google LLC

General

Check archive.org

Download Go to

Full URL

https://fonts.gstatic.com/s/dmsans/v17/rP2Yp2ywxg089UriI5-g4vlH9VoD8Cmcqbu0-K4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=DM+Sans:wght@300;400;500&family=DM+Serif+Display&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.30.94 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

sv-in-f94.1e100.net

Software

sffe /

Resource Hash

9fea608a947e67020c33cad9a6fe3d60c54119dfb8cff87768a8117a15ed7543

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Origin: https://paint.toys
Referer: https://fonts.googleapis.com/

Response headers

age: 485306
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Wed, 10 Mar 2027 10:38:29 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 10 Mar 2026 10:38:29 GMT
last-modified: Wed, 10 Sep 2025 16:31:03 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 36932
x-xss-protection: 0
server: sffe

GET
H2 200 pageos.js Show response
cdn.intergient.com/pageos/V.20260309.1/ 411 B
406 B 84ms
84ms Script
text/javascript 104.18.20.56
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20260309.1/pageos.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/ramp_core.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4a2748be77c4db7f307625dd415c614f4471973c729714678cbef2578bfa4369

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: PT
cache-control: public, max-age=31536000
content-encoding: br
cf-cache-status: HIT
etag: W/"cbbde0a5bb5d10b39cc3618793687ac4"
age: 468306
cf-ray: 9dcff8f7f80693a7-LIS
expires: Tue, 16 Mar 2027 01:26:56 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 16 Mar 2026 01:26:56 GMT
content-type: text/javascript
last-modified: Tue, 10 Mar 2026 14:04:20 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 runtime.6b45652da3a28a52717a.js Show response
cdn.intergient.com/pageos/V.20260309.1/ 4 KB
2 KB 54ms
53ms Script
text/javascript 104.18.20.56
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20260309.1/runtime.6b45652da3a28a52717a.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260309.1/pageos.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: e2e944d47d525002fa0fda4f96ab3299ebe3d1dad45e50bf7a199bf49d709893

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: PT
cache-control: public, max-age=31536000
content-encoding: br
cf-cache-status: HIT
etag: W/"d0970ca931df1e7221275ff1430b8e48"
age: 468306
cf-ray: 9dcff8f8888f93a7-LIS
expires: Tue, 16 Mar 2027 01:26:56 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 16 Mar 2026 01:26:56 GMT
content-type: text/javascript
last-modified: Tue, 10 Mar 2026 14:04:21 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 main.ae82acf4b07e6ef288d4.js Show response
cdn.intergient.com/pageos/V.20260309.1/ 554 KB
170 KB 56ms
55ms Script
text/javascript 104.18.20.56
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20260309.1/main.ae82acf4b07e6ef288d4.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260309.1/pageos.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: f94be857ea3e13feab9326211d4fe752cdf800af90a29d57155c254553f5cbd2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: PT
cache-control: public, max-age=31536000
content-encoding: br
cf-cache-status: HIT
etag: W/"a43de54548b8dc862420d701ac16a276"
age: 468306
cf-ray: 9dcff8f8889093a7-LIS
expires: Tue, 16 Mar 2027 01:26:56 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 16 Mar 2026 01:26:56 GMT
content-type: text/javascript
last-modified: Tue, 10 Mar 2026 14:04:18 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 skeleton.gif
static.adsafeprotected.com/ 43 B
481 B 257ms
85ms Image
image/gif 3.174.46.80
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://static.adsafeprotected.com/skeleton.gif?service=ad&adid=pqxovk&adnum=492471
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.174.46.80 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-3-174-46-80.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: "45cf913e5d9d3c9b2058033056d3dd23"
x-amz-version-id: iiN8XkcmZQdDIQeKkzAiegPwcD.5WPja
age: 2909461
x-cache: Hit from cloudfront
x-amz-cf-id: D9G5UBOrQso4Kqaht3sD658S-N1K2B8zCSW4ZPEbqwDlQQ6n8Oo3hg==
date: Tue, 10 Feb 2026 09:15:56 GMT
content-type: image/gif
last-modified: Mon, 17 Aug 2020 23:55:15 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 10a31a8919932a2483a8dee40abc5178.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 43
x-amz-cf-pop: FRA60-P12
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 videoCard.cea8a6bd8cad3ad73428.js Show response
cdn.intergient.com/pageos/V.20260309.1/ 552 B
457 B 54ms
54ms Script
text/javascript 104.18.20.56
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20260309.1/videoCard.cea8a6bd8cad3ad73428.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260309.1/runtime.6b45652da3a28a52717a.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0a0a95fd080f68f2d8c0a916f30cdb5cde422c6908dd64bd98043ef5c160f0f1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: PT
cache-control: public, max-age=31536000
content-encoding: br
cf-cache-status: HIT
etag: W/"b923f9cae7c940f9f384e93b5120abff"
age: 468305
cf-ray: 9dcff8f948ec93a7-LIS
expires: Tue, 16 Mar 2027 01:26:56 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 16 Mar 2026 01:26:56 GMT
content-type: text/javascript
last-modified: Tue, 10 Mar 2026 14:04:26 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 iframe.html Show response
cdn.intergient.com/pageos/V.20260309.1/iframe/ Frame 94BC 1 KB
851 B 189ms
52ms Document
text/html 104.18.20.56
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20260309.1/iframe/iframe.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260309.1/main.ae82acf4b07e6ef288d4.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1a7a0da69c9b0f91641c6ae8ae9fcc0804d56db0c7bcbe202cb8339a20345b7a

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36

Response headers

age: 468306
alt-svc: h3=":443"; ma=86400
cache-control: public, max-age=31536000
cf-cache-status: HIT
cf-ray: 9dcff8fa1fc9b2a2-LIS
content-encoding: br
content-type: text/html
date: Mon, 16 Mar 2026 01:26:56 GMT
expires: Tue, 16 Mar 2027 01:26:56 GMT
hw-country-code: PT
last-modified: Tue, 10 Mar 2026 14:04:17 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 gdpr.cb77810dde1dbfe83191.js Show response
cdn.intergient.com/pageos/V.20260309.1/ 6 KB
2 KB 54ms
53ms Script
text/javascript 104.18.20.56
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20260309.1/gdpr.cb77810dde1dbfe83191.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260309.1/runtime.6b45652da3a28a52717a.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5bb55e332151af2bd8292db0028efd3e891545bb2abace6473ceda51db9f7a45

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: PT
cache-control: public, max-age=31536000
content-encoding: br
cf-cache-status: HIT
etag: W/"23596a544b29c0b05432c914ace3ea3e"
age: 468306
cf-ray: 9dcff8f948ef93a7-LIS
expires: Tue, 16 Mar 2027 01:26:56 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 16 Mar 2026 01:26:56 GMT
content-type: text/javascript
last-modified: Tue, 10 Mar 2026 14:04:16 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 GDPR Show response
impression-inferences-edge-prod.playwire.com/websites/74068/v1/Sun/21/desktop/Chrome/ 27 B
362 B 278ms
92ms XHR
application/json 18.245.46.100
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://impression-inferences-edge-prod.playwire.com/websites/74068/v1/Sun/21/desktop/Chrome/GDPR
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260309.1/main.ae82acf4b07e6ef288d4.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.245.46.100 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-18-245-46-100.fra56.r.cloudfront.net
Software: CloudFront /
Resource Hash: 9fc044cb2022940f48beb1fcacb7ff4e4e3718784754ef291dbdca2dba5dd1ad

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=3600, public, must-revalidate
access-control-expose-headers: *
age: 1528
via: 1.1 5a2cb96a37aeca3f9626798c4e9dab28.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Hit from cloudfront
content-length: 27
x-amz-cf-id: GqNiVMiK93Vhk7sNF9PdoRkdcmOZRPYb5cjaI01SpO1mGChzhSKRew==
date: Mon, 16 Mar 2026 01:01:28 GMT
content-type: application/json
x-amz-cf-pop: FRA56-P9
server: CloudFront

GET
H2 200 tag Show response
btloader.com/ 179 KB
49 KB 143ms
52ms Script
application/javascript 172.66.171.133
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260309.1/main.ae82acf4b07e6ef288d4.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.66.171.133 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 603e30c09146be318b1937f8be3b2c7e26e37e1c37eda883a88ff11f30a36580

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-robots-tag: noindex, nofollow
cache-control: public, max-age=300, stale-if-error=3600, stale-while-revalidate=300
content-encoding: br
cf-cache-status: HIT
etag: W/"9dcad5d91d7d33e71a7896c8359cf5a5"
via: 1.1 google
cf-ray: 9dcff8f9ea6ce3d0-LIS
access-control-allow-origin: *
date: Mon, 16 Mar 2026 01:26:56 GMT
content-type: application/javascript
last-modified: Mon, 16 Mar 2026 00:24:18 GMT
server: cloudflare
vary: Accept-Encoding, X-Acceptable-Ads, DNT

GET
H2 200 1x1.gif
raw.githubusercontent.com/easylist/easylist/master/docs/ 43 B
583 B 141ms
45ms Image
image/gif 185.199.109.133
Fastly

General

Check archive.org

Download Go to Show image

Full URL

https://raw.githubusercontent.com/easylist/easylist/master/docs/1x1.gif

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.199.109.133 , United States, ASN54113 (FASTLY - Fastly, Inc., US),

Reverse DNS

cdn-185-199-109-133.github.com

Software

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; style-src 'unsafe-inline'; sandbox
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-fastly-request-id: c1bbcb488add6978b8e4f9198a422ac8b206f031
etag: W/"0c4a5773f7e435c57c40bd270aef756513eba26bd7ba5317b5bd765569a7325d"
x-content-type-options: nosniff
x-github-request-id: F260:367167:80C1C5:91C10B:699FF4A1
expires: Mon, 16 Mar 2026 01:31:56 GMT
x-cache: HIT
date: Mon, 16 Mar 2026 01:26:56 GMT
content-type: image/gif
x-served-by: cache-lis1490046-LIS
x-cache-hits: 10
source-age: 178
x-frame-options: deny
strict-transport-security: max-age=31536000
vary: Authorization,Accept-Encoding
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
cache-control: max-age=300
x-timer: S1773624416.303599,VS0,VE0
cross-origin-resource-policy: cross-origin
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
content-length: 43
x-xss-protection: 1; mode=block

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202603100101/ 586 KB
184 KB 86ms
86ms Script
text/javascript 142.250.129.155
Google LLC

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202603100101/pubads_impl.js?cb=31097189

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.129.155 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

lclhrb-in-f155.1e100.net

Software

cafe /

Resource Hash

9481f03cd082f9a97ea027108e032feb34ec2f23f9537295ab47262308c9fc0b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 7755772273650124547
age: 56630
x-content-type-options: nosniff
expires: Mon, 15 Mar 2027 09:43:06 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Sun, 15 Mar 2026 09:43:06 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 188312
x-xss-protection: 0
server: cafe

GET
H3 200 gpt
securepubads.g.doubleclick.net/pagead/managed/dict/m202603120101/ 64 KB
23 KB 83ms
82ms Other
text/plain 142.250.129.155
Google LLC

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/dict/m202603120101/gpt

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.129.155 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

lclhrb-in-f155.1e100.net

Software

cafe /

Resource Hash

f184cb4d6a26e808fee7e6127bd5e2bf944860c6fa9799312a88f037304fc1ed

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 2776994303440329288
age: 33355
x-content-type-options: nosniff
expires: Sun, 22 Mar 2026 16:11:01 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Sun, 15 Mar 2026 16:11:01 GMT
content-type: text/plain; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=604800, stale-while-revalidate=7200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 23492
x-xss-protection: 0
server: cafe
use-as-dictionary: match="/gampad/ads", id="m202603120101"

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 387 KB
137 KB 96ms
95ms Script
application/javascript 172.217.168.72
Google LLC

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-CEFZJ359V8&cx=c&gtm=4e63b1

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.168.72 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a2bb30c4ed1be0d5f49baa6308010df022476202e760ce720d843e85b9a46d9c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
content-encoding: zstd
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Mon, 16 Mar 2026 01:26:56 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 139886
date: Mon, 16 Mar 2026 01:26:56 GMT
x-xss-protection: 0
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Google Tag Manager
access-control-allow-headers: Cache-Control

POST
H2 204 collect
region1.google-analytics.com/g/ 0
0 202ms
75ms Fetch
text/plain 216.239.32.36
Google LLC

General

Check archive.org

Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-VJBRK9986D&gtm=45je63b1v9101576445za200zd9101576445&_p=1773624415440&gcd=13l3l3l2l1l1&npa=1&dma_cps=a&dma=1&cid=1207575171.1773624416&ul=pt-pt&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&tag_exp=103116026~103200004~115938465~115938468~116024733~117484252&sid=1773624416&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Fdfhwqd.fundacaoromeningh.pt%2F&dt=Paint%20with%20Oils&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=1629
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 216.239.32.36 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:113:0
report-to: {"group":"ascnsrsggc:113:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:113:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:113:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 16 Mar 2026 01:26:56 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 iframe.js Show response
cdn.intergient.com/pageos/V.20260309.1/iframe/ Frame 94BC 17 KB
7 KB 57ms
56ms Script
text/javascript 104.18.20.56
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20260309.1/iframe/iframe.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260309.1/iframe/iframe.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: a1e9592b119e182885673d049ec2ead66dab57473f2f6da59f43d888cea5ac1e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://cdn.intergient.com/pageos/V.20260309.1/iframe/iframe.html

Response headers

hw-country-code: PT
cache-control: public, max-age=31536000
content-encoding: br
cf-cache-status: HIT
etag: W/"3eecc5d11812ac69fb4f2c63c5dea237"
age: 468306
cf-ray: 9dcff8fa7831b2a2-LIS
expires: Tue, 16 Mar 2027 01:26:56 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 16 Mar 2026 01:26:56 GMT
content-type: text/javascript
last-modified: Tue, 10 Mar 2026 14:04:17 GMT
vary: Accept-Encoding
server: cloudflare

POST
H2 204 collect
region1.google-analytics.com/g/ 0
0 75ms
75ms Fetch
text/plain 216.239.32.36
Google LLC

General

Check archive.org

Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-CEFZJ359V8&gtm=45je63b1v9102396898za200zb9101576445zd9101576445&_p=1773624415440&gcd=13l3l3l2l1l1&npa=1&dma_cps=a&dma=1&cid=1207575171.1773624416&ul=pt-pt&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&tag_exp=102015666~103116026~103200004~115616985~115938465~115938469~116024733~117484252&sid=1773624416&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Fdfhwqd.fundacaoromeningh.pt%2F&dt=Paint%20with%20Oils&en=ramp_js&_fv=1&_ss=1&_ee=1&ep.pageview_id=1773624415440&tfd=1769
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-CEFZJ359V8&cx=c&gtm=4e63b1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 216.239.32.36 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:113:0
report-to: {"group":"ascnsrsggc:113:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:113:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:113:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 16 Mar 2026 01:26:56 GMT
content-type: text/plain
server: Golfe2

GET
H3 200 a
www.googletagmanager.com/ 0
11 B 89ms
88ms Image
text/html 172.217.168.72
Google LLC

General

Check archive.org

Download Go to Show image

Full URL

https://www.googletagmanager.com/a?id=G-CEFZJ359V8&v=3&t=t&pid=2117318831&gtm=45je63b1v9102396898za200zb9101576445zd9101576445&cv=1&rv=63b1&tc=7&tag_exp=102015666~103116026~103200004~115616985~115938465~115938469~116024733~117484252&es=1&e=gtm.init&eid=2&u=AAAAAAAAAAAAAAAgAAAAAABA&h=Ag&tr=1ogt1pdatav2.1ccdgafirst.1setproductsettings.1ccdgaregscope.1ccdconversionmarking.1ccdgalast&ti=2ogt1pdatav2.2ccdgafirst.2setproductsettings.2ccdgaregscope.2ccdconversionmarking.2ccdgalast&z=0

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.168.72 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Mon, 16 Mar 2026 01:26:56 GMT
x-xss-protection: 0
content-type: text/html
server: Google Tag Manager

GET
H3 200 a
www.googletagmanager.com/ 0
11 B 97ms
96ms Image
text/html 172.217.168.72
Google LLC

General

Check archive.org

Download Go to Show image

Full URL

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.168.72 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Mon, 16 Mar 2026 01:26:56 GMT
x-xss-protection: 0
content-type: text/html
server: Google Tag Manager

GET
H3 200 a
www.googletagmanager.com/ 0
11 B 97ms
97ms Image
text/html 172.217.168.72
Google LLC

General

Check archive.org

Download Go to Show image

Full URL

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.168.72 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Mon, 16 Mar 2026 01:26:56 GMT
x-xss-protection: 0
content-type: text/html
server: Google Tag Manager

GET
H3 200 a
www.googletagmanager.com/ 0
11 B 98ms
97ms Image
text/html 172.217.168.72
Google LLC

General

Check archive.org

Download Go to Show image

Full URL

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.168.72 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Mon, 16 Mar 2026 01:26:56 GMT
x-xss-protection: 0
content-type: text/html
server: Google Tag Manager

GET
H3 200 a
www.googletagmanager.com/ 0
11 B 99ms
98ms Image
text/html 172.217.168.72
Google LLC

General

Check archive.org

Download Go to Show image

Full URL

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.168.72 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Mon, 16 Mar 2026 01:26:56 GMT
x-xss-protection: 0
content-type: text/html
server: Google Tag Manager

GET main.js
cdn.intergient.com/cdn-cgi/challenge-platform/scripts/jsd/ Frame A128 0
0

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
110 B 140ms
48ms Fetch
image/gif 104.20.47.80
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=2&e=0.9766519463720936
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.47.80 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 942408
x-goog-stored-content-encoding: identity
expires: Thu, 05 Mar 2026 03:40:45 GMT
x-goog-stored-content-length: 43
date: Mon, 16 Mar 2026 01:26:56 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH8-vjlDXUPURhkYZQuCbklw5HEqrQPoIxWeNr5b2HFnZnkflerafjIoH0cVJi8HNxqWvGiioHEw
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9dcff8fb9b33d852-LIS
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico Show response
ad.doubleclick.net/ 1 KB
129 B 181ms
90ms Fetch
image/x-icon 142.250.201.166
Google LLC

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.9485583293233689

Requested by

Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.201.166 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

186.176.8.34.bc.googleusercontent.com

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Tue, 17 Mar 2026 01:26:56 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 16 Mar 2026 01:26:56 GMT
content-type: image/x-icon
vary: Accept-Encoding
last-modified: Tue, 08 May 2012 13:08:06 GMT
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
616 B 139ms
47ms Fetch
image/gif 104.20.47.80
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.23302814136749628
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.47.80 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 942408
x-goog-stored-content-encoding: identity
expires: Thu, 05 Mar 2026 03:40:45 GMT
x-goog-stored-content-length: 43
date: Mon, 16 Mar 2026 01:26:56 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH8-vjlDXUPURhkYZQuCbklw5HEqrQPoIxWeNr5b2HFnZnkflerafjIoH0cVJi8HNxqWvGiioHEw
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9dcff8fb9b32d852-LIS
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H2 200 dns Show response
ab.dns-finder.com/meta/ 2 B
233 B 274ms
159ms Fetch
text/plain 34.36.200.111
Google LLC

General

Check archive.org

Download Go to

Full URL: https://ab.dns-finder.com/meta/dns
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.36.200.111 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS: 111.200.36.34.bc.googleusercontent.com
Software: /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private, max-age=180, stale-if-error=180, stale-while-revalidate=180
access-control-expose-headers: X-Resolver
x-resolver: default
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
date: Mon, 16 Mar 2026 01:26:56 GMT
content-type: text/plain; charset=utf-8
vary: Origin

GET
H2 200 trustedIframe.html Show response
btloader.com/ Frame 9AAF 6 KB
2 KB 166ms
74ms Document
text/html 172.66.171.133
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://btloader.com/trustedIframe.html?o=5150306120761344&upapi=true
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.66.171.133 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7699df53e5893e0a67e04e9143a9712d557c79a537b07d20fb9e6911f1f6636a

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36

Response headers

cache-control: public, max-age=3600, stale-while-revalidate=3600
cf-ray: 9dcff8fbad5448a0-LIS
content-encoding: br
content-type: text/html
date: Mon, 16 Mar 2026 01:26:56 GMT
server: cloudflare

POST
H3 200 l15cr2cwixdbtie70l2mst886 Show response
faucetfoot.com/ 303 B
327 B 159ms
84ms Fetch
application/json 34.8.176.186
Google LLC

General

Check archive.org

Download Go to

Full URL

https://faucetfoot.com/l15cr2cwixdbtie70l2mst886

Requested by

Host: faucetfoot.com
URL: https://faucetfoot.com/assets/m1mg4_ciexcc0.vendor.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.8.176.186 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),

Reverse DNS

Software

hoothoot/2276946183 /

Resource Hash

28b7f4cf227740c0be41a71a109872f5bf3b3f6c5bebaf4f47d4edd1baf37feb

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=15724800; preload
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: POST, OPTIONS
via: fen-hoothoot-europe-west1-spot-k56t.gce-europe-west1, 1.1 google
expires: Mon, 16 Mar 2026 01:26:55 GMT
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 303
date: Mon, 16 Mar 2026 01:26:56 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding, Origin
server: hoothoot/2276946183
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Cookie

GET
H2 200 154013155 Show response
fundingchoicesmessages.google.com/i/ 216 KB
70 KB 262ms
105ms Script
application/javascript 172.217.76.101
Google LLC

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/154013155?ers=3

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202603100101/pubads_impl.js?cb=31097189

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.76.101 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

lcfraa-bl-in-f10.1e100.net

Software

ESF /

Resource Hash

6cd0d3475bb55baaf8ccac8294c75ba318790e0824dd1730dac995606159a38d

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-iutJ5xC6Scr8FdWgRT9m_g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 16 Mar 2026 01:26:56 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjqtHikmJw15BiOHHrNtMFIG69eY51OhCXLDrP2gbEXUA8B4gNFS6xOgPxh_rLrD-AuEjiCmsLEH-qusEqUn2D9VuxLxtHiS_bkyl-bN-AmOWtP5vhygA2SyBWOxrAZgHEC6cFsq0E4jsxQWxPgFiIh-PBjrtn2QR-vJr-lklJIym_MD45P6-kKDOptCS_KC05LbU4tagstSjeyMDIzMDY0EjPwDS-wAAA8bxIUA"
content-security-policy: script-src 'report-sample' 'nonce-iutJ5xC6Scr8FdWgRT9m_g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

POST
H2 204 exd
api.btloader.com/ 0
0 268ms
155ms Fetch 130.211.23.194
Google LLC

General

Check archive.org

Download Go to

Full URL: https://api.btloader.com/exd?tid=KVtkU74afT-Jq2C8x20y-9cf440d8cb&sid=02Ry23Rg-DWUA0UWZ-9cf440d8cb&cv=2.1.184&upapi=true
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.23.194 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS: 194.23.211.130.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

via: 1.1 google
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 16 Mar 2026 01:26:56 GMT
vary: Origin

GET
H2 200 iframe.html Show response
cdn.intergient.com/pageos/V.20260309.1/iframe/ Frame 0613 1 KB
0 0ms
0ms Document
text/html 104.18.20.56
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20260309.1/iframe/iframe.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260309.1/main.ae82acf4b07e6ef288d4.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1a7a0da69c9b0f91641c6ae8ae9fcc0804d56db0c7bcbe202cb8339a20345b7a

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36

Response headers

age: 468306
alt-svc: h3=":443"; ma=86400
cache-control: public, max-age=31536000
cf-cache-status: HIT
cf-ray: 9dcff8fa1fc9b2a2-LIS
content-encoding: br
content-type: text/html
date: Mon, 16 Mar 2026 01:26:56 GMT
expires: Tue, 16 Mar 2027 01:26:56 GMT
hw-country-code: PT
last-modified: Tue, 10 Mar 2026 14:04:17 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 350 KB
89 KB 317ms
103ms Script
application/javascript 13.33.52.91
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260309.1/main.ae82acf4b07e6ef288d4.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.52.91 New York, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-33-52-91.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 70817fa32bc61e3c4dd3bf4a90d4a5162adb938413a83f43382c644bc0155962

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: max-age=3600
content-encoding: gzip
etag: W/"523aab6324dcde5f8b8db001d43908eb"
age: 775
via: 1.1 fe5f2d46fff25f2d03917e482fe3f670.cloudfront.net (CloudFront), 1.1 a16f1fe9224bb87d6515221a5b907364.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: 9kFOgJZEn3fwTVIrA1_iEUKKU403evE9Ue3HNkCdpA4lxLHs20-f4A==
date: Mon, 16 Mar 2026 01:14:02 GMT
content-type: application/javascript
x-amz-cf-pop: FRA56-P14, FRA56-P15
server: AmazonS3
last-modified: Wed, 11 Mar 2026 21:28:12 GMT
x-amz-server-side-encryption: AES256

GET
H2 200 iframe.js Show response
cdn.intergient.com/pageos/V.20260309.1/iframe/ Frame 0613 17 KB
0 57ms
56ms Script
text/javascript 104.18.20.56
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20260309.1/iframe/iframe.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260309.1/iframe/iframe.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: a1e9592b119e182885673d049ec2ead66dab57473f2f6da59f43d888cea5ac1e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://cdn.intergient.com/pageos/V.20260309.1/iframe/iframe.html

Response headers

hw-country-code: PT
cache-control: public, max-age=31536000
content-encoding: br
cf-cache-status: HIT
etag: W/"3eecc5d11812ac69fb4f2c63c5dea237"
age: 468306
cf-ray: 9dcff8fa7831b2a2-LIS
expires: Tue, 16 Mar 2027 01:26:56 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 16 Mar 2026 01:26:56 GMT
content-type: text/javascript
last-modified: Tue, 10 Mar 2026 14:04:17 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2

200

main.js Show response
cdn.intergient.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/ea2d291c0fdc/ Frame 05E1
Redirect Chain

https://cdn.intergient.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
https://cdn.intergient.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/ea2d291c0fdc/main.js?

25 KB
11 KB

53ms
53ms

Script
application/javascript

104.18.20.56
Cloudflare

General

Check archive.org

Download Go to

Full URL

https://cdn.intergient.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/ea2d291c0fdc/main.js?

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

0e3f7516579b96b28a9437f885b1014b03801c356023d2b4eb167f25be6c31d5

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer

Response headers

hw-country-code: PT
cache-control: max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public
content-encoding: br
x-content-type-options: nosniff
cf-ray: 9dcff8fd2b60b2a2-LIS
alt-svc: h3=":443"; ma=86400
date: Mon, 16 Mar 2026 01:26:56 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

Redirect headers

hw-country-code: PT
cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public
location: /cdn-cgi/challenge-platform/h/g/scripts/jsd/ea2d291c0fdc/main.js?
cf-ray: 9dcff8fcdaf1b2a2-LIS
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
content-length: 0
date: Mon, 16 Mar 2026 01:26:56 GMT
vary: Accept-Encoding
server: cloudflare

GET 34cada1e-0a41-427e-9751-f1b21eda101f
https://paint.toys/ 0
0

GET
H2 200 474.54ec3c969d5dcf548468.js Show response
cdn.intergient.com/pageos/V.20260309.1/ 3 KB
1 KB 61ms
61ms Script
text/javascript 104.18.20.56
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20260309.1/474.54ec3c969d5dcf548468.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260309.1/runtime.6b45652da3a28a52717a.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 70fdcbbe7129a79cab3b0839348a16e359bda7056b157c52ec8d2cb89d40fa3e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: PT
cache-control: public, max-age=31536000
content-encoding: br
cf-cache-status: HIT
etag: W/"a4ba8a8e24e7796c977c7ad0213bf24d"
age: 468306
cf-ray: 9dcff8fceabe93a7-LIS
expires: Tue, 16 Mar 2027 01:26:56 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 16 Mar 2026 01:26:56 GMT
content-type: text/javascript
last-modified: Tue, 10 Mar 2026 14:04:09 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 ima3.js Show response
imasdk.googleapis.com/js/sdkloader/ 463 KB
146 KB 303ms
109ms Script
text/javascript 142.251.208.170
Google LLC

General

Check archive.org

Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/ima3.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260309.1/main.ae82acf4b07e6ef288d4.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

142.251.208.170 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

414e2119c136e91e29762f6222c5397b5188a301f319c39cc7ec430fe9a3cd65

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 11755807146990761803
x-content-type-options: nosniff
expires: Mon, 16 Mar 2026 01:26:56 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Mon, 16 Mar 2026 01:26:56 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 148598
x-xss-protection: 0
server: cafe

POST
H2 200 fb87a4ea41 Show response
cd836371f1d.cdn.intergient.com/ 0
96 B 276ms
90ms XHR
application/octet-stream 3.73.242.72
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://cd836371f1d.cdn.intergient.com/fb87a4ea41
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260309.1/main.ae82acf4b07e6ef288d4.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.73.242.72 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-3-73-242-72.eu-central-1.compute.amazonaws.com
Software: nginx/1.24.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

access-control-allow-origin: *
date: Mon, 16 Mar 2026 01:26:56 GMT
content-type: application/octet-stream
server: nginx/1.24.0

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
116 B 48ms
48ms Fetch
image/gif 104.20.47.80
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.8272972979833645
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.47.80 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 942409
x-goog-stored-content-encoding: identity
expires: Thu, 05 Mar 2026 03:40:45 GMT
x-goog-stored-content-length: 43
date: Mon, 16 Mar 2026 01:26:56 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH8-vjlDXUPURhkYZQuCbklw5HEqrQPoIxWeNr5b2HFnZnkflerafjIoH0cVJi8HNxqWvGiioHEw
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9dcff8fd2de5d852-LIS
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

POST
H2 200 9dcff8fa1fc9b2a2 Show response
cdn.intergient.com/cdn-cgi/challenge-platform/h/g/jsd/oneshot/ea2d291c0fdc/0.7333969891054388:1773621027:jAB_VrBouhumY1_4ZaB9tJOlhPxnYOiFuVcsbCZ3Gzg/ Frame 05E1 0
1 KB 102ms
97ms XHR
text/plain 104.18.20.56
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/cdn-cgi/challenge-platform/h/g/jsd/oneshot/ea2d291c0fdc/0.7333969891054388:1773621027:jAB_VrBouhumY1_4ZaB9tJOlhPxnYOiFuVcsbCZ3Gzg/9dcff8fa1fc9b2a2
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer

Response headers

hw-country-code: PT
timing-allow-origin: https://cdn.intergient.com
cf-ray: 9dcff8fdcc02b2a2-LIS
alt-svc: h3=":443"; ma=86400
content-length: 0
cf-chl-out-s: 88iSljXcBYPnZY7gZKN8Ah4hRAj1vXQJxsFzahx7E8tTxwazAXVpPMGxZfXZY5i9WlG6QOfwOG+ziudojHRP0E8VgPkiNSPRKwC3KeL43c4u4VbLeO42UZKmMeh0kpxB8cqg7AxZsLbh6E9GlL6BrucZ1Z9WLWOyGqX6gQrx9wpZ2MwD1v/cGIPg081FJymCwwj5iNVrqynsAuh4KkB4ROLnPQXH4KRBrUt52kFC7PQZAYhXN5q/V5ICU3Ash5IY1rtJ7j5zMZAFXnlVWOHsi4RQ/J/WLga3l5Vx1xXXYRn1kO7eMeoYTRJAG3jIEVuqn5VbfGXfVWBwZWa5JHZ7rCETO7Q8GuKbPv+TXq14JGq4joto/T5Le1xNSYPwzLDFcxEdWAoo3dS6tWAIpi4nAduVxkaJk5F3/peOw+oUysoG2JD4hg2/oAwWfU08/sAMCvF1OkNWLXYw6k1rVv2eXj7OxlgsVFoxl6NNs2jp+d1x3riopDuBt60WVrSi3rigo+PiQPrxPhw+STxxgLcd/2c3zm9LkppckxLd6OEdlwvgZrkZu1B+O6+snYibncRzbAVr5K4/Xennb0Cnc9zA+9Rbvmj+nJaYaKObr7qiOu3x3n2pEnxu7prx5Is3wu72YejDxsqbq1SUFPftbr9X7xBog3Ww8r4Qe+9EET2od1QIZLJSFmwAMjeWUloxNUp8J2IMIJryZHbzMnIJR2Svpw==$3sHTw2jlI1Yad1lbXMUAIg==
date: Mon, 16 Mar 2026 01:26:56 GMT
content-type: text/plain; charset=UTF-8
server: cloudflare

POST
H3 204 AGSKWxVcjYReVdpOAlJV5JgW4vaQIv39vY2T4OlmJQGXD2Qw4MFvuk33fGhwaPemHjl6gT9Geu7SLPiFpzm3g_cH1S5SWnadPV_DplSSCFkRq_WGjqE2rLnC_YxtBGiNaBnXUV8k45oWOQ== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 262ms
112ms XHR
text/html 172.217.76.101
Google LLC

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxVcjYReVdpOAlJV5JgW4vaQIv39vY2T4OlmJQGXD2Qw4MFvuk33fGhwaPemHjl6gT9Geu7SLPiFpzm3g_cH1S5SWnadPV_DplSSCFkRq_WGjqE2rLnC_YxtBGiNaBnXUV8k45oWOQ==

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.pt_PT.XeV9XhaOjKQ.es5.O/d=1/rs=AJlcJMwErd8boc5mVL0h5gtEsLo5q7xW0Q/m=kernel_loader,loader_js_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.76.101 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-LMQKcN0AJSno385RXO_MGQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 16 Mar 2026 01:26:57 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjMtDikmJw0pBi-FB_mfUHEBuuDGCzBGLTkEA2ZyBeOC2QbSUQ34kJYnsCxELcHA933D3LJjDh_iUXJZek_ML45Py8ktS8Et3ElGJdELsoM6m0JL8IhZ1aBlKRk5-enpmXHm9kYGRmYGxopGdgFl9gAAA2QC9E"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-LMQKcN0AJSno385RXO_MGQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxVcjYReVdpOAlJV5JgW4vaQIv39vY2T4OlmJQGXD2Qw4MFvuk33fGhwaPemHjl6gT9Geu7SLPiFpzm3g_cH1S5SWnadPV_DplSSCFkRq_WGjqE2rLnC_YxtBGiNaBnXUV8k45oWOQ==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.76.101 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-BNMzJXCguYIgOW7WIVPBBw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 16 Mar 2026 01:26:57 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjMtDikmII1JBi-FB_mfUHEBuuDGCzBGKzkEA2FyBeOC2QbSUQ34kJYnsCxELcHA933D3LJvBi9kUXJZek_ML45Py8ktS8Et3ElGJdELsoM6m0JL8IhZ1aBlKRk5-enpmXHm9kYGRmYGxopGdgFl9gAABERy9o"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-BNMzJXCguYIgOW7WIVPBBw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxVcjYReVdpOAlJV5JgW4vaQIv39vY2T4OlmJQGXD2Qw4MFvuk33fGhwaPemHjl6gT9Geu7SLPiFpzm3g_cH1S5SWnadPV_DplSSCFkRq_WGjqE2rLnC_YxtBGiNaBnXUV8k45oWOQ==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.76.101 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-VObYSIkUrX8OdLkS20S8Mg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 16 Mar 2026 01:26:57 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjMtDikmLw05Bi-FB_mfUHEBuuDGCzBGKzkEA2FyBeOC2QbSUQ34kJYnsCxELcHA933D3LJjBj1TtzJZek_ML45Py8ktS8Et3ElGJdELsoM6m0JL8IhZ1aBlKRk5-enpmXHm9kYGRmYGxopGdgFl9gAAA0fi80"
content-security-policy: script-src 'report-sample' 'nonce-VObYSIkUrX8OdLkS20S8Mg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H2 200 AGSKWxW-bKxgdAuRKvoHOYtC8ZN-NOKmvOmiygZhCPRCFO5eZmW5HBfgVsjxeIx-lxXKB32wvB5CYKtS4BfjYakw5YG67LSMFmsuIcfBaAcBAON1wEMD_Z9S-w_iVXCWhN0-sPB0HveR5w== Show response
fundingchoicesmessages.google.com/f/ 885 KB
106 KB 134ms
133ms Script
application/javascript 172.217.76.101
Google LLC

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxW-bKxgdAuRKvoHOYtC8ZN-NOKmvOmiygZhCPRCFO5eZmW5HBfgVsjxeIx-lxXKB32wvB5CYKtS4BfjYakw5YG67LSMFmsuIcfBaAcBAON1wEMD_Z9S-w_iVXCWhN0-sPB0HveR5w==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzczNjI0NDE2LDkzMTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzddXSwiaHR0cHM6Ly9wYWludC50b3lzL29pbC8iLG51bGwsW1s4LCJYZVY5WGhhT2pLUSJdLFs5LCJwdC1QVCJdLFsxOCwiW1tbbnVsbCwxODg1XV1dIl0sWzE5LCIxIl0sWzE3LCJbMF0iXSxbMjQsImRmaHdxZC5mdW5kYWNhb3JvbWVuaW5naC5wdCJdLFsyOSwiZmFsc2UiXV1d

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.76.101 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

0ee3a96a7299ff80e3b617d64b5dcb3eba3c805a980b002c0d90355a1b441feb

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-ZDDXr1gpzyLfG-6ZpyZibQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 16 Mar 2026 01:26:57 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjKtHikmJw05BiaL15jnU6EJcsOs_aBsRdQDwHiA0VLrE6A_GH-susP4C4SOIKawsQf6q6wSpSfYP1W7EvG0eJL9uTKX5s34CY5a0_m-HKADZLIFY7GsBmAcQLpwWyrQTiOzFBbE-AWIib4-GOu2fZBBb0beJV0kjKL4xPzs8rKcpMKi3JL0pLTkstTi0qSy2KNzIwMjMwNjTSMzCNLzAAABmSQcY"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-ZDDXr1gpzyLfG-6ZpyZibQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
133 B 47ms
47ms Fetch
image/gif 104.20.47.80
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=2&e=0.4447958812329377
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.47.80 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 942409
x-goog-stored-content-encoding: identity
expires: Thu, 05 Mar 2026 03:40:45 GMT
x-goog-stored-content-length: 43
date: Mon, 16 Mar 2026 01:26:57 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH8-vjlDXUPURhkYZQuCbklw5HEqrQPoIxWeNr5b2HFnZnkflerafjIoH0cVJi8HNxqWvGiioHEw
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9dcff8fe6812d852-LIS
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico Show response
ad.doubleclick.net/ 1 KB
129 B 91ms
90ms Fetch
image/x-icon 142.250.201.166
Google LLC

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.3730978317838599

Requested by

Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.201.166 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Tue, 17 Mar 2026 01:26:57 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 16 Mar 2026 01:26:57 GMT
content-type: image/x-icon
vary: Accept-Encoding
last-modified: Tue, 08 May 2012 13:08:06 GMT
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 css
fonts.googleapis.com/ 123 KB
6 KB 113ms
112ms Stylesheet
text/css 142.250.129.95
Google LLC

General

Check archive.org

Download Go to

Full URL

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.pt_PT.XeV9XhaOjKQ.es5.O/d=1/exm=kernel_loader,loader_js_executable/ed=1/rs=AJlcJMwErd8boc5mVL0h5gtEsLo5q7xW0Q/m=web_iab_tcf_v2_wall_executable

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

142.250.129.95 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

lclhrb-in-f95.1e100.net

Software

ESF /

Resource Hash

a41d75f5f03440d486e54aa4330a496be8ec12f1bdb6d9d971c495e767b8bd4f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 16 Mar 2026 01:26:57 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 16 Mar 2026 01:26:57 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Mon, 16 Mar 2026 01:26:57 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H3 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v40/ 47 KB
47 KB 83ms
83ms Font
font/woff2 142.251.30.94
Google LLC

General

Check archive.org

Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.30.94 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

sv-in-f94.1e100.net

Software

sffe /

Resource Hash

3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Origin: https://paint.toys
Referer: https://paint.toys/

Response headers

age: 485331
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Wed, 10 Mar 2027 10:38:06 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 10 Mar 2026 10:38:06 GMT
last-modified: Thu, 14 Dec 2023 02:08:40 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 48236
x-xss-protection: 0
server: sffe

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxVcjYReVdpOAlJV5JgW4vaQIv39vY2T4OlmJQGXD2Qw4MFvuk33fGhwaPemHjl6gT9Geu7SLPiFpzm3g_cH1S5SWnadPV_DplSSCFkRq_WGjqE2rLnC_YxtBGiNaBnXUV8k45oWOQ==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.76.101 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-v3mTcSIMW89cQrEp4S9eQQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 16 Mar 2026 01:26:57 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjstDikmLw1JBiOHnrNtNFIP5Qf5n1BxAbrgxgswRis5BANhcgXjgtkG0lEN-JCWJ7AsRC3BwPd9w9yybQcHxqjZJLUn5hfHJ-XklqXoluYkqxLohdlJlUWpJfhMJOLQOpyMlPT8_MS483MjAyMzA2NNIzMIsvMAAAvl00MA"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-v3mTcSIMW89cQrEp4S9eQQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxVcjYReVdpOAlJV5JgW4vaQIv39vY2T4OlmJQGXD2Qw4MFvuk33fGhwaPemHjl6gT9Geu7SLPiFpzm3g_cH1S5SWnadPV_DplSSCFkRq_WGjqE2rLnC_YxtBGiNaBnXUV8k45oWOQ==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.76.101 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-x2pLgfZY9CaztdermnqT0g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 16 Mar 2026 01:26:57 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjMtDikmJw1pBi-FB_mfUHEBuuDGCzBGKzkEA2FyBeOC2QbSUQ34kJYnsCxELcHA933D3LJrDi4a9qJZek_ML45Py8ktS8Et3ElGJdELsoM6m0JL8IhZ1aBlKRk5-enpmXHm9kYGRmYGxopGdgFl9gAABZlC_A"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-x2pLgfZY9CaztdermnqT0g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxVcjYReVdpOAlJV5JgW4vaQIv39vY2T4OlmJQGXD2Qw4MFvuk33fGhwaPemHjl6gT9Geu7SLPiFpzm3g_cH1S5SWnadPV_DplSSCFkRq_WGjqE2rLnC_YxtBGiNaBnXUV8k45oWOQ==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.76.101 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

ns31533568.ip-162-19-138.eu

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-WWgfOKgiPS2xXXLmq1eKYg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 16 Mar 2026 01:26:57 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjMtDikmII0JBi-FB_mfUHEBuuDGCzBGLTkEA2ZyBeOC2QbSUQ34kJYnsCxELcHA933D3LJvDg_O0aJZek_ML45Py8ktS8Et3ElGJdELsoM6m0JL8IhZ1aBlKRk5-enpmXHm9kYGRmYGxopGdgFl9gAABh0i_T"
content-security-policy: script-src 'report-sample' 'nonce-WWgfOKgiPS2xXXLmq1eKYg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

OPTIONS
H2 200 bid
aax.amazon-adsystem.com/e/dtb/ Frame 0
0 298ms
112ms Preflight 13.33.186.215
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://aax.amazon-adsystem.com/e/dtb/bid
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.186.215 New York, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-33-186-215.fra60.r.cloudfront.net
Software: Server /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: origin,x-requested-with,access-control-request-headers,content-type,access-control-request-method,accept
access-control-allow-methods: POST
access-control-allow-origin: https://paint.toys
access-control-max-age: 1800
content-encoding: gzip
content-length: 0
date: Mon, 16 Mar 2026 01:26:57 GMT
server: Server
via: 1.1 abf16b943a9b4039b87ccdb094d9303e.cloudfront.net (CloudFront)
x-amz-cf-id: id5-JT-TC2vL-d1nT-IuFObB5v8sXbdOG0xWzGGhy3EU-9XcnmnJ_w==
x-amz-cf-pop: FRA60-P9
x-cache: Miss from cloudfront

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 257ms
88ms XHR
application/javascript 13.33.52.91
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.52.91 New York, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-33-52-91.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-max-age: 3000
content-encoding: gzip
x-amz-version-id: r5.lR.LJ66XEXzxUUVo7iMemjL_F_GoE
etag: W/"a4d296427fc806b21335359e398c025c"
age: 77651
access-control-allow-methods: GET
x-cache: Hit from cloudfront
x-amz-cf-id: 9_LJiIh1_E0hn5zXlTqJVJp0ndP8HcV6SJFrTAg0qgEElKKHTqkK7Q==
date: Sun, 15 Mar 2026 03:57:34 GMT
content-type: application/javascript
vary: Origin,accept-encoding
last-modified: Thu, 29 Feb 2024 02:13:08 GMT
cache-control: public, max-age=86400
via: 1.1 262e9bd80864e82dd3bf98eedc41b28e.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: FRA56-P15
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 bd056b42-51db-43ce-9a8e-3b11319b5d1f Show response
config.aps.amazon-adsystem.com/configs/ 639 B
906 B 256ms
84ms Script
application/javascript 18.245.31.9
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://config.aps.amazon-adsystem.com/configs/bd056b42-51db-43ce-9a8e-3b11319b5d1f
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.245.31.9 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-18-245-31-9.fra56.r.cloudfront.net
Software: CloudFront /
Resource Hash: 33ca1c3ffcc35996d35d063101a7c8966faf38a34804ef1e2c8855d251ddcde0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=3600
age: 1536
via: 1.1 e030504e72fa75d92c1856a58b964932.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
content-length: 639
x-amz-cf-id: pMFWOd7X39Yj6D4WyjwB0hhCRLNYUgv2Qa3sk8ya3irh8hZ32VRHbQ==
date: Mon, 16 Mar 2026 01:01:21 GMT
content-type: application/javascript
x-amz-cf-pop: FRA56-P8
server: CloudFront

GET
H2 200 config Show response
c.amazon-adsystem.com/cdn/prod/ 3 KB
3 KB 88ms
88ms XHR
application/json 13.33.52.91
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fpaint.toys&pubid=bd056b42-51db-43ce-9a8e-3b11319b5d1f
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.52.91 New York, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-33-52-91.fra56.r.cloudfront.net
Software: Server /
Resource Hash: 20bd4e8b4884ff3a757b962866b9aa95f9f4e54c7cd8ae30a67171c208b202ba

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=21550, s-maxage=21600
age: 14
access-control-allow-credentials: true
via: 1.1 a16f1fe9224bb87d6515221a5b907364.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Hit from cloudfront
content-length: 3077
x-amz-cf-id: K5PFP1tVIrzYGWJYK5nRpx5BisW5SowlzgI0cpk8e2fkAOGLFmg6Zg==
date: Mon, 16 Mar 2026 01:26:43 GMT
content-type: application/json;charset=UTF-8
x-amz-cf-pop: FRA56-P15
server: Server

POST
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 25 B
386 B 282ms
111ms Fetch
application/json 13.33.186.215
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://aax.amazon-adsystem.com/e/dtb/bid
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.186.215 New York, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-33-186-215.fra60.r.cloudfront.net
Software: Server /
Resource Hash: 7dc78c5c119373b361b76d7e9c1b2759725163789661df908ee4cd8faf842676

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Content-Type: application/json
Referer: https://paint.toys/

Response headers

content-encoding: gzip
access-control-allow-credentials: true
via: 1.1 d2c570942164f5ee69dab53f43b0f1d2.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Miss from cloudfront
content-length: 45
x-amz-cf-id: 8Ipm2iHP6OsVOsVA7nrx1NJlpgxEa_34bDHAeVsGl9pi2TXhY23vDw==
date: Mon, 16 Mar 2026 01:26:57 GMT
content-type: application/json;charset=UTF-8
vary: Origin
server: Server
x-amz-cf-pop: FRA60-P9

GET
H2 200 pubcid.min.js Show response
secure.cdn.fastclick.net/js/pubcid/latest/ 67 KB
22 KB 272ms
98ms Script
application/javascript 23.215.23.105
Akamai Technologies

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/pubcid/latest/pubcid.min.js
Requested by: Host: dfhwqd.fundacaoromeningh.pt
URL: https://dfhwqd.fundacaoromeningh.pt/vjr7m1x97eaRSkJiNDVUV1BmWllmRmFUcDQ0SEstNTE5MC0yNjc2ODk3MS0xMDE5MDI3ZS04ODI0LWp2TVlmZHkweG1JWTFWSlV2bDla/bvsshelwxkrpvncmfzyjl/e8w1jzrmqtsffg6gqnnec9/1916688557497744563
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.215.23.105 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-215-23-105.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 45bc6978e281a938d9485dcbf0859159b24e2f7c9b8b0fafc120b9606e0ea8b1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "10ab4-63a0ee37f7c40-gzip"
expires: Mon, 16 Mar 2026 01:41:57 GMT
accept-ranges: bytes
content-length: 21994
date: Mon, 16 Mar 2026 01:26:57 GMT
last-modified: Wed, 16 Jul 2025 17:04:41 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16576/ 44 KB
13 KB 270ms
98ms Script
text/javascript 18.66.102.47
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Requested by: Host: dfhwqd.fundacaoromeningh.pt
URL: https://dfhwqd.fundacaoromeningh.pt/vjr7m1x97eaRSkJiNDVUV1BmWllmRmFUcDQ0SEstNTE5MC0yNjc2ODk3MS0xMDE5MDI3ZS04ODI0LWp2TVlmZHkweG1JWTFWSlV2bDla/bvsshelwxkrpvncmfzyjl/e8w1jzrmqtsffg6gqnnec9/1916688557497744563
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.102.47 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-18-66-102-47.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5ac6db9eca6024415fceff0efcb39732b882e99babaaf05b94b04baa16980583

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"27a001ef77a3a0515b877de836201c21"
age: 75456
via: 1.1 84294257ed643a88ee54d2e3f7d7ccea.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: zR51ukeLN2lOoAhZ6gRXmEaLsSpNlPIlku5q5ZEgFB6cBUIvJaxsuQ==
date: Sun, 15 Mar 2026 04:29:22 GMT
content-type: text/javascript
last-modified: Tue, 10 Feb 2026 20:18:40 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P2
x-amz-server-side-encryption: AES256

GET
H2 200 hadron.js Show response
cdn.hadronid.net/ 11 B
186 B 144ms
50ms Script
text/plain 172.66.166.119
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fdfhwqd.fundacaoromeningh.pt%2F&_it=amazon&partner_id=403
Requested by: Host: dfhwqd.fundacaoromeningh.pt
URL: https://dfhwqd.fundacaoromeningh.pt/vjr7m1x97eaRSkJiNDVUV1BmWllmRmFUcDQ0SEstNTE5MC0yNjc2ODk3MS0xMDE5MDI3ZS04ODI0LWp2TVlmZHkweG1JWTFWSlV2bDla/bvsshelwxkrpvncmfzyjl/e8w1jzrmqtsffg6gqnnec9/1916688557497744563
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.66.166.119 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: a73f5986eb985871284e6e216372de3505634a97229de643216728d0fbfd6227

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=432000
cf-cache-status: HIT
etag: "6943ef12-b"
age: 6335
cf-ray: 9dcff9011ff948a6-LIS
accept-ranges: bytes
content-length: 11
date: Mon, 16 Mar 2026 01:26:57 GMT
content-type: text/plain
last-modified: Thu, 18 Dec 2025 12:09:54 GMT
server: cloudflare

GET
H2 200 id5-api.js Show response
cdn.id5-sync.com/api/1.0/ 114 KB
33 KB 148ms
54ms Script
text/javascript 172.66.169.55
Cloudflare

General

Check archive.org

Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/id5-api.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.66.169.55 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

c1d18f87d7efe21cc525e503452d1abef3250121df02b4e3d5961a7d956ddab9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-amz-id-2: vBfvbbcyF/zdcWRCYrW0bOKMFPPRlCdhTrcY6CdA5CVbo4qJMUE7G0aw5QkWs9wsOZAvnz57TBwgyQdPZa72yGTW/Py/CmY/TTrKhl2GAZY=
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: public, max-age=3600
content-encoding: br
cf-cache-status: HIT
etag: W/"9ccc0eb1c9d7557d61d6ba1f0d64bd30"
age: 2670
x-amz-request-id: 8BMGGC6XSN3RBX5A
cf-ray: 9dcff9011d9a691a-LIS
date: Mon, 16 Mar 2026 01:26:57 GMT
content-type: text/javascript;charset=utf-8
last-modified: Wed, 11 Feb 2026 15:28:45 GMT
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 id5-api-js Show response
api.id5-sync.com/analytics/483/ 1 KB
682 B 253ms
82ms Fetch
application/json 162.19.138.117
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://api.id5-sync.com/analytics/483/id5-api-js

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.117 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

64731b0c4bddd9b69b5d748b611bcb8cc52a9dd00a6d9f4c9664dfac0a8d6e1b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: max-age=300
access-control-expose-headers: Access-Control-Allow-Origin
content-encoding: gzip
access-control-allow-origin: *
date: Mon, 16 Mar 2026 01:26:57 GMT
content-type: application/json
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding

GET
H2 200 favicon.ico
paint.toys/ 615 B
747 B 158ms
157ms Other
image/vnd.microsoft.icon 3.33.186.135
Amazon.com

General

Check archive.org

Download Go to

Full URL

https://paint.toys/favicon.ico

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

Software

Netlify /

Resource Hash

30a007a99e491d9e1b2b72c02e4a8454334c6ea2b3a03316d50135b20464fccc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "6c77abc0123fbfdebbf702a90fb50938-ssl"
age: 30339
accept-ranges: bytes
content-length: 615
x-nf-request-id: 01KKT41QER8SC5DDKK12YA77VM
cache-status: "Netlify Edge"; hit
date: Mon, 16 Mar 2026 01:26:57 GMT
content-type: image/vnd.microsoft.icon
server: Netlify

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
116 B 49ms
48ms Fetch
image/gif 104.20.47.80
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=2&e=0.8315462755161871
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.47.80 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 942410
x-goog-stored-content-encoding: identity
expires: Thu, 05 Mar 2026 03:40:45 GMT
x-goog-stored-content-length: 43
date: Mon, 16 Mar 2026 01:26:57 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH8-vjlDXUPURhkYZQuCbklw5HEqrQPoIxWeNr5b2HFnZnkflerafjIoH0cVJi8HNxqWvGiioHEw
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9dcff9036963d852-LIS
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico Show response
ad.doubleclick.net/ 1 KB
129 B 91ms
90ms Fetch
image/x-icon 142.250.201.166
Google LLC

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.9339240044698981

Requested by

Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.201.166 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Tue, 17 Mar 2026 01:26:57 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 16 Mar 2026 01:26:57 GMT
content-type: image/x-icon
vary: Accept-Encoding
last-modified: Tue, 08 May 2012 13:08:06 GMT
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
110 B 49ms
48ms Fetch
image/gif 104.20.47.80
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.2918125020829686
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.47.80 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 942410
x-goog-stored-content-encoding: identity
expires: Thu, 05 Mar 2026 03:40:45 GMT
x-goog-stored-content-length: 43
date: Mon, 16 Mar 2026 01:26:57 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH8-vjlDXUPURhkYZQuCbklw5HEqrQPoIxWeNr5b2HFnZnkflerafjIoH0cVJi8HNxqWvGiioHEw
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9dcff9036965d852-LIS
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H2 200 dns Show response
ab.dns-finder.com/meta/ 2 B
0 0ms
0ms Fetch
text/plain 34.36.200.111
Google LLC

General

Check archive.org

Download Go to

Full URL: https://ab.dns-finder.com/meta/dns
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.36.200.111 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS: 111.200.36.34.bc.googleusercontent.com
Software: /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private, max-age=180, stale-if-error=180, stale-while-revalidate=180
access-control-expose-headers: X-Resolver
x-resolver: default
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
date: Mon, 16 Mar 2026 01:26:56 GMT
content-type: text/plain; charset=utf-8
vary: Origin

POST
H3 204 ping
pagead2.googlesyndication.com/pagead/ 0
0 248ms
90ms Fetch
image/gif 142.251.30.156
Google LLC

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/ping?e=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202603100101/pubads_impl.js?cb=31097189

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.30.156 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

sv-in-f156.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Mon, 16 Mar 2026 01:26:58 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
133 B 49ms
48ms Fetch
image/gif 104.20.47.80
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.7138326414863907
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.47.80 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 942410
x-goog-stored-content-encoding: identity
expires: Thu, 05 Mar 2026 03:40:45 GMT
x-goog-stored-content-length: 43
date: Mon, 16 Mar 2026 01:26:58 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH8-vjlDXUPURhkYZQuCbklw5HEqrQPoIxWeNr5b2HFnZnkflerafjIoH0cVJi8HNxqWvGiioHEw
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9dcff904fbf6d852-LIS
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 a
www.googletagmanager.com/ 0
11 B 89ms
89ms Image
text/html 172.217.168.72
Google LLC

General

Check archive.org

Download Go to Show image

Full URL

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.168.72 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Mon, 16 Mar 2026 01:26:58 GMT
x-xss-protection: 0
content-type: text/html
server: Google Tag Manager

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
110 B 49ms
48ms Fetch
image/gif 104.20.47.80
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=2&e=0.9123417507841368
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.47.80 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 942410
x-goog-stored-content-encoding: identity
expires: Thu, 05 Mar 2026 03:40:45 GMT
x-goog-stored-content-length: 43
date: Mon, 16 Mar 2026 01:26:58 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH8-vjlDXUPURhkYZQuCbklw5HEqrQPoIxWeNr5b2HFnZnkflerafjIoH0cVJi8HNxqWvGiioHEw
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9dcff9063dced852-LIS
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico Show response
ad.doubleclick.net/ 1 KB
129 B 94ms
94ms Fetch
image/x-icon 142.250.201.166
Google LLC

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.6309985426079071

Requested by

Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.201.166 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Tue, 17 Mar 2026 01:26:58 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 16 Mar 2026 01:26:58 GMT
content-type: image/x-icon
vary: Accept-Encoding
last-modified: Tue, 08 May 2012 13:08:06 GMT
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
116 B 48ms
48ms Fetch
image/gif 104.20.47.80
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=2&e=0.8321104174913218
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.47.80 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 942411
x-goog-stored-content-encoding: identity
expires: Thu, 05 Mar 2026 03:40:45 GMT
x-goog-stored-content-length: 43
date: Mon, 16 Mar 2026 01:26:58 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH8-vjlDXUPURhkYZQuCbklw5HEqrQPoIxWeNr5b2HFnZnkflerafjIoH0cVJi8HNxqWvGiioHEw
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9dcff9090a55d852-LIS
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

POST
H2 200 fb87a4ea41 Show response
cd836371f1d.cdn.intergient.com/ 0
95 B 91ms
89ms XHR
application/octet-stream 3.73.242.72
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://cd836371f1d.cdn.intergient.com/fb87a4ea41
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260309.1/main.ae82acf4b07e6ef288d4.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.73.242.72 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-3-73-242-72.eu-central-1.compute.amazonaws.com
Software: nginx/1.24.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

access-control-allow-origin: *
date: Mon, 16 Mar 2026 01:26:58 GMT
content-type: application/octet-stream
server: nginx/1.24.0

GET
H3 200 favicon.ico Show response
ad.doubleclick.net/ 1 KB
129 B 93ms
93ms Fetch
image/x-icon 142.250.201.166
Google LLC

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.13386379891189848

Requested by

Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.201.166 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Tue, 17 Mar 2026 01:26:58 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 16 Mar 2026 01:26:58 GMT
content-type: image/x-icon
vary: Accept-Encoding
last-modified: Tue, 08 May 2012 13:08:06 GMT
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
133 B 49ms
48ms Fetch
image/gif 104.20.47.80
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=2&e=0.30288743983330024
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.47.80 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 942411
x-goog-stored-content-encoding: identity
expires: Thu, 05 Mar 2026 03:40:45 GMT
x-goog-stored-content-length: 43
date: Mon, 16 Mar 2026 01:26:59 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH8-vjlDXUPURhkYZQuCbklw5HEqrQPoIxWeNr5b2HFnZnkflerafjIoH0cVJi8HNxqWvGiioHEw
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9dcff90bdef2d852-LIS
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico Show response
ad.doubleclick.net/ 1 KB
129 B 90ms
90ms Fetch
image/x-icon 142.250.201.166
Google LLC

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.3339436551179562

Requested by

Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.201.166 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Tue, 17 Mar 2026 01:26:59 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 16 Mar 2026 01:26:59 GMT
content-type: image/x-icon
vary: Accept-Encoding
last-modified: Tue, 08 May 2012 13:08:06 GMT
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
116 B 49ms
48ms Fetch
image/gif 104.20.47.80
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=2&e=0.14041345380032055
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.47.80 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 942412
x-goog-stored-content-encoding: identity
expires: Thu, 05 Mar 2026 03:40:45 GMT
x-goog-stored-content-length: 43
date: Mon, 16 Mar 2026 01:26:59 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH8-vjlDXUPURhkYZQuCbklw5HEqrQPoIxWeNr5b2HFnZnkflerafjIoH0cVJi8HNxqWvGiioHEw
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9dcff90eabcdd852-LIS
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico Show response
ad.doubleclick.net/ 1 KB
129 B 91ms
90ms Fetch
image/x-icon 142.250.201.166
Google LLC

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.1757253899862543

Requested by

Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.201.166 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS