paint.toys
3.33.186.135 Public Scan Open in urlscan Pro

Software

Netlify /

Resource Hash

5764e7bbfaef797512a8c208ebbcc104a98e69605f5fa934138bbb831dafbf88

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://xfgrj5.graphicon.org/hp2sap1nbai7kjk9j3k7y7h67xq49f5pf0Rellob251T25SVkNneWVGSDNCSnItNTk4Mi0yNjE2MDA2My0xMDFhMDI3MS0xMDM0NC1hcVI2V3gzYndNR1lka3QydGJscw/layeh849g2m/ehibibkwfwyvxfmaieywiftx/SCL8R5958BF2/yxkbcwhzsdcqogotcobtexgpqlosm/091935918227822158385887
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

accept-ranges: bytes
age: 11643
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-encoding: br
content-length: 2561
content-type: text/html; charset=UTF-8
date: Sun, 12 Apr 2026 01:37:10 GMT
etag: "1682e9e4844ad308d368ad938129b1a7-ssl-df"
server: Netlify
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-nf-request-id: 01KNZNBTPG9TAQYZ6D9BJHQVSA

Redirect headers

cache-status: "Netlify Edge"; fwd=miss
content-length: 98
content-type: text/html
date: Sun, 12 Apr 2026 01:37:10 GMT
location: /oil/
server: Netlify
strict-transport-security: max-age=31536000
x-nf-request-id: 01KNZNBTJC9MNVS306GF3NMKR6

GET
H2 200 ramp_config.js Show response
cdn.intergient.com/1024872/74068/ 40 KB
7 KB 98ms
46ms Script
application/javascript 2606:4700::6812:1438
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/1024872/74068/ramp_config.js
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 66c0e34de15b83406adb0685b88d9dd25911788b28e7573b2e8d9ccf25694170

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cf-ray: 9eae81186ef1f531-AMS
hw-country-code: NL
cache-control: max-age=600, public, must-revalidate
content-encoding: br
date: Sun, 12 Apr 2026 01:37:10 GMT
content-type: application/javascript
server: cloudflare

GET
H2 200 apps.css
paint.toys/ 6 KB
2 KB 109ms
108ms Stylesheet
text/css 3.33.186.135
Amazon.com

General

Check archive.org

Download Go to

Full URL

https://paint.toys/apps.css

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

Software

Netlify /

Resource Hash

98db09da3e1109288620e5f78abf4769bb160bb5d505ba03f683edd1227a4a53

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/oil/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
content-encoding: br
etag: "56a5025fbb6b2d9217c0c90816b2fee9-ssl-df"
age: 20990
accept-ranges: bytes
content-length: 1643
x-nf-request-id: 01KNZNBTT2ME9T5XAFCQ1GB736
cache-status: "Netlify Edge"; hit
date: Sun, 12 Apr 2026 01:37:10 GMT
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: Netlify

GET
H2 200 index.js Show response
paint.toys/oil/ 4 KB
1 KB 320ms
319ms Script
application/javascript 3.33.186.135
Amazon.com

General

Check archive.org

Download Go to

Full URL

https://paint.toys/oil/index.js

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

Software

Netlify /

Resource Hash

1afce4631b4f1dcc9f08ca5b89182fa0e68307e0df60b096646ce66296354ae1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/oil/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
content-encoding: br
etag: "94ae9b9ed2162106abf0e8e5295e04e0-ssl-df"
age: 11642
accept-ranges: bytes
content-length: 1262
x-nf-request-id: 01KNZNBTT2J5RMK8Q0REF4NHZ4
cache-status: "Netlify Edge"; hit
date: Sun, 12 Apr 2026 01:37:10 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Netlify

GET
H2 200 art-icon.png
paint.toys/assets/ 33 KB
33 KB 111ms
110ms Image
image/png 3.33.186.135
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/art-icon.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

Software

Netlify /

Resource Hash

f4d368e4230539c778afbb020e0ea611b3e1d984179f5b3769b44081d6703f3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/oil/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "1394f8469f2ca5750397e3d7b6ec70a1-ssl"
age: 48575
accept-ranges: bytes
content-length: 33562
x-nf-request-id: 01KNZNBTT209DWGDTRDW21V2Q2
cache-status: "Netlify Edge"; hit
date: Sun, 12 Apr 2026 01:37:10 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-hand.png
paint.toys/assets/ 27 KB
27 KB 320ms
320ms Image
image/png 3.33.186.135
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-hand.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

Software

Netlify /

Resource Hash

32aa05a5648678542ab9044647f0bf5549c0b53a070585edb773f0e92b72b97d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/oil/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "a0822110a4671ffdf710da1467460fba-ssl"
age: 41007
accept-ranges: bytes
content-length: 27394
x-nf-request-id: 01KNZNBTT2MHAHSMS5N3XSVXD0
cache-status: "Netlify Edge"; hit
date: Sun, 12 Apr 2026 01:37:10 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-disk.png
paint.toys/assets/ 13 KB
14 KB 110ms
109ms Image
image/png 3.33.186.135
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-disk.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

Software

Netlify /

Resource Hash

436814c2374a6d92a42a02d39969ef7c56b5f225667abecb218e692c5569943c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/oil/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "26852fa1548a91e004629b01e4abf1dd-ssl"
age: 41007
accept-ranges: bytes
content-length: 13766
x-nf-request-id: 01KNZNBV45N4CFTST3KGK1CE8Y
cache-status: "Netlify Edge"; hit
date: Sun, 12 Apr 2026 01:37:10 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-trash.png
paint.toys/assets/ 50 KB
51 KB 111ms
109ms Image
image/png 3.33.186.135
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-trash.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

Software

Netlify /

Resource Hash

6ceb226c487cb85243545e768944e0e1ae0944be8fde6c1c43c7314a9287e6d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/oil/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "e91ef5e34b5154d392e8560031eaaa4c-ssl"
age: 41007
accept-ranges: bytes
content-length: 51680
x-nf-request-id: 01KNZNBV456P5G92JCEQE3W9A7
cache-status: "Netlify Edge"; hit
date: Sun, 12 Apr 2026 01:37:10 GMT
content-type: image/png
server: Netlify

GET
H2 200 ramp_core.js Show response
cdn.intergient.com/ 3 KB
2 KB 24ms
22ms Script
application/javascript 2606:4700::6812:1438
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/ramp_core.js
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1949aee7003f21821c144cb5048abcbd7c3462c0ba59a4fdfbdf2f7830b36269

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cf-ray: 9eae811a2a37f531-AMS
hw-country-code: NL
cache-control: max-age=600, public, must-revalidate
content-encoding: br
date: Sun, 12 Apr 2026 01:37:10 GMT
content-type: application/javascript
server: cloudflare

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 454 KB
155 KB 82ms
31ms Script
application/javascript 2a00:1450:4001:c15::61
Google LLC

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:c15::61 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

32a7934869f4666c9fb6e64681e0916d8c0ff49824b9a29eb6adc0fd038c3aaa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
content-encoding: zstd
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Sun, 12 Apr 2026 01:37:10 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 158416
date: Sun, 12 Apr 2026 01:37:10 GMT
x-xss-protection: 0
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Google Tag Manager
access-control-allow-headers: Cache-Control

GET
H2 200 p94wwqs1nsnv-prod.js Show response
faucetfoot.com/files/ 102 KB
35 KB 70ms
27ms Script
text/javascript 2600:1901:0:2b4c::1
Google LLC

General

Check archive.org

Download Go to

Full URL

https://faucetfoot.com/files/p94wwqs1nsnv-prod.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:1901:0:2b4c::1 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),

Reverse DNS

Software

hoothoot/2438300242 /

Resource Hash

1442ffa60c2c9737b4dfef9fef759ff17210f6a9bfd986a4286be99aa383c390

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=15724800; preload
cache-control: private, must-revalidate, max-age=21600
timing-allow-origin: *
content-encoding: zstd
etag: W/"011fe6fcf3c0894cd0bf4728f916cdd415c408279362b2f45deb5dec7b5e7a49"
via: fen-hoothoot-europe-west1-spot-3vr5.gce-europe-west1, 1.1 google
alt-svc: h3=":443"; ma=2592000
date: Sun, 12 Apr 2026 01:37:10 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding, Accept-Language
server: hoothoot/2438300242

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 108 KB
34 KB 67ms
37ms Script
text/javascript 142.251.20.154
Google LLC

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.20.154 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

bx-in-f154.1e100.net

Software

cafe /

Resource Hash

5d963e6ee4bdd62bb39d1ff947c4a85e2993e90d95bd74a74593e98354136faf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
etag: 834 / 20555 / 31097742 / config-hash: 16260121154920961607
x-content-type-options: nosniff
expires: Sun, 12 Apr 2026 01:37:10 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Sun, 12 Apr 2026 01:37:10 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 34802
x-xss-protection: 0
server: cafe

GET
H2 200 prebid.335dd724b9406dcd9e2b.js Show response
cdn.intergient.com/prebid/ 742 KB
221 KB 36ms
35ms Script
text/javascript 2606:4700::6812:1438
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/prebid/prebid.335dd724b9406dcd9e2b.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7008da7a6103f5a898b4e955ebde8dbe336f097c7fe17e71ced8980affd910a5

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

hw-country-code: NL
cache-control: public, max-age=31536000, immutable
content-encoding: br
cf-cache-status: HIT
etag: W/"3cc83bd65e8e68eb8c0c6a66de20d662"
age: 2117101
cf-ray: 9eae811a2a3ef531-AMS
date: Sun, 12 Apr 2026 01:37:10 GMT
content-type: text/javascript
last-modified: Wed, 18 Mar 2026 13:23:44 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 css2
fonts.googleapis.com/ 3 KB
968 B 82ms
32ms Stylesheet
text/css 2a00:1450:4001:c21::5f
Google LLC

General

Check archive.org

Download Go to

Full URL

https://fonts.googleapis.com/css2?family=DM+Sans:wght@300;400;500&family=DM+Serif+Display&display=swap

Requested by

Host: paint.toys
URL: https://paint.toys/apps.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a00:1450:4001:c21::5f Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

0e43e66404ff234d0d874c9422542a2e6442c73246650d680490f46bedd60898

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Sun, 12 Apr 2026 01:37:10 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 12 Apr 2026 01:37:10 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Sun, 12 Apr 2026 01:23:36 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H3 200 rP2Yp2ywxg089UriI5-g4vlH9VoD8Cmcqbu0-K4.woff2
fonts.gstatic.com/s/dmsans/v17/ 36 KB
36 KB 56ms
24ms Font
font/woff2 142.251.20.94
Google LLC

General

Check archive.org

Download Go to

Full URL

https://fonts.gstatic.com/s/dmsans/v17/rP2Yp2ywxg089UriI5-g4vlH9VoD8Cmcqbu0-K4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=DM+Sans:wght@300;400;500&family=DM+Serif+Display&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.20.94 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

bx-in-f94.1e100.net

Software

sffe /

Resource Hash

9fea608a947e67020c33cad9a6fe3d60c54119dfb8cff87768a8117a15ed7543

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://paint.toys
sec-ch-ua-platform: "Linux"
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

age: 143416
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Sat, 10 Apr 2027 09:46:54 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 10 Apr 2026 09:46:54 GMT
last-modified: Wed, 10 Sep 2025 16:31:03 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 36932
x-xss-protection: 0
server: sffe

GET
H2 200 pageos.js Show response
cdn.intergient.com/pageos/V.20260406.1/ 411 B
613 B 21ms
20ms Script
text/javascript 2606:4700::6812:1438
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20260406.1/pageos.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/ramp_core.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 663e651d6997269c8015d9f4181751e82e79e17c5064b281901da2d5bae9afbb

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

hw-country-code: NL
cache-control: public, max-age=31536000
content-encoding: br
cf-cache-status: HIT
etag: W/"3d6c06503ce4ffaebd634af1821ff2bb"
age: 374308
cf-ray: 9eae811a7ae0f531-AMS
expires: Mon, 12 Apr 2027 01:37:10 GMT
date: Sun, 12 Apr 2026 01:37:10 GMT
content-type: text/javascript
last-modified: Tue, 07 Apr 2026 17:28:00 GMT
server: cloudflare

GET
H2 200 runtime.e74e4ca9f030172e8b39.js Show response
cdn.intergient.com/pageos/V.20260406.1/ 4 KB
2 KB 21ms
21ms Script
text/javascript 2606:4700::6812:1438
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20260406.1/runtime.e74e4ca9f030172e8b39.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260406.1/pageos.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: b10003abbe4a3ce3e6321a50803e1f613baaf74e6b2e63313f5746b3c40000e6

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

hw-country-code: NL
cache-control: public, max-age=31536000
content-encoding: br
cf-cache-status: HIT
etag: W/"b366df6a2913bfb7e570c5b0d2685a5d"
age: 374308
cf-ray: 9eae811a9b16f531-AMS
expires: Mon, 12 Apr 2027 01:37:10 GMT
date: Sun, 12 Apr 2026 01:37:10 GMT
content-type: text/javascript
last-modified: Tue, 07 Apr 2026 17:28:01 GMT
server: cloudflare

GET
H2 200 main.551129c9449d5acc2196.js Show response
cdn.intergient.com/pageos/V.20260406.1/ 560 KB
172 KB 32ms
32ms Script
text/javascript 2606:4700::6812:1438
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20260406.1/main.551129c9449d5acc2196.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260406.1/pageos.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: fda09a9d73e6a889955a6faf14d822c25876d920ac4abdc896d8ffa41bcf6f27

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

hw-country-code: NL
cache-control: public, max-age=31536000
content-encoding: br
cf-cache-status: HIT
etag: W/"5d2c55c2fd6774cf191a8f89af7c0804"
age: 374308
cf-ray: 9eae811a9b18f531-AMS
expires: Mon, 12 Apr 2027 01:37:10 GMT
date: Sun, 12 Apr 2026 01:37:10 GMT
content-type: text/javascript
last-modified: Tue, 07 Apr 2026 17:27:58 GMT
server: cloudflare

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202604080101/ 583 KB
183 KB 22ms
22ms Script
text/javascript 142.251.20.154
Google LLC

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202604080101/pubads_impl.js?cb=31097742

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.20.154 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

bx-in-f154.1e100.net

Software

cafe /

Resource Hash

ca9ab811c0d20578c1c957ce3f3531c66e827dfc1883dada328c56e2487e8a1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
etag: 8848173397282281628
age: 56107
x-content-type-options: nosniff
expires: Sun, 11 Apr 2027 10:02:03 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Sat, 11 Apr 2026 10:02:03 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 187343
x-xss-protection: 0
server: cafe

GET
H2 200 dt
dt.adsafeprotected.com/ 43 B
178 B 305ms
102ms Image
image/gif 2600:1f18:1aca:4282:d193:5a21:9d72:3410
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?adspot_id=ad_300x250_400989
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f18:1aca:4282:d193:5a21:9d72:3410 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-cache
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-length: 43
date: Sun, 12 Apr 2026 01:37:11 GMT
pragma: no-cache
content-type: image/gif

GET
H2 200 videoCard.cea8a6bd8cad3ad73428.js Show response
cdn.intergient.com/pageos/V.20260406.1/ 552 B
677 B 22ms
21ms Script
text/javascript 2606:4700::6812:1438
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20260406.1/videoCard.cea8a6bd8cad3ad73428.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260406.1/runtime.e74e4ca9f030172e8b39.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0a0a95fd080f68f2d8c0a916f30cdb5cde422c6908dd64bd98043ef5c160f0f1

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

hw-country-code: NL
cache-control: public, max-age=31536000
content-encoding: br
cf-cache-status: HIT
etag: W/"b923f9cae7c940f9f384e93b5120abff"
age: 374306
cf-ray: 9eae811bad48f531-AMS
expires: Mon, 12 Apr 2027 01:37:10 GMT
date: Sun, 12 Apr 2026 01:37:10 GMT
content-type: text/javascript
last-modified: Tue, 07 Apr 2026 17:28:06 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 iframe.html Show response
cdn.intergient.com/pageos/V.20260406.1/iframe/ Frame 579F 1 KB
1020 B 70ms
23ms Document
text/html 2606:4700::6812:1438
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20260406.1/iframe/iframe.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260406.1/main.551129c9449d5acc2196.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 90d513103bc2344c23fc4688085d61fad48a8e22c0c536248682d4ac6e44cf00

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

age: 374307
cache-control: public, max-age=31536000
cf-cache-status: HIT
cf-ray: 9eae811bfb311c64-AMS
content-encoding: br
content-type: text/html
date: Sun, 12 Apr 2026 01:37:11 GMT
expires: Mon, 12 Apr 2027 01:37:11 GMT
hw-country-code: NL
last-modified: Tue, 07 Apr 2026 17:27:56 GMT
server: cloudflare

GET
H2 200 gdpr.80f4ed51ebfc5feb6de9.js Show response
cdn.intergient.com/pageos/V.20260406.1/ 6 KB
2 KB 128ms
128ms Script
text/javascript 2606:4700::6812:1438
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20260406.1/gdpr.80f4ed51ebfc5feb6de9.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260406.1/runtime.e74e4ca9f030172e8b39.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: b0040483703a19464fa35f27f815ca3eac5b70035b5216d35f78a9425708ffb3

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

hw-country-code: NL
cache-control: public, max-age=31536000
content-encoding: br
cf-cache-status: HIT
etag: W/"276aef4d651d0760f5e70f7b2c569bb4"
age: 374307
cf-ray: 9eae811bad52f531-AMS
expires: Mon, 12 Apr 2027 01:37:11 GMT
date: Sun, 12 Apr 2026 01:37:11 GMT
content-type: text/javascript
last-modified: Tue, 07 Apr 2026 17:27:56 GMT
server: cloudflare

GET
H2 200 GDPR Show response
impression-inferences-edge-prod.playwire.com/websites/74068/v1/Sat/21/desktop/Chrome/ 548 B
885 B 66ms
22ms XHR
application/json 2600:9000:2670:a00:b:99e7:bb00:93a1
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://impression-inferences-edge-prod.playwire.com/websites/74068/v1/Sat/21/desktop/Chrome/GDPR
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260406.1/main.551129c9449d5acc2196.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2670:a00:b:99e7:bb00:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: CloudFront /
Resource Hash: fa943fe441f13d737f70e4afe5504eb9eb9156e916074b4fb8b35a239dd43442

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: max-age=3600, public, must-revalidate
access-control-expose-headers: *
age: 2020
via: 1.1 1e53d5f889e2ac50f0d7b6cad073c03e.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Hit from cloudfront
content-length: 548
x-amz-cf-id: RP5wTLYTLhPiHM6c1gZ9LLxK2qPc7KNOKvWptI4VWjbhuWlt_LUzqQ==
date: Sun, 12 Apr 2026 01:03:31 GMT
content-type: application/json
x-amz-cf-pop: FRA56-P9
server: CloudFront

GET
H2 200 tag Show response
btloader.com/ 180 KB
49 KB 55ms
23ms Script
application/javascript 2606:4700:10::ac42:ab85
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260406.1/main.551129c9449d5acc2196.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac42:ab85 -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: af33adef0f1e7b4e0714817457a9952d17d5ae03868a87c7d12ef56132d72a0b

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-robots-tag: noindex, nofollow
cache-control: public, max-age=300, stale-if-error=3600, stale-while-revalidate=300
content-encoding: br
cf-cache-status: HIT
etag: W/"fe24325b9c3b9a905ee994d39caaedc3"
via: 1.1 google
cf-ray: 9eae811beaede5e0-AMS
access-control-allow-origin: *
date: Sun, 12 Apr 2026 01:37:11 GMT
content-type: application/javascript
last-modified: Sun, 12 Apr 2026 01:37:00 GMT
server: cloudflare
vary: Accept-Encoding, X-Acceptable-Ads, DNT

GET
H2 200 1x1.gif
raw.githubusercontent.com/easylist/easylist/master/docs/ 43 B
581 B 48ms
16ms Image
image/gif 2606:50c0:8001::154
Fastly

General

Check archive.org

Download Go to Show image

Full URL

https://raw.githubusercontent.com/easylist/easylist/master/docs/1x1.gif

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:50c0:8001::154 , United States, ASN54113 (FASTLY - Fastly, Inc., US),

Reverse DNS

Software

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; style-src 'unsafe-inline'; sandbox
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-fastly-request-id: 451280e33cf4b1c47bacb4618617ea124fe2e9d0
etag: W/"0c4a5773f7e435c57c40bd270aef756513eba26bd7ba5317b5bd765569a7325d"
x-content-type-options: nosniff
x-github-request-id: 7DCE:20B1E4:C6F06C:E0AE82:69D8C75C
expires: Sun, 12 Apr 2026 01:42:11 GMT
x-cache: HIT
date: Sun, 12 Apr 2026 01:37:11 GMT
content-type: image/gif
x-served-by: cache-ams2100134-AMS
x-cache-hits: 2
source-age: 298
x-frame-options: deny
strict-transport-security: max-age=31536000
vary: Authorization,Accept-Encoding
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
cache-control: max-age=300
x-timer: S1775957831.022343,VS0,VE0
cross-origin-resource-policy: cross-origin
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
content-length: 43
x-xss-protection: 1; mode=block

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 398 KB
141 KB 31ms
31ms Script
application/javascript 2a00:1450:4001:c15::61
Google LLC

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-CEFZJ359V8&cx=c&gtm=4e6481

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:c15::61 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

4cc857061cabd21e136f7a900987073d1a2879c565b915572d67f4dca570444a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
content-encoding: zstd
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Sun, 12 Apr 2026 01:37:11 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 144074
date: Sun, 12 Apr 2026 01:37:11 GMT
x-xss-protection: 0
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Google Tag Manager
access-control-allow-headers: Cache-Control

POST
H2 204 collect
region1.google-analytics.com/g/ 0
0 55ms
22ms Fetch
text/plain 2001:4860:4802:34::36
Google LLC

General

Check archive.org

Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-VJBRK9986D&gtm=45je6481v9101576445za200zd9101576445&_p=1775957830419&gcd=13l3l3l2l1l1&npa=1&dma_cps=a&dma=1&are=1&cid=1010900704.1775957831&frm=0&pscdl=noapi&rcb=19&sr=1600x1200&uaa=x86&uab=64&uafvl=Chromium%3B147.0.0.0%7CGoogle%2520Chrome%3B147.0.0.0%7CNot-A.Brand%3B24.0.0.0&uam=&uamb=0&uap=Linux&uapv=&uaw=0&ul=nl-nl&_s=1&tag_exp=0~115616985~115938465~115938469~118442252&sid=1775957831&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Fxfgrj5.graphicon.org%2F&dt=Paint%20with%20Oils&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=1135
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:137:0
report-to: {"group":"ascnsrsggc:137:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:137:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:137:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 12 Apr 2026 01:37:11 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 154013155 Show response
fundingchoicesmessages.google.com/i/ 216 KB
70 KB 97ms
47ms Script
application/javascript 2a00:1450:4001:c13::65
Google LLC

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/154013155?ers=3

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202604080101/pubads_impl.js?cb=31097742

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:c13::65 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

02f77f05054d2a24225f46bcbcfe5c8830ee7aed2195e03873fe3180b2a22909

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-O3oWPExHq2enEE9LRR0NGQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 12 Apr 2026 01:37:11 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjmsKoxSXFEKwhxXDi1m2mC0DcevMc62QgLll0nrUJiLuAeAYQGypcYrUH4g_1l1l_AHGRxBXWBiD-VHWDVaD6Bms4lw9bPBB_K_ZlYynxZTsxxY_tGhA_AeJPQMzy1p9N7WgAmwkQm4YEsjkD8cJpgWwrgfhOTBDbEyA-tTqY7RIQC3FzHH_3-hybwIruVXZKGkn5hfHJ-XklRZlJpSX5RWnJaanFqUVlqUXxRgZGZgYmBpZ6BubxBQYAJZNPHg"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-O3oWPExHq2enEE9LRR0NGQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H2 200 iframe.js Show response
cdn.intergient.com/pageos/V.20260406.1/iframe/ Frame 579F 17 KB
7 KB 21ms
21ms Script
text/javascript 2606:4700::6812:1438
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20260406.1/iframe/iframe.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260406.1/iframe/iframe.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: a1e9592b119e182885673d049ec2ead66dab57473f2f6da59f43d888cea5ac1e

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://cdn.intergient.com/pageos/V.20260406.1/iframe/iframe.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

hw-country-code: NL
cache-control: public, max-age=31536000
content-encoding: br
cf-cache-status: HIT
etag: W/"3eecc5d11812ac69fb4f2c63c5dea237"
age: 374307
cf-ray: 9eae811c2ba01c64-AMS
expires: Mon, 12 Apr 2027 01:37:11 GMT
date: Sun, 12 Apr 2026 01:37:11 GMT
content-type: text/javascript
last-modified: Tue, 07 Apr 2026 17:27:57 GMT
server: cloudflare

GET main.js
cdn.intergient.com/cdn-cgi/challenge-platform/scripts/jsd/ Frame 7EF7 0
0

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
108 B 54ms
21ms Fetch
image/gif 2606:4700:10::ac42:948c
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=2&e=0.1894055959978277
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac42:948c -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 4
x-goog-stored-content-encoding: identity
expires: Fri, 20 Mar 2026 13:41:52 GMT
x-goog-stored-content-length: 43
date: Sun, 12 Apr 2026 01:37:11 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH89K2Yq4pnfcvUStBId9HlURvizPqf3MVWGgPxZrgZz6nkGA3_cdbcg0whsVowwYFR03VNFb3R4
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9eae811ca81f5f1e-AMS
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico Show response
ad.doubleclick.net/ 1 KB
129 B 62ms
32ms Fetch
image/x-icon 192.178.183.148
Google LLC

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.34743066737075357

Requested by

Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.183.148 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Mon, 13 Apr 2026 01:37:11 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 12 Apr 2026 01:37:11 GMT
content-type: image/x-icon
vary: Accept-Encoding
last-modified: Tue, 08 May 2012 13:08:06 GMT
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
611 B 51ms
19ms Fetch
image/gif 2606:4700:10::ac42:948c
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.7747438932370494
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac42:948c -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 4
x-goog-stored-content-encoding: identity
expires: Fri, 20 Mar 2026 13:41:52 GMT
x-goog-stored-content-length: 43
date: Sun, 12 Apr 2026 01:37:11 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH89K2Yq4pnfcvUStBId9HlURvizPqf3MVWGgPxZrgZz6nkGA3_cdbcg0whsVowwYFR03VNFb3R4
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9eae811ca81d5f1e-AMS
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H2 200 dns Show response
ab.dns-finder.com/meta/ 2 B
233 B 173ms
128ms Fetch
text/plain 34.36.200.111
Google LLC

General

Check archive.org

Download Go to

Full URL: https://ab.dns-finder.com/meta/dns
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.36.200.111 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS: 111.200.36.34.bc.googleusercontent.com
Software: /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: private, max-age=180, stale-if-error=180, stale-while-revalidate=180
access-control-expose-headers: X-Resolver
x-resolver: default
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
date: Sun, 12 Apr 2026 01:37:11 GMT
content-type: text/plain; charset=utf-8
vary: Origin

GET
H2 200 trustedIframe.html Show response
btloader.com/ Frame DD14 6 KB
2 KB 53ms
23ms Document
text/html 2606:4700:10::6814:14bd
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://btloader.com/trustedIframe.html?o=5150306120761344&upapi=true
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:14bd -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7699df53e5893e0a67e04e9143a9712d557c79a537b07d20fb9e6911f1f6636a

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

cache-control: public, max-age=3600, stale-while-revalidate=3600
cf-ray: 9eae811caa3eb192-AMS
content-encoding: br
content-type: text/html
date: Sun, 12 Apr 2026 01:37:11 GMT
server: cloudflare

POST
H2 204 collect
region1.google-analytics.com/g/ 0
0 22ms
22ms Fetch
text/plain 2001:4860:4802:34::36
Google LLC

General

Check archive.org

Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-CEFZJ359V8&gtm=45je6481v9102396898za200zb9101576445zd9101576445&_p=1775957830419&gcd=13l3l3l2l1l1&npa=1&dma_cps=a&dma=1&are=1&cid=1010900704.1775957831&frm=0&pscdl=noapi&rcb=5&sr=1600x1200&uaa=x86&uab=64&uafvl=Chromium%3B147.0.0.0%7CGoogle%2520Chrome%3B147.0.0.0%7CNot-A.Brand%3B24.0.0.0&uam=&uamb=0&uap=Linux&uapv=&uaw=0&ul=nl-nl&_s=1&tag_exp=0~115938465~115938468&sid=1775957831&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Fxfgrj5.graphicon.org%2F&dt=Paint%20with%20Oils&en=ramp_js&_fv=1&_ss=1&_ee=1&ep.pageview_id=1775957830419&tfd=1252
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-CEFZJ359V8&cx=c&gtm=4e6481
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:137:0
report-to: {"group":"ascnsrsggc:137:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:137:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:137:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 12 Apr 2026 01:37:11 GMT
content-type: text/plain
server: Golfe2

GET
H3 200 gpt
securepubads.g.doubleclick.net/pagead/managed/dict/m202604090101/ 63 KB
23 KB 30ms
29ms Other
text/plain 142.251.20.154
Google LLC

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/dict/m202604090101/gpt

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.20.154 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

bx-in-f154.1e100.net

Software

cafe /

Resource Hash

d3e01c343083ce4c4a9fe64f0ab915f99339794372f31378e58ed309824d1dfc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
etag: 2796382326219958242
age: 5362
x-content-type-options: nosniff
expires: Sun, 19 Apr 2026 00:07:49 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Sun, 12 Apr 2026 00:07:49 GMT
content-type: text/plain; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=604800, stale-while-revalidate=7200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 23174
x-xss-protection: 0
server: cafe
use-as-dictionary: match="/gampad/ads", id="m202604090101"

POST
H2 204 exd
api.btloader.com/ 0
0 167ms
124ms Fetch 130.211.23.194
Google LLC

General

Check archive.org

Download Go to

Full URL: https://api.btloader.com/exd?tid=LOGqrAXw4-jtfCvohdhO-9d7f55edc1&sid=2m47uRAR-qgtEkPYDHJ-9d7f55edc1&cv=2.1.186-5-gb7ec539&upapi=true
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.23.194 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS: 194.23.211.130.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

via: 1.1 google
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000
date: Sun, 12 Apr 2026 01:37:11 GMT
vary: Origin

POST
H3 204 AGSKWxUeTSt92GbwFstlEtap16dagvWDy9BTU0Od1c-SKLXYAR_PMZiKZKt2aVsZ4dJf0vdGvaOk5UOXXvUz8EFdAbnRhhqYBGh58g9bfhgL_fmUH_bFnIOPS3VEXi2K7HGeVuZz2vZplg== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 63ms
33ms XHR
text/html 192.178.183.100
Google LLC

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUeTSt92GbwFstlEtap16dagvWDy9BTU0Od1c-SKLXYAR_PMZiKZKt2aVsZ4dJf0vdGvaOk5UOXXvUz8EFdAbnRhhqYBGh58g9bfhgL_fmUH_bFnIOPS3VEXi2K7HGeVuZz2vZplg==

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.nl.Xz4Te3TqfT8.es5.O/d=1/rs=AJlcJMwlLFM9qRyUvr8AYprHS9f73mZUZg/m=kernel_loader,loader_js_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.183.100 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-x4XXI7p9FqgbSAZ9Vcf6sg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type: text/plain
sec-ch-ua-mobile: ?0

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 12 Apr 2026 01:37:11 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjMtDikmLw0pBi-FB_mfUHEIdz-bDFA_HCaYFsK4H4TkwQ2xMgPrU6mO0SEAtxcxx_9_ocm8CHzQdKlVyS8gvjk_PzSlLzSnQTU4p1QeyizKTSkvwiFHZqGUhFTn56emZeeryRgZGZgYmBpZ6BaXyBAQCqbDCs"
content-security-policy: script-src 'report-sample' 'nonce-x4XXI7p9FqgbSAZ9Vcf6sg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUeTSt92GbwFstlEtap16dagvWDy9BTU0Od1c-SKLXYAR_PMZiKZKt2aVsZ4dJf0vdGvaOk5UOXXvUz8EFdAbnRhhqYBGh58g9bfhgL_fmUH_bFnIOPS3VEXi2K7HGeVuZz2vZplg==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.183.100 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-OtOGrUNhngJ0FBADfzcieQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type: text/plain
sec-ch-ua-mobile: ?0

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 12 Apr 2026 01:37:11 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjstDikmJw0pBiOHHrNtMFIP5Qf5n1BxCHc_mwxQPxwmmBbCuB-E5MENsTID61OpjtEhALcXMcf_f6HJvAgcZrpUouSfmF8cn5eSWpeSW6iSnFuiB2UWZSaUl-EQo7tQykIic_PT0zLz3eyMDIzMDEwFLPwDS-wAAAIEE1Zg"
content-security-policy: script-src 'report-sample' 'nonce-OtOGrUNhngJ0FBADfzcieQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUeTSt92GbwFstlEtap16dagvWDy9BTU0Od1c-SKLXYAR_PMZiKZKt2aVsZ4dJf0vdGvaOk5UOXXvUz8EFdAbnRhhqYBGh58g9bfhgL_fmUH_bFnIOPS3VEXi2K7HGeVuZz2vZplg==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.183.100 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

186.176.8.34.bc.googleusercontent.com

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-gDbNa0o5zjEU2oPSbce8OQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type: text/plain
sec-ch-ua-mobile: ?0

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 12 Apr 2026 01:37:11 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjMtDikmJw0JBi-FB_mfUHEIdz-bDFA_HCaYFsK4H4TkwQ2xMgPrU6mO0SEAtxcxx_9_ocm8CBWQvLlFyS8gvjk_PzSlLzSnQTU4p1QeyizKTSkvwiFHZqGUhFTn56emZeeryRgZGZgYmBpZ6BaXyBAQCIBDA7"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-gDbNa0o5zjEU2oPSbce8OQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H2 200 AGSKWxVlOU9n1Mq-pZ3jxUV-oCDmYM_ebgmeTJTHuRk2i9e4OBGm_Vv6dFAdNWDQ8hZsS3iwqfHHglFeNdbfte5SD88mBtqWu1i-xPPsoXCq1BuiUpTyqZKW-hRumzyB2oGPbn5GZIsXAA== Show response
fundingchoicesmessages.google.com/f/ 885 KB
106 KB 102ms
102ms Script
application/javascript 2a00:1450:4001:c13::65
Google LLC

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxVlOU9n1Mq-pZ3jxUV-oCDmYM_ebgmeTJTHuRk2i9e4OBGm_Vv6dFAdNWDQ8hZsS3iwqfHHglFeNdbfte5SD88mBtqWu1i-xPPsoXCq1BuiUpTyqZKW-hRumzyB2oGPbn5GZIsXAA==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzc1OTU3ODMxLDIxMjAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzddXSwiaHR0cHM6Ly9wYWludC50b3lzL29pbC8iLG51bGwsW1s4LCJYejRUZTNUcWZUOCJdLFs5LCJubCJdLFsxOCwiW1tbbnVsbCwxMTYxXV1dIl0sWzM1LCIxNzc1OTU3ODMxIl0sWzI2LCIzIl0sWzE5LCIxIl0sWzE3LCJbMF0iXSxbMjQsInhmZ3JqNS5ncmFwaGljb24ub3JnIl0sWzI1LCJbWzk1Mzg2MTkwLDk1Mzc5ODIzXV0iXSxbMjksImZhbHNlIl1dXQ

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:c13::65 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

68e4c56d58ade4997daf4eac1b08f9253b48cac38a3d83f284bc508d2a31c735

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-rffGm_R1gEUqKTBcoX0qKA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 12 Apr 2026 01:37:11 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzj6mHU4pJicNSQYmi9eY51MhCXLDrP2gTEXUA8A4gNFS6x2gPxh_rLrD-AuEjiCmsDEH-qusEqUH2DNZzLhy0eiL8V-7KxlPiynZjix3YNiJ8A8ScgZnnrz6Z2NIDNBIhNQwLZnIF44bRAtpVAfCcmiO0JEJ9aHcx2CYiFeDiOv3t9jk3gw465fYxKGkn5hfHJ-XklRZlJpSX5RWnJaanFqUVlqUXxRgZGZgYmBpZ6BubxBQYAnilKuA"
content-security-policy: script-src 'report-sample' 'nonce-rffGm_R1gEUqKTBcoX0qKA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

POST
H3 200 o1q39vsak_927o28tiqspg6w1b Show response
faucetfoot.com/ 303 B
327 B 61ms
36ms Fetch
application/json 34.8.176.186
Google LLC

General

Check archive.org

Download Go to

Full URL

https://faucetfoot.com/o1q39vsak_927o28tiqspg6w1b

Requested by

Host: faucetfoot.com
URL: https://faucetfoot.com/files/p94wwqs1nsnv-prod.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.8.176.186 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),

Reverse DNS

Software

hoothoot/2438300242 /

Resource Hash

9ae3a152542f60f5b5abc3b8775b6b513dc32576422d7a666b0abb7b39acc06e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=15724800; preload
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: POST, OPTIONS
via: fen-hoothoot-europe-west1-test-1w44.gce-europe-west1, 1.1 google
expires: Sun, 12 Apr 2026 01:37:10 GMT
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000
content-length: 303
date: Sun, 12 Apr 2026 01:37:11 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding, Origin
server: hoothoot/2438300242
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Cookie

GET
H2 200 css
fonts.googleapis.com/ 123 KB
6 KB 43ms
43ms Stylesheet
text/css 2a00:1450:4001:c21::5f
Google LLC

General

Check archive.org

Download Go to

Full URL

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.nl.Xz4Te3TqfT8.es5.O/d=1/exm=kernel_loader,loader_js_executable/ed=1/rs=AJlcJMwlLFM9qRyUvr8AYprHS9f73mZUZg/m=web_iab_tcf_v2_wall_executable

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a00:1450:4001:c21::5f Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

6f55a179811727a333e01eb1e16c9d003ffe30a223c8e6121ed732b2b09b95f7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Sun, 12 Apr 2026 01:37:11 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 12 Apr 2026 01:37:11 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Sun, 12 Apr 2026 01:37:11 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
110 B 19ms
18ms Fetch
image/gif 2606:4700:10::ac42:948c
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.6401364705244711
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac42:948c -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 4
x-goog-stored-content-encoding: identity
expires: Fri, 20 Mar 2026 13:41:52 GMT
x-goog-stored-content-length: 43
date: Sun, 12 Apr 2026 01:37:11 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH89K2Yq4pnfcvUStBId9HlURvizPqf3MVWGgPxZrgZz6nkGA3_cdbcg0whsVowwYFR03VNFb3R4
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9eae811e7bf55f1e-AMS
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v40/ 47 KB
47 KB 22ms
22ms Font
font/woff2 142.251.20.94
Google LLC

General

Check archive.org

Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.20.94 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

bx-in-f94.1e100.net

Software

sffe /

Resource Hash

3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://paint.toys
sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

age: 146270
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Sat, 10 Apr 2027 08:59:21 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 10 Apr 2026 08:59:21 GMT
last-modified: Thu, 14 Dec 2023 02:08:40 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 48236
x-xss-protection: 0
server: sffe

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUeTSt92GbwFstlEtap16dagvWDy9BTU0Od1c-SKLXYAR_PMZiKZKt2aVsZ4dJf0vdGvaOk5UOXXvUz8EFdAbnRhhqYBGh58g9bfhgL_fmUH_bFnIOPS3VEXi2K7HGeVuZz2vZplg==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.183.100 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-Q_lCGqFiB-NAa8URTOk5Yg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type: text/plain
sec-ch-ua-mobile: ?0

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 12 Apr 2026 01:37:11 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjMtDikmJw0pBi-FB_mfUHEIdz-bDFA_HCaYFsK4H4TkwQ2xMgPrU6mO0SEAvxcBx_9_ocm8CH0503GJVckvIL45Pz80pS80p0E1OKdUHsosyk0pL8IhR2ahlIRU5-enpmXnq8kYGRmYGJgaWegWl8gQEA0akw6g"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-Q_lCGqFiB-NAa8URTOk5Yg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUeTSt92GbwFstlEtap16dagvWDy9BTU0Od1c-SKLXYAR_PMZiKZKt2aVsZ4dJf0vdGvaOk5UOXXvUz8EFdAbnRhhqYBGh58g9bfhgL_fmUH_bFnIOPS3VEXi2K7HGeVuZz2vZplg==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.183.100 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-2AkmygtpbrAcYuZuboNV-w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type: text/plain
sec-ch-ua-mobile: ?0

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 12 Apr 2026 01:37:11 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjstDikmJw1ZBiOHnrNtNFIP5Qf5n1BxCHc_mwxQPxwmmBbCuB-E5MENsTID61OpjtEhAL8XAcf_f6HJvAjqkHrjMquSTlF8Yn5-eVpOaV6CamFOuC2EWZSaUl-UUo7NQykIqc_PT0zLz0eCMDIzMDEwNLPQPT-AIDAFh1NcU"
content-security-policy: script-src 'report-sample' 'nonce-2AkmygtpbrAcYuZuboNV-w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUeTSt92GbwFstlEtap16dagvWDy9BTU0Od1c-SKLXYAR_PMZiKZKt2aVsZ4dJf0vdGvaOk5UOXXvUz8EFdAbnRhhqYBGh58g9bfhgL_fmUH_bFnIOPS3VEXi2K7HGeVuZz2vZplg==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.183.100 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-iEEdziUeePJyJGCW1Se58Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type: text/plain
sec-ch-ua-mobile: ?0

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 12 Apr 2026 01:37:11 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjstDikmJw1ZBiOHnrNtNFIP5Qf5n1BxCHc_mwxQPxwmmBbCuB-E5MENsTID61OpjtEhAL8XAcf_f6HJvAijmvbzMquSTlF8Yn5-eVpOaV6CamFOuC2EWZSaUl-UUo7NQykIqc_PT0zLz0eCMDIzMDEwNLPQPT-AIDAGMuNes"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-iEEdziUeePJyJGCW1Se58Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H2 200 favicon.ico
paint.toys/ 615 B
748 B 108ms
108ms Other
image/vnd.microsoft.icon 3.33.186.135
Amazon.com

General

Check archive.org

Download Go to

Full URL

https://paint.toys/favicon.ico

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

Software

Netlify /

Resource Hash

30a007a99e491d9e1b2b72c02e4a8454334c6ea2b3a03316d50135b20464fccc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/oil/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "6c77abc0123fbfdebbf702a90fb50938-ssl"
age: 19014
accept-ranges: bytes
content-length: 615
x-nf-request-id: 01KNZNBVVGA2JENGAB2JVMWVJR
cache-status: "Netlify Edge"; hit
date: Sun, 12 Apr 2026 01:37:11 GMT
content-type: image/vnd.microsoft.icon
server: Netlify

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
110 B 20ms
20ms Fetch
image/gif 2606:4700:10::ac42:948c
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=2&e=0.2221410042297629
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac42:948c -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 4
x-goog-stored-content-encoding: identity
expires: Fri, 20 Mar 2026 13:41:52 GMT
x-goog-stored-content-length: 43
date: Sun, 12 Apr 2026 01:37:11 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH89K2Yq4pnfcvUStBId9HlURvizPqf3MVWGgPxZrgZz6nkGA3_cdbcg0whsVowwYFR03VNFb3R4
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9eae811f5da85f1e-AMS
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico Show response
ad.doubleclick.net/ 1 KB
129 B 32ms
32ms Fetch
image/x-icon 192.178.183.148
Google LLC

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.9306891675739374

Requested by

Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.183.148 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

ns3216658.ip-141-95-98.eu

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Mon, 13 Apr 2026 01:37:11 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 12 Apr 2026 01:37:11 GMT
content-type: image/x-icon
vary: Accept-Encoding
last-modified: Tue, 08 May 2012 13:08:06 GMT
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 iframe.html Show response
cdn.intergient.com/pageos/V.20260406.1/iframe/ Frame B060 1 KB
0 0ms
0ms Document
text/html 2606:4700::6812:1438
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20260406.1/iframe/iframe.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260406.1/main.551129c9449d5acc2196.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 90d513103bc2344c23fc4688085d61fad48a8e22c0c536248682d4ac6e44cf00

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

age: 374307
cache-control: public, max-age=31536000
cf-cache-status: HIT
cf-ray: 9eae811bfb311c64-AMS
content-encoding: br
content-type: text/html
date: Sun, 12 Apr 2026 01:37:11 GMT
expires: Mon, 12 Apr 2027 01:37:11 GMT
hw-country-code: NL
last-modified: Tue, 07 Apr 2026 17:27:56 GMT
server: cloudflare

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 354 KB
90 KB 68ms
24ms Script
application/javascript 108.138.3.93
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260406.1/main.551129c9449d5acc2196.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.3.93 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-108-138-3-93.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 676e51f4fae12e637d7c95adcfe1a93fb3c523f1ee99985d1a580e26077ba970

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

vary: Accept-Encoding
cache-control: max-age=3600
content-encoding: gzip
etag: W/"e01949a8eee0862893b61174efba0140"
age: 3136
via: 1.1 94bd75b95472ec61935815aa61472392.cloudfront.net (CloudFront), 1.1 0e37105a96e87c22ff4981659a6dc176.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: rxcA9z-VxR7VcYA5w8t6KHooUJihEOo12YfuiJioP2XygQlAskx6GQ==
date: Sun, 12 Apr 2026 00:44:56 GMT
content-type: application/javascript
x-amz-cf-pop: FRA56-P14, FRA56-P6
server: AmazonS3
last-modified: Thu, 09 Apr 2026 21:07:55 GMT
x-amz-server-side-encryption: AES256

GET
H2 200 iframe.js Show response
cdn.intergient.com/pageos/V.20260406.1/iframe/ Frame B060 17 KB
0 21ms
21ms Script
text/javascript 2606:4700::6812:1438
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20260406.1/iframe/iframe.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260406.1/iframe/iframe.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: a1e9592b119e182885673d049ec2ead66dab57473f2f6da59f43d888cea5ac1e

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://cdn.intergient.com/pageos/V.20260406.1/iframe/iframe.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

hw-country-code: NL
cache-control: public, max-age=31536000
content-encoding: br
cf-cache-status: HIT
etag: W/"3eecc5d11812ac69fb4f2c63c5dea237"
age: 374307
cf-ray: 9eae811c2ba01c64-AMS
expires: Mon, 12 Apr 2027 01:37:11 GMT
date: Sun, 12 Apr 2026 01:37:11 GMT
content-type: text/javascript
last-modified: Tue, 07 Apr 2026 17:27:57 GMT
server: cloudflare

GET
H2

200

main.js Show response
cdn.intergient.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/b0a7532ac8ec/ Frame 7548
Redirect Chain

https://cdn.intergient.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
https://cdn.intergient.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/b0a7532ac8ec/main.js?

26 KB
12 KB

18ms
17ms

Script
application/javascript

2606:4700::6812:1438
Cloudflare

General

Check archive.org

Download Go to

Full URL

https://cdn.intergient.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/b0a7532ac8ec/main.js?

Protocol

Server

2606:4700::6812:1438 -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

7cce88373cab85c9d03ec5a9dc24370408659260ebe2f15b728a9fd80c768a7b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer

Response headers

cf-ray: 9eae81200b941c64-AMS
cache-control: max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public
content-encoding: gzip
date: Sun, 12 Apr 2026 01:37:11 GMT
content-type: application/javascript; charset=UTF-8
server: cloudflare
x-content-type-options: nosniff

Redirect headers

cf-ray: 9eae811feb3f1c64-AMS
cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public
location: /cdn-cgi/challenge-platform/h/g/scripts/jsd/b0a7532ac8ec/main.js?
content-length: 0
access-control-allow-origin: *
date: Sun, 12 Apr 2026 01:37:11 GMT
server: cloudflare

GET 47874f9f-cc80-4f49-a240-6311e55f76b3
https://paint.toys/ 0
0

GET
H2 200 474.54ec3c969d5dcf548468.js Show response
cdn.intergient.com/pageos/V.20260406.1/ 3 KB
1 KB 21ms
21ms Script
text/javascript 2606:4700::6812:1438
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20260406.1/474.54ec3c969d5dcf548468.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260406.1/runtime.e74e4ca9f030172e8b39.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 70fdcbbe7129a79cab3b0839348a16e359bda7056b157c52ec8d2cb89d40fa3e

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

hw-country-code: NL
cache-control: public, max-age=31536000
content-encoding: br
cf-cache-status: HIT
etag: W/"a4ba8a8e24e7796c977c7ad0213bf24d"
age: 374307
cf-ray: 9eae811ffe07f531-AMS
expires: Mon, 12 Apr 2027 01:37:11 GMT
date: Sun, 12 Apr 2026 01:37:11 GMT
content-type: text/javascript
last-modified: Tue, 07 Apr 2026 17:27:49 GMT
server: cloudflare

GET
H2 200 ima3.js Show response
imasdk.googleapis.com/js/sdkloader/ 464 KB
146 KB 97ms
46ms Script
text/javascript 2a00:1450:4001:c25::5f
Google LLC

General

Check archive.org

Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/ima3.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260406.1/main.551129c9449d5acc2196.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a00:1450:4001:c25::5f Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

74e59fc67c703f82c13c2e3a7ad1770fa26f274a9617aa79ad2d065b2d1b11df

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
etag: 1366167282717696831
x-content-type-options: nosniff
expires: Sun, 12 Apr 2026 01:37:11 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sun, 12 Apr 2026 01:37:11 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 148947
x-xss-protection: 0
server: cafe

POST
H2 200 fb87a4ea41 Show response
cd836371f1d.cdn.intergient.com/ 0
96 B 65ms
21ms XHR
application/octet-stream 63.176.195.25
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://cd836371f1d.cdn.intergient.com/fb87a4ea41
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260406.1/main.551129c9449d5acc2196.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 63.176.195.25 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-63-176-195-25.eu-central-1.compute.amazonaws.com
Software: nginx/1.24.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0

Response headers

access-control-allow-origin: *
date: Sun, 12 Apr 2026 01:37:11 GMT
content-type: application/octet-stream
server: nginx/1.24.0

POST
H2 200 9eae811bfb311c64 Show response
cdn.intergient.com/cdn-cgi/challenge-platform/h/g/jsd/oneshot/b0a7532ac8ec/0.38805911369366874:1775956765:KSIU20VRP2vuiPPOtkb5VclIclep-LiOUkH3MwxI1kM/ Frame 7548 0
985 B 38ms
34ms XHR
text/plain 2606:4700::6812:1438
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/cdn-cgi/challenge-platform/h/g/jsd/oneshot/b0a7532ac8ec/0.38805911369366874:1775956765:KSIU20VRP2vuiPPOtkb5VclIclep-LiOUkH3MwxI1kM/9eae811bfb311c64
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform: "Linux"
Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0

Response headers

cf-ray: 9eae81206c4c1c64-AMS
timing-allow-origin: https://cdn.intergient.com
content-length: 0
cf-chl-out-s: CarMyVu5gFcplCCPxfQfa+WxdpBNK3UpAiEl1b2c1p1wpxZFKzQfur58IcDIpwvX/YDcb7EFtK2GfoskBkSl97Ls00OcrCj07CdPXowTTxIHkKIT/WDiw2/fu848HLorE9EU4+nuGnGwKV7WkUd+YkDQ7zytr3A/auLs1RTonYCcHTjiwAf+LbRoOvUbTMh6owxzUDpqjeIFXyqcuaFAv1ZZBe4ttzoNvtdpLfimW0LW72bc3CxDoSmQgfQKDh3h$oUiiyTx1zoOI2tatzSxFRw==
date: Sun, 12 Apr 2026 01:37:11 GMT
content-type: text/plain; charset=UTF-8
server: cloudflare

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 67ms
21ms XHR
application/javascript 108.138.3.93
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.3.93 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-108-138-3-93.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

access-control-max-age: 3000
content-encoding: gzip
x-amz-version-id: r5.lR.LJ66XEXzxUUVo7iMemjL_F_GoE
etag: W/"a4d296427fc806b21335359e398c025c"
age: 78640
access-control-allow-methods: GET
x-cache: Hit from cloudfront
x-amz-cf-id: BzwGgoYZOH3S5I0DF-TtWXDMma5hr2mTBtAD8CNOrreZhzjW54pKPg==
date: Sat, 11 Apr 2026 03:49:44 GMT
content-type: application/javascript
vary: Origin,Accept-Encoding
last-modified: Thu, 29 Feb 2024 02:13:08 GMT
cache-control: public, max-age=86400
via: 1.1 6b85d8725dd6471c3db1f65d4096afc4.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: FRA56-P6
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 bd056b42-51db-43ce-9a8e-3b11319b5d1f Show response
config.aps.amazon-adsystem.com/configs/ 67 KB
3 KB 67ms
22ms Script
application/javascript 18.245.46.61
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://config.aps.amazon-adsystem.com/configs/bd056b42-51db-43ce-9a8e-3b11319b5d1f
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.245.46.61 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-18-245-46-61.fra56.r.cloudfront.net
Software: CloudFront /
Resource Hash: 2edc4749082382c6dc56e08a38f7135bba65296cbc4f7d19c8e42a53d1171540

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: max-age=3600
content-encoding: gzip
age: 2228
via: 1.1 ae80ccab7109b5d2f1c1ee784af203a6.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
content-length: 3244
x-amz-cf-id: iqvIQXZOxJz5dljqJ0vAJ8UHHevI4iSnAPM_233-_E3VlBOrgT4goQ==
date: Sun, 12 Apr 2026 01:00:03 GMT
content-type: application/javascript
x-amz-cf-pop: FRA56-P9
server: CloudFront

GET
H2 200 config Show response
c.amazon-adsystem.com/cdn/prod/ 3 KB
3 KB 22ms
22ms XHR
application/json 108.138.3.93
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fpaint.toys&pubid=bd056b42-51db-43ce-9a8e-3b11319b5d1f
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.3.93 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-108-138-3-93.fra56.r.cloudfront.net
Software: Server /
Resource Hash: d4146a9ffdccf871cc20ab37bd23ca6ebdcbcae9d6255d3d311a97cfd138a74f

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: max-age=21550, s-maxage=21600
age: 12853
access-control-allow-credentials: true
via: 1.1 0e37105a96e87c22ff4981659a6dc176.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Hit from cloudfront
content-length: 3077
x-amz-cf-id: cOb24RAedyv2HViRJJ6rvThKzSszynIMn12VeXx6JcsG_QbIiNtGQw==
date: Sat, 11 Apr 2026 22:02:58 GMT
content-type: application/json;charset=UTF-8
x-amz-cf-pop: FRA56-P6
server: Server

GET
H2 200 pubcid.min.js Show response
secure.cdn.fastclick.net/js/pubcid/latest/ 67 KB
22 KB 66ms
21ms Script
application/javascript 23.45.96.101
Akamai Technologies

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/pubcid/latest/pubcid.min.js
Requested by: Host: xfgrj5.graphicon.org
URL: https://xfgrj5.graphicon.org/hp2sap1nbai7kjk9j3k7y7h67xq49f5pf0Rellob251T25SVkNneWVGSDNCSnItNTk4Mi0yNjE2MDA2My0xMDFhMDI3MS0xMDM0NC1hcVI2V3gzYndNR1lka3QydGJscw/layeh849g2m/ehibibkwfwyvxfmaieywiftx/SCL8R5958BF2/yxkbcwhzsdcqogotcobtexgpqlosm/091935918227822158385887
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.45.96.101 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-45-96-101.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 45bc6978e281a938d9485dcbf0859159b24e2f7c9b8b0fafc120b9606e0ea8b1

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "10ab4-63a0ee37f7c40-gzip"
expires: Sun, 12 Apr 2026 01:52:11 GMT
accept-ranges: bytes
content-length: 21994
date: Sun, 12 Apr 2026 01:37:11 GMT
last-modified: Wed, 16 Jul 2025 17:04:41 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16576/ 44 KB
13 KB 66ms
21ms Script
text/javascript 18.66.102.77
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Requested by: Host: xfgrj5.graphicon.org
URL: https://xfgrj5.graphicon.org/hp2sap1nbai7kjk9j3k7y7h67xq49f5pf0Rellob251T25SVkNneWVGSDNCSnItNTk4Mi0yNjE2MDA2My0xMDFhMDI3MS0xMDM0NC1hcVI2V3gzYndNR1lka3QydGJscw/layeh849g2m/ehibibkwfwyvxfmaieywiftx/SCL8R5958BF2/yxkbcwhzsdcqogotcobtexgpqlosm/091935918227822158385887
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.102.77 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-18-66-102-77.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5ac6db9eca6024415fceff0efcb39732b882e99babaaf05b94b04baa16980583

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

vary: Accept-Encoding
cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"27a001ef77a3a0515b877de836201c21"
age: 80326
via: 1.1 985c0b2ec44bdebc7f24f26d1e427d30.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: vU1yDwdEWQvMfrZI3kkWoqOa09KptcKBYsMO_BTLaZPuckWMmRl5IQ==
date: Sat, 11 Apr 2026 05:20:30 GMT
content-type: text/javascript
last-modified: Tue, 10 Feb 2026 20:18:40 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P2
x-amz-server-side-encryption: AES256

GET
H2 200 hadron.js Show response
cdn.hadronid.net/ 11 B
185 B 52ms
20ms Script
text/plain 2606:4700:10::ac42:a677
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fxfgrj5.graphicon.org%2F&_it=amazon&partner_id=403
Requested by: Host: xfgrj5.graphicon.org
URL: https://xfgrj5.graphicon.org/hp2sap1nbai7kjk9j3k7y7h67xq49f5pf0Rellob251T25SVkNneWVGSDNCSnItNTk4Mi0yNjE2MDA2My0xMDFhMDI3MS0xMDM0NC1hcVI2V3gzYndNR1lka3QydGJscw/layeh849g2m/ehibibkwfwyvxfmaieywiftx/SCL8R5958BF2/yxkbcwhzsdcqogotcobtexgpqlosm/091935918227822158385887
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac42:a677 -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: a73f5986eb985871284e6e216372de3505634a97229de643216728d0fbfd6227

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: max-age=432000
cf-cache-status: HIT
etag: "6943ef12-b"
age: 4244
cf-ray: 9eae8121388c270e-AMS
accept-ranges: bytes
content-length: 11
date: Sun, 12 Apr 2026 01:37:11 GMT
content-type: text/plain
last-modified: Thu, 18 Dec 2025 12:09:54 GMT
server: cloudflare

GET
H2 200 id5-api.js Show response
cdn.id5-sync.com/api/1.0/ 117 KB
34 KB 60ms
25ms Script
text/javascript 2606:4700:10::6814:170d
Cloudflare

General

Check archive.org

Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/id5-api.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6814:170d -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

18120a6bee05cd823d5f4ab0c52006863a059a5d6c535c790a31bdd2ee8c45e7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-amz-id-2: H/Fu1bh7AsQ70++MWwc6+Z189TzBojy+B5MTf9BVoIn4YoFLvgQ0/DYZc4K+nAo1uX5XcqDl/W+mcAi8RqU63rplYK5H9qXVgSaChLTONsg=
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: public, max-age=3600
content-encoding: br
cf-cache-status: HIT
etag: W/"78d670c3a2facd95b81a836b6857d830"
age: 2837
x-amz-request-id: VB3EWK5QGCQM0AYW
cf-ray: 9eae812139de0b4c-AMS
date: Sun, 12 Apr 2026 01:37:11 GMT
content-type: text/javascript;charset=utf-8
last-modified: Wed, 18 Mar 2026 12:22:23 GMT
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 id5-api-js Show response
api.id5-sync.com/analytics/483/ 1 KB
691 B 77ms
23ms Fetch
application/json 141.95.98.64
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://api.id5-sync.com/analytics/483/id5-api-js

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.64 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

64731b0c4bddd9b69b5d748b611bcb8cc52a9dd00a6d9f4c9664dfac0a8d6e1b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: max-age=300
access-control-expose-headers: Access-Control-Allow-Origin
content-encoding: gzip
access-control-allow-origin: *
date: Sun, 12 Apr 2026 01:37:11 GMT
content-type: application/json
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding

POST
H3 204 ping
pagead2.googlesyndication.com/pagead/ 0
0 83ms
52ms Fetch
image/gif 142.251.110.156
Google LLC

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/ping?e=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202604080101/pubads_impl.js?cb=31097742

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.110.156 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

bz-in-f156.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sun, 12 Apr 2026 01:37:12 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
135 B 18ms
17ms Fetch
image/gif 2606:4700:10::ac42:948c
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=2&e=0.05474867872849176
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac42:948c -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 5
x-goog-stored-content-encoding: identity
expires: Fri, 20 Mar 2026 13:41:52 GMT
x-goog-stored-content-length: 43
date: Sun, 12 Apr 2026 01:37:12 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH89K2Yq4pnfcvUStBId9HlURvizPqf3MVWGgPxZrgZz6nkGA3_cdbcg0whsVowwYFR03VNFb3R4
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9eae81239f4c5f1e-AMS
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico Show response
ad.doubleclick.net/ 1 KB
129 B 29ms
29ms Fetch
image/x-icon 192.178.183.148
Google LLC

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.8390701268110461

Requested by

Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.183.148 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Mon, 13 Apr 2026 01:37:12 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 12 Apr 2026 01:37:12 GMT
content-type: image/x-icon
vary: Accept-Encoding
last-modified: Tue, 08 May 2012 13:08:06 GMT
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
110 B 19ms
18ms Fetch
image/gif 2606:4700:10::ac42:948c
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.08776417965498384
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac42:948c -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 5
x-goog-stored-content-encoding: identity
expires: Fri, 20 Mar 2026 13:41:52 GMT
x-goog-stored-content-length: 43
date: Sun, 12 Apr 2026 01:37:12 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH89K2Yq4pnfcvUStBId9HlURvizPqf3MVWGgPxZrgZz6nkGA3_cdbcg0whsVowwYFR03VNFb3R4
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9eae81239f4f5f1e-AMS
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H2 200 dns Show response
ab.dns-finder.com/meta/ 2 B
0 0ms
0ms Fetch
text/plain 34.36.200.111
Google LLC

General

Check archive.org

Download Go to

Full URL: https://ab.dns-finder.com/meta/dns
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.36.200.111 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS: 111.200.36.34.bc.googleusercontent.com
Software: /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: private, max-age=180, stale-if-error=180, stale-while-revalidate=180
access-control-expose-headers: X-Resolver
x-resolver: default
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
date: Sun, 12 Apr 2026 01:37:11 GMT
content-type: text/plain; charset=utf-8
vary: Origin

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
110 B 19ms
18ms Fetch
image/gif 2606:4700:10::ac42:948c
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.6882561065861149
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac42:948c -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 5
x-goog-stored-content-encoding: identity
expires: Fri, 20 Mar 2026 13:41:52 GMT
x-goog-stored-content-length: 43
date: Sun, 12 Apr 2026 01:37:12 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH89K2Yq4pnfcvUStBId9HlURvizPqf3MVWGgPxZrgZz6nkGA3_cdbcg0whsVowwYFR03VNFb3R4
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9eae8124faaf5f1e-AMS
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
110 B 18ms
17ms Fetch
image/gif 2606:4700:10::ac42:948c
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=2&e=0.8393116309914951
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac42:948c -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 5
x-goog-stored-content-encoding: identity
expires: Fri, 20 Mar 2026 13:41:52 GMT
x-goog-stored-content-length: 43
date: Sun, 12 Apr 2026 01:37:12 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH89K2Yq4pnfcvUStBId9HlURvizPqf3MVWGgPxZrgZz6nkGA3_cdbcg0whsVowwYFR03VNFb3R4
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9eae81263d475f1e-AMS
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico Show response
ad.doubleclick.net/ 1 KB
129 B 29ms
29ms Fetch
image/x-icon 192.178.183.148
Google LLC

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.20477079867916248

Requested by

Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.183.148 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Mon, 13 Apr 2026 01:37:12 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 12 Apr 2026 01:37:12 GMT
content-type: image/x-icon
vary: Accept-Encoding
last-modified: Tue, 08 May 2012 13:08:06 GMT
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
135 B 19ms
19ms Fetch
image/gif 2606:4700:10::ac42:948c
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=2&e=0.7920413664770215
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac42:948c -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 6
x-goog-stored-content-encoding: identity
expires: Fri, 20 Mar 2026 13:41:52 GMT
x-goog-stored-content-length: 43
date: Sun, 12 Apr 2026 01:37:13 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH89K2Yq4pnfcvUStBId9HlURvizPqf3MVWGgPxZrgZz6nkGA3_cdbcg0whsVowwYFR03VNFb3R4
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9eae8128daf85f1e-AMS
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico Show response
ad.doubleclick.net/ 1 KB
129 B 29ms
29ms Fetch
image/x-icon 192.178.183.148
Google LLC

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.96863656182679

Requested by

Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.183.148 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Mon, 13 Apr 2026 01:37:13 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 12 Apr 2026 01:37:13 GMT
content-type: image/x-icon
vary: Accept-Encoding
last-modified: Tue, 08 May 2012 13:08:06 GMT
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
110 B 20ms
19ms Fetch
image/gif 2606:4700:10::ac42:948c
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=2&e=0.1138751581625217
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac42:948c -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 6
x-goog-stored-content-encoding: identity
expires: Fri, 20 Mar 2026 13:41:52 GMT
x-goog-stored-content-length: 43
date: Sun, 12 Apr 2026 01:37:13 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH89K2Yq4pnfcvUStBId9HlURvizPqf3MVWGgPxZrgZz6nkGA3_cdbcg0whsVowwYFR03VNFb3R4
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9eae812b79075f1e-AMS
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico Show response
ad.doubleclick.net/ 1 KB
129 B 31ms
30ms Fetch
image/x-icon 192.178.183.148
Google LLC

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.7073510215258477

Requested by

Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.183.148 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Mon, 13 Apr 2026 01:37:13 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 12 Apr 2026 01:37:13 GMT
content-type: image/x-icon
vary: Accept-Encoding
last-modified: Tue, 08 May 2012 13:08:06 GMT
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

POST
H2 200 fb87a4ea41 Show response
cd836371f1d.cdn.intergient.com/ 0
95 B 25ms
24ms XHR
application/octet-stream 63.176.195.25
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://cd836371f1d.cdn.intergient.com/fb87a4ea41
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260406.1/main.551129c9449d5acc2196.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 63.176.195.25 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-63-176-195-25.eu-central-1.compute.amazonaws.com
Software: nginx/1.24.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0

Response headers

access-control-allow-origin: *
date: Sun, 12 Apr 2026 01:37:13 GMT
content-type: application/octet-stream
server: nginx/1.24.0

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
135 B 19ms
18ms Fetch
image/gif 2606:4700:10::ac42:948c
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=2&e=0.7240814759576552
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac42:948c -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 7
x-goog-stored-content-encoding: identity
expires: Fri, 20 Mar 2026 13:41:52 GMT
x-goog-stored-content-length: 43
date: Sun, 12 Apr 2026 01:37:14 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH89K2Yq4pnfcvUStBId9HlURvizPqf3MVWGgPxZrgZz6nkGA3_cdbcg0whsVowwYFR03VNFb3R4
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9eae812ee86f5f1e-AMS
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico Show response
ad.doubleclick.net/ 1 KB
129 B 29ms
29ms Fetch
image/x-icon 192.178.183.148
Google LLC

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.7848448469897498

Requested by

Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.183.148 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS