urlscan.io logo urlscan.io
SecurityTrails logo

paint.toys
3.33.186.135  Public Scan Open in urlscan Pro

Go To Rescan Add Verdict Report
Submitted URL: https://jvnzoez.consulmexvan.com/PP0agfqQXu/?id=a0vwnRaVMybFYzTVBjeGhVeWJNVVcyN20tNTk4OS0yNTc1ODM5MC0xMDlkMDI4Ny0xMDM2Mi1KazBZeFV... 1mo old
Effective URL: https://paint.toys/oil/ 5yr old
Submission: On April 12 via api from BE — Scanned from NL
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 31 IPs in 4 countries across 23 domains to perform 91 HTTP transactions. The main IP is 3.33.186.135, located in United States and belongs to AMAZON-02 - Amazon.com, Inc., US. The main domain is paint.toys. 5yr old
TLS certificate: Issued by E8 on March 29th 2026. Valid for: 3mo.
This is the only time paint.toys was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 103.29.182.40 150393 (LWPL-AS-A...)
1 2 188.114.96.3 13335 (CLOUDFLAR...)
1 9 3.33.186.135 16509 (AMAZON-02)
1 16 104.18.20.56 13335 (CLOUDFLAR...)
2 142.251.14.97 15169 (GOOGLE)
2 192.178.183.95 15169 (GOOGLE)
2 34.8.176.186 396982 (GOOGLE-CL...)
3 192.178.183.156 15169 (GOOGLE)
2 142.251.14.94 15169 (GOOGLE)
1 35.175.18.88 14618 (AMAZON-AES)
3 216.239.32.36 15169 (GOOGLE)
8 142.251.20.113 15169 (GOOGLE)
1 18.245.46.16 16509 (AMAZON-02)
1 172.66.171.133 13335 (CLOUDFLAR...)
1 185.199.111.133 54113 (FASTLY)
11 104.20.47.80 13335 (CLOUDFLAR...)
7 142.251.14.148 15169 (GOOGLE)
2 34.36.200.111 396982 (GOOGLE-CL...)
1 104.20.20.189 13335 (CLOUDFLAR...)
3 130.211.23.194 396982 (GOOGLE-CL...)
3 108.138.3.93 16509 (AMAZON-02)
1 142.251.110.95 15169 (GOOGLE)
2 63.176.195.25 16509 (AMAZON-02)
2 108.138.4.226 16509 (AMAZON-02)
1 18.245.46.20 16509 (AMAZON-02)
1 23.45.96.101 16625 (AKAMAI-AS)
1 18.66.102.77 16509 (AMAZON-02)
1 172.66.166.119 13335 (CLOUDFLAR...)
1 172.66.169.55 13335 (CLOUDFLAR...)
1 162.19.138.120 16276 (OVH OVH SAS)
1 142.251.20.155 15169 (GOOGLE)
91 31
1    103.29.182.40 (Netherlands)

ASN150393 (LWPL-AS-AP LAYER WEBHOST PVT. LIMITED, PK)
PTR: nouaime.com
jvnzoez.consulmexvan.com 1mo old
2    188.114.96.3 (Ascension Island)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
beasiswalpdp.my.id 3yr old
9    3.33.186.135 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: afa7f374f51cc8991.awsglobalaccelerator.com
paint.toys 5yr old
16    104.18.20.56 (Ascension Island)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
cdn.intergient.com 7yr old
2    142.251.14.97 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: pm-in-f97.1e100.net
www.googletagmanager.com 56yr old
2    192.178.183.95 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: lcfraw-in-f95.1e100.net
fonts.googleapis.com 56yr old
2    34.8.176.186 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US)
PTR: 186.176.8.34.bc.googleusercontent.com
faucetfoot.com 3yr old
3    192.178.183.156 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: lcfraw-in-f156.1e100.net
securepubads.g.doubleclick.net 9yr old
2    142.251.14.94 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: pm-in-f94.1e100.net
fonts.gstatic.com 9yr old
1    35.175.18.88 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-35-175-18-88.compute-1.amazonaws.com
dt.adsafeprotected.com 9yr old
3    216.239.32.36 (United States)

ASN15169 (GOOGLE - Google LLC, US)
region1.google-analytics.com 5yr old
8    142.251.20.113 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: bx-in-f113.1e100.net
fundingchoicesmessages.google.com 7yr old
1    18.245.46.16 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-18-245-46-16.fra56.r.cloudfront.net
impression-inferences-edge-prod.playwire.com 3yr old
1    172.66.171.133 (Ascension Island)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
btloader.com 6yr old
1    185.199.111.133 (United States)

ASN54113 (FASTLY - Fastly, Inc., US)
PTR: cdn-185-199-111-133.github.com
raw.githubusercontent.com 9yr old
11    104.20.47.80 (Ascension Island)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
ad-delivery.net 9yr old
7    142.251.14.148 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: pm-in-f148.1e100.net
ad.doubleclick.net 9yr old
2    34.36.200.111 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US)
PTR: 111.200.36.34.bc.googleusercontent.com
ab.dns-finder.com 7mo old
1    104.20.20.189 (Ascension Island)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
btloader.com 6yr old
3    130.211.23.194 (United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US)
PTR: 194.23.211.130.bc.googleusercontent.com
api.btloader.com 6yr old
3    108.138.3.93 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-108-138-3-93.fra56.r.cloudfront.net
c.amazon-adsystem.com 12yr old
1    142.251.110.95 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: bz-in-f95.1e100.net
imasdk.googleapis.com 9yr old
2    63.176.195.25 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-63-176-195-25.eu-central-1.compute.amazonaws.com
cd836371f1d.cdn.intergient.com 2yr old
2    108.138.4.226 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-108-138-4-226.fra56.r.cloudfront.net
aax.amazon-adsystem.com 12yr old
1    18.245.46.20 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-18-245-46-20.fra56.r.cloudfront.net
config.aps.amazon-adsystem.com 3yr old
1    23.45.96.101 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a23-45-96-101.deploy.static.akamaitechnologies.com
secure.cdn.fastclick.net 13yr old
1    18.66.102.77 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-18-66-102-77.fra56.r.cloudfront.net
tags.crwdcntrl.net 13yr old
1    172.66.166.119 (Ascension Island)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
cdn.hadronid.net 4yr old
1    172.66.169.55 (Ascension Island)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
cdn.id5-sync.com 6yr old
1    162.19.138.120 (Frankfurt am Main, Germany)

ASN16276 (OVH OVH SAS, FR)
PTR: ns31533571.ip-162-19-138.eu
api.id5-sync.com 5yr old
1    142.251.20.155 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: bx-in-f155.1e100.net
pagead2.googlesyndication.com 9yr old
Apex Domain
Subdomains		 Transfer
18 intergient.com
cdn.intergient.com — Cisco Umbrella Rank: 7461 7yr old
cd836371f1d.cdn.intergient.com — Cisco Umbrella Rank: 9146 2yr old
431 KB
11 ad-delivery.net
ad-delivery.net — Cisco Umbrella Rank: 1262 9yr old
2 KB
10 doubleclick.net
securepubads.g.doubleclick.net — Cisco Umbrella Rank: 295 9yr old
ad.doubleclick.net — Cisco Umbrella Rank: 195 9yr old
241 KB
9 paint.toys
paint.toys 5yr old
131 KB
8 google.com
fundingchoicesmessages.google.com — Cisco Umbrella Rank: 677 7yr old
176 KB
6 amazon-adsystem.com
c.amazon-adsystem.com — Cisco Umbrella Rank: 450 12yr old
aax.amazon-adsystem.com — Cisco Umbrella Rank: 759 12yr old
config.aps.amazon-adsystem.com — Cisco Umbrella Rank: 885 3yr old
101 KB
5 btloader.com
btloader.com — Cisco Umbrella Rank: 1154 6yr old
api.btloader.com — Cisco Umbrella Rank: 1447 6yr old
52 KB
3 google-analytics.com
region1.google-analytics.com — Cisco Umbrella Rank: 3331 5yr old
3 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 43 56yr old
imasdk.googleapis.com — Cisco Umbrella Rank: 611 9yr old
153 KB
2 id5-sync.com
cdn.id5-sync.com — Cisco Umbrella Rank: 820 6yr old
api.id5-sync.com — Cisco Umbrella Rank: 1352 5yr old
35 KB
2 dns-finder.com
ab.dns-finder.com — Cisco Umbrella Rank: 1502 7mo old
233 B
2 gstatic.com
fonts.gstatic.com — Cisco Umbrella Rank: 26 9yr old
83 KB
2 faucetfoot.com
faucetfoot.com — Cisco Umbrella Rank: 712753 3yr old
36 KB
2 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 41 56yr old
296 KB
2 beasiswalpdp.my.id
beasiswalpdp.my.id 3yr old
2 KB
1 googlesyndication.com
pagead2.googlesyndication.com — Cisco Umbrella Rank: 141 9yr old
1 hadronid.net
cdn.hadronid.net — Cisco Umbrella Rank: 1992 4yr old
186 B
1 crwdcntrl.net
tags.crwdcntrl.net — Cisco Umbrella Rank: 1029 13yr old
13 KB
1 fastclick.net
secure.cdn.fastclick.net — Cisco Umbrella Rank: 1544 13yr old
22 KB
1 githubusercontent.com
raw.githubusercontent.com — Cisco Umbrella Rank: 3059 9yr old
580 B
1 playwire.com
impression-inferences-edge-prod.playwire.com — Cisco Umbrella Rank: 10570 3yr old
883 B
1 adsafeprotected.com
dt.adsafeprotected.com — Cisco Umbrella Rank: 789 9yr old
178 B
1 consulmexvan.com
jvnzoez.consulmexvan.com 1mo old
401 B
91 23
Domain Requested by
16 cdn.intergient.com 1 redirects paint.toys
cdn.intergient.com
beasiswalpdp.my.id
11 ad-delivery.net btloader.com
9 paint.toys 1 redirects beasiswalpdp.my.id
paint.toys
8 fundingchoicesmessages.google.com securepubads.g.doubleclick.net
7 ad.doubleclick.net btloader.com
3 c.amazon-adsystem.com cdn.intergient.com
c.amazon-adsystem.com
3 api.btloader.com btloader.com
3 region1.google-analytics.com www.googletagmanager.com
3 securepubads.g.doubleclick.net cdn.intergient.com
securepubads.g.doubleclick.net
paint.toys
2 aax.amazon-adsystem.com c.amazon-adsystem.com
2 cd836371f1d.cdn.intergient.com cdn.intergient.com
2 ab.dns-finder.com btloader.com
2 btloader.com cdn.intergient.com
btloader.com
2 fonts.gstatic.com fonts.googleapis.com
paint.toys
2 faucetfoot.com cdn.intergient.com
faucetfoot.com
2 fonts.googleapis.com paint.toys
2 www.googletagmanager.com paint.toys
www.googletagmanager.com
2 beasiswalpdp.my.id 1 redirects
1 pagead2.googlesyndication.com securepubads.g.doubleclick.net
1 api.id5-sync.com cdn.id5-sync.com
1 cdn.id5-sync.com beasiswalpdp.my.id
1 cdn.hadronid.net beasiswalpdp.my.id
1 tags.crwdcntrl.net beasiswalpdp.my.id
1 secure.cdn.fastclick.net beasiswalpdp.my.id
1 config.aps.amazon-adsystem.com c.amazon-adsystem.com
1 imasdk.googleapis.com cdn.intergient.com
1 raw.githubusercontent.com paint.toys
1 impression-inferences-edge-prod.playwire.com cdn.intergient.com
1 dt.adsafeprotected.com paint.toys
1 jvnzoez.consulmexvan.com 1 redirects
91 30

This site contains links to these domains. Also see Links.

Domain
toybox.toms.toys
Subject Issuer Validity Valid
beasiswalpdp.my.id
WE1		 2026-03-11 -
2026-06-09		 3mo crt.sh
paint.toys
E8		 2026-03-29 -
2026-06-27		 3mo crt.sh
834af943.sni.cloudflaressl.com
WE1		 2026-02-18 -
2026-05-19		 3mo crt.sh
*.google-analytics.com
WE2		 2026-03-23 -
2026-06-15		 3mo crt.sh
upload.video.google.com
WE2		 2026-03-23 -
2026-06-15		 3mo crt.sh
faucetfoot.com
E8		 2026-03-03 -
2026-06-01		 3mo crt.sh
*.g.doubleclick.net
WE2		 2026-03-23 -
2026-06-15		 3mo crt.sh
*.gstatic.com
WE2		 2026-03-23 -
2026-06-15		 3mo crt.sh
dt.adsafeprotected.com
Amazon RSA 2048 M01		 2026-02-07 -
2027-03-08		 1yr crt.sh
*.google.com
WE2		 2026-03-23 -
2026-06-15		 3mo crt.sh
*.playwire.com
Amazon RSA 2048 M01		 2025-11-11 -
2026-12-09		 1yr crt.sh
btloader.com
WE1		 2026-04-01 -
2026-06-30		 3mo crt.sh
*.github.io
R12		 2026-02-06 -
2026-05-07		 3mo crt.sh
ad-delivery.net
WE1		 2026-02-25 -
2026-05-27		 3mo crt.sh
*.doubleclick.net
WE2		 2026-03-23 -
2026-06-15		 3mo crt.sh
ab.dns-finder.com
WR3		 2026-04-01 -
2026-06-30		 3mo crt.sh
api.btloader.com
WR3		 2026-03-07 -
2026-06-05		 3mo crt.sh
c.amazon-adsystem.com
Amazon RSA 2048 M04		 2025-10-20 -
2026-11-18		 1yr crt.sh
*.cdn.intergient.com
Amazon RSA 2048 M04		 2026-04-03 -
2026-10-17		 7mo crt.sh
alt1-3ps.amazon-adsystem.com
Amazon RSA 2048 M04		 2026-03-01 -
2026-09-14		 7mo crt.sh
config.aps.amazon-adsystem.com
Amazon RSA 2048 M04		 2025-11-23 -
2026-12-22		 1yr crt.sh
secure.cdn.fastclick.net
DigiCert Global G3 TLS ECC SHA384 2020 CA1		 2025-06-08 -
2026-06-09		 1yr crt.sh
*.crwdcntrl.net
Amazon RSA 2048 M04		 2025-08-09 -
2026-09-07		 1yr crt.sh
hadronid.net
WE1		 2026-03-10 -
2026-06-08		 3mo crt.sh
id5-sync.com
WE1		 2026-03-16 -
2026-06-14		 3mo crt.sh

This page contains 6 frames:

Primary Page: https://paint.toys/oil/
Frame ID: E4E0C875603FF08139BDE89D8805B962
Requests: 82 HTTP requests in this frame

Frame: https://cdn.intergient.com/pageos/V.20260406.1/iframe/iframe.html
Frame ID: FFC759B245D703C4A9FF664E1453614D
Requests: 2 HTTP requests in this frame

Frame: https://btloader.com/trustedIframe.html?o=5150306120761344&upapi=true
Frame ID: 30E2AF1DA10D7A8F29372947FFF9E5AF
Requests: 1 HTTP requests in this frame

Frame: https://cdn.intergient.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
Frame ID: AB483A0ACC3FFF2E131FEDE23893F607
Requests: 1 HTTP requests in this frame

Frame: https://cdn.intergient.com/pageos/V.20260406.1/iframe/iframe.html
Frame ID: 12972CD677B852CC7C3574756A5EBEE7
Requests: 2 HTTP requests in this frame

Frame: https://cdn.intergient.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/b0a7532ac8ec/main.js
Frame ID: ADBC88EA4063880E10EDAD56ED65CE16
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Paint with Oils

Page URL History Show full URLs

  1. https://jvnzoez.consulmexvan.com/PP0agfqQXu/?id=a0vwnRaVMybFYzTVBjeGhVeWJNVVcyN20tNTk4OS0yNTc1ODM5MC0xMDlkMDI... HTTP 302
    https://beasiswalpdp.my.id/a0vwnRaVMybFYzTVBjeGhVeWJNVVcyN20tNTk4OS0yNTc1ODM5MC0xMDlkMDI4Ny0xMDM2Mi1Kaz... Page URL
  2. http://beasiswalpdp.my.id/a0vwnRaVMybFYzTVBjeGhVeWJNVVcyN20tNTk4OS0yNTc1ODM5MC0xMDlkMDI4Ny0xMDM2Mi1Kaz... HTTP 307
    https://beasiswalpdp.my.id/a0vwnRaVMybFYzTVBjeGhVeWJNVVcyN20tNTk4OS0yNTc1ODM5MC0xMDlkMDI4Ny0xMDM2Mi1Kaz... HTTP 302
    https://paint.toys/oil HTTP 301
    https://paint.toys/oil/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.doubleclick\.net
Overall confidence: 100%
Detected patterns
  • googlesyndication\.com/
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtag/js
Overall confidence: 100%
Detected patterns
  • \.googletagmanager\.com/
Overall confidence: 100%
Detected patterns
  • \.amazon-adsystem\.com
Overall confidence: 100%
Detected patterns
  • fundingchoicesmessages\.google\.com
Overall confidence: 100%
Detected patterns
  • securepubads\.g\.doubleclick.net/tag/js/gpt\.js
Overall confidence: 100%
Detected patterns
  • ^https://(?:cdn\.)?id5-sync\.com/
Overall confidence: 100%
Detected patterns
  • \.adsafeprotected\.com/

Page Statistics

91
Requests

97 %
HTTPS

0 %
IPv6

23
Domains

30
Subdomains

31
IPs

4
Countries

1773 kB
Transfer

5905 kB
Size

7
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://jvnzoez.consulmexvan.com/PP0agfqQXu/?id=a0vwnRaVMybFYzTVBjeGhVeWJNVVcyN20tNTk4OS0yNTc1ODM5MC0xMDlkMDI4Ny0xMDM2Mi1KazBZeFVqd1VLdldqYXlVbnpPbA HTTP 302
    https://beasiswalpdp.my.id/a0vwnRaVMybFYzTVBjeGhVeWJNVVcyN20tNTk4OS0yNTc1ODM5MC0xMDlkMDI4Ny0xMDM2Mi1KazBZeFVqd1VLdldqYXlVbnpPbA Page URL
  2. http://beasiswalpdp.my.id/a0vwnRaVMybFYzTVBjeGhVeWJNVVcyN20tNTk4OS0yNTc1ODM5MC0xMDlkMDI4Ny0xMDM2Mi1KazBZeFVqd1VLdldqYXlVbnpPbA?in=1 HTTP 307
    https://beasiswalpdp.my.id/a0vwnRaVMybFYzTVBjeGhVeWJNVVcyN20tNTk4OS0yNTc1ODM5MC0xMDlkMDI4Ny0xMDM2Mi1KazBZeFVqd1VLdldqYXlVbnpPbA?in=1 HTTP 302
    https://paint.toys/oil HTTP 301
    https://paint.toys/oil/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://jvnzoez.consulmexvan.com/PP0agfqQXu/?id=a0vwnRaVMybFYzTVBjeGhVeWJNVVcyN20tNTk4OS0yNTc1ODM5MC0xMDlkMDI4Ny0xMDM2Mi1KazBZeFVqd1VLdldqYXlVbnpPbA HTTP 302
  • https://beasiswalpdp.my.id/a0vwnRaVMybFYzTVBjeGhVeWJNVVcyN20tNTk4OS0yNTc1ODM5MC0xMDlkMDI4Ny0xMDM2Mi1KazBZeFVqd1VLdldqYXlVbnpPbA
Request Chain 54
  • https://cdn.intergient.com/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
  • https://cdn.intergient.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/b0a7532ac8ec/main.js

91 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
a0vwnRaVMybFYzTVBjeGhVeWJNVVcyN20tNTk4OS0yNTc1ODM5MC0xMDlkMDI4Ny0xMDM2Mi1KazBZeFVqd1VLdldqYXlVbnpPbA
beasiswalpdp.my.id/
Redirect Chain
  • https://jvnzoez.consulmexvan.com/PP0agfqQXu/?id=a0vwnRaVMybFYzTVBjeGhVeWJNVVcyN20tNTk4OS0yNTc1ODM5MC0xMDlkMDI4Ny0xMDM2Mi1KazBZeFVqd1VLdldqYXlVbnpPbA
  • https://beasiswalpdp.my.id/a0vwnRaVMybFYzTVBjeGhVeWJNVVcyN20tNTk4OS0yNTc1ODM5MC0xMDlkMDI4Ny0xMDM2Mi1KazBZeFVqd1VLdldqYXlVbnpPbA
559 B
978 B 		Document
General
Check archive.org
Download Go to
Full URL
https://beasiswalpdp.my.id/a0vwnRaVMybFYzTVBjeGhVeWJNVVcyN20tNTk4OS0yNTc1ODM5MC0xMDlkMDI4Ny0xMDM2Mi1KazBZeFVqd1VLdldqYXlVbnpPbA
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.96.3 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / PHP/7.4.33
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Linux"

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
max-age=0, no-cache, no-store, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
9eae7b443e590bb6-AMS
content-encoding
zstd
content-type
text/html; charset=UTF-8
date
Sun, 12 Apr 2026 01:33:11 GMT
developed-by
Mohamed Amine El Attabi
email
mohamed.amine.elattabi@gmail.com
expires
Sat, 2 Aug 1980 15:15:00 GMT
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
pragma
no-cache
priority
u=0,i
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=N4EEz3ipkOdIXmwczsQZV%2Fzlxzf1H%2F4KZapYGJbVRPWnOoQg7PhIdpjphW2T%2FWjWdCYdCGigsET%2FV7Ihz6qzX1jm1Dcz1vuRY4k7nob3VQpEV9DMfmGehn5q%2F7Vur5gjOQEE%2BoU%3D"}]}
server
cloudflare
server-timing
cfExtPri
vary
Accept-Encoding,User-Agent
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-powered-by
PHP/7.4.33
x-xss-protection
1; mode=block

Redirect headers

Connection
Keep-Alive
Content-Length
0
Content-Type
text/html; charset=UTF-8
Date
Sun, 12 Apr 2026 01:33:11 GMT
Keep-Alive
timeout=5, max=100
Location
https://beasiswalpdp.my.id/a0vwnRaVMybFYzTVBjeGhVeWJNVVcyN20tNTk4OS0yNTc1ODM5MC0xMDlkMDI4Ny0xMDM2Mi1KazBZeFVqd1VLdldqYXlVbnpPbA
Server
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
X-Powered-By
PHP/7.4.33
Primary Request /
paint.toys/oil/
Redirect Chain
  • http://beasiswalpdp.my.id/a0vwnRaVMybFYzTVBjeGhVeWJNVVcyN20tNTk4OS0yNTc1ODM5MC0xMDlkMDI4Ny0xMDM2Mi1KazBZeFVqd1VLdldqYXlVbnpPbA?in=1
  • https://beasiswalpdp.my.id/a0vwnRaVMybFYzTVBjeGhVeWJNVVcyN20tNTk4OS0yNTc1ODM5MC0xMDlkMDI4Ny0xMDM2Mi1KazBZeFVqd1VLdldqYXlVbnpPbA?in=1
  • https://paint.toys/oil
  • https://paint.toys/oil/
10 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://paint.toys/oil/
Requested by
Host: beasiswalpdp.my.id
URL: https://beasiswalpdp.my.id/a0vwnRaVMybFYzTVBjeGhVeWJNVVcyN20tNTk4OS0yNTc1ODM5MC0xMDlkMDI4Ny0xMDM2Mi1KazBZeFVqd1VLdldqYXlVbnpPbA
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.33.186.135 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
afa7f374f51cc8991.awsglobalaccelerator.com
Software
Netlify /
Resource Hash
5764e7bbfaef797512a8c208ebbcc104a98e69605f5fa934138bbb831dafbf88
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://beasiswalpdp.my.id/a0vwnRaVMybFYzTVBjeGhVeWJNVVcyN20tNTk4OS0yNTc1ODM5MC0xMDlkMDI4Ny0xMDM2Mi1KazBZeFVqd1VLdldqYXlVbnpPbA
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36

Response headers

accept-ranges
bytes
age
87393
cache-control
public,max-age=0,must-revalidate
cache-status
"Netlify Edge"; hit
content-encoding
br
content-length
2515
content-type
text/html; charset=UTF-8
date
Sun, 12 Apr 2026 01:33:12 GMT
etag
"1682e9e4844ad308d368ad938129b1a7-ssl-df"
server
Netlify
strict-transport-security
max-age=31536000
vary
Accept-Encoding
x-nf-request-id
01KNZN4JBA14WNJ0M80NA5TYK8

Redirect headers

cache-status
"Netlify Edge"; fwd=miss
content-length
98
content-type
text/html
date
Sun, 12 Apr 2026 01:33:12 GMT
location
/oil/
server
Netlify
strict-transport-security
max-age=31536000
x-nf-request-id
01KNZN4J4CHBC8GTFD99R9SNSR
ramp_config.js
cdn.intergient.com/1024872/74068/ 		40 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.intergient.com/1024872/74068/ramp_config.js
Requested by
Host: paint.toys
URL: https://paint.toys/oil/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
66c0e34de15b83406adb0685b88d9dd25911788b28e7573b2e8d9ccf25694170

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cf-ray
9eae7b49aa38c886-AMS
hw-country-code
NL
cache-control
max-age=600, public, must-revalidate
content-encoding
br
date
Sun, 12 Apr 2026 01:33:12 GMT
content-type
application/javascript
server
cloudflare
apps.css
paint.toys/ 		6 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://paint.toys/apps.css
Requested by
Host: paint.toys
URL: https://paint.toys/oil/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.33.186.135 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
afa7f374f51cc8991.awsglobalaccelerator.com
Software
Netlify /
Resource Hash
98db09da3e1109288620e5f78abf4769bb160bb5d505ba03f683edd1227a4a53
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/oil/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=31536000
cache-control
public,max-age=0,must-revalidate
content-encoding
br
etag
"56a5025fbb6b2d9217c0c90816b2fee9-ssl-df"
age
84713
accept-ranges
bytes
content-length
1643
x-nf-request-id
01KNZN4JF37KXMFG47KKY24B7Y
cache-status
"Netlify Edge"; hit
date
Sun, 12 Apr 2026 01:33:12 GMT
content-type
text/css; charset=UTF-8
vary
Accept-Encoding
server
Netlify
index.js
paint.toys/oil/ 		4 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://paint.toys/oil/index.js
Requested by
Host: paint.toys
URL: https://paint.toys/oil/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.33.186.135 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
afa7f374f51cc8991.awsglobalaccelerator.com
Software
Netlify /
Resource Hash
1afce4631b4f1dcc9f08ca5b89182fa0e68307e0df60b096646ce66296354ae1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/oil/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=31536000
cache-control
public,max-age=0,must-revalidate
content-encoding
br
etag
"94ae9b9ed2162106abf0e8e5295e04e0-ssl-df"
age
28223
accept-ranges
bytes
content-length
1262
x-nf-request-id
01KNZN4JJ050YWMGFB5N5D17E1
cache-status
"Netlify Edge"; hit
date
Sun, 12 Apr 2026 01:33:12 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
server
Netlify
art-icon.png
paint.toys/assets/ 		33 KB
33 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://paint.toys/assets/art-icon.png
Requested by
Host: paint.toys
URL: https://paint.toys/oil/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.33.186.135 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
afa7f374f51cc8991.awsglobalaccelerator.com
Software
Netlify /
Resource Hash
f4d368e4230539c778afbb020e0ea611b3e1d984179f5b3769b44081d6703f3b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/oil/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=31536000
cache-control
public,max-age=0,must-revalidate
etag
"1394f8469f2ca5750397e3d7b6ec70a1-ssl"
age
59653
accept-ranges
bytes
content-length
33562
x-nf-request-id
01KNZN4JJ0C3HSE4TQGGYM4DM1
cache-status
"Netlify Edge"; hit
date
Sun, 12 Apr 2026 01:33:12 GMT
content-type
image/png
server
Netlify
icon-hand.png
paint.toys/assets/ 		27 KB
27 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://paint.toys/assets/icon-hand.png
Requested by
Host: paint.toys
URL: https://paint.toys/oil/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.33.186.135 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
afa7f374f51cc8991.awsglobalaccelerator.com
Software
Netlify /
Resource Hash
32aa05a5648678542ab9044647f0bf5549c0b53a070585edb773f0e92b72b97d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/oil/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=31536000
cache-control
public,max-age=0,must-revalidate
etag
"a0822110a4671ffdf710da1467460fba-ssl"
age
254
accept-ranges
bytes
content-length
27394
x-nf-request-id
01KNZN4JJ0ACNWQJ4P590HF2TC
cache-status
"Netlify Edge"; hit
date
Sun, 12 Apr 2026 01:33:12 GMT
content-type
image/png
server
Netlify
icon-disk.png
paint.toys/assets/ 		13 KB
14 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://paint.toys/assets/icon-disk.png
Requested by
Host: paint.toys
URL: https://paint.toys/oil/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.33.186.135 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
afa7f374f51cc8991.awsglobalaccelerator.com
Software
Netlify /
Resource Hash
436814c2374a6d92a42a02d39969ef7c56b5f225667abecb218e692c5569943c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/oil/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=31536000
cache-control
public,max-age=0,must-revalidate
etag
"26852fa1548a91e004629b01e4abf1dd-ssl"
age
86657
accept-ranges
bytes
content-length
13766
x-nf-request-id
01KNZN4JP0M8VCDJV1JME2SD2S
cache-status
"Netlify Edge"; hit
date
Sun, 12 Apr 2026 01:33:12 GMT
content-type
image/png
server
Netlify
icon-trash.png
paint.toys/assets/ 		50 KB
51 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://paint.toys/assets/icon-trash.png
Requested by
Host: paint.toys
URL: https://paint.toys/oil/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.33.186.135 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
afa7f374f51cc8991.awsglobalaccelerator.com
Software
Netlify /
Resource Hash
6ceb226c487cb85243545e768944e0e1ae0944be8fde6c1c43c7314a9287e6d9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/oil/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=31536000
cache-control
public,max-age=0,must-revalidate
etag
"e91ef5e34b5154d392e8560031eaaa4c-ssl"
age
10669
accept-ranges
bytes
content-length
51680
x-nf-request-id
01KNZN4JT3D9EKDW95XMC1QFXS
cache-status
"Netlify Edge"; hit
date
Sun, 12 Apr 2026 01:33:12 GMT
content-type
image/png
server
Netlify
ramp_core.js
cdn.intergient.com/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.intergient.com/ramp_core.js
Requested by
Host: paint.toys
URL: https://paint.toys/oil/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b0529195572705472c53f9003a196e1cf5d41d8d5d0e1e391a674750a6ee3d88

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cf-ray
9eae7b4a8b6ac886-AMS
hw-country-code
NL
cache-control
max-age=600, public, must-revalidate
content-encoding
br
date
Sun, 12 Apr 2026 01:33:12 GMT
content-type
application/javascript
server
cloudflare
js
www.googletagmanager.com/gtag/ 		454 KB
155 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D
Requested by
Host: paint.toys
URL: https://paint.toys/oil/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.14.97 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pm-in-f97.1e100.net
Software
Google Tag Manager /
Resource Hash
32a7934869f4666c9fb6e64681e0916d8c0ff49824b9a29eb6adc0fd038c3aaa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
cache-control
private, max-age=900
content-encoding
zstd
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
expires
Sun, 12 Apr 2026 01:33:12 GMT
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
158416
date
Sun, 12 Apr 2026 01:33:12 GMT
x-xss-protection
0
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
server
Google Tag Manager
access-control-allow-headers
Cache-Control
css2
fonts.googleapis.com/ 		3 KB
968 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css2?family=DM+Sans:wght@300;400;500&family=DM+Serif+Display&display=swap
Requested by
Host: paint.toys
URL: https://paint.toys/apps.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
192.178.183.95 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
lcfraw-in-f95.1e100.net
Software
ESF /
Resource Hash
0e43e66404ff234d0d874c9422542a2e6442c73246650d680490f46bedd60898
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
x-content-type-options
nosniff
expires
Sun, 12 Apr 2026 01:33:12 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sun, 12 Apr 2026 01:33:12 GMT
content-type
text/css; charset=utf-8
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified
Sun, 12 Apr 2026 01:33:12 GMT
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
x-xss-protection
0
server
ESF
p94wwqs1nsnv-prod.js
faucetfoot.com/files/ 		102 KB
35 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://faucetfoot.com/files/p94wwqs1nsnv-prod.js
Requested by
Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.8.176.186 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS
186.176.8.34.bc.googleusercontent.com
Software
hoothoot/2438300242 /
Resource Hash
21c70f3abd65c2ed8d271bdb6768540ed502bface8884e2ac82b6d45b3209518
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; preload

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=15724800; preload
cache-control
private, must-revalidate, max-age=21600
timing-allow-origin
*
content-encoding
zstd
etag
W/"1e6c06cfb56c90f253bceb6defc43f75b50fa4937f8a664d695b5c3c644e5b6a"
via
fen-hoothoot-europe-west1-cqkh.gce-europe-west1, 1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sun, 12 Apr 2026 01:33:12 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding, Accept-Language
server
hoothoot/2438300242
gpt.js
securepubads.g.doubleclick.net/tag/js/ 		108 KB
34 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/tag/js/gpt.js
Requested by
Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
192.178.183.156 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
lcfraw-in-f156.1e100.net
Software
cafe /
Resource Hash
dd71b5dd080502cc60234b858fb511527930773b961196ac76388d60df0da23a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
etag
898 / 20555 / 31097742 / config-hash: 16260121154920961607
x-content-type-options
nosniff
expires
Sun, 12 Apr 2026 01:33:12 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sun, 12 Apr 2026 01:33:12 GMT
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
content-disposition
attachment; filename="f.txt"
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
content-length
34803
x-xss-protection
0
server
cafe
prebid.335dd724b9406dcd9e2b.js
cdn.intergient.com/prebid/ 		742 KB
221 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.intergient.com/prebid/prebid.335dd724b9406dcd9e2b.js
Requested by
Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
7008da7a6103f5a898b4e955ebde8dbe336f097c7fe17e71ced8980affd910a5

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

hw-country-code
NL
cache-control
public, max-age=31536000, immutable
content-encoding
br
cf-cache-status
HIT
etag
W/"3cc83bd65e8e68eb8c0c6a66de20d662"
age
2116863
cf-ray
9eae7b4a9b73c886-AMS
date
Sun, 12 Apr 2026 01:33:12 GMT
content-type
text/javascript
last-modified
Wed, 18 Mar 2026 13:23:44 GMT
server
cloudflare
vary
Accept-Encoding
rP2Yp2ywxg089UriI5-g4vlH9VoD8Cmcqbu0-K4.woff2
fonts.gstatic.com/s/dmsans/v17/ 		36 KB
36 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/dmsans/v17/rP2Yp2ywxg089UriI5-g4vlH9VoD8Cmcqbu0-K4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=DM+Sans:wght@300;400;500&family=DM+Serif+Display&display=swap
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.14.94 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pm-in-f94.1e100.net
Software
sffe /
Resource Hash
9fea608a947e67020c33cad9a6fe3d60c54119dfb8cff87768a8117a15ed7543
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://paint.toys
sec-ch-ua-platform
"Linux"
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

age
91329
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Sun, 11 Apr 2027 00:11:03 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 11 Apr 2026 00:11:03 GMT
last-modified
Wed, 10 Sep 2025 16:31:03 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
36932
x-xss-protection
0
server
sffe
pageos.js
cdn.intergient.com/pageos/V.20260406.1/ 		411 B
612 B 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.intergient.com/pageos/V.20260406.1/pageos.js
Requested by
Host: cdn.intergient.com
URL: https://cdn.intergient.com/ramp_core.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
663e651d6997269c8015d9f4181751e82e79e17c5064b281901da2d5bae9afbb

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

hw-country-code
NL
cache-control
public, max-age=31536000
content-encoding
br
cf-cache-status
HIT
etag
W/"3d6c06503ce4ffaebd634af1821ff2bb"
age
374070
cf-ray
9eae7b4acbcdc886-AMS
expires
Mon, 12 Apr 2027 01:33:12 GMT
date
Sun, 12 Apr 2026 01:33:12 GMT
content-type
text/javascript
last-modified
Tue, 07 Apr 2026 17:28:00 GMT
server
cloudflare
pubads_impl.js
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202604080101/ 		583 KB
183 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202604080101/pubads_impl.js?cb=31097742
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
192.178.183.156 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
lcfraw-in-f156.1e100.net
Software
cafe /
Resource Hash
ca9ab811c0d20578c1c957ce3f3531c66e827dfc1883dada328c56e2487e8a1e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
etag
8848173397282281628
age
55890
x-content-type-options
nosniff
expires
Sun, 11 Apr 2027 10:01:42 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sat, 11 Apr 2026 10:01:42 GMT
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
cache-control
public, immutable, max-age=31536000
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
content-length
187343
x-xss-protection
0
server
cafe
runtime.e74e4ca9f030172e8b39.js
cdn.intergient.com/pageos/V.20260406.1/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.intergient.com/pageos/V.20260406.1/runtime.e74e4ca9f030172e8b39.js
Requested by
Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260406.1/pageos.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b10003abbe4a3ce3e6321a50803e1f613baaf74e6b2e63313f5746b3c40000e6

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

hw-country-code
NL
cache-control
public, max-age=31536000
content-encoding
br
cf-cache-status
HIT
etag
W/"b366df6a2913bfb7e570c5b0d2685a5d"
age
374070
cf-ray
9eae7b4b7cc0c886-AMS
expires
Mon, 12 Apr 2027 01:33:12 GMT
date
Sun, 12 Apr 2026 01:33:12 GMT
content-type
text/javascript
last-modified
Tue, 07 Apr 2026 17:28:01 GMT
server
cloudflare
main.551129c9449d5acc2196.js
cdn.intergient.com/pageos/V.20260406.1/ 		560 KB
172 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.intergient.com/pageos/V.20260406.1/main.551129c9449d5acc2196.js
Requested by
Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260406.1/pageos.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
fda09a9d73e6a889955a6faf14d822c25876d920ac4abdc896d8ffa41bcf6f27

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

hw-country-code
NL
cache-control
public, max-age=31536000
content-encoding
br
cf-cache-status
HIT
etag
W/"5d2c55c2fd6774cf191a8f89af7c0804"
age
374070
cf-ray
9eae7b4b8cd3c886-AMS
expires
Mon, 12 Apr 2027 01:33:12 GMT
date
Sun, 12 Apr 2026 01:33:12 GMT
content-type
text/javascript
last-modified
Tue, 07 Apr 2026 17:27:58 GMT
server
cloudflare
dt
dt.adsafeprotected.com/ 		43 B
178 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dt.adsafeprotected.com/dt?adspot_id=kbazv_728x90_
Requested by
Host: paint.toys
URL: https://paint.toys/oil/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.175.18.88 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-35-175-18-88.compute-1.amazonaws.com
Software
/
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache
p3p
CP="COM NAV INT STA NID OUR IND NOI"
content-length
43
date
Sun, 12 Apr 2026 01:33:13 GMT
pragma
no-cache
content-type
image/gif
js
www.googletagmanager.com/gtag/ 		398 KB
141 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=G-CEFZJ359V8&cx=c&gtm=4e6481
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.14.97 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pm-in-f97.1e100.net
Software
Google Tag Manager /
Resource Hash
4cc857061cabd21e136f7a900987073d1a2879c565b915572d67f4dca570444a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
cache-control
private, max-age=900
content-encoding
zstd
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
expires
Sun, 12 Apr 2026 01:33:13 GMT
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
144074
date
Sun, 12 Apr 2026 01:33:13 GMT
x-xss-protection
0
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
server
Google Tag Manager
access-control-allow-headers
Cache-Control
collect
region1.google-analytics.com/g/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-VJBRK9986D&gtm=45je6481v9101576445za200zd9101576445&_p=1775957592496&gcd=13l3l3l2l1l1&npa=1&dma_cps=a&dma=1&are=1&cid=1557090395.1775957593&frm=0&pscdl=noapi&rcb=4&sr=1600x1200&uaa=x86&uab=64&uafvl=Chromium%3B147.0.0.0%7CGoogle%2520Chrome%3B147.0.0.0%7CNot-A.Brand%3B24.0.0.0&uam=&uamb=0&uap=Linux&uapv=&uaw=0&ul=nl-nl&_s=1&tag_exp=0~115616985~115938466~115938468&sid=1775957592&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dt=Paint%20with%20Oils&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=1212
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.239.32.36 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:137:0
report-to
{"group":"ascnsrsggc:137:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:137:0"}],}
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
https://paint.toys
cross-origin-opener-policy-report-only
same-origin; report-to=ascnsrsggc:137:0
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sun, 12 Apr 2026 01:33:13 GMT
content-type
text/plain
server
Golfe2
154013155
fundingchoicesmessages.google.com/i/ 		216 KB
70 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://fundingchoicesmessages.google.com/i/154013155?ers=3
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202604080101/pubads_impl.js?cb=31097742
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.20.113 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
bx-in-f113.1e100.net
Software
ESF /
Resource Hash
64eec773b598708de54a23f35992f2a0725e86abc44362f1f2661d4d730704db
Security Headers
Name Value
Content-Security-Policy require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-RqZgLuYJ2uMDkVsVL_FL_w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
x-content-type-options
nosniff
expires
Mon, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sun, 12 Apr 2026 01:33:13 GMT
content-type
application/javascript; charset=utf-8
x-frame-options
SAMEORIGIN
reporting-endpoints
default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzj6mHU4pJi8NSQYjh56zbTRSBuvXmOdToQlyw6z9oGxF1APAeIDRUusToD8Yf6y6w_gLhI4gprCxB_qrrBKlJ9gzWcy4ctHoi_FfuycZT4sp2c4sd2G4ifAPE3IGZ568-mdjSAzQKIF04LZFsJxHdigtieAPGp1cFsl4BYiJvj5pvX59gEdky77aykkZRfGJ-cn1dSlJlUWpJflJacllqcWlSWWhRvZGBkZmBiYKlnYB5fYAAALpVNyw"
content-security-policy
require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-RqZgLuYJ2uMDkVsVL_FL_w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control
no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin
*
cross-origin-opener-policy
same-origin
pragma
no-cache
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy
cross-origin
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection
0
server
ESF
videoCard.cea8a6bd8cad3ad73428.js
cdn.intergient.com/pageos/V.20260406.1/ 		552 B
722 B 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.intergient.com/pageos/V.20260406.1/videoCard.cea8a6bd8cad3ad73428.js
Requested by
Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260406.1/runtime.e74e4ca9f030172e8b39.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
0a0a95fd080f68f2d8c0a916f30cdb5cde422c6908dd64bd98043ef5c160f0f1

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

hw-country-code
NL
cache-control
public, max-age=31536000
content-encoding
br
cf-cache-status
HIT
etag
W/"b923f9cae7c940f9f384e93b5120abff"
age
374068
cf-ray
9eae7b4c9e1bc886-AMS
expires
Mon, 12 Apr 2027 01:33:13 GMT
date
Sun, 12 Apr 2026 01:33:13 GMT
content-type
text/javascript
last-modified
Tue, 07 Apr 2026 17:28:06 GMT
server
cloudflare
vary
Accept-Encoding
iframe.html
cdn.intergient.com/pageos/V.20260406.1/iframe/ Frame FFC7 		1 KB
1018 B 		Document
General
Check archive.org
Download Go to
Full URL
https://cdn.intergient.com/pageos/V.20260406.1/iframe/iframe.html
Requested by
Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260406.1/main.551129c9449d5acc2196.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
c8039db3019fcff8be120f5287c9945c828d07138271b8c16fa4738521abf769

Request headers

Referer
https://paint.toys/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Linux"

Response headers

age
374069
cache-control
public, max-age=31536000
cf-cache-status
HIT
cf-ray
9eae7b4d0ffc9d5d-AMS
content-encoding
br
content-type
text/html
date
Sun, 12 Apr 2026 01:33:13 GMT
expires
Mon, 12 Apr 2027 01:33:13 GMT
hw-country-code
NL
last-modified
Tue, 07 Apr 2026 17:27:56 GMT
server
cloudflare
gdpr.80f4ed51ebfc5feb6de9.js
cdn.intergient.com/pageos/V.20260406.1/ 		6 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.intergient.com/pageos/V.20260406.1/gdpr.80f4ed51ebfc5feb6de9.js
Requested by
Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260406.1/runtime.e74e4ca9f030172e8b39.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b0040483703a19464fa35f27f815ca3eac5b70035b5216d35f78a9425708ffb3

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

hw-country-code
NL
cache-control
public, max-age=31536000
content-encoding
br
cf-cache-status
HIT
etag
W/"276aef4d651d0760f5e70f7b2c569bb4"
age
374069
cf-ray
9eae7b4cae30c886-AMS
expires
Mon, 12 Apr 2027 01:33:13 GMT
date
Sun, 12 Apr 2026 01:33:13 GMT
content-type
text/javascript
last-modified
Tue, 07 Apr 2026 17:27:56 GMT
server
cloudflare
GDPR
impression-inferences-edge-prod.playwire.com/websites/74068/v1/Sat/21/desktop/Chrome/ 		548 B
883 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://impression-inferences-edge-prod.playwire.com/websites/74068/v1/Sat/21/desktop/Chrome/GDPR
Requested by
Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260406.1/main.551129c9449d5acc2196.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.245.46.16 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-18-245-46-16.fra56.r.cloudfront.net
Software
CloudFront /
Resource Hash
fa943fe441f13d737f70e4afe5504eb9eb9156e916074b4fb8b35a239dd43442

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
max-age=3600, public, must-revalidate
access-control-expose-headers
*
age
1782
via
1.1 c968eb4bd5f1a91dae1c71eba1ef9d56.cloudfront.net (CloudFront)
access-control-allow-origin
*
x-cache
Hit from cloudfront
content-length
548
x-amz-cf-id
7yWVD4gazoiY_-2SKGsuHv046ImM706iamMxsRTfl2PsCEn3oHTy5Q==
date
Sun, 12 Apr 2026 01:03:31 GMT
content-type
application/json
x-amz-cf-pop
FRA56-P9
server
CloudFront
tag
btloader.com/ 		180 KB
49 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://btloader.com/tag?o=5150306120761344&upapi=true
Requested by
Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260406.1/main.551129c9449d5acc2196.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.66.171.133 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
af33adef0f1e7b4e0714817457a9952d17d5ae03868a87c7d12ef56132d72a0b

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-robots-tag
noindex, nofollow
cache-control
public, max-age=300, stale-if-error=3600, stale-while-revalidate=300
content-encoding
br
cf-cache-status
HIT
etag
W/"fe24325b9c3b9a905ee994d39caaedc3"
via
1.1 google
cf-ray
9eae7b4cfa0eb932-AMS
access-control-allow-origin
*
date
Sun, 12 Apr 2026 01:33:13 GMT
content-type
application/javascript
last-modified
Sun, 12 Apr 2026 00:33:59 GMT
server
cloudflare
vary
Accept-Encoding, X-Acceptable-Ads, DNT
1x1.gif
raw.githubusercontent.com/easylist/easylist/master/docs/ 		43 B
580 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://raw.githubusercontent.com/easylist/easylist/master/docs/1x1.gif
Requested by
Host: paint.toys
URL: https://paint.toys/oil/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.199.111.133 , United States, ASN54113 (FASTLY - Fastly, Inc., US),
Reverse DNS
cdn-185-199-111-133.github.com
Software
/
Resource Hash
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277
Security Headers
Name Value
Content-Security-Policy default-src 'none'; style-src 'unsafe-inline'; sandbox
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-fastly-request-id
c4a42847ba3d213828e6106f2012872419e62605
etag
W/"0c4a5773f7e435c57c40bd270aef756513eba26bd7ba5317b5bd765569a7325d"
x-content-type-options
nosniff
x-github-request-id
7DCE:20B1E4:C6F06C:E0AE82:69D8C75C
expires
Sun, 12 Apr 2026 01:38:13 GMT
x-cache
HIT
date
Sun, 12 Apr 2026 01:33:13 GMT
content-type
image/gif
x-served-by
cache-ams2100098-AMS
x-cache-hits
1
source-age
60
x-frame-options
deny
strict-transport-security
max-age=31536000
vary
Authorization,Accept-Encoding
content-security-policy
default-src 'none'; style-src 'unsafe-inline'; sandbox
cache-control
max-age=300
x-timer
S1775957593.107865,VS0,VE1
cross-origin-resource-policy
cross-origin
via
1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
43
x-xss-protection
1; mode=block
collect
region1.google-analytics.com/g/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-CEFZJ359V8&gtm=45je6481v9102396898za200zb9101576445zd9101576445&_p=1775957592496&gcd=13l3l3l2l1l1&npa=1&dma_cps=a&dma=1&are=1&cid=1557090395.1775957593&frm=0&pscdl=noapi&rcb=2&sr=1600x1200&uaa=x86&uab=64&uafvl=Chromium%3B147.0.0.0%7CGoogle%2520Chrome%3B147.0.0.0%7CNot-A.Brand%3B24.0.0.0&uam=&uamb=0&uap=Linux&uapv=&uaw=0&ul=nl-nl&_s=1&tag_exp=0~115938466~115938469&sid=1775957593&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dt=Paint%20with%20Oils&en=ramp_js&_fv=1&_ss=1&_ee=1&ep.pageview_id=1775957592496&tfd=1313
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-CEFZJ359V8&cx=c&gtm=4e6481
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.239.32.36 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:137:0
report-to
{"group":"ascnsrsggc:137:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:137:0"}],}
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
https://paint.toys
cross-origin-opener-policy-report-only
same-origin; report-to=ascnsrsggc:137:0
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sun, 12 Apr 2026 01:33:13 GMT
content-type
text/plain
server
Golfe2
gpt
securepubads.g.doubleclick.net/pagead/managed/dict/m202604090101/ 		63 KB
23 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pagead/managed/dict/m202604090101/gpt
Requested by
Host: paint.toys
URL: https://paint.toys/oil/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
192.178.183.156 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
lcfraw-in-f156.1e100.net
Software
cafe /
Resource Hash
d3e01c343083ce4c4a9fe64f0ab915f99339794372f31378e58ed309824d1dfc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
etag
2796382326219958242
age
269
x-content-type-options
nosniff
expires
Sun, 19 Apr 2026 01:28:44 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sun, 12 Apr 2026 01:28:44 GMT
content-type
text/plain; charset=UTF-8
vary
Accept-Encoding
cache-control
public, immutable, max-age=604800, stale-while-revalidate=7200
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
content-length
23174
x-xss-protection
0
server
cafe
use-as-dictionary
match="/gampad/ads", id="m202604090101"
iframe.js
cdn.intergient.com/pageos/V.20260406.1/iframe/ Frame FFC7 		17 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.intergient.com/pageos/V.20260406.1/iframe/iframe.js
Requested by
Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260406.1/iframe/iframe.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
a1e9592b119e182885673d049ec2ead66dab57473f2f6da59f43d888cea5ac1e

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://cdn.intergient.com/pageos/V.20260406.1/iframe/iframe.html
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

hw-country-code
NL
cache-control
public, max-age=31536000
content-encoding
br
cf-cache-status
HIT
etag
W/"3eecc5d11812ac69fb4f2c63c5dea237"
age
374069
cf-ray
9eae7b4d58b59d5d-AMS
expires
Mon, 12 Apr 2027 01:33:13 GMT
date
Sun, 12 Apr 2026 01:33:13 GMT
content-type
text/javascript
last-modified
Tue, 07 Apr 2026 17:27:57 GMT
server
cloudflare
px.gif
ad-delivery.net/ 		43 B
616 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ad-delivery.net/px.gif?ch=2&e=0.5583689557280471
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.47.80 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-goog-metageneration
5
access-control-expose-headers
*, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash
crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status
HIT
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3"
age
1946962
x-goog-stored-content-encoding
identity
expires
Fri, 20 Mar 2026 13:41:52 GMT
x-goog-stored-content-length
43
date
Sun, 12 Apr 2026 01:33:13 GMT
content-type
image/gif
last-modified
Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid
ABgVH89K2Yq4pnfcvUStBId9HlURvizPqf3MVWGgPxZrgZz6nkGA3_cdbcg0whsVowwYFR03VNFb3R4
cache-control
public, max-age=86400
x-goog-storage-class
MULTI_REGIONAL
cf-ray
9eae7b4d9e7a2d31-AMS
accept-ranges
bytes
access-control-allow-origin
*
x-goog-generation
1620242732037093
content-length
43
server
cloudflare
favicon.ico
ad.doubleclick.net/ 		1 KB
129 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.7444560422923087
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.14.148 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pm-in-f148.1e100.net
Software
sffe /
Resource Hash
d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options
nosniff
expires
Mon, 13 Apr 2026 01:33:13 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sun, 12 Apr 2026 01:33:13 GMT
content-type
image/x-icon
vary
Accept-Encoding
last-modified
Tue, 08 May 2012 13:08:06 GMT
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
content-length
104
x-xss-protection
0
server
sffe
px.gif
ad-delivery.net/ 		43 B
109 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ad-delivery.net/px.gif?ch=1&e=0.10005839635694302
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.47.80 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-goog-metageneration
5
access-control-expose-headers
*, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash
crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status
HIT
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3"
age
1946962
x-goog-stored-content-encoding
identity
expires
Fri, 20 Mar 2026 13:41:52 GMT
x-goog-stored-content-length
43
date
Sun, 12 Apr 2026 01:33:13 GMT
content-type
image/gif
last-modified
Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid
ABgVH89K2Yq4pnfcvUStBId9HlURvizPqf3MVWGgPxZrgZz6nkGA3_cdbcg0whsVowwYFR03VNFb3R4
cache-control
public, max-age=86400
x-goog-storage-class
MULTI_REGIONAL
cf-ray
9eae7b4d9e742d31-AMS
accept-ranges
bytes
access-control-allow-origin
*
x-goog-generation
1620242732037093
content-length
43
server
cloudflare
dns
ab.dns-finder.com/meta/ 		2 B
233 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ab.dns-finder.com/meta/dns
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.36.200.111 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS
111.200.36.34.bc.googleusercontent.com
Software
/
Resource Hash
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
private, max-age=180, stale-if-error=180, stale-while-revalidate=180
access-control-expose-headers
X-Resolver
x-resolver
default
via
1.1 google
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
2
date
Sun, 12 Apr 2026 01:33:13 GMT
content-type
text/plain; charset=utf-8
vary
Origin
trustedIframe.html
btloader.com/ Frame 30E2 		6 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://btloader.com/trustedIframe.html?o=5150306120761344&upapi=true
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.20.189 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
7699df53e5893e0a67e04e9143a9712d557c79a537b07d20fb9e6911f1f6636a

Request headers

Referer
https://paint.toys/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Linux"

Response headers

cache-control
public, max-age=3600, stale-while-revalidate=3600
cf-ray
9eae7b4d9b6c06c2-AMS
content-encoding
br
content-type
text/html
date
Sun, 12 Apr 2026 01:33:13 GMT
server
cloudflare
AGSKWxXvf7GkhSfZrxHGgkVh-HR7YU9n2jO4s7b33dAVngCk3HzUzGJMqVwb_xVBpqc3MKhapd-qYT_E1246sWBI5kDz6iiSCRuVb21YwLTENG4MojFuICl1-lht7Ds_co2EJwUcs9SAWg==
fundingchoicesmessages.google.com/el/ 		0
28 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fundingchoicesmessages.google.com/el/AGSKWxXvf7GkhSfZrxHGgkVh-HR7YU9n2jO4s7b33dAVngCk3HzUzGJMqVwb_xVBpqc3MKhapd-qYT_E1246sWBI5kDz6iiSCRuVb21YwLTENG4MojFuICl1-lht7Ds_co2EJwUcs9SAWg==
Requested by
Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.nl.Xz4Te3TqfT8.es5.O/d=1/rs=AJlcJMwlLFM9qRyUvr8AYprHS9f73mZUZg/m=kernel_loader,loader_js_executable
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.20.113 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
bx-in-f113.1e100.net
Software
ESF /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-SaHH3PakoCyjfNT2SueRLA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type
text/plain
sec-ch-ua-mobile
?0

Response headers

access-control-max-age
86400
access-control-allow-methods
POST, GET, OPTIONS
x-content-type-options
nosniff
expires
Mon, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sun, 12 Apr 2026 01:33:13 GMT
content-type
text/html; charset=utf-8
x-frame-options
SAMEORIGIN
reporting-endpoints
default="/_/ContributorLoggingHttp/web-reports?context=eJzjstDikmLw15Bi-FB_mfUHEIdz-bDFA7FpSCCbMxAvnBbIthKI78QEsT0B4lOrg9kuAbEQN8fNN6_PsQk0_F9To-SSlF8Yn5yfV5KaV6KbmFKsC2IXZSaVluQXobBTy0AqcvLT0zPz0uONDIzMDEwMLPUMTOMLDACqpzJm"
content-security-policy
require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-SaHH3PakoCyjfNT2SueRLA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control
no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy
same-origin
pragma
no-cache
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials
true
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin
https://paint.toys
content-length
0
x-xss-protection
0
server
ESF
AGSKWxXvf7GkhSfZrxHGgkVh-HR7YU9n2jO4s7b33dAVngCk3HzUzGJMqVwb_xVBpqc3MKhapd-qYT_E1246sWBI5kDz6iiSCRuVb21YwLTENG4MojFuICl1-lht7Ds_co2EJwUcs9SAWg==
fundingchoicesmessages.google.com/el/ 		0
28 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fundingchoicesmessages.google.com/el/AGSKWxXvf7GkhSfZrxHGgkVh-HR7YU9n2jO4s7b33dAVngCk3HzUzGJMqVwb_xVBpqc3MKhapd-qYT_E1246sWBI5kDz6iiSCRuVb21YwLTENG4MojFuICl1-lht7Ds_co2EJwUcs9SAWg==
Requested by
Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.nl.Xz4Te3TqfT8.es5.O/d=1/rs=AJlcJMwlLFM9qRyUvr8AYprHS9f73mZUZg/m=kernel_loader,loader_js_executable
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.20.113 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
bx-in-f113.1e100.net
Software
ESF /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-F5kiWtqgH3e3cOBhqvN1gA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type
text/plain
sec-ch-ua-mobile
?0

Response headers

access-control-max-age
86400
access-control-allow-methods
POST, GET, OPTIONS
x-content-type-options
nosniff
expires
Mon, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sun, 12 Apr 2026 01:33:13 GMT
content-type
text/html; charset=utf-8
x-frame-options
SAMEORIGIN
reporting-endpoints
default="/_/ContributorLoggingHttp/web-reports?context=eJzjstDikmII0JBi-FB_mfUHEIdz-bDFA7FpSCCbMxAvnBbIthKI78QEsT0B4lOrg9kuAbEQN8fNN6_PsQnceNNQruSSlF8Yn5yfV5KaV6KbmFKsC2IXZSaVluQXobBTy0AqcvLT0zPz0uONDIzMDEwMLPUMTOMLDACxcDJ7"
content-security-policy
require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-F5kiWtqgH3e3cOBhqvN1gA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control
no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy
same-origin
pragma
no-cache
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials
true
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin
https://paint.toys
content-length
0
x-xss-protection
0
server
ESF
AGSKWxXvf7GkhSfZrxHGgkVh-HR7YU9n2jO4s7b33dAVngCk3HzUzGJMqVwb_xVBpqc3MKhapd-qYT_E1246sWBI5kDz6iiSCRuVb21YwLTENG4MojFuICl1-lht7Ds_co2EJwUcs9SAWg==
fundingchoicesmessages.google.com/el/ 		0
28 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fundingchoicesmessages.google.com/el/AGSKWxXvf7GkhSfZrxHGgkVh-HR7YU9n2jO4s7b33dAVngCk3HzUzGJMqVwb_xVBpqc3MKhapd-qYT_E1246sWBI5kDz6iiSCRuVb21YwLTENG4MojFuICl1-lht7Ds_co2EJwUcs9SAWg==
Requested by
Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.nl.Xz4Te3TqfT8.es5.O/d=1/rs=AJlcJMwlLFM9qRyUvr8AYprHS9f73mZUZg/m=kernel_loader,loader_js_executable
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.20.113 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
bx-in-f113.1e100.net
Software
ESF /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-RNg3nZJYQh6h9Q5flNcgDw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type
text/plain
sec-ch-ua-mobile
?0

Response headers

access-control-max-age
86400
access-control-allow-methods
POST, GET, OPTIONS
x-content-type-options
nosniff
expires
Mon, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sun, 12 Apr 2026 01:33:13 GMT
content-type
text/html; charset=utf-8
x-frame-options
SAMEORIGIN
reporting-endpoints
default="/_/ContributorLoggingHttp/web-reports?context=eJzjstDikmJw05Bi-FB_mfUHEIdz-bDFA7FpSCCbMxAvnBbIthKI78QEsT0B4lOrg9kuAbEQN8fNN6_PsQncOL6qWsklKb8wPjk_ryQ1r0Q3MaVYF8QuykwqLckvQmGnloFU5OSnp2fmpccbGRiZGZgYWOoZmMYXGAAArokyeg"
content-security-policy
script-src 'report-sample' 'nonce-RNg3nZJYQh6h9Q5flNcgDw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control
no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy
same-origin
pragma
no-cache
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials
true
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin
https://paint.toys
content-length
0
x-xss-protection
0
server
ESF
AGSKWxX7pzeR3DMacFvfo6--X1cMnEFAn8SdbHyXku0Sl0WMrMshwVvWo8xzp57H5Cvq32_K2OuHRZB2IlHC3u1sMYAX3oywyt7jZUBBAyOnL-ZdgqyAW3KQ6_2mjTIKZ_bKwHSEmF1bbA==
fundingchoicesmessages.google.com/f/ 		885 KB
106 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://fundingchoicesmessages.google.com/f/AGSKWxX7pzeR3DMacFvfo6--X1cMnEFAn8SdbHyXku0Sl0WMrMshwVvWo8xzp57H5Cvq32_K2OuHRZB2IlHC3u1sMYAX3oywyt7jZUBBAyOnL-ZdgqyAW3KQ6_2mjTIKZ_bKwHSEmF1bbA==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzc1OTU3NTkzLDIxMzAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzddXSwiaHR0cHM6Ly9wYWludC50b3lzL29pbC8iLG51bGwsW1s4LCJYejRUZTNUcWZUOCJdLFs5LCJubCJdLFsxOCwiW1tbbnVsbCwxMjMyXV1dIl0sWzM1LCIxNzc1OTU3NTkzIl0sWzE5LCIxIl0sWzE3LCJbMF0iXSxbMjQsIiJdLFsyOSwiZmFsc2UiXV1d
Requested by
Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.nl.Xz4Te3TqfT8.es5.O/d=1/rs=AJlcJMwlLFM9qRyUvr8AYprHS9f73mZUZg/m=kernel_loader,loader_js_executable
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.20.113 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
bx-in-f113.1e100.net
Software
ESF /
Resource Hash
7bb7f1ee30af78087c4c4f7e8620983249799b71727baaf7ca55e5976ce791fe
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-5MuG99MyF8-XZ0y16IAXKQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
x-content-type-options
nosniff
expires
Mon, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sun, 12 Apr 2026 01:33:13 GMT
content-type
application/javascript; charset=utf-8
x-frame-options
SAMEORIGIN
reporting-endpoints
default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjamHU4pJicNSQYmi9eY51OhCXLDrP2gbEXUA8B4gNFS6xOgPxh_rLrD-AuEjiCmsLEH-qusEqUn2DNZzLhy0eiL8V-7JxlPiynZjix3YLiJ8A8TcgZnnrz6Z2NIDNAogXTgtkWwnEd2KC2J4A8anVwWyXgFiIh-Pmm9fn2AQm9PX3MippJOUXxifn55UUZSaVluQXpSWnpRanFpWlFsUbGRiZGZgYWOoZmMcXGAAAqh9IgQ"
content-security-policy
script-src 'report-sample' 'nonce-5MuG99MyF8-XZ0y16IAXKQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control
no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin
*
cross-origin-opener-policy
same-origin
pragma
no-cache
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy
cross-origin
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection
0
server
ESF
main.js
cdn.intergient.com/cdn-cgi/challenge-platform/scripts/jsd/ Frame AB48 		0
0
exd
api.btloader.com/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://api.btloader.com/exd?tid=2MRJPGKLE-Q9UpCEB0Q-9d7f524c50&sid=bq25Hxx5-5a9GN7a8Su-9d7f524c50&cv=2.1.186-5-gb7ec539&upapi=true
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
130.211.23.194 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS
194.23.211.130.bc.googleusercontent.com
Software
/
Resource Hash

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

via
1.1 google
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
alt-svc
h3=":443"; ma=2592000
date
Sun, 12 Apr 2026 01:33:13 GMT
vary
Origin
css
fonts.googleapis.com/ 		123 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Archivo:400,500|Arimo:400,500|Bitter:400,500|EB+Garamond:400,500|Lato|Libre+Baskervill|Libre+Franklin:400,500|Lora:400,500|Google+Sans:regular,medium:400,500|Material+Icons|Google+Symbols|Merriweather|Montserrat:400,500|Mukta:400,500|Muli:400,500|Nunito:400,500|Open+Sans:400,500,600|Open+Sans+Condensed:400,600|Oswald:500|Playfair+Display:400,500|Poppins:400,500|Raleway:400,500|Roboto:400,500|Roboto+Condensed:400,500|Roboto+Slab:400,500|Slabo+27px|Source+Sans+Pro|Ubuntu:400,500|Volkhov&display=swap
Requested by
Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.nl.Xz4Te3TqfT8.es5.O/d=1/exm=kernel_loader,loader_js_executable/ed=1/rs=AJlcJMwlLFM9qRyUvr8AYprHS9f73mZUZg/m=web_iab_tcf_v2_wall_executable
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
192.178.183.95 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
lcfraw-in-f95.1e100.net
Software
ESF /
Resource Hash
6f55a179811727a333e01eb1e16c9d003ffe30a223c8e6121ed732b2b09b95f7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
x-content-type-options
nosniff
expires
Sun, 12 Apr 2026 01:33:13 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sun, 12 Apr 2026 01:33:13 GMT
content-type
text/css; charset=utf-8
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified
Sun, 12 Apr 2026 01:33:13 GMT
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
x-xss-protection
0
server
ESF
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v40/ 		47 KB
47 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
Requested by
Host: paint.toys
URL: https://paint.toys/oil/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.14.94 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pm-in-f94.1e100.net
Software
sffe /
Resource Hash
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://paint.toys
sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

age
50203
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Sun, 11 Apr 2027 11:36:30 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 11 Apr 2026 11:36:30 GMT
last-modified
Thu, 14 Dec 2023 02:08:40 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
48236
x-xss-protection
0
server
sffe
AGSKWxXvf7GkhSfZrxHGgkVh-HR7YU9n2jO4s7b33dAVngCk3HzUzGJMqVwb_xVBpqc3MKhapd-qYT_E1246sWBI5kDz6iiSCRuVb21YwLTENG4MojFuICl1-lht7Ds_co2EJwUcs9SAWg==
fundingchoicesmessages.google.com/el/ 		0
28 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fundingchoicesmessages.google.com/el/AGSKWxXvf7GkhSfZrxHGgkVh-HR7YU9n2jO4s7b33dAVngCk3HzUzGJMqVwb_xVBpqc3MKhapd-qYT_E1246sWBI5kDz6iiSCRuVb21YwLTENG4MojFuICl1-lht7Ds_co2EJwUcs9SAWg==
Requested by
Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.nl.Xz4Te3TqfT8.es5.O/d=1/rs=AJlcJMwlLFM9qRyUvr8AYprHS9f73mZUZg/m=kernel_loader,loader_js_executable
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.20.113 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
bx-in-f113.1e100.net
Software
ESF /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-a0qDVYJxeOqHnqYluKEzqQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type
text/plain
sec-ch-ua-mobile
?0

Response headers

access-control-max-age
86400
access-control-allow-methods
POST, GET, OPTIONS
x-content-type-options
nosniff
expires
Mon, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sun, 12 Apr 2026 01:33:13 GMT
content-type
text/html; charset=utf-8
x-frame-options
SAMEORIGIN
reporting-endpoints
default="/_/ContributorLoggingHttp/web-reports?context=eJzjstDikmLw15Bi-FB_mfUHEIdz-bDFA7FpSCCbMxAvnBbIthKI78QEsT0B4lOrg9kuAbEQD8fNN6_PsQnMaP92kVHJJSm_MD45P68kNa9ENzGlWBfELspMKi3JL0Jhp5aBVOTkp6dn5qXHGxkYmRmYGFjqGZjGFxgAANXfMqc"
content-security-policy
require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-a0qDVYJxeOqHnqYluKEzqQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control
no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy
same-origin
pragma
no-cache
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials
true
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin
https://paint.toys
content-length
0
x-xss-protection
0
server
ESF
AGSKWxXvf7GkhSfZrxHGgkVh-HR7YU9n2jO4s7b33dAVngCk3HzUzGJMqVwb_xVBpqc3MKhapd-qYT_E1246sWBI5kDz6iiSCRuVb21YwLTENG4MojFuICl1-lht7Ds_co2EJwUcs9SAWg==
fundingchoicesmessages.google.com/el/ 		0
28 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fundingchoicesmessages.google.com/el/AGSKWxXvf7GkhSfZrxHGgkVh-HR7YU9n2jO4s7b33dAVngCk3HzUzGJMqVwb_xVBpqc3MKhapd-qYT_E1246sWBI5kDz6iiSCRuVb21YwLTENG4MojFuICl1-lht7Ds_co2EJwUcs9SAWg==
Requested by
Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.nl.Xz4Te3TqfT8.es5.O/d=1/rs=AJlcJMwlLFM9qRyUvr8AYprHS9f73mZUZg/m=kernel_loader,loader_js_executable
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.20.113 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
bx-in-f113.1e100.net
Software
ESF /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-tHA-8v1UMIM08JlpkO5jJA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type
text/plain
sec-ch-ua-mobile
?0

Response headers

access-control-max-age
86400
access-control-allow-methods
POST, GET, OPTIONS
x-content-type-options
nosniff
expires
Mon, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sun, 12 Apr 2026 01:33:13 GMT
content-type
text/html; charset=utf-8
x-frame-options
SAMEORIGIN
reporting-endpoints
default="/_/ContributorLoggingHttp/web-reports?context=eJzjstDikmLw0JBi-FB_mfUHEIdz-bDFA7FpSCCbMxAvnBbIthKI78QEsT0B4lOrg9kuAbEQD8fNN6_PsQkcWHXmKqOSS1J-YXxyfl5Jal6JbmJKsS6IXZSZVFqSX4TCTi0DqcjJT0_PzEuPNzIwMjMwMbDUMzCNLzAAAN0jMsU"
content-security-policy
require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-tHA-8v1UMIM08JlpkO5jJA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control
no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy
same-origin
pragma
no-cache
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials
true
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin
https://paint.toys
content-length
0
x-xss-protection
0
server
ESF
AGSKWxXvf7GkhSfZrxHGgkVh-HR7YU9n2jO4s7b33dAVngCk3HzUzGJMqVwb_xVBpqc3MKhapd-qYT_E1246sWBI5kDz6iiSCRuVb21YwLTENG4MojFuICl1-lht7Ds_co2EJwUcs9SAWg==
fundingchoicesmessages.google.com/el/ 		0
28 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fundingchoicesmessages.google.com/el/AGSKWxXvf7GkhSfZrxHGgkVh-HR7YU9n2jO4s7b33dAVngCk3HzUzGJMqVwb_xVBpqc3MKhapd-qYT_E1246sWBI5kDz6iiSCRuVb21YwLTENG4MojFuICl1-lht7Ds_co2EJwUcs9SAWg==
Requested by
Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.nl.Xz4Te3TqfT8.es5.O/d=1/rs=AJlcJMwlLFM9qRyUvr8AYprHS9f73mZUZg/m=kernel_loader,loader_js_executable
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.20.113 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
bx-in-f113.1e100.net
Software
ESF /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-3B44gGJL7nuPXvGjG6yj4g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type
text/plain
sec-ch-ua-mobile
?0

Response headers

access-control-max-age
86400
access-control-allow-methods
POST, GET, OPTIONS
x-content-type-options
nosniff
expires
Mon, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sun, 12 Apr 2026 01:33:13 GMT
content-type
text/html; charset=utf-8
x-frame-options
SAMEORIGIN
reporting-endpoints
default="/_/ContributorLoggingHttp/web-reports?context=eJzjstDikmLw1JBi-FB_mfUHEIdz-bDFA7FpSCCbMxAvnBbIthKI78QEsT0B4lOrg9kuAbEQD8fNN6_PsQn8eP7yKqOSS1J-YXxyfl5Jal6JbmJKsS6IXZSZVFqSX4TCTi0DqcjJT0_PzEuPNzIwMjMwMbDUMzCNLzAAAAgJM1g"
content-security-policy
require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-3B44gGJL7nuPXvGjG6yj4g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control
no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy
same-origin
pragma
no-cache
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials
true
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin
https://paint.toys
content-length
0
x-xss-protection
0
server
ESF
qz93xj6apwx_c07d1azd7vde0
faucetfoot.com/ 		303 B
327 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://faucetfoot.com/qz93xj6apwx_c07d1azd7vde0
Requested by
Host: faucetfoot.com
URL: https://faucetfoot.com/files/p94wwqs1nsnv-prod.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.8.176.186 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS
186.176.8.34.bc.googleusercontent.com
Software
hoothoot/2438300242 /
Resource Hash
4d1a4780262ed98fbe4a12dfb5593b2bcefebbbe220f269eddd9769588de6112
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; preload

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type
text/plain;charset=UTF-8
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=15724800; preload
cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
access-control-allow-credentials
true
access-control-allow-methods
POST, OPTIONS
via
fen-hoothoot-europe-west1-cqkh.gce-europe-west1, 1.1 google
expires
Sun, 12 Apr 2026 01:33:12 GMT
access-control-allow-origin
https://paint.toys
alt-svc
h3=":443"; ma=2592000
content-length
303
date
Sun, 12 Apr 2026 01:33:13 GMT
content-type
application/json; charset=utf-8
vary
Accept-Encoding, Origin
server
hoothoot/2438300242
access-control-allow-headers
DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Cookie
px.gif
ad-delivery.net/ 		43 B
110 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ad-delivery.net/px.gif?ch=1&e=0.12869714132394416
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.47.80 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-goog-metageneration
5
access-control-expose-headers
*, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash
crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status
HIT
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3"
age
1946962
x-goog-stored-content-encoding
identity
expires
Fri, 20 Mar 2026 13:41:52 GMT
x-goog-stored-content-length
43
date
Sun, 12 Apr 2026 01:33:13 GMT
content-type
image/gif
last-modified
Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid
ABgVH89K2Yq4pnfcvUStBId9HlURvizPqf3MVWGgPxZrgZz6nkGA3_cdbcg0whsVowwYFR03VNFb3R4
cache-control
public, max-age=86400
x-goog-storage-class
MULTI_REGIONAL
cf-ray
9eae7b4f09a12d31-AMS
accept-ranges
bytes
access-control-allow-origin
*
x-goog-generation
1620242732037093
content-length
43
server
cloudflare
favicon.ico
paint.toys/ 		615 B
748 B 		Other
General
Check archive.org
Download Go to
Full URL
https://paint.toys/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.33.186.135 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
afa7f374f51cc8991.awsglobalaccelerator.com
Software
Netlify /
Resource Hash
30a007a99e491d9e1b2b72c02e4a8454334c6ea2b3a03316d50135b20464fccc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/oil/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=31536000
cache-control
public,max-age=0,must-revalidate
etag
"6c77abc0123fbfdebbf702a90fb50938-ssl"
age
79651
accept-ranges
bytes
content-length
615
x-nf-request-id
01KNZN4KD8M2M246ZHXEEV9Z93
cache-status
"Netlify Edge"; hit
date
Sun, 12 Apr 2026 01:33:13 GMT
content-type
image/vnd.microsoft.icon
server
Netlify
iframe.html
cdn.intergient.com/pageos/V.20260406.1/iframe/ Frame 1297 		1 KB
0 		Document
General
Check archive.org
Download Go to
Full URL
https://cdn.intergient.com/pageos/V.20260406.1/iframe/iframe.html
Requested by
Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260406.1/main.551129c9449d5acc2196.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
c8039db3019fcff8be120f5287c9945c828d07138271b8c16fa4738521abf769

Request headers

Referer
https://paint.toys/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Linux"

Response headers

age
374069
cache-control
public, max-age=31536000
cf-cache-status
HIT
cf-ray
9eae7b4d0ffc9d5d-AMS
content-encoding
br
content-type
text/html
date
Sun, 12 Apr 2026 01:33:13 GMT
expires
Mon, 12 Apr 2027 01:33:13 GMT
hw-country-code
NL
last-modified
Tue, 07 Apr 2026 17:27:56 GMT
server
cloudflare
apstag.js
c.amazon-adsystem.com/aax2/ 		354 KB
90 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c.amazon-adsystem.com/aax2/apstag.js
Requested by
Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260406.1/main.551129c9449d5acc2196.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.138.3.93 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-108-138-3-93.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
676e51f4fae12e637d7c95adcfe1a93fb3c523f1ee99985d1a580e26077ba970

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

vary
Accept-Encoding
cache-control
max-age=3600
content-encoding
gzip
etag
W/"e01949a8eee0862893b61174efba0140"
age
2898
via
1.1 94bd75b95472ec61935815aa61472392.cloudfront.net (CloudFront), 1.1 def5acc189db6e2856a956225d5cd100.cloudfront.net (CloudFront)
x-cache
Hit from cloudfront
x-amz-cf-id
BGROsYnjPENsAuxd4Y7rGxxEQJk4D-494z7u-9BJ8DwZLUuetIHXpA==
date
Sun, 12 Apr 2026 00:44:56 GMT
content-type
application/javascript
x-amz-cf-pop
FRA56-P14, FRA56-P6
server
AmazonS3
last-modified
Thu, 09 Apr 2026 21:07:55 GMT
x-amz-server-side-encryption
AES256
iframe.js
cdn.intergient.com/pageos/V.20260406.1/iframe/ Frame 1297 		17 KB
0 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.intergient.com/pageos/V.20260406.1/iframe/iframe.js
Requested by
Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260406.1/iframe/iframe.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
a1e9592b119e182885673d049ec2ead66dab57473f2f6da59f43d888cea5ac1e

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://cdn.intergient.com/pageos/V.20260406.1/iframe/iframe.html
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

hw-country-code
NL
cache-control
public, max-age=31536000
content-encoding
br
cf-cache-status
HIT
etag
W/"3eecc5d11812ac69fb4f2c63c5dea237"
age
374069
cf-ray
9eae7b4d58b59d5d-AMS
expires
Mon, 12 Apr 2027 01:33:13 GMT
date
Sun, 12 Apr 2026 01:33:13 GMT
content-type
text/javascript
last-modified
Tue, 07 Apr 2026 17:27:57 GMT
server
cloudflare
main.js
cdn.intergient.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/b0a7532ac8ec/ Frame ADBC
Redirect Chain
  • https://cdn.intergient.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
  • https://cdn.intergient.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/b0a7532ac8ec/main.js?
26 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.intergient.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/b0a7532ac8ec/main.js?
Protocol
H2
Server
104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
12a1f9e0d6cc3d5fcb5a4b52445f3092821c3df32b97354aac99526c1ef27805
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer

Response headers

cf-ray
9eae7b505dfe9d5d-AMS
cache-control
max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public
content-encoding
gzip
date
Sun, 12 Apr 2026 01:33:13 GMT
content-type
application/javascript; charset=UTF-8
server
cloudflare
x-content-type-options
nosniff

Redirect headers

cf-ray
9eae7b503dc09d5d-AMS
cache-control
max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public
location
/cdn-cgi/challenge-platform/h/g/scripts/jsd/b0a7532ac8ec/main.js?
content-length
0
access-control-allow-origin
*
date
Sun, 12 Apr 2026 01:33:13 GMT
server
cloudflare
d968bbaf-b865-4695-9dd4-5b88fb213f0d
https://paint.toys/ 		0
0
474.54ec3c969d5dcf548468.js
cdn.intergient.com/pageos/V.20260406.1/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.intergient.com/pageos/V.20260406.1/474.54ec3c969d5dcf548468.js
Requested by
Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260406.1/runtime.e74e4ca9f030172e8b39.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
70fdcbbe7129a79cab3b0839348a16e359bda7056b157c52ec8d2cb89d40fa3e

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

hw-country-code
NL
cache-control
public, max-age=31536000
content-encoding
br
cf-cache-status
HIT
etag
W/"a4ba8a8e24e7796c977c7ad0213bf24d"
age
374069
cf-ray
9eae7b503b22c886-AMS
expires
Mon, 12 Apr 2027 01:33:13 GMT
date
Sun, 12 Apr 2026 01:33:13 GMT
content-type
text/javascript
last-modified
Tue, 07 Apr 2026 17:27:49 GMT
server
cloudflare
ima3.js
imasdk.googleapis.com/js/sdkloader/ 		464 KB
146 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://imasdk.googleapis.com/js/sdkloader/ima3.js
Requested by
Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260406.1/main.551129c9449d5acc2196.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
142.251.110.95 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
bz-in-f95.1e100.net
Software
cafe /
Resource Hash
74e59fc67c703f82c13c2e3a7ad1770fa26f274a9617aa79ad2d065b2d1b11df
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
etag
1366167282717696831
x-content-type-options
nosniff
expires
Sun, 12 Apr 2026 01:33:13 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date
Sun, 12 Apr 2026 01:33:13 GMT
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
content-disposition
attachment; filename="f.txt"
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
content-length
148947
x-xss-protection
0
server
cafe
fb87a4ea41
cd836371f1d.cdn.intergient.com/ 		0
96 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://cd836371f1d.cdn.intergient.com/fb87a4ea41
Requested by
Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260406.1/main.551129c9449d5acc2196.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
63.176.195.25 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-63-176-195-25.eu-central-1.compute.amazonaws.com
Software
nginx/1.24.0 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type
text/plain;charset=UTF-8
sec-ch-ua-mobile
?0

Response headers

access-control-allow-origin
*
date
Sun, 12 Apr 2026 01:33:13 GMT
content-type
application/octet-stream
server
nginx/1.24.0
px.gif
ad-delivery.net/ 		43 B
110 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ad-delivery.net/px.gif?ch=2&e=0.010004403782616023
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.47.80 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-goog-metageneration
5
access-control-expose-headers
*, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash
crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status
HIT
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3"
age
1946962
x-goog-stored-content-encoding
identity
expires
Fri, 20 Mar 2026 13:41:52 GMT
x-goog-stored-content-length
43
date
Sun, 12 Apr 2026 01:33:13 GMT
content-type
image/gif
last-modified
Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid
ABgVH89K2Yq4pnfcvUStBId9HlURvizPqf3MVWGgPxZrgZz6nkGA3_cdbcg0whsVowwYFR03VNFb3R4
cache-control
public, max-age=86400
x-goog-storage-class
MULTI_REGIONAL
cf-ray
9eae7b505c162d31-AMS
accept-ranges
bytes
access-control-allow-origin
*
x-goog-generation
1620242732037093
content-length
43
server
cloudflare
favicon.ico
ad.doubleclick.net/ 		1 KB
129 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.651084784543768
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.14.148 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pm-in-f148.1e100.net
Software
sffe /
Resource Hash
d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options
nosniff
expires
Mon, 13 Apr 2026 01:33:13 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sun, 12 Apr 2026 01:33:13 GMT
content-type
image/x-icon
vary
Accept-Encoding
last-modified
Tue, 08 May 2012 13:08:06 GMT
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
content-length
104
x-xss-protection
0
server
sffe
9eae7b4d0ffc9d5d
cdn.intergient.com/cdn-cgi/challenge-platform/h/g/jsd/oneshot/b0a7532ac8ec/0.38805911369366874:1775956765:KSIU20VRP2vuiPPOtkb5VclIclep-LiOUkH3MwxI1kM/ Frame ADBC 		0
802 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://cdn.intergient.com/cdn-cgi/challenge-platform/h/g/jsd/oneshot/b0a7532ac8ec/0.38805911369366874:1775956765:KSIU20VRP2vuiPPOtkb5VclIclep-LiOUkH3MwxI1kM/9eae7b4d0ffc9d5d
Requested by
Host: cdn.intergient.com
URL: https://cdn.intergient.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type
text/plain;charset=UTF-8
sec-ch-ua-mobile
?0

Response headers

cf-ray
9eae7b50be939d5d-AMS
timing-allow-origin
https://cdn.intergient.com
content-length
0
cf-chl-out-s
g3irXYJG0B85u9/H6IfgwQ==$OkW4y0U2/CxXryVeLL4CHw==
date
Sun, 12 Apr 2026 01:33:13 GMT
content-type
text/plain; charset=UTF-8
server
cloudflare
bid
aax.amazon-adsystem.com/e/dtb/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://aax.amazon-adsystem.com/e/dtb/bid
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.138.4.226 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-108-138-4-226.fra56.r.cloudfront.net
Software
Server /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://paint.toys
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
origin,x-requested-with,access-control-request-headers,content-type,access-control-request-method,accept
access-control-allow-methods
POST
access-control-allow-origin
https://paint.toys
access-control-max-age
1800
content-encoding
gzip
content-length
0
date
Sun, 12 Apr 2026 01:33:13 GMT
server
Server
via
1.1 cfbb6e543d97587a32117dbabb25fc86.cloudfront.net (CloudFront)
x-amz-cf-id
Y3yU3CziiRfO7y_f4guVgvkESzMgWeNtpOBrb5KtzPDOLDHwn-5sLg==
x-amz-cf-pop
FRA56-P6
x-cache
Miss from cloudfront
aps_csm.js
c.amazon-adsystem.com/bao-csm/aps-comm/ 		6 KB
3 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.138.3.93 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-108-138-3-93.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

access-control-max-age
3000
content-encoding
gzip
x-amz-version-id
r5.lR.LJ66XEXzxUUVo7iMemjL_F_GoE
etag
W/"a4d296427fc806b21335359e398c025c"
age
78402
access-control-allow-methods
GET
x-cache
Hit from cloudfront
x-amz-cf-id
bBP-no7px2MP5w7TkiIMOYwQxFilq2ds5z81DYgMqquS8U0UnEAd4A==
date
Sat, 11 Apr 2026 03:46:32 GMT
content-type
application/javascript
vary
Origin,Accept-Encoding
last-modified
Thu, 29 Feb 2024 02:13:08 GMT
cache-control
public, max-age=86400
via
1.1 f13110b40e6214ad566c753a838f49f4.cloudfront.net (CloudFront)
access-control-allow-origin
*
x-amz-cf-pop
FRA56-P6
server
AmazonS3
x-amz-server-side-encryption
AES256
bd056b42-51db-43ce-9a8e-3b11319b5d1f
config.aps.amazon-adsystem.com/configs/ 		67 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://config.aps.amazon-adsystem.com/configs/bd056b42-51db-43ce-9a8e-3b11319b5d1f
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.245.46.20 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-18-245-46-20.fra56.r.cloudfront.net
Software
CloudFront /
Resource Hash
2edc4749082382c6dc56e08a38f7135bba65296cbc4f7d19c8e42a53d1171540

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
max-age=3600
content-encoding
gzip
age
1990
via
1.1 9938d2bc2f9fab06207e42238c10bb32.cloudfront.net (CloudFront)
x-cache
Hit from cloudfront
content-length
3244
x-amz-cf-id
EMrGRYF9US3JfeLfBbi9j0AeUgYtujWIunJLNLJaqHk7TGg5Yk8abw==
date
Sun, 12 Apr 2026 01:00:03 GMT
content-type
application/javascript
x-amz-cf-pop
FRA56-P9
server
CloudFront
config
c.amazon-adsystem.com/cdn/prod/ 		3 KB
3 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fpaint.toys&pubid=bd056b42-51db-43ce-9a8e-3b11319b5d1f
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.138.3.93 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-108-138-3-93.fra56.r.cloudfront.net
Software
Server /
Resource Hash
d4146a9ffdccf871cc20ab37bd23ca6ebdcbcae9d6255d3d311a97cfd138a74f

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
max-age=21550, s-maxage=21600
age
12615
access-control-allow-credentials
true
via
1.1 def5acc189db6e2856a956225d5cd100.cloudfront.net (CloudFront)
access-control-allow-origin
https://paint.toys
x-cache
Hit from cloudfront
content-length
3077
x-amz-cf-id
t33IOz_FetVpnGh5CW9gxkgH1jhFuc8r9Jus_t63pvjMn2GUfuWa_g==
date
Sat, 11 Apr 2026 22:02:58 GMT
content-type
application/json;charset=UTF-8
x-amz-cf-pop
FRA56-P6
server
Server
bid
aax.amazon-adsystem.com/e/dtb/ 		25 B
386 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://aax.amazon-adsystem.com/e/dtb/bid
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.138.4.226 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-108-138-4-226.fra56.r.cloudfront.net
Software
Server /
Resource Hash
7dc78c5c119373b361b76d7e9c1b2759725163789661df908ee4cd8faf842676

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type
application/json
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
access-control-allow-credentials
true
via
1.1 bb5a1c03f2335d92378a3e68542733da.cloudfront.net (CloudFront)
access-control-allow-origin
https://paint.toys
x-cache
Miss from cloudfront
content-length
45
x-amz-cf-id
ozoMKhC0ltrt1w1KSaNb_SYCf36PwO6sse884FoqbM3AQBlsUgCgXw==
date
Sun, 12 Apr 2026 01:33:13 GMT
content-type
application/json;charset=UTF-8
vary
Origin
server
Server
x-amz-cf-pop
FRA56-P6
pubcid.min.js
secure.cdn.fastclick.net/js/pubcid/latest/ 		67 KB
22 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://secure.cdn.fastclick.net/js/pubcid/latest/pubcid.min.js
Requested by
Host: beasiswalpdp.my.id
URL: https://beasiswalpdp.my.id/a0vwnRaVMybFYzTVBjeGhVeWJNVVcyN20tNTk4OS0yNTc1ODM5MC0xMDlkMDI4Ny0xMDM2Mi1KazBZeFVqd1VLdldqYXlVbnpPbA
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.45.96.101 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-45-96-101.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
45bc6978e281a938d9485dcbf0859159b24e2f7c9b8b0fafc120b9606e0ea8b1

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
max-age=900
content-encoding
gzip
etag
"10ab4-63a0ee37f7c40-gzip"
expires
Sun, 12 Apr 2026 01:48:13 GMT
accept-ranges
bytes
content-length
21994
date
Sun, 12 Apr 2026 01:33:13 GMT
last-modified
Wed, 16 Jul 2025 17:04:41 GMT
content-type
application/javascript
server
Apache
vary
Accept-Encoding
sync.min.js
tags.crwdcntrl.net/lt/c/16576/ 		44 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Requested by
Host: beasiswalpdp.my.id
URL: https://beasiswalpdp.my.id/a0vwnRaVMybFYzTVBjeGhVeWJNVVcyN20tNTk4OS0yNTc1ODM5MC0xMDlkMDI4Ny0xMDM2Mi1KazBZeFVqd1VLdldqYXlVbnpPbA
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.102.77 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-18-66-102-77.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
5ac6db9eca6024415fceff0efcb39732b882e99babaaf05b94b04baa16980583

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

vary
Accept-Encoding
cache-control
public, max-age=86400
content-encoding
gzip
etag
W/"27a001ef77a3a0515b877de836201c21"
age
80088
via
1.1 f4137273db9ae377298b8f8daf5b93f0.cloudfront.net (CloudFront)
alt-svc
h3=":443"; ma=86400
x-cache
Hit from cloudfront
x-amz-cf-id
xqRsEPmzuZ6Z0ax5KFQussoYSTteg7HPPLrPoyHKbhrYSKhDkHTqHw==
date
Sat, 11 Apr 2026 05:20:30 GMT
content-type
text/javascript
last-modified
Tue, 10 Feb 2026 20:18:40 GMT
server
AmazonS3
x-amz-cf-pop
FRA56-P2
x-amz-server-side-encryption
AES256
hadron.js
cdn.hadronid.net/ 		11 B
186 B 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=&_it=amazon&partner_id=403
Requested by
Host: beasiswalpdp.my.id
URL: https://beasiswalpdp.my.id/a0vwnRaVMybFYzTVBjeGhVeWJNVVcyN20tNTk4OS0yNTc1ODM5MC0xMDlkMDI4Ny0xMDM2Mi1KazBZeFVqd1VLdldqYXlVbnpPbA
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.66.166.119 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
a73f5986eb985871284e6e216372de3505634a97229de643216728d0fbfd6227

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
max-age=432000
cf-cache-status
HIT
etag
"6943ef12-b"
age
4006
cf-ray
9eae7b51df27fb87-AMS
accept-ranges
bytes
content-length
11
date
Sun, 12 Apr 2026 01:33:13 GMT
content-type
text/plain
last-modified
Thu, 18 Dec 2025 12:09:54 GMT
server
cloudflare
id5-api.js
cdn.id5-sync.com/api/1.0/ 		117 KB
35 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.id5-sync.com/api/1.0/id5-api.js
Requested by
Host: beasiswalpdp.my.id
URL: https://beasiswalpdp.my.id/a0vwnRaVMybFYzTVBjeGhVeWJNVVcyN20tNTk4OS0yNTc1ODM5MC0xMDlkMDI4Ny0xMDM2Mi1KazBZeFVqd1VLdldqYXlVbnpPbA
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.66.169.55 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
18120a6bee05cd823d5f4ab0c52006863a059a5d6c535c790a31bdd2ee8c45e7
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-amz-id-2
H/Fu1bh7AsQ70++MWwc6+Z189TzBojy+B5MTf9BVoIn4YoFLvgQ0/DYZc4K+nAo1uX5XcqDl/W+mcAi8RqU63rplYK5H9qXVgSaChLTONsg=
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=3600
content-encoding
br
cf-cache-status
HIT
etag
W/"78d670c3a2facd95b81a836b6857d830"
age
2599
x-amz-request-id
VB3EWK5QGCQM0AYW
cf-ray
9eae7b51ebb816bf-AMS
date
Sun, 12 Apr 2026 01:33:13 GMT
content-type
text/javascript;charset=utf-8
last-modified
Wed, 18 Mar 2026 12:22:23 GMT
server
cloudflare
x-amz-server-side-encryption
AES256
id5-api-js
api.id5-sync.com/analytics/483/ 		1 KB
691 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://api.id5-sync.com/analytics/483/id5-api-js
Requested by
Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
162.19.138.120 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),
Reverse DNS
ns31533571.ip-162-19-138.eu
Software
/
Resource Hash
64731b0c4bddd9b69b5d748b611bcb8cc52a9dd00a6d9f4c9664dfac0a8d6e1b
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
cache-control
max-age=300
access-control-expose-headers
Access-Control-Allow-Origin
content-encoding
gzip
access-control-allow-origin
*
date
Sun, 12 Apr 2026 01:33:14 GMT
content-type
application/json
vary
origin,access-control-request-method,access-control-request-headers,accept-encoding
ping
pagead2.googlesyndication.com/pagead/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/ping?e=1
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202604080101/pubads_impl.js?cb=31097742
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.20.155 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
bx-in-f155.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type
text/plain;charset=UTF-8
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Sun, 12 Apr 2026 01:33:14 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
px.gif
ad-delivery.net/ 		43 B
140 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ad-delivery.net/px.gif?ch=2&e=0.13101078005994504
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.47.80 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-goog-metageneration
5
access-control-expose-headers
*, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash
crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status
HIT
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3"
age
1946963
x-goog-stored-content-encoding
identity
expires
Fri, 20 Mar 2026 13:41:52 GMT
x-goog-stored-content-length
43
date
Sun, 12 Apr 2026 01:33:14 GMT
content-type
image/gif
last-modified
Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid
ABgVH89K2Yq4pnfcvUStBId9HlURvizPqf3MVWGgPxZrgZz6nkGA3_cdbcg0whsVowwYFR03VNFb3R4
cache-control
public, max-age=86400
x-goog-storage-class
MULTI_REGIONAL
cf-ray
9eae7b547ba12d31-AMS
accept-ranges
bytes
access-control-allow-origin
*
x-goog-generation
1620242732037093
content-length
43
server
cloudflare
favicon.ico
ad.doubleclick.net/ 		1 KB
129 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.5762577395600855
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.14.148 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pm-in-f148.1e100.net
Software
sffe /
Resource Hash
d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options
nosniff
expires
Mon, 13 Apr 2026 01:33:14 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sun, 12 Apr 2026 01:33:14 GMT
content-type
image/x-icon
vary
Accept-Encoding
last-modified
Tue, 08 May 2012 13:08:06 GMT
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
content-length
104
x-xss-protection
0
server
sffe
px.gif
ad-delivery.net/ 		43 B
110 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ad-delivery.net/px.gif?ch=1&e=0.5703377574426716
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.47.80 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-goog-metageneration
5
access-control-expose-headers
*, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash
crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status
HIT
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3"
age
1946963
x-goog-stored-content-encoding
identity
expires
Fri, 20 Mar 2026 13:41:52 GMT
x-goog-stored-content-length
43
date
Sun, 12 Apr 2026 01:33:14 GMT
content-type
image/gif
last-modified
Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid
ABgVH89K2Yq4pnfcvUStBId9HlURvizPqf3MVWGgPxZrgZz6nkGA3_cdbcg0whsVowwYFR03VNFb3R4
cache-control
public, max-age=86400
x-goog-storage-class
MULTI_REGIONAL
cf-ray
9eae7b547bb22d31-AMS
accept-ranges
bytes
access-control-allow-origin
*
x-goog-generation
1620242732037093
content-length
43
server
cloudflare
dns
ab.dns-finder.com/meta/ 		2 B
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ab.dns-finder.com/meta/dns
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.36.200.111 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS
111.200.36.34.bc.googleusercontent.com
Software
/
Resource Hash
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
private, max-age=180, stale-if-error=180, stale-while-revalidate=180
access-control-expose-headers
X-Resolver
x-resolver
default
via
1.1 google
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
2
date
Sun, 12 Apr 2026 01:33:13 GMT
content-type
text/plain; charset=utf-8
vary
Origin
px.gif
ad-delivery.net/ 		43 B
110 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ad-delivery.net/px.gif?ch=1&e=0.6321368649003722
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.47.80 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-goog-metageneration
5
access-control-expose-headers
*, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash
crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status
HIT
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3"
age
1946963
x-goog-stored-content-encoding
identity
expires
Fri, 20 Mar 2026 13:41:52 GMT
x-goog-stored-content-length
43
date
Sun, 12 Apr 2026 01:33:14 GMT
content-type
image/gif
last-modified
Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid
ABgVH89K2Yq4pnfcvUStBId9HlURvizPqf3MVWGgPxZrgZz6nkGA3_cdbcg0whsVowwYFR03VNFb3R4
cache-control
public, max-age=86400
x-goog-storage-class
MULTI_REGIONAL
cf-ray
9eae7b55ee7a2d31-AMS
accept-ranges
bytes
access-control-allow-origin
*
x-goog-generation
1620242732037093
content-length
43
server
cloudflare
px.gif
ad-delivery.net/ 		43 B
110 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ad-delivery.net/px.gif?ch=2&e=0.6884096413732806
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.47.80 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-goog-metageneration
5
access-control-expose-headers
*, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash
crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status
HIT
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3"
age
1946963
x-goog-stored-content-encoding
identity
expires
Fri, 20 Mar 2026 13:41:52 GMT
x-goog-stored-content-length
43
date
Sun, 12 Apr 2026 01:33:14 GMT
content-type
image/gif
last-modified
Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid
ABgVH89K2Yq4pnfcvUStBId9HlURvizPqf3MVWGgPxZrgZz6nkGA3_cdbcg0whsVowwYFR03VNFb3R4
cache-control
public, max-age=86400
x-goog-storage-class
MULTI_REGIONAL
cf-ray
9eae7b5718da2d31-AMS
accept-ranges
bytes
access-control-allow-origin
*
x-goog-generation
1620242732037093
content-length
43
server
cloudflare
favicon.ico
ad.doubleclick.net/ 		1 KB
129 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.5684862720669003
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.14.148 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pm-in-f148.1e100.net
Software
sffe /
Resource Hash
d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options
nosniff
expires
Mon, 13 Apr 2026 01:33:14 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sun, 12 Apr 2026 01:33:14 GMT
content-type
image/x-icon
vary
Accept-Encoding
last-modified
Tue, 08 May 2012 13:08:06 GMT
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
content-length
104
x-xss-protection
0
server
sffe
px.gif
ad-delivery.net/ 		43 B
133 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ad-delivery.net/px.gif?ch=2&e=0.8395702738192784
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.47.80 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-goog-metageneration
5
access-control-expose-headers
*, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash
crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status
HIT
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3"
age
1946963
x-goog-stored-content-encoding
identity
expires
Fri, 20 Mar 2026 13:41:52 GMT
x-goog-stored-content-length
43
date
Sun, 12 Apr 2026 01:33:15 GMT
content-type
image/gif
last-modified
Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid
ABgVH89K2Yq4pnfcvUStBId9HlURvizPqf3MVWGgPxZrgZz6nkGA3_cdbcg0whsVowwYFR03VNFb3R4
cache-control
public, max-age=86400
x-goog-storage-class
MULTI_REGIONAL
cf-ray
9eae7b59be8f2d31-AMS
accept-ranges
bytes
access-control-allow-origin
*
x-goog-generation
1620242732037093
content-length
43
server
cloudflare
favicon.ico
ad.doubleclick.net/ 		1 KB
129 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.21187602795157368
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.14.148 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pm-in-f148.1e100.net
Software
sffe /
Resource Hash
d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options
nosniff
expires
Mon, 13 Apr 2026 01:33:15 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sun, 12 Apr 2026 01:33:15 GMT
content-type
image/x-icon
vary
Accept-Encoding
last-modified
Tue, 08 May 2012 13:08:06 GMT
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
content-length
104
x-xss-protection
0
server
sffe
px.gif
ad-delivery.net/ 		43 B
117 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ad-delivery.net/px.gif?ch=2&e=0.19561273733515805
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.47.80 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-goog-metageneration
5
access-control-expose-headers
*, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash
crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status
HIT
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3"
age
1946964
x-goog-stored-content-encoding
identity
expires
Fri, 20 Mar 2026 13:41:52 GMT
x-goog-stored-content-length
43
date
Sun, 12 Apr 2026 01:33:15 GMT
content-type
image/gif
last-modified
Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid
ABgVH89K2Yq4pnfcvUStBId9HlURvizPqf3MVWGgPxZrgZz6nkGA3_cdbcg0whsVowwYFR03VNFb3R4
cache-control
public, max-age=86400
x-goog-storage-class
MULTI_REGIONAL
cf-ray
9eae7b5c6bca2d31-AMS
accept-ranges
bytes
access-control-allow-origin
*
x-goog-generation
1620242732037093
content-length
43
server
cloudflare
favicon.ico
ad.doubleclick.net/ 		1 KB
129 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.731753438940356
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.14.148 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pm-in-f148.1e100.net
Software
sffe /
Resource Hash
d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options
nosniff
expires
Mon, 13 Apr 2026 01:33:15 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sun, 12 Apr 2026 01:33:15 GMT
content-type
image/x-icon
vary
Accept-Encoding
last-modified
Tue, 08 May 2012 13:08:06 GMT
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
content-length
104
x-xss-protection
0
server
sffe
fb87a4ea41
cd836371f1d.cdn.intergient.com/ 		0
95 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://cd836371f1d.cdn.intergient.com/fb87a4ea41
Requested by
Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260406.1/main.551129c9449d5acc2196.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
63.176.195.25 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-63-176-195-25.eu-central-1.compute.amazonaws.com
Software
nginx/1.24.0 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type
text/plain;charset=UTF-8
sec-ch-ua-mobile
?0

Response headers

access-control-allow-origin
*
date
Sun, 12 Apr 2026 01:33:15 GMT
content-type
application/octet-stream
server
nginx/1.24.0
px.gif
ad-delivery.net/ 		43 B
133 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ad-delivery.net/px.gif?ch=2&e=0.5150821319050335
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.47.80 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-goog-metageneration
5
access-control-expose-headers
*, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash
crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status
HIT
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3"
age
1946964
x-goog-stored-content-encoding
identity
expires
Fri, 20 Mar 2026 13:41:52 GMT
x-goog-stored-content-length
43
date
Sun, 12 Apr 2026 01:33:16 GMT
content-type
image/gif
last-modified
Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid
ABgVH89K2Yq4pnfcvUStBId9HlURvizPqf3MVWGgPxZrgZz6nkGA3_cdbcg0whsVowwYFR03VNFb3R4
cache-control
public, max-age=86400
x-goog-storage-class
MULTI_REGIONAL
cf-ray
9eae7b5f192d2d31-AMS
accept-ranges
bytes
access-control-allow-origin
*
x-goog-generation
1620242732037093
content-length
43
server
cloudflare
favicon.ico
ad.doubleclick.net/ 		1 KB
129 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.9666980286391595
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.14.148 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pm-in-f148.1e100.net
Software
sffe /
Resource Hash
d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options
nosniff
expires
Mon, 13 Apr 2026 01:33:16 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sun, 12 Apr 2026 01:33:16 GMT
content-type
image/x-icon
vary
Accept-Encoding
last-modified
Tue, 08 May 2012 13:08:06 GMT
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
content-length
104
x-xss-protection
0
server
sffe
country
api.btloader.com/ 		37 B
153 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://api.btloader.com/country?o=5150306120761344
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
130.211.23.194 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS
194.23.211.130.bc.googleusercontent.com
Software
/
Resource Hash
6f11c57367491b5eb5066b3fec56454ba83d9b311253dab9de0cceb1a2e9c972

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
private, max-age=300, stale-while-revalidate=600, stale-if-error=600
via
1.1 google
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000
content-length
37
date
Sun, 12 Apr 2026 01:33:16 GMT
content-type
application/json
vary
Origin
pv
api.btloader.com/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://api.btloader.com/pv?nlf=false&tid=2MRJPGKLE-Q9UpCEB0Q-9d7f524c50&sid=bq25Hxx5-5a9GN7a8Su-9d7f524c50&cv=2.1.186-5-gb7ec539&upapi=true
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
130.211.23.194 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS
194.23.211.130.bc.googleusercontent.com
Software
/
Resource Hash

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

via
1.1 google
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
alt-svc
h3=":443"; ma=2592000
date
Sun, 12 Apr 2026 01:33:16 GMT
vary
Origin
collect
region1.google-analytics.com/g/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-VJBRK9986D&gtm=45je6481v9101576445za200zd9101576445&_p=1775957592496&gcd=13l3l3l2l1l1&npa=1&dma_cps=a&dma=1&_eu=AEAAAAQ&ae=a&are=1&cid=1557090395.1775957593&frm=0&pscdl=noapi&rcb=4&sr=1600x1200&uaa=x86&uab=64&uafvl=Chromium%3B147.0.0.0%7CGoogle%2520Chrome%3B147.0.0.0%7CNot-A.Brand%3B24.0.0.0&uam=&uamb=0&uap=Linux&uapv=&uaw=0&ul=nl-nl&_s=2&tag_exp=0~115616985~115938466~115938468&sid=1775957592&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dt=Paint%20with%20Oils&en=scroll&epn.percent_scrolled=90&_et=4&tfd=6218
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.239.32.36 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://paint.toys/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:137:0
report-to
{"group":"ascnsrsggc:137:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:137:0"}],}
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
https://paint.toys
cross-origin-opener-policy-report-only
same-origin; report-to=ascnsrsggc:137:0
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sun, 12 Apr 2026 01:33:18 GMT
content-type
text/plain
server
Golfe2

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
cdn.intergient.com
URL
https://cdn.intergient.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
Domain
paint.toys
URL
blob:https://paint.toys/d968bbaf-b865-4695-9dd4-5b88fb213f0d

Verdicts & Comments Add Verdict or Comment

234 JavaScript Window variables

These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| ramp string| _pwGA4PageviewId object| dataLayer function| gtag function| admiral function| QS02Mzg3RDEwMjU5NjBGOUQ0REY5Q0YwOTEtMjc0 object| googletag object| _pwTycheAB string| _pwUserContentEncoding object| pwEdgeFlags object| pwEdgeYieldOptions string| pwWrapperPubCode string| pwRampConfigNoopUrl object| PageOS function| reflect function| OilPainting object| app function| selectColor function| save number| cmpVersion boolean| tycheSampling number| tycheSamplingRate boolean| rampSampling number| rampSamplingRate number| _pageViewSR number| _adImpressionSR object| _pwLogger number| _pwFpSampling string| _pwUserCC string| _pwUserBrowserName string| _pwUserDeviceType string| _pwUserIp number| _pwApsPrebidTrafficPercentage number| _pwBotScore object| tyche boolean| pwRAMPInitiated object| ggeac object| google_tag_data object| google_js_reporting_queue object| regeneratorRuntime object| __pwpbjs__ object| _pbjsGlobals function| 4dm1r11545242527 object| google_tag_manager function| onYouTubeIframeAPIReady object| gaGlobal object| webpackChunkpageos object| google_reactive_ads_global_state object| googlefc object| pageos object| __core-js_shared__ object| core object| __bt_edge_data object| __bt object| __bt_intrnl boolean| __bt_already_invoked object| __bt_tag_d object| default_ContributorServingResponseClientJs object| _F_toggles_default_ContributorServingResponseClientJs object| __googlefc string| __fcInvoked string| __fcexpdef string| NTBiODRhZTA3MTliYzg1Y2xvYWRlcl9qcw== string| NTBiODRhZTA3MTliYzg1Y2NhY2hlZF9qcw== object| __fcInternalApiManager boolean| __fcInternalApiPostMessageReady object| __tcfapiEventListeners function| __tcfapi object| __tcfapiManager boolean| __tcfapiPostMessageReady object| apstag object| kinesis object| pbjs object| __pwhbjs boolean| liModuleEnabled object| processedImpEventIds object| _aps boolean| apstagLOADED object| apscustom object| aps_prebid object| _google_rum_ns_ object| google_persistent_state_async number| google_global_correlator function| Goog_AdSense_Lidar_sendVastEvent function| Goog_AdSense_Lidar_getViewability function| Goog_AdSense_Lidar_getUrlSignalsArray function| Goog_AdSense_Lidar_getUrlSignalsList number| google_srt object| google object| module$exports$google3$javascript$ads$interactivemedia$sdk$clientside$api$companion_ad_selection_settings object| module$exports$google3$javascript$ads$interactivemedia$sdk$clientside$api$ad_cue_points object| module$exports$google3$javascript$ads$interactivemedia$sdk$clientside$api$ads_rendering_settings object| ima object| module$exports$google3$javascript$ads$interactivemedia$sdk$clientside$api$ad_error object| module$exports$google3$javascript$ads$interactivemedia$sdk$clientside$api$ad_error_event object| module$exports$google3$javascript$ads$interactivemedia$sdk$clientside$api$ad_event object| module$exports$google3$javascript$ads$interactivemedia$sdk$clientside$api$ads_manager_loaded_event object| lotame_sync_16576 function| ha object| __id5_finalization_registry object| ID5 object| id5_pbjs_et object| PublisherCommonId function| lotameIsCompatible function| sync16576_aa function| sync16576_c function| sync16576_f object| sync16576_h function| sync16576_ca function| sync16576_j function| sync16576_ea object| sync16576_ object| sync16576_la object| sync16576_ma object| sync16576_p object| sync16576_y object| sync16576_za function| sync16576_a function| sync16576_b function| sync16576_g function| sync16576_i function| sync16576_k function| sync16576_da function| sync16576_fa function| sync16576_l function| sync16576_ga function| sync16576_m function| sync16576_n function| sync16576_o function| sync16576_ia function| sync16576_ha function| sync16576_ja function| sync16576_ka function| sync16576_q function| sync16576_s function| sync16576_t function| sync16576_u function| sync16576_na function| sync16576_oa function| sync16576_v function| sync16576_pa function| sync16576_w function| sync16576_x function| sync16576_r function| sync16576_z function| sync16576_qa function| sync16576_ra function| sync16576_sa function| sync16576_A function| sync16576_B function| sync16576_C function| sync16576_ta function| sync16576_D function| sync16576_E function| sync16576_F function| sync16576_H function| sync16576_J function| sync16576_I function| sync16576_K function| sync16576_L function| sync16576_G function| sync16576_ua function| sync16576_va function| sync16576_wa function| sync16576_xa function| sync16576_ya function| sync16576_M function| sync16576_N function| sync16576_Aa function| sync16576_O function| sync16576_Ba function| sync16576_Ca function| sync16576_Da function| sync16576_P function| sync16576_Ea function| sync16576_Fa function| sync16576_Ga function| sync16576_Ha function| sync16576_Q function| sync16576_Ia function| sync16576_R function| sync16576_S function| sync16576_T function| sync16576_U function| sync16576_Ja function| sync16576_V function| sync16576_W function| sync16576_X function| sync16576_Y function| sync16576_Z function| sync16576__ function| sync16576_0 function| sync16576_Ka function| sync16576_1 function| sync16576_Ma function| sync16576_La function| sync16576_2 function| sync16576_Oa function| sync16576_Pa function| sync16576_Na function| sync16576_Qa function| sync16576_Ta function| sync16576_Sa function| sync16576_Ra function| sync16576_Va function| sync16576_Xa function| sync16576_Ua function| sync16576_5 function| sync16576_Wa function| sync16576__a function| sync16576_0a function| sync16576_Za function| sync16576_Ya function| sync16576_6 function| sync16576_3 function| sync16576_4 function| sync16576_7 function| sync16576_8 function| sync16576_1a function| sync16576_2a function| sync16576_3a function| sync16576_4a function| sync16576_9 function| sync16576_5a function| sync16576_$ function| sync16576_6a function| sync16576_7a function| sync16576_8a

7 Cookies

Domain/Path Name / Value
.paint.toys/ Name: _ga
Value: GA1.1.1557090395.1775957593
.paint.toys/ Name: _ga_VJBRK9986D
Value: GS2.1.s1775957592$o1$g0$t1775957593$j59$l0$h0
paint.toys/ Name: usprivacy
Value: 1---
.paint.toys/ Name: _ga_CEFZJ359V8
Value: GS2.1.s1775957593$o1$g0$t1775957593$j60$l0$h0
.paint.toys/ Name: FCCDCF
Value: %5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%22ba530c9a-5b0b-487b-8e65-d38ead855f5a%5C%22%2C%5B1775957593%2C201000000%5D%5D%22%5D%5D%5D
.paint.toys/ Name: _awl
Value: 2.1775957593.5-cad48c00be254d9be6d28744359f09e3-6763652d6575726f70652d7765737431-0
.intergient.com/ Name: cf_clearance
Value: 2ctfyly9AmGLQ8YTOCqoNC9cvS9rdRDkkhWzyTHJNw8-1775957593-1.2.1.1-qc9e4kYWxA.ARD71l5WozmH2LIL9Xw4co6HqXLMzNrS4jWk2IKrRYvm49N7Ec6tsL9XW6_vl1xLJBv2nxnaBIm660zmmmYM3YRdE95Oi4KSF4nhKhv7i6ZaSNRg6daKBpokvtbxFt29JjVOMkeUPHayvfHuKFOuK6sNUlQiLMGtTYUUhlHT79_0ZyON6e6jqS1.juglDxeofy5fr6e3xR1DCkSl4NCug1dVlo0r0_Gd_nA1odYM95RUfOgJWOvtgd530FEet8Gd4u6RkwZm4PA2Eru_5FuvM6h8PZ82j75mbMskqkTRDntk7AZH6N3LYHTomrUjrApPC2GOqSd_D8g

1 Console Messages

Source Level URL
Text
rendering warning URL: https://paint.toys/oil/
Message:
[GroupMarkerNotSet(crbug.com/242999)!:20940021E0A0]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader (about:flags#enable-unsafe-swiftshader) flag to opt in to lower security guarantees for trusted content.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aax.amazon-adsystem.com
ab.dns-finder.com
ad-delivery.net
ad.doubleclick.net
api.btloader.com
api.id5-sync.com
beasiswalpdp.my.id
btloader.com
c.amazon-adsystem.com
cd836371f1d.cdn.intergient.com
cdn.hadronid.net
cdn.id5-sync.com
cdn.intergient.com
config.aps.amazon-adsystem.com
dt.adsafeprotected.com
faucetfoot.com
fonts.googleapis.com
fonts.gstatic.com
fundingchoicesmessages.google.com
imasdk.googleapis.com
impression-inferences-edge-prod.playwire.com
jvnzoez.consulmexvan.com
pagead2.googlesyndication.com
paint.toys
raw.githubusercontent.com
region1.google-analytics.com
secure.cdn.fastclick.net
securepubads.g.doubleclick.net
tags.crwdcntrl.net
www.googletagmanager.com
cdn.intergient.com
paint.toys
103.29.182.40
104.18.20.56
104.20.20.189
104.20.47.80
108.138.3.93
108.138.4.226
130.211.23.194
142.251.110.95
142.251.14.148
142.251.14.94
142.251.14.97
142.251.20.113
142.251.20.155
162.19.138.120
172.66.166.119
172.66.169.55
172.66.171.133
18.245.46.16
18.245.46.20
18.66.102.77
185.199.111.133
188.114.96.3
192.178.183.156
192.178.183.95
216.239.32.36
23.45.96.101
3.33.186.135
34.36.200.111
34.8.176.186
35.175.18.88
63.176.195.25
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
0a0a95fd080f68f2d8c0a916f30cdb5cde422c6908dd64bd98043ef5c160f0f1
0e43e66404ff234d0d874c9422542a2e6442c73246650d680490f46bedd60898
12a1f9e0d6cc3d5fcb5a4b52445f3092821c3df32b97354aac99526c1ef27805
18120a6bee05cd823d5f4ab0c52006863a059a5d6c535c790a31bdd2ee8c45e7
1afce4631b4f1dcc9f08ca5b89182fa0e68307e0df60b096646ce66296354ae1
21c70f3abd65c2ed8d271bdb6768540ed502bface8884e2ac82b6d45b3209518
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
2edc4749082382c6dc56e08a38f7135bba65296cbc4f7d19c8e42a53d1171540
30a007a99e491d9e1b2b72c02e4a8454334c6ea2b3a03316d50135b20464fccc
32a7934869f4666c9fb6e64681e0916d8c0ff49824b9a29eb6adc0fd038c3aaa
32aa05a5648678542ab9044647f0bf5549c0b53a070585edb773f0e92b72b97d
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa
436814c2374a6d92a42a02d39969ef7c56b5f225667abecb218e692c5569943c
45bc6978e281a938d9485dcbf0859159b24e2f7c9b8b0fafc120b9606e0ea8b1
4cc857061cabd21e136f7a900987073d1a2879c565b915572d67f4dca570444a
4d1a4780262ed98fbe4a12dfb5593b2bcefebbbe220f269eddd9769588de6112
5764e7bbfaef797512a8c208ebbcc104a98e69605f5fa934138bbb831dafbf88
5ac6db9eca6024415fceff0efcb39732b882e99babaaf05b94b04baa16980583
64731b0c4bddd9b69b5d748b611bcb8cc52a9dd00a6d9f4c9664dfac0a8d6e1b
64eec773b598708de54a23f35992f2a0725e86abc44362f1f2661d4d730704db
663e651d6997269c8015d9f4181751e82e79e17c5064b281901da2d5bae9afbb
66c0e34de15b83406adb0685b88d9dd25911788b28e7573b2e8d9ccf25694170
676e51f4fae12e637d7c95adcfe1a93fb3c523f1ee99985d1a580e26077ba970
6ceb226c487cb85243545e768944e0e1ae0944be8fde6c1c43c7314a9287e6d9
6f11c57367491b5eb5066b3fec56454ba83d9b311253dab9de0cceb1a2e9c972
6f55a179811727a333e01eb1e16c9d003ffe30a223c8e6121ed732b2b09b95f7
7008da7a6103f5a898b4e955ebde8dbe336f097c7fe17e71ced8980affd910a5
70fdcbbe7129a79cab3b0839348a16e359bda7056b157c52ec8d2cb89d40fa3e
74e59fc67c703f82c13c2e3a7ad1770fa26f274a9617aa79ad2d065b2d1b11df
7699df53e5893e0a67e04e9143a9712d557c79a537b07d20fb9e6911f1f6636a
7bb7f1ee30af78087c4c4f7e8620983249799b71727baaf7ca55e5976ce791fe
7dc78c5c119373b361b76d7e9c1b2759725163789661df908ee4cd8faf842676
98db09da3e1109288620e5f78abf4769bb160bb5d505ba03f683edd1227a4a53
9fea608a947e67020c33cad9a6fe3d60c54119dfb8cff87768a8117a15ed7543
a1e9592b119e182885673d049ec2ead66dab57473f2f6da59f43d888cea5ac1e
a73f5986eb985871284e6e216372de3505634a97229de643216728d0fbfd6227
af33adef0f1e7b4e0714817457a9952d17d5ae03868a87c7d12ef56132d72a0b
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277
b0040483703a19464fa35f27f815ca3eac5b70035b5216d35f78a9425708ffb3
b0529195572705472c53f9003a196e1cf5d41d8d5d0e1e391a674750a6ee3d88
b10003abbe4a3ce3e6321a50803e1f613baaf74e6b2e63313f5746b3c40000e6
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
c8039db3019fcff8be120f5287c9945c828d07138271b8c16fa4738521abf769
ca9ab811c0d20578c1c957ce3f3531c66e827dfc1883dada328c56e2487e8a1e
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d3e01c343083ce4c4a9fe64f0ab915f99339794372f31378e58ed309824d1dfc
d4146a9ffdccf871cc20ab37bd23ca6ebdcbcae9d6255d3d311a97cfd138a74f
d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8
dd71b5dd080502cc60234b858fb511527930773b961196ac76388d60df0da23a
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f4d368e4230539c778afbb020e0ea611b3e1d984179f5b3769b44081d6703f3b
fa943fe441f13d737f70e4afe5504eb9eb9156e916074b4fb8b35a239dd43442
fda09a9d73e6a889955a6faf14d822c25876d920ac4abdc896d8ffa41bcf6f27