paint.toys
15.197.167.90 Public Scan Open in urlscan Pro

Software

Netlify /

Resource Hash

fe22d7bc39aeadb33e17b218425d2a50939f49166eb696f087bf4be21a0308eb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://dfef.comlink-it.com.au/8rv4antkas7digh9pi7glovg5mmewihwt27c8q9rn9df61npgny4ckbt6p8xbpx1lkuqjea9jqRN0gzalM4bmYzZGt2WlhpeURab2UtNjExOC0yNTc1NDQ1NC0wZmYxMDI3NS0xMDYyMy1XZE4zVUw0RnFwVDNQamFHR3Q4WA/hhz53m0jbbq/0G9CcQJr5IYfK8rMejRHSRr977HFQWnaFOCpa1hwpThl/520904034370726572938706541793457/t46PM6p8gsEqR6rndxp7CcKxC2BvcTW5TknZrojHWggx
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

accept-ranges: bytes
age: 3354
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-encoding: br
content-length: 2573
content-type: text/html; charset=UTF-8
date: Mon, 20 Apr 2026 16:52:51 GMT
etag: "1abafd6c5c05a39a35ba571205295b68-ssl-df"
server: Netlify
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-nf-request-id: 01KPNWY81ZJ6TKXGR2SGPECMX7

Redirect headers

cache-status: "Netlify Edge"; fwd=miss
content-length: 98
content-type: text/html
date: Mon, 20 Apr 2026 16:52:51 GMT
location: /oil/
server: Netlify
strict-transport-security: max-age=31536000
x-nf-request-id: 01KPNWY7RSAFM72CGWG1PS6NV1

GET
H2 200 ramp_config.js Show response
cdn.intergient.com/1024872/74068/ 39 KB
7 KB 438ms
242ms Script
application/javascript 104.18.20.56
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/1024872/74068/ramp_config.js
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 22168713fd9edf35457fcde1c7915fcb7b32642882ddd531188e58c4cf261fc7

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cf-ray: 9ef5a96f2b38c742-PER
hw-country-code: AU
cache-control: max-age=600, public, must-revalidate
content-encoding: br
date: Mon, 20 Apr 2026 16:52:51 GMT
content-type: application/javascript
server: cloudflare

GET
H2 200 apps.css
paint.toys/ 6 KB
2 KB 92ms
90ms Stylesheet
text/css 15.197.167.90
Amazon.com

General

Check archive.org

Download Go to

Full URL

https://paint.toys/apps.css

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.197.167.90 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

Software

Netlify /

Resource Hash

98db09da3e1109288620e5f78abf4769bb160bb5d505ba03f683edd1227a4a53

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/oil/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
content-encoding: br
etag: "56a5025fbb6b2d9217c0c90816b2fee9-ssl-df"
age: 3354
accept-ranges: bytes
content-length: 1644
x-nf-request-id: 01KPNWY867CRHCGTVRKHWGBXRA
cache-status: "Netlify Edge"; hit
date: Mon, 20 Apr 2026 16:52:51 GMT
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: Netlify

GET
H2 200 index.js Show response
paint.toys/oil/ 4 KB
1 KB 92ms
91ms Script
application/javascript 15.197.167.90
Amazon.com

General

Check archive.org

Download Go to

Full URL

https://paint.toys/oil/index.js

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.197.167.90 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

Software

Netlify /

Resource Hash

1afce4631b4f1dcc9f08ca5b89182fa0e68307e0df60b096646ce66296354ae1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/oil/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
content-encoding: br
etag: "94ae9b9ed2162106abf0e8e5295e04e0-ssl-df"
age: 3354
accept-ranges: bytes
content-length: 1264
x-nf-request-id: 01KPNWY868ZV6DFPDR2QPKHJC6
cache-status: "Netlify Edge"; hit
date: Mon, 20 Apr 2026 16:52:51 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Netlify

GET
H2 200 art-icon.png
paint.toys/assets/ 33 KB
33 KB 93ms
92ms Image
image/png 15.197.167.90
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/art-icon.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.197.167.90 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

Software

Netlify /

Resource Hash

f4d368e4230539c778afbb020e0ea611b3e1d984179f5b3769b44081d6703f3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/oil/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "1394f8469f2ca5750397e3d7b6ec70a1-ssl"
age: 3354
accept-ranges: bytes
content-length: 33562
x-nf-request-id: 01KPNWY8684C7E7GEKT2BQQ6YE
cache-status: "Netlify Edge"; hit
date: Mon, 20 Apr 2026 16:52:51 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-hand.png
paint.toys/assets/ 27 KB
27 KB 179ms
178ms Image
image/png 15.197.167.90
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-hand.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.197.167.90 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

Software

Netlify /

Resource Hash

32aa05a5648678542ab9044647f0bf5549c0b53a070585edb773f0e92b72b97d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/oil/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "a0822110a4671ffdf710da1467460fba-ssl"
age: 3354
accept-ranges: bytes
content-length: 27394
x-nf-request-id: 01KPNWY868G64257E0ZDQQQJ8A
cache-status: "Netlify Edge"; hit
date: Mon, 20 Apr 2026 16:52:51 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-disk.png
paint.toys/assets/ 13 KB
14 KB 90ms
90ms Image
image/png 15.197.167.90
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-disk.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.197.167.90 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

Software

Netlify /

Resource Hash

436814c2374a6d92a42a02d39969ef7c56b5f225667abecb218e692c5569943c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/oil/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "26852fa1548a91e004629b01e4abf1dd-ssl"
age: 3352
accept-ranges: bytes
content-length: 13766
x-nf-request-id: 01KPNWY8BV7QD0PVYT98JP75W2
cache-status: "Netlify Edge"; hit
date: Mon, 20 Apr 2026 16:52:51 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-trash.png
paint.toys/assets/ 50 KB
51 KB 90ms
90ms Image
image/png 15.197.167.90
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-trash.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.197.167.90 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

pnsyda-ae-in-f8.1e100.net

Software

Netlify /

Resource Hash

6ceb226c487cb85243545e768944e0e1ae0944be8fde6c1c43c7314a9287e6d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/oil/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "e91ef5e34b5154d392e8560031eaaa4c-ssl"
age: 3352
accept-ranges: bytes
content-length: 51680
x-nf-request-id: 01KPNWY8D14A2FH5PXH4HWMAMR
cache-status: "Netlify Edge"; hit
date: Mon, 20 Apr 2026 16:52:51 GMT
content-type: image/png
server: Netlify

GET
H2 200 ramp_core.js Show response
cdn.intergient.com/ 3 KB
2 KB 54ms
54ms Script
application/javascript 104.18.20.56
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/ramp_core.js
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9333f398054df915902b1119b1be6e83a6666923b162cbb5f25070b28198fd96

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cf-ray: 9ef5a970fcc4c742-PER
hw-country-code: AU
cache-control: max-age=600, public, must-revalidate
content-encoding: br
date: Mon, 20 Apr 2026 16:52:51 GMT
content-type: application/javascript
server: cloudflare

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 457 KB
156 KB 593ms
262ms Script
application/javascript 142.251.222.8
Google LLC

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.222.8 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a6ac54bfaeccfe60cacbc20439e2adc4864c6b4e5c076fbca742d2bfd17f2eeb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
content-encoding: zstd
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Mon, 20 Apr 2026 16:52:52 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 159262
date: Mon, 20 Apr 2026 16:52:52 GMT
x-xss-protection: 0
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Google Tag Manager
access-control-allow-headers: Cache-Control

GET
H2 200 css2
fonts.googleapis.com/ 3 KB
968 B 578ms
246ms Stylesheet
text/css 142.250.183.42
Google LLC

General

Check archive.org

Download Go to

Full URL

https://fonts.googleapis.com/css2?family=DM+Sans:wght@300;400;500&family=DM+Serif+Display&display=swap

Requested by

Host: paint.toys
URL: https://paint.toys/apps.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

142.250.183.42 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

pnsyda-aj-in-f10.1e100.net

Software

ESF /

Resource Hash

0e43e66404ff234d0d874c9422542a2e6442c73246650d680490f46bedd60898

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 20 Apr 2026 16:52:52 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 20 Apr 2026 16:52:52 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Mon, 20 Apr 2026 16:52:52 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 4wf_dl Show response
faucetfoot.com/j/mcppts5/ 104 KB
36 KB 521ms
256ms Script
text/javascript 34.8.176.186
Google LLC

General

Check archive.org

Download Go to

Full URL

https://faucetfoot.com/j/mcppts5/4wf_dl

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.8.176.186 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),

Reverse DNS

186.176.8.34.bc.googleusercontent.com

Software

hoothoot/2455384222 /

Resource Hash

6b614345aca97aa6c454d36b50f6e9aab87177499aebe272907829e2d5668035

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=15724800; preload
cache-control: private, must-revalidate, max-age=21600
timing-allow-origin: *
content-encoding: zstd
etag: W/"927b222073c2677aff027799f2d75f72900dc741220e2f72ac6687d64fd986de"
via: fen-hoothoot-asia-east1-spot-wzhx.gce-asia-east1, 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 20 Apr 2026 16:52:52 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding, Accept-Language
server: hoothoot/2455384222

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 108 KB
34 KB 394ms
203ms Script
text/javascript 142.250.195.226
Google LLC

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.195.226 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

cdn-185-199-111-133.github.com

Software

cafe /

Resource Hash

ade71e929134dc0d296cfadd1efb52526f78cc18fb4ccdd40f5b1489fd20fd7b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
etag: 219 / 20563 / 31097905 / config-hash: 13477949240123161746
x-content-type-options: nosniff
expires: Mon, 20 Apr 2026 16:52:52 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Mon, 20 Apr 2026 16:52:52 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 34807
x-xss-protection: 0
server: cafe

GET
H2 200 prebid.05eaa3284c60ad6e334d.js Show response
cdn.intergient.com/prebid/ 746 KB
222 KB 65ms
64ms Script
text/javascript 104.18.20.56
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/prebid/prebid.05eaa3284c60ad6e334d.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8f9757938ed08b400ae866b022739d2ea1f4db4369e324174661f11bd7ae6ad6

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

hw-country-code: AU
cache-control: public, max-age=31536000, immutable
content-encoding: br
cf-cache-status: HIT
etag: W/"2539bceaf323aef3b5bbf813e3bcbe07"
age: 337283
cf-ray: 9ef5a9726e40c742-PER
date: Mon, 20 Apr 2026 16:52:52 GMT
content-type: text/javascript
vary: Accept-Encoding
server: cloudflare
last-modified: Thu, 16 Apr 2026 19:07:06 GMT

GET
H3 200 rP2Yp2ywxg089UriI5-g4vlH9VoD8Cmcqbu0-K4.woff2
fonts.gstatic.com/s/dmsans/v17/ 36 KB
36 KB 286ms
96ms Font
font/woff2 172.217.25.163
Google LLC

General

Check archive.org

Download Go to

Full URL

https://fonts.gstatic.com/s/dmsans/v17/rP2Yp2ywxg089UriI5-g4vlH9VoD8Cmcqbu0-K4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=DM+Sans:wght@300;400;500&family=DM+Serif+Display&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.25.163 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

syd09s13-in-f3.1e100.net

Software

sffe /

Resource Hash

9fea608a947e67020c33cad9a6fe3d60c54119dfb8cff87768a8117a15ed7543

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://paint.toys
sec-ch-ua-platform: "Linux"
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

age: 110801
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Mon, 19 Apr 2027 10:06:11 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 19 Apr 2026 10:06:11 GMT
last-modified: Wed, 10 Sep 2025 16:31:03 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 36932
x-xss-protection: 0
server: sffe

GET
H2 200 pageos.js Show response
cdn.intergient.com/pageos/V.20260416.1/ 411 B
603 B 159ms
159ms Script
text/javascript 104.18.20.56
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20260416.1/pageos.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/ramp_core.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 81a02b09b84ff07fe4dc4af420e09e59605528129ceee6d57b5a2eb0ff5c1a78

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

hw-country-code: AU
cache-control: public, max-age=31536000
content-encoding: br
cf-cache-status: HIT
etag: W/"6ad444ea00e062d21df63efbe06abedc"
age: 337283
cf-ray: 9ef5a972dea6c742-PER
expires: Tue, 20 Apr 2027 16:52:52 GMT
date: Mon, 20 Apr 2026 16:52:52 GMT
content-type: text/javascript
last-modified: Thu, 16 Apr 2026 18:59:25 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 runtime.a0196c83a5d19546c235.js Show response
cdn.intergient.com/pageos/V.20260416.1/ 4 KB
2 KB 53ms
52ms Script
text/javascript 104.18.20.56
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20260416.1/runtime.a0196c83a5d19546c235.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260416.1/pageos.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9187243bcd5d0006d7c162ab15d81c249ddac717e7eed5ff0e00deda9cfaba73

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

hw-country-code: AU
cache-control: public, max-age=31536000
content-encoding: br
cf-cache-status: HIT
etag: W/"95db28b8690f9386bc513bbb835c616a"
age: 337283
cf-ray: 9ef5a973df75c742-PER
expires: Tue, 20 Apr 2027 16:52:52 GMT
date: Mon, 20 Apr 2026 16:52:52 GMT
content-type: text/javascript
last-modified: Thu, 16 Apr 2026 18:59:26 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 main.121b53b8564b55f13382.js Show response
cdn.intergient.com/pageos/V.20260416.1/ 557 KB
172 KB 66ms
66ms Script
text/javascript 104.18.20.56
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20260416.1/main.121b53b8564b55f13382.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260416.1/pageos.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8900c9eb96093b7d72e8a09407ec3dcbfb4cdb6c99cc683bc2f35a2dc6fb9048

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

hw-country-code: AU
cache-control: public, max-age=31536000
content-encoding: br
cf-cache-status: HIT
etag: W/"82e74acc6040b697ec3a648ac2d78822"
age: 337283
cf-ray: 9ef5a973df79c742-PER
expires: Tue, 20 Apr 2027 16:52:52 GMT
date: Mon, 20 Apr 2026 16:52:52 GMT
content-type: text/javascript
last-modified: Thu, 16 Apr 2026 18:59:23 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 videoCard.cea8a6bd8cad3ad73428.js Show response
cdn.intergient.com/pageos/V.20260416.1/ 552 B
680 B 53ms
53ms Script
text/javascript 104.18.20.56
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20260416.1/videoCard.cea8a6bd8cad3ad73428.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260416.1/runtime.a0196c83a5d19546c235.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0a0a95fd080f68f2d8c0a916f30cdb5cde422c6908dd64bd98043ef5c160f0f1

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

hw-country-code: AU
cache-control: public, max-age=31536000
content-encoding: br
cf-cache-status: HIT
etag: W/"b923f9cae7c940f9f384e93b5120abff"
age: 337277
cf-ray: 9ef5a9753898c742-PER
expires: Tue, 20 Apr 2027 16:52:52 GMT
date: Mon, 20 Apr 2026 16:52:52 GMT
content-type: text/javascript
last-modified: Thu, 16 Apr 2026 18:59:33 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 iframe.html Show response
cdn.intergient.com/pageos/V.20260416.1/iframe/ Frame 7005 1 KB
1 KB 286ms
93ms Document
text/html 104.18.20.56
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20260416.1/iframe/iframe.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260416.1/main.121b53b8564b55f13382.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 14aad8d98a16bebead3dcb9a36928542a368a5cfd57dd8f4e52720ec13354628

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

age: 337282
cache-control: public, max-age=31536000
cf-cache-status: HIT
cf-ray: 9ef5a9766be42d56-PER
content-encoding: br
content-type: text/html
date: Mon, 20 Apr 2026 16:52:52 GMT
expires: Tue, 20 Apr 2027 16:52:52 GMT
hw-country-code: AU
last-modified: Thu, 16 Apr 2026 18:59:21 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 iframe.html Show response
cdn.intergient.com/pageos/V.20260416.1/iframe/ Frame AA19 1 KB
0 283ms
283ms Document
text/html 104.18.20.56
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20260416.1/iframe/iframe.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260416.1/main.121b53b8564b55f13382.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 14aad8d98a16bebead3dcb9a36928542a368a5cfd57dd8f4e52720ec13354628

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

age: 337282
cache-control: public, max-age=31536000
cf-cache-status: HIT
cf-ray: 9ef5a9766be42d56-PER
content-encoding: br
content-type: text/html
date: Mon, 20 Apr 2026 16:52:52 GMT
expires: Tue, 20 Apr 2027 16:52:52 GMT
hw-country-code: AU
last-modified: Thu, 16 Apr 2026 18:59:21 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 tag Show response
btloader.com/ 183 KB
50 KB 202ms
58ms Script
application/javascript 104.20.20.189
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260416.1/main.121b53b8564b55f13382.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.20.189 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 020cd3380efb41475f3fcbe97fc4b33eb19e0cc0affbac406b7c5a41b47033d7

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-robots-tag: noindex, nofollow
cache-control: public, max-age=300, stale-if-error=3600, stale-while-revalidate=300
content-encoding: br
cf-cache-status: HIT
etag: W/"66512984c443f4a72a560afd89f03925"
via: 1.1 google
cf-ray: 9ef5a9763e3c8661-PER
access-control-allow-origin: *
date: Mon, 20 Apr 2026 16:52:52 GMT
content-type: application/javascript
last-modified: Mon, 20 Apr 2026 16:04:26 GMT
server: cloudflare
vary: Accept-Encoding, X-Acceptable-Ads, DNT

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 356 KB
91 KB 388ms
154ms Script
application/javascript 108.158.21.92
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260416.1/main.121b53b8564b55f13382.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.158.21.92 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-108-158-21-92.syd62.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 153ca442b7e7d55008acd6fee39a8ed7fad0e0e45b77ecb039153849eb3cc167

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

vary: Accept-Encoding
cache-control: max-age=3600
content-encoding: gzip
etag: W/"2d578afb62c7b1f9d1f6df2c705b0e42"
age: 3133
via: 1.1 8772cc868ba7a4ffdd26d8e57abd6a36.cloudfront.net (CloudFront), 1.1 1b68da67ecd8210b43b9ded7550536ca.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: ick0QvfcZ702lF3HaRQCMQY0EQ8DHbp3J8-1MdVaDH4HwaGM0nX9oQ==
date: Mon, 20 Apr 2026 16:00:40 GMT
content-type: application/javascript
x-amz-cf-pop: SYD3-P3, SYD62-P3
server: AmazonS3
last-modified: Thu, 16 Apr 2026 19:50:13 GMT
x-amz-server-side-encryption: AES256

GET
H2 200 1x1.gif
raw.githubusercontent.com/easylist/easylist/master/docs/ 43 B
587 B 235ms
93ms Image
image/gif 185.199.111.133
Fastly

General

Check archive.org

Download Go to Show image

Full URL

https://raw.githubusercontent.com/easylist/easylist/master/docs/1x1.gif

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.199.111.133 , United States, ASN54113 (FASTLY - Fastly, Inc., US),

Reverse DNS

Software

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; style-src 'unsafe-inline'; sandbox
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-fastly-request-id: f0690b3d7545a98280a0d396851c93526e502bbe
etag: W/"0c4a5773f7e435c57c40bd270aef756513eba26bd7ba5317b5bd765569a7325d"
x-content-type-options: nosniff
x-github-request-id: 2D72:2DA42:383DF3:A77765:69DD5AEA
expires: Mon, 20 Apr 2026 16:57:52 GMT
x-cache: HIT
date: Mon, 20 Apr 2026 16:52:52 GMT
content-type: image/gif
x-served-by: cache-per-ypph1920030-PER
x-cache-hits: 70959
source-age: 25
x-frame-options: deny
strict-transport-security: max-age=31536000
vary: Authorization,Accept-Encoding
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
cache-control: max-age=300
x-timer: S1776703973.830166,VS0,VE0
cross-origin-resource-policy: cross-origin
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
content-length: 43
x-xss-protection: 1; mode=block

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/17138/ 44 KB
13 KB 418ms
185ms Script
text/javascript 108.158.20.59
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/17138/sync.min.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260416.1/main.121b53b8564b55f13382.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.158.20.59 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-108-158-20-59.syd62.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 968cc0d9ec78ed8bf2eeab381275b4e04194deb7b1367c24a9b933382e9671ba

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

vary: Accept-Encoding
cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"ae88fc79005fcfbecf3ec3967da1b80f"
age: 29742
via: 1.1 48e2dac80dc53d66fef4721e63ea9f44.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: prf2PTWh7p7hihWhRQPl0QbH07v9vd7lbO666fIHTKzRiexS-SX6IQ==
date: Mon, 20 Apr 2026 08:37:11 GMT
content-type: text/javascript
last-modified: Tue, 10 Feb 2026 20:26:15 GMT
server: AmazonS3
x-amz-cf-pop: SYD62-P3
x-amz-server-side-encryption: AES256

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202604090101/ 593 KB
186 KB 98ms
98ms Script
text/javascript 142.250.195.226
Google LLC

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202604090101/pubads_impl.js?cb=31097905

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.195.226 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

e1ed9d82948dd67d2638e6f05d19a768d46f1aa939445508129619aae89a855a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
etag: 14353294419774252755
age: 40789
x-content-type-options: nosniff
expires: Tue, 20 Apr 2027 05:33:03 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Mon, 20 Apr 2026 05:33:03 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 190353
x-xss-protection: 0
server: cafe

GET
H3 200 gpt
securepubads.g.doubleclick.net/pagead/managed/dict/m202604160101/ 64 KB
23 KB 192ms
191ms Other
text/plain 142.250.195.226
Google LLC

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/dict/m202604160101/gpt

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.195.226 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

pnsyda-ae-in-f8.1e100.net

Software

cafe /

Resource Hash

00cd519defdbc1ddeba378c2b76b4b626bce37f66fbf6ffce2f088a08efa21c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
etag: 6066547729234053981
age: 4832
x-content-type-options: nosniff
expires: Mon, 27 Apr 2026 15:32:20 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Mon, 20 Apr 2026 15:32:20 GMT
content-type: text/plain; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=604800, stale-while-revalidate=7200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 23344
x-xss-protection: 0
server: cafe
use-as-dictionary: match="/gampad/ads", id="m202604160101"

GET
H2 200 dt
dt.adsafeprotected.com/ 43 B
178 B 1255ms
624ms Image
image/gif 54.159.183.109
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?adspot_id=uizqxn_728x90_
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.159.183.109 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-54-159-183-109.compute-1.amazonaws.com
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-cache
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-length: 43
date: Mon, 20 Apr 2026 16:52:53 GMT
pragma: no-cache
content-type: image/gif

GET
H2 200 iframe.js Show response
cdn.intergient.com/pageos/V.20260416.1/iframe/ Frame 7005 17 KB
7 KB 55ms
55ms Script
text/javascript 104.18.20.56
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20260416.1/iframe/iframe.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260416.1/iframe/iframe.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: a1e9592b119e182885673d049ec2ead66dab57473f2f6da59f43d888cea5ac1e

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://cdn.intergient.com/pageos/V.20260416.1/iframe/iframe.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

hw-country-code: AU
cache-control: public, max-age=31536000
content-encoding: br
cf-cache-status: HIT
etag: W/"3eecc5d11812ac69fb4f2c63c5dea237"
age: 337282
cf-ray: 9ef5a9775c4b2d56-PER
expires: Tue, 20 Apr 2027 16:52:53 GMT
date: Mon, 20 Apr 2026 16:52:53 GMT
content-type: text/javascript
last-modified: Thu, 16 Apr 2026 18:59:22 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 iframe.js Show response
cdn.intergient.com/pageos/V.20260416.1/iframe/ Frame AA19 17 KB
0 39ms
39ms Script
text/javascript 104.18.20.56
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20260416.1/iframe/iframe.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260416.1/iframe/iframe.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: a1e9592b119e182885673d049ec2ead66dab57473f2f6da59f43d888cea5ac1e

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://cdn.intergient.com/pageos/V.20260416.1/iframe/iframe.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

hw-country-code: AU
cache-control: public, max-age=31536000
content-encoding: br
cf-cache-status: HIT
etag: W/"3eecc5d11812ac69fb4f2c63c5dea237"
age: 337282
cf-ray: 9ef5a9775c4b2d56-PER
expires: Tue, 20 Apr 2027 16:52:53 GMT
date: Mon, 20 Apr 2026 16:52:53 GMT
content-type: text/javascript
last-modified: Thu, 16 Apr 2026 18:59:22 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 400 KB
142 KB 227ms
226ms Script
application/javascript 142.251.222.8
Google LLC

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-CEFZJ359V8&cx=c&gtm=4e64g0

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.222.8 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d6b082cd8ccbff237a6118d6b865539528b4c30c4738953eb24c4205d1246b38

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
content-encoding: zstd
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Mon, 20 Apr 2026 16:52:53 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 144881
date: Mon, 20 Apr 2026 16:52:53 GMT
x-xss-protection: 0
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Google Tag Manager
access-control-allow-headers: Cache-Control

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 571ms
241ms Fetch
text/plain 172.217.25.206
Google LLC

General

Check archive.org

Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-VJBRK9986D&gtm=45je64g0v9101576445za200zd9101576445&_p=1776703971482&gcd=13l3l3l3l1l1&npa=0&dma=0&are=1&cid=633749692.1776703973&frm=0&pscdl=noapi&rcb=19&sr=1600x1200&uaa=x86&uab=64&uafvl=Chromium%3B147.0.0.0%7CGoogle%2520Chrome%3B147.0.0.0%7CNot-A.Brand%3B24.0.0.0&uam=&uamb=0&uap=Linux&uapv=&uaw=0&ul=en-au&_s=1&tag_exp=0~115938466~115938469~117266400~118463261&sid=1776703973&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Fdfef.comlink-it.com.au%2F&dt=Paint%20with%20Oils&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=2567
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.217.25.206 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: nrt12s13-in-f14.1e100.net
Software: Golfe2 /
Resource Hash

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:138:0
report-to: {"group":"ascnsrsggc:138:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:138:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:138:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 20 Apr 2026 16:52:53 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 cchecker.html Show response
cdn.btloader.com/ Frame 3691 366 B
707 B 236ms
93ms Document
text/html 104.20.20.189
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.btloader.com/cchecker.html?upapi=true
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.20.189 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: c700c58e763a5ae34f446713819957ed9755025d35b8497ec1150f428f5ff227

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

access-control-allow-origin: *
access-control-expose-headers: *
age: 6475
cache-control: public, max-age=86400, immutable
cf-cache-status: HIT
cf-ray: 9ef5a978c8e88e94-PER
content-encoding: br
content-type: text/html
date: Mon, 20 Apr 2026 16:52:53 GMT
expires: Tue, 21 Apr 2026 15:04:57 GMT
last-modified: Thu, 16 Apr 2026 14:02:40 GMT
server: cloudflare
x-goog-generation: 1776348160499015
x-goog-hash: crc32c=/3eT+A== md5=WtMW8Jy4XJceDGzQqhOktA==
x-goog-metageneration: 1
x-goog-storage-class: MULTI_REGIONAL
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 366
x-guploader-uploadid: AMNfjG1x5tEKoIdjJA31XvgVHmFJGGzj2pn5ZYsi5AR6wfKQbVgUE46LVDjp3jMoS7NxiRgJ

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
550 B 236ms
93ms Fetch
image/gif 172.66.148.140
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=2&e=0.5342354187835219
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.66.148.140 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 926301
x-goog-stored-content-encoding: identity
expires: Thu, 09 Apr 2026 23:47:53 GMT
x-goog-stored-content-length: 43
date: Mon, 20 Apr 2026 16:52:53 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH8-8d6tsHANUa2r84JrwjQITmm63V7aSPrfwA9n_jkotwDDYByg5ASpAwhKW45wurAfWr-QyLYc
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9ef5a978cf91cf9d-PER
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico Show response
ad.doubleclick.net/ 1 KB
129 B 383ms
192ms Fetch
image/x-icon 142.250.195.230
Google LLC

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.2414284545082387

Requested by

Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.195.230 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

maa03s43-in-f10.1e100.net

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Tue, 21 Apr 2026 16:52:53 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 20 Apr 2026 16:52:53 GMT
content-type: image/x-icon
vary: Accept-Encoding
last-modified: Tue, 08 May 2012 13:08:06 GMT
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
109 B 235ms
93ms Fetch
image/gif 172.66.148.140
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.3978612193906502
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.66.148.140 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 926301
x-goog-stored-content-encoding: identity
expires: Thu, 09 Apr 2026 23:47:53 GMT
x-goog-stored-content-length: 43
date: Mon, 20 Apr 2026 16:52:53 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH8-8d6tsHANUa2r84JrwjQITmm63V7aSPrfwA9n_jkotwDDYByg5ASpAwhKW45wurAfWr-QyLYc
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9ef5a978cf92cf9d-PER
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H2 200 dns Show response
ab.dns-finder.com/meta/ 2 B
233 B 534ms
319ms Fetch
text/plain 34.36.200.111
Google LLC

General

Check archive.org

Download Go to

Full URL: https://ab.dns-finder.com/meta/dns
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.36.200.111 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS: 111.200.36.34.bc.googleusercontent.com
Software: /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: private, max-age=180, stale-if-error=180, stale-while-revalidate=180
access-control-expose-headers: X-Resolver
x-resolver: default
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
date: Mon, 20 Apr 2026 16:52:53 GMT
content-type: text/plain; charset=utf-8
vary: Origin

GET
H2 200 trustedIframe.html Show response
btloader.com/ Frame C8CC 6 KB
2 KB 196ms
55ms Document
text/html 104.20.20.189
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://btloader.com/trustedIframe.html?o=5150306120761344&upapi=true
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.20.189 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: b11d97e368d4bf84852324f6c6592e41315107a11f6025dc63aa630e77cf6e4b

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

cache-control: public, max-age=3600, stale-while-revalidate=3600
cf-ray: 9ef5a978cf9aafce-PER
content-encoding: br
content-type: text/html
date: Mon, 20 Apr 2026 16:52:53 GMT
server: cloudflare

GET
H2 200 device Show response
cdn.api.btloader.com/ 87 B
320 B 240ms
94ms Fetch
application/json 104.20.20.189
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.api.btloader.com/device?orgid=5150306120761344&fullVersionList=%5B%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22147.0.0.0%22%7D%2C%7B%22brand%22%3A%22Google+Chrome%22%2C%22version%22%3A%22147.0.0.0%22%7D%2C%7B%22brand%22%3A%22Not-A.Brand%22%2C%22version%22%3A%2224.0.0.0%22%7D%5D
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.20.189 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0d1140c720545957f3b2e4fbcda5ec195003863f2b1824166481589f5ab46fe1

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: public, max-age=7200
content-encoding: br
cf-cache-status: HIT
age: 22
x-ratelimit-reset: 1776703951
via: 1.1 google
cf-ray: 9ef5a978e895863d-PER
x-ratelimit-remaining: 93
access-control-allow-origin: *
date: Mon, 20 Apr 2026 16:52:53 GMT
x-ratelimit-limit: 100
content-type: application/json
last-modified: Mon, 20 Apr 2026 16:52:30 GMT
server: cloudflare
vary: Origin

GET main.js
cdn.intergient.com/cdn-cgi/challenge-platform/scripts/jsd/ Frame C139 0
0

GET
H2

200

main.js Show response
cdn.intergient.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/0b8fb825cb67/ Frame 7210
Redirect Chain

https://cdn.intergient.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
https://cdn.intergient.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/0b8fb825cb67/main.js?

25 KB
12 KB

51ms
51ms

Script
application/javascript

104.18.20.56
Cloudflare

General

Check archive.org

Download Go to

Full URL

https://cdn.intergient.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/0b8fb825cb67/main.js?

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

c7cfa79ef12d3c813509fe598df1dc34be9d07c95b8d2caf408f0dc2195407ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer

Response headers

cf-ray: 9ef5a978ecce2d56-PER
cache-control: max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public
content-encoding: gzip
date: Mon, 20 Apr 2026 16:52:53 GMT
content-type: application/javascript; charset=UTF-8
server: cloudflare
x-content-type-options: nosniff

Redirect headers

cf-ray: 9ef5a9780c902d56-PER
cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public
location: /cdn-cgi/challenge-platform/h/b/scripts/jsd/0b8fb825cb67/main.js?
content-length: 0
access-control-allow-origin: *
date: Mon, 20 Apr 2026 16:52:53 GMT
server: cloudflare

GET 020386c3-92f3-4544-a10d-2e8fe0e6e87d
https://paint.toys/ 0
0

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 642ms
317ms Preflight
application/json 182.161.73.131
CRITEO-AS-AP Crit...

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&cw=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.131 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://paint.toys
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Mon, 20 Apr 2026 16:52:53 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 220293
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 config.json Show response
config.playwire.com/audience_segments/ 332 KB
58 KB 118ms
67ms XHR
application/json 104.18.10.207
Cloudflare

General

Check archive.org

Download Go to

Full URL

https://config.playwire.com/audience_segments/config.json

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260416.1/main.121b53b8564b55f13382.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.10.207 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

b9e0d49beac36d0c7e1c7b228cdea11ea73fd2abd3588d92ae44250e872fefe3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

access-control-max-age: 7200
access-control-expose-headers: hw-country-code
content-encoding: gzip
cf-cache-status: HIT
age: 68872
access-control-allow-methods: GET
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Mon, 20 Apr 2026 16:52:53 GMT
last-modified: Sun, 19 Apr 2026 21:45:00 GMT
content-type: application/json
vary: Origin
priority: u=1,i
strict-transport-security: max-age=31536000; includeSubDomains
hw-country-code: AU
cache-control: public, max-age=86400
cf-ray: 9ef5a9786f2ccf9d-PER
access-control-allow-origin: *
server: cloudflare

GET
H2 200 474.54ec3c969d5dcf548468.js Show response
cdn.intergient.com/pageos/V.20260416.1/ 3 KB
1 KB 53ms
52ms Script
text/javascript 104.18.20.56
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20260416.1/474.54ec3c969d5dcf548468.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260416.1/runtime.a0196c83a5d19546c235.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 70fdcbbe7129a79cab3b0839348a16e359bda7056b157c52ec8d2cb89d40fa3e

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

hw-country-code: AU
cache-control: public, max-age=31536000
content-encoding: br
cf-cache-status: HIT
etag: W/"a4ba8a8e24e7796c977c7ad0213bf24d"
age: 337282
cf-ray: 9ef5a9781b83c742-PER
expires: Tue, 20 Apr 2027 16:52:53 GMT
date: Mon, 20 Apr 2026 16:52:53 GMT
content-type: text/javascript
last-modified: Thu, 16 Apr 2026 18:59:13 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 script Show response
carbon-cdn.ccgateway.net/ 39 KB
10 KB 1125ms
539ms Script
text/javascript 3.237.175.195
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Requested by: Host: dfef.comlink-it.com.au
URL: https://dfef.comlink-it.com.au/8rv4antkas7digh9pi7glovg5mmewihwt27c8q9rn9df61npgny4ckbt6p8xbpx1lkuqjea9jqRN0gzalM4bmYzZGt2WlhpeURab2UtNjExOC0yNTc1NDQ1NC0wZmYxMDI3NS0xMDYyMy1XZE4zVUw0RnFwVDNQamFHR3Q4WA/hhz53m0jbbq/0G9CcQJr5IYfK8rMejRHSRr977HFQWnaFOCpa1hwpThl/520904034370726572938706541793457/t46PM6p8gsEqR6rndxp7CcKxC2BvcTW5TknZrojHWggx
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.237.175.195 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-3-237-175-195.compute-1.amazonaws.com
Software: /
Resource Hash: e6deb661c5f1af794c87a9726e0947d3460b6d1fde443dc60bde707753b2dd3d

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: private,max-age=900
content-encoding: gzip
date: Mon, 20 Apr 2026 16:52:54 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 ima3.js Show response
imasdk.googleapis.com/js/sdkloader/ 466 KB
147 KB 593ms
263ms Script
text/javascript 142.250.195.234
Google LLC

General

Check archive.org

Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/ima3.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260416.1/main.121b53b8564b55f13382.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

142.250.195.234 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

efc8defcc04c4cbcbebd66cbfd10f38292b5a9f0eb4dfe9f6064d6a2a5cd26b7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
etag: 14601415150532403508
x-content-type-options: nosniff
expires: Mon, 20 Apr 2026 16:52:53 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Mon, 20 Apr 2026 16:52:53 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 149510
x-xss-protection: 0
server: cafe

GET
H2 200 pf Show response
cdn.intergient.com/ 1 KB
1 KB 239ms
95ms Script
application/javascript 104.18.20.56
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pf?country=AU&browser=Chrome&device=desktop&website_id=74068
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260416.1/main.121b53b8564b55f13382.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1e5a52ef6baeac10a37b6ed4af061466be68f6cef8b417728f64230451e9c1de

Request headers

Origin: https://paint.toys
sec-ch-ua-platform: "Linux"
Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cf-ray: 9ef5a9790b838643-PER
hw-country-code: AU
access-control-allow-origin: *
content-encoding: br
date: Mon, 20 Apr 2026 16:52:53 GMT
content-type: application/javascript
server: cloudflare

POST
H2 200 prebid Show response
id5-sync.com/api/config/ 194 B
639 B 1554ms
729ms Fetch
application/json 135.125.170.108
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.05eaa3284c60ad6e334d.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

135.125.170.108 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ec2-52-221-85-145.ap-southeast-1.compute.amazonaws.com

Software

Resource Hash

1526f7f540b829baf0e6d1b491aa7b26b5e49fa160abca67c11695ccfa2cee82

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
content-encoding: gzip
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Mon, 20 Apr 2026 16:52:53 GMT
content-type: application/json;charset=UTF-8
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding

GET
H2 200 id Show response
id.crwdcntrl.net/ 75 B
822 B 662ms
265ms Fetch
application/json 52.221.85.145
Amazon.com

General

Check archive.org

Download Go to

Full URL

https://id.crwdcntrl.net/id?c=17262

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.05eaa3284c60ad6e334d.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.221.85.145 Singapore, Singapore, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

Software

Resource Hash

11bf8b8c5dc49ae7eeec384d172413557c12bba443342df264de53fc2d139fa1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
content-type: text/plain
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains
cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 75
date: Mon, 20 Apr 2026 16:52:53 GMT
content-type: application/json;charset=utf-8

GET
H2 200 f Show response
fid.agkn.com/ 0
364 B 1038ms
515ms Fetch 34.217.228.237
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://fid.agkn.com/f?apiKey=2104320612&r=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.05eaa3284c60ad6e334d.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.217.228.237 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-34-217-228-237.us-west-2.compute.amazonaws.com
Software: AAWebServer /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
content-type: text/plain
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
expires: 0
access-control-allow-origin: https://paint.toys
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
date: Mon, 20 Apr 2026 16:52:53 GMT
vary: Origin
server: AAWebServer
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type

GET
H2 200 envelope Show response
lexicon.33across.com/v1/ 1 KB
2 KB 1315ms
677ms Fetch
application/json 79.127.255.1
CDN77 Datacamp Li...

General

Check archive.org

Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0014000001YrMoYAAV&gdpr=0&src=pbjs&ver=10.23.0&coppa=0
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.05eaa3284c60ad6e334d.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 79.127.255.1 San Jose, United States, ASN60068 (CDN77 Datacamp Limited, GB),
Reverse DNS: unn-79-127-255-1.datapacket.com
Software: /
Resource Hash: 66da89a3ba330996b4a3d69ff91431c70fd62aa8dc42fb1da4084ff77f854800

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
content-type: text/plain
sec-ch-ua-mobile: ?0

Response headers

access-control-allow-origin: https://paint.toys
content-length: 1444
content-type: application/json
vary: origin
access-control-allow-credentials: true

GET
H2 204 any Show response
idx.liadm.com/idex/did-0046/ 0
366 B 1257ms
626ms Fetch 52.44.224.167
Amazon.com

General

Check archive.org

Download Go to

Full URL

https://idx.liadm.com/idex/did-0046/any?duid=8e413bd09c43--01kpnwy9r9yjj46pfmg6dpg3g6&did=did-0046&cd=.paint.toys&pu=https%3A%2F%2Fpaint.toys&resolve=nonId&resolve=uid2&resolve=index&resolve=bidswitch&resolve=pubmatic&resolve=magnite&resolve=openx&resolve=sorvrn&resolve=thetradedesk&resolve=medianet&resolve=vidazoo&resolve=sonobi&resolve=sharethrough&resolve=triplelift

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.05eaa3284c60ad6e334d.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.44.224.167 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-52-44-224-167.compute-1.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
content-type: text/plain
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: max-age=3599, private
trace-id: 1c051ce4c080a7f6
request-time: 1
access-control-allow-credentials: true
expires: Mon, 20 Apr 2026 17:52:54 GMT
access-control-allow-origin: https://paint.toys
date: Mon, 20 Apr 2026 16:52:54 GMT
vary: Origin

GET
H2 200 json Show response
gum.criteo.com/sid/ 356 B
1 KB 557ms
233ms Fetch
application/json 182.161.73.131
CRITEO-AS-AP Crit...

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&cw=1&lsw=1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.05eaa3284c60ad6e334d.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.131 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

95be41cbb5efc401b1655d31f1d91242f17953d10fa460d573c874af6cc1190c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
content-type: application/json
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 414047
expires: 0
access-control-allow-origin: https://paint.toys
date: Mon, 20 Apr 2026 16:52:53 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

GET
H/1.1

200
OK

/ Show response
ps.eyeota.net/pixel/bounce/
Redirect Chain

https://ps.eyeota.net/pixel?pid=m51mh00&t=ajs&uid=user_d2c7e698-f790-4fd8-ac83-99f22f0931a3_1776703973103
https://ps.eyeota.net/pixel/bounce/?pid=m51mh00&t=ajs&uid=user_d2c7e698-f790-4fd8-ac83-99f22f0931a3_1776703973103

1 KB
1 KB

96ms
96ms

Script
application/javascript

13.237.11.119
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://ps.eyeota.net/pixel/bounce/?pid=m51mh00&t=ajs&uid=user_d2c7e698-f790-4fd8-ac83-99f22f0931a3_1776703973103
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 13.237.11.119 Sydney, Australia, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-13-237-11-119.ap-southeast-2.compute.amazonaws.com
Software: /
Resource Hash: 97819a9b582c8ccb66a1736a342d60b95a9e8d8a2dccdcdc597c8f7316a932dd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 1130
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Mon, 20 Apr 2026 16:52:53 GMT
Content-Type: application/javascript

Redirect headers

Location: /pixel/bounce/?pid=m51mh00&t=ajs&uid=user_d2c7e698-f790-4fd8-ac83-99f22f0931a3_1776703973103
Content-Length: 0
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Mon, 20 Apr 2026 16:52:53 GMT

GET
H2 200 154013155 Show response
fundingchoicesmessages.google.com/i/ 216 KB
70 KB 615ms
284ms Script
application/javascript 142.250.183.46
Google LLC

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/154013155?ers=3

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202604090101/pubads_impl.js?cb=31097905

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.183.46 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

ec2-52-221-85-145.ap-southeast-1.compute.amazonaws.com

Software

ESF /

Resource Hash

a61ed2564243f608c74e46be07608b259b1b3b0b343b99511152e42f89279892

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-ilN1iHqCzTSRkL4PP74DsQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 20 Apr 2026 16:52:53 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzj6mHU4pJiCNCQYjhx6zbTBSBuvXmOdToQlyw6z9oGxF1APAeIDRUusToD8Yf6y6w_gLhI4gprCxB_qrrBKlJ9gzWcy4ctHoi_FfuycZT4sp2Y4sd2C4ifAPE3IGZ568-mdjSAzQKIF04LZFsJxHdigtieAPGp1cFsl4BYiIfj6eaZ59kEFjzrPc-kpJGUXxifnJ9XUpSZVFqSX5SWnJZanFpUlloUb2RgZGZgYmipZ2AeX2AAAGyoTco"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-ilN1iHqCzTSRkL4PP74DsQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 115 B
490 B 606ms
261ms XHR
application/json 52.221.85.145
Amazon.com

General

Check archive.org

Download Go to

Full URL

https://bcp.crwdcntrl.net/6/map?xcid=17138

Requested by

Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/17138/sync.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.221.85.145 Singapore, Singapore, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

Software

Resource Hash

2f3fa00e8ae9e2e79c7e671103084fb7e4fac6c2e64c92d313ef814e37f51e00

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains
cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 115
date: Mon, 20 Apr 2026 16:52:53 GMT
content-type: application/json;charset=utf-8

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 414ms
181ms XHR
application/javascript 108.158.21.92
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.158.21.92 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-108-158-21-92.syd62.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

access-control-max-age: 3000
content-encoding: gzip
x-amz-version-id: r5.lR.LJ66XEXzxUUVo7iMemjL_F_GoE
etag: W/"a4d296427fc806b21335359e398c025c"
age: 59539
access-control-allow-methods: GET
x-cache: Hit from cloudfront
x-amz-cf-id: TQSLt7omyWSlKRO7bdYYqCERnTxcQZyjIAujmiQbR2ECKAdMwFD7hQ==
date: Mon, 20 Apr 2026 00:20:35 GMT
content-type: application/javascript
vary: Origin,Accept-Encoding
last-modified: Thu, 29 Feb 2024 02:13:08 GMT
cache-control: public, max-age=86400
via: 1.1 721ef19e45939954cd82c5c6b7f5854e.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: SYD62-P3
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 bd056b42-51db-43ce-9a8e-3b11319b5d1f Show response
config.aps.amazon-adsystem.com/configs/ 57 KB
4 KB 417ms
184ms Script
application/javascript 3.175.115.79
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://config.aps.amazon-adsystem.com/configs/bd056b42-51db-43ce-9a8e-3b11319b5d1f
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.175.115.79 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-3-175-115-79.syd3.r.cloudfront.net
Software: CloudFront /
Resource Hash: ce7f22d87b3e6252e9eb1e3993bc73e3b1429db675f542bda4acebc7111deffe

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: max-age=3600
content-encoding: gzip
age: 592
via: 1.1 b0e8fd9e92b83d8fa5aeaafff249a8e8.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
content-length: 3685
x-amz-cf-id: FHp5xIpLi_dqqI_6ZkpvvygHeBFuZXodIm3aH_8Sw6-yBr0WdZRknA==
date: Mon, 20 Apr 2026 16:43:01 GMT
content-type: application/javascript
x-amz-cf-pop: SYD3-P3
server: CloudFront

GET
H2 200 config Show response
c.amazon-adsystem.com/cdn/prod/ 3 KB
3 KB 142ms
141ms XHR
application/json 108.158.21.92
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fpaint.toys&pubid=bd056b42-51db-43ce-9a8e-3b11319b5d1f
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.158.21.92 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-108-158-21-92.syd62.r.cloudfront.net
Software: Server /
Resource Hash: d4146a9ffdccf871cc20ab37bd23ca6ebdcbcae9d6255d3d311a97cfd138a74f

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: max-age=21550, s-maxage=21600
age: 14479
access-control-allow-credentials: true
via: 1.1 1b68da67ecd8210b43b9ded7550536ca.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Hit from cloudfront
content-length: 3077
x-amz-cf-id: BLr7tdbEfBTM4PnKpRnZkZk6TVbpYvYS8L27-_Al1MQUYeOU5TB33A==
date: Mon, 20 Apr 2026 12:51:34 GMT
content-type: application/json;charset=UTF-8
x-amz-cf-pop: SYD62-P3
server: Server

POST
H2 204 exd
api.btloader.com/ 0
0 542ms
320ms Fetch 130.211.23.194
Google LLC

General

Check archive.org

Download Go to

Full URL: https://api.btloader.com/exd?tid=JMmEJyDAWj-61cF4vHB-9dabcf26cc&sid=Szai4MQzRB-WY8ZqGd2eY-9dabcf26cc&cv=2.1.187-1-g24d1c87&upapi=true
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.23.194 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS: 194.23.211.130.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

via: 1.1 google
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 20 Apr 2026 16:52:53 GMT
vary: Origin

POST
H2 200 9ef5a9766be42d56 Show response
cdn.intergient.com/cdn-cgi/challenge-platform/h/b/jsd/oneshot/0b8fb825cb67/0.7672171444697773:1776701617:6nBc3ZldettfidDW7yybnK51LPXeHhs7VJBribW7ZNA/ Frame 7210 0
798 B 198ms
193ms XHR
text/plain 104.18.20.56
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/cdn-cgi/challenge-platform/h/b/jsd/oneshot/0b8fb825cb67/0.7672171444697773:1776701617:6nBc3ZldettfidDW7yybnK51LPXeHhs7VJBribW7ZNA/9ef5a9766be42d56
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform: "Linux"
Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0

Response headers

cf-ray: 9ef5a979cd002d56-PER
timing-allow-origin: https://cdn.intergient.com
content-length: 0
cf-chl-out-s: 82d5Tu0V49QG32W4sgkLIQ==$sV2r9oKX2cM0xEuK+f2U5Q==
date: Mon, 20 Apr 2026 16:52:53 GMT
content-type: text/plain; charset=UTF-8
server: cloudflare

OPTIONS
H2 200 bid
aax.amazon-adsystem.com/e/dtb/ Frame 0
0 467ms
233ms Preflight 18.67.106.137
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://aax.amazon-adsystem.com/e/dtb/bid
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.67.106.137 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-18-67-106-137.syd62.r.cloudfront.net
Software: Server /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: origin,x-requested-with,access-control-request-headers,content-type,access-control-request-method,accept
access-control-allow-methods: POST
access-control-allow-origin: https://paint.toys
access-control-max-age: 1800
content-encoding: gzip
content-length: 0
date: Mon, 20 Apr 2026 16:52:53 GMT
server: Server
via: 1.1 902b6168cd46b8e2de576dabe4e7f0f8.cloudfront.net (CloudFront)
x-amz-cf-id: MEwrT-ob_EdCHdrqQnHIp85lTXUWgCfUFgaGiEXp3eSxHNTHR6gYbA==
x-amz-cf-pop: SYD62-P2
x-cache: Miss from cloudfront

POST
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 25 B
387 B 472ms
241ms Fetch
application/json 18.67.106.137
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://aax.amazon-adsystem.com/e/dtb/bid
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.67.106.137 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-18-67-106-137.syd62.r.cloudfront.net
Software: Server /
Resource Hash: 7dc78c5c119373b361b76d7e9c1b2759725163789661df908ee4cd8faf842676

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type: application/json
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
access-control-allow-credentials: true
via: 1.1 8008f773a176223da2278b5cb39f91fa.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Miss from cloudfront
content-length: 45
x-amz-cf-id: _D1D3N_J8tK5JzInUoM7Yq6cLaGuDQMqnFhZJC9PIs7Bo8JutnQiXA==
date: Mon, 20 Apr 2026 16:52:53 GMT
content-type: application/json;charset=UTF-8
vary: Origin
server: Server
x-amz-cf-pop: SYD62-P2

GET
H2 200 pubcid.min.js Show response
secure.cdn.fastclick.net/js/pubcid/latest/ 67 KB
22 KB 328ms
139ms Script
application/javascript 23.38.142.110
Akamai Technologies

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/pubcid/latest/pubcid.min.js
Requested by: Host: dfef.comlink-it.com.au
URL: https://dfef.comlink-it.com.au/8rv4antkas7digh9pi7glovg5mmewihwt27c8q9rn9df61npgny4ckbt6p8xbpx1lkuqjea9jqRN0gzalM4bmYzZGt2WlhpeURab2UtNjExOC0yNTc1NDQ1NC0wZmYxMDI3NS0xMDYyMy1XZE4zVUw0RnFwVDNQamFHR3Q4WA/hhz53m0jbbq/0G9CcQJr5IYfK8rMejRHSRr977HFQWnaFOCpa1hwpThl/520904034370726572938706541793457/t46PM6p8gsEqR6rndxp7CcKxC2BvcTW5TknZrojHWggx
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.38.142.110 Sydney, Australia, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-38-142-110.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 45bc6978e281a938d9485dcbf0859159b24e2f7c9b8b0fafc120b9606e0ea8b1

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "10ab4-63a0ee37f7c40-gzip"
expires: Mon, 20 Apr 2026 17:07:53 GMT
accept-ranges: bytes
content-length: 21994
date: Mon, 20 Apr 2026 16:52:53 GMT
last-modified: Wed, 16 Jul 2025 17:04:41 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16576/ 44 KB
13 KB 141ms
140ms Script
text/javascript 108.158.20.59
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Requested by: Host: dfef.comlink-it.com.au
URL: https://dfef.comlink-it.com.au/8rv4antkas7digh9pi7glovg5mmewihwt27c8q9rn9df61npgny4ckbt6p8xbpx1lkuqjea9jqRN0gzalM4bmYzZGt2WlhpeURab2UtNjExOC0yNTc1NDQ1NC0wZmYxMDI3NS0xMDYyMy1XZE4zVUw0RnFwVDNQamFHR3Q4WA/hhz53m0jbbq/0G9CcQJr5IYfK8rMejRHSRr977HFQWnaFOCpa1hwpThl/520904034370726572938706541793457/t46PM6p8gsEqR6rndxp7CcKxC2BvcTW5TknZrojHWggx
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.158.20.59 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-108-158-20-59.syd62.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 517f9d49f64b0c45a9869756479cbb64844f2228819833a8191d0c474c9179c4

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

vary: Accept-Encoding
cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"23aff465a95f15b3a346b4a378b016f0"
age: 73730
via: 1.1 48e2dac80dc53d66fef4721e63ea9f44.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: RrAxdz44HibLLG_AkYjPbQf_-XV42ySf0SISTirvQTuqqwvDRD0UlA==
date: Sun, 19 Apr 2026 21:04:06 GMT
content-type: text/javascript
last-modified: Tue, 10 Feb 2026 20:18:38 GMT
server: AmazonS3
x-amz-cf-pop: SYD62-P3
x-amz-server-side-encryption: AES256

GET
H2 200 hadron.js Show response
cdn.hadronid.net/ 11 B
186 B 192ms
94ms Script
text/plain 104.20.22.97
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fdfef.comlink-it.com.au%2F&_it=amazon&partner_id=403
Requested by: Host: dfef.comlink-it.com.au
URL: https://dfef.comlink-it.com.au/8rv4antkas7digh9pi7glovg5mmewihwt27c8q9rn9df61npgny4ckbt6p8xbpx1lkuqjea9jqRN0gzalM4bmYzZGt2WlhpeURab2UtNjExOC0yNTc1NDQ1NC0wZmYxMDI3NS0xMDYyMy1XZE4zVUw0RnFwVDNQamFHR3Q4WA/hhz53m0jbbq/0G9CcQJr5IYfK8rMejRHSRr977HFQWnaFOCpa1hwpThl/520904034370726572938706541793457/t46PM6p8gsEqR6rndxp7CcKxC2BvcTW5TknZrojHWggx
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.22.97 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: a73f5986eb985871284e6e216372de3505634a97229de643216728d0fbfd6227

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: max-age=432000
cf-cache-status: HIT
etag: "6943ef12-b"
age: 6017
cf-ray: 9ef5a97abd9e04b2-PER
accept-ranges: bytes
content-length: 11
date: Mon, 20 Apr 2026 16:52:53 GMT
content-type: text/plain
last-modified: Thu, 18 Dec 2025 12:09:54 GMT
server: cloudflare

GET
H2 200 id5-api.js Show response
cdn.id5-sync.com/api/1.0/ 117 KB
34 KB 199ms
56ms Script
text/javascript 104.20.23.13
Cloudflare

General

Check archive.org

Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/id5-api.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.23.13 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

18120a6bee05cd823d5f4ab0c52006863a059a5d6c535c790a31bdd2ee8c45e7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-amz-id-2: xdsfqf8HBCEO8im1ORnYXTSaZuVJ/3rGVxWIA8h08q22sbhIlW6Bd/Q6vzpqMmhptAXXLfHepiVdZnuZVNcEKEoyqLB2gc8mamudQfMGMDg=
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: public, max-age=3600
content-encoding: br
cf-cache-status: HIT
etag: W/"78d670c3a2facd95b81a836b6857d830"
age: 2534
x-amz-request-id: VYK0YBPB0BTSPTD1
cf-ray: 9ef5a97b085595b0-PER
date: Mon, 20 Apr 2026 16:52:53 GMT
content-type: text/javascript;charset=utf-8
last-modified: Wed, 18 Mar 2026 12:22:23 GMT
server: cloudflare
x-amz-server-side-encryption: AES256

POST
H2 200 fb87a4ea41 Show response
cd836371f1d.cdn.intergient.com/ 0
96 B 947ms
427ms XHR
application/octet-stream 35.162.56.239
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://cd836371f1d.cdn.intergient.com/fb87a4ea41
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260416.1/main.121b53b8564b55f13382.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.162.56.239 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-35-162-56-239.us-west-2.compute.amazonaws.com
Software: nginx/1.24.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0

Response headers

access-control-allow-origin: *
date: Mon, 20 Apr 2026 16:52:54 GMT
content-type: application/octet-stream
server: nginx/1.24.0

POST
H3 200 cookie_sync Show response
pbs.intergient.com/ 2 KB
1 KB 348ms
295ms Fetch
application/json 104.18.20.56
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://pbs.intergient.com/cookie_sync
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.05eaa3284c60ad6e334d.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 180ea044cf2b81bfba7bbe60e355d9675000a2b14743bd4d020cc735df69c921

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
content-type: text/plain
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
access-control-allow-credentials: true
x-proxy-host: prebid.intergient.com
cf-ray: 9ef5a97abac16e81-PER
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Mon, 20 Apr 2026 16:52:53 GMT
content-type: application/json
server: cloudflare
priority: u=1,i

POST
H3 200 auction Show response
pbs.intergient.com/openrtb2/ 229 KB
103 KB 654ms
604ms Fetch
application/json 104.18.20.56
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://pbs.intergient.com/openrtb2/auction
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.05eaa3284c60ad6e334d.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 447ed08728898a8deab4a66c5007fc478bb78c236e08d248aa27ce80bc5bce44

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
content-type: text/plain
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
access-control-allow-credentials: true
x-proxy-host: prebid.intergient.com
cf-ray: 9ef5a97abac26e81-PER
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Mon, 20 Apr 2026 16:52:54 GMT
content-type: application/json
server: cloudflare
priority: u=1,i

POST
H2 204 hb-multi Show response
hb.yellowblue.io/ 0
180 B 1045ms
475ms Fetch 35.219.182.198
Google LLC

General

Check archive.org

Download Go to

Full URL: https://hb.yellowblue.io/hb-multi
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.05eaa3284c60ad6e334d.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.219.182.198 Las Vegas, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 198.182.219.35.bc.googleusercontent.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
content-type: text/plain
sec-ch-ua-mobile: ?0

Response headers

via: 1.1 google
access-control-allow-origin: https://paint.toys
date: Mon, 20 Apr 2026 16:52:54 GMT
x-envoy-upstream-service-time: 0
server: istio-envoy
access-control-allow-credentials: true
x-envoy-decorator-operation: filtration-canary.default.svc.cluster.local:80/*

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 28 KB
11 KB 707ms
374ms Fetch
application/json 69.173.158.65
Magnite

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=9&alt_size_ids=8&p_pos=atf&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=3d0e0f23-75f1-452a-a371-9ea8d007d6a9%5E1%5E%5E%5E%5E%5E&eid_linkedin.com=e9949cb5-997a-4599-943d-ae4ac2793e3f%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fdfef.comlink-it.com.au%2F&tg_i.documentLang=en&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.mobile=0&tg_i.pos=atf&tg_i.sitecont_cat=games_casual&tg_i.adunit=pw-160x600_atf&tg_i.dfp_ad_unit_code=%2F154013155%2C21762409181%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600&tk_flint=pbjs_lite_v10.23.0&x_source.tid=u9e969e9b-a4c1-4707-a68a-41b3a722b816&l_pb_bid_id=3426d1e6-f4f1-4c78-90a4-726f24b88ad6&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=u86f0a2a6-2265-48ea-b976-7235f9effc48&p_site.mobile=0&p_gpid=%2F154013155%2C21762409181%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600&m_ch_ua=%22Chromium%22%7Cv%3D%22147%22%2C%22Google%20Chrome%22%7Cv%3D%22147%22%2C%22Not-A.Brand%22%7Cv%3D%2224%22&m_ch_mobile=%3F0&m_ch_platform=Linux&slots=1&rand=0.5061723263389027
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.05eaa3284c60ad6e334d.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.158.65 Ashburn, United States, ASN26667 (RUBICONPROJECT - Magnite, Inc., US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: c69243f9a45c408af4f2b7e5276586f2c3954de96045c947973b763698e101fd

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
content-type: text/plain
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
date: Mon, 20 Apr 2026 16:52:54 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

POST
H3 200 pbjs Show response
htlb.casalemedia.com/openrtb/ 17 KB
9 KB 342ms
288ms Fetch
application/json 104.18.27.193
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://htlb.casalemedia.com/openrtb/pbjs?s=1031634
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.05eaa3284c60ad6e334d.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.27.193 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7c7075b2d4baed3083a42ced73b0dabd0153e8cb961049083e708e4391f458d8

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
content-type: text/plain
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=Sy9LxvHNDuEfMQBqCYc2oqzHHGUq1%2FOMyTo%2BQ3gWSj4NVC%2FbDaIsV4EQChDFRF1JVx3zMgT4xudqQ5K63BuPdYFL3h3XbdGA%2BMLtxSZvgZBpIpafSUh6z5bTQOS3Z%2BZHuX2Q3YyA"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Mon, 20 Apr 2026 16:52:53 GMT
content-type: application/json
vary: Accept-Encoding
priority: u=1,i
cache-control: no-cache
nel: {"report_to":"cf-nel","success_fraction":0.01,"max_age":604800}
pragma: no-cache
access-control-allow-credentials: true
cf-ray: 9ef5a97add758670-PER
access-control-allow-origin: https://paint.toys
content-length: 8204
server: cloudflare

POST
H2 200 playwire Show response
direct.adsrvr.org/bid/bidder/ 0
243 B 720ms
314ms Fetch
application/json 3.33.241.113
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://direct.adsrvr.org/bid/bidder/playwire
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.05eaa3284c60ad6e334d.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.33.241.113 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ae69789f15ba8a942.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
content-type: text/plain
sec-ch-ua-mobile: ?0

Response headers

x-openrtb-version: 2.3
cache-control: private
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
content-length: 0
date: Mon, 20 Apr 2026 16:52:53 GMT
content-type: application/json
server: Kestrel
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept, x-integration-type

POST
H2 200 auction Show response
tlx.3lift.com/header/ 18 KB
9 KB 1087ms
685ms Fetch
application/json 54.151.166.244
Amazon.com

General

Check archive.org

Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=10.23.0&referrer=https%3A%2F%2Fpaint.toys%2Foil%2F&tmax=2500&fledge=true

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.05eaa3284c60ad6e334d.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.151.166.244 Singapore, Singapore, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-151-166-244.ap-southeast-1.compute.amazonaws.com

Software

Resource Hash

ab4565a9d3921d515b93233f49bd3ac24a50f0612dc69c9c55a40785ead74ad4

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
content-type: text/plain
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: zstd
pragma: no-cache
access-control-allow-credentials: true
expires: Thu, 15 Oct 1992 20:10:00 GMT
access-control-allow-origin: https://paint.toys
content-length: 8382
x-xss-protection: 0
content-type: application/json; charset=utf-8

POST
H2 200 prebidjs Show response
rtb.openx.net/openrtbb/ 17 KB
8 KB 703ms
484ms Fetch
text/plain 35.186.253.211
Google LLC

General

Check archive.org

Download Go to

Full URL: https://rtb.openx.net/openrtbb/prebidjs
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.05eaa3284c60ad6e334d.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.253.211 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: /
Resource Hash: 504c88338f07585b71c0809a9f55187a7b9c1d0b0cd2dd1be1d39d91468a5bbc

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
content-type: text/plain
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
x-forwarded-for: 103.108.231.228
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000
content-length: 8193
date: Mon, 20 Apr 2026 16:52:53 GMT
content-type: text/plain
vary: Origin,Accept-Encoding

POST
H2 204 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
275 B 1183ms
546ms Fetch 138.197.56.40
DigitalOcean

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.05eaa3284c60ad6e334d.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 138.197.56.40 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
content-type: text/plain
sec-ch-ua-mobile: ?0

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Mon, 20 Apr 2026 16:52:54 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 8 KB
3 KB 789ms
390ms Fetch
application/json 3.1.94.197
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=10.23.0&lt=1776703973507&to=-600&aun=pw-160x600_atf&gpid=%2F154013155%2C21762409181%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600&t=8ylgv2wd&pi=3&maxw=160&maxh=600&si=1111716&bf=160x600%2C120x600&ae=true&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=uf44e35de-325c-4425-a3ee-45bc5d0cc227&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%2210.23.0%22%7D&ogu=https%3A%2F%2Fpaint.toys%2Foil%2F&ns=6554&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F147.0.0.0%20Safari%2F537.36&sua=%7B%22source%22%3A1%2C%22platform%22%3A%7B%22brand%22%3A%22Linux%22%7D%2C%22browsers%22%3A%5B%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%5B%22147%22%5D%7D%2C%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%5B%22147%22%5D%7D%2C%7B%22brand%22%3A%22Not-A.Brand%22%2C%22version%22%3A%5B%2224%22%5D%7D%5D%2C%22mobile%22%3A0%7D&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.05eaa3284c60ad6e334d.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.1.94.197 Singapore, Singapore, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-3-1-94-197.ap-southeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 4fcf57d062a72d9146f67447391838123770f471534ddd61d6b43aa492ce161a

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
content-type: text/plain
sec-ch-ua-mobile: ?0

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
date: Mon, 20 Apr 2026 16:52:54 GMT
content-type: application/json;charset=UTF-8
server: nginx

POST
H2 200 v1 Show response
btlr.sharethrough.com/universal/ 404 B
610 B 805ms
401ms Fetch
application/json 54.169.114.26
Amazon.com

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.05eaa3284c60ad6e334d.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

54.169.114.26 Singapore, Singapore, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-169-114-26.ap-southeast-1.compute.amazonaws.com

Software

Resource Hash

56eff0b1a5a13134534153f910319aaedf4ad8065fcf2859a534446fd5e22541

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
content-type: text/plain
sec-ch-ua-mobile: ?0

Response headers

x-openrtb-version: 2.5
strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
content-encoding: gzip
content-length: 253
content-type: application/json; charset=utf-8
access-control-allow-credentials: true

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 165 B
1 KB 374ms
184ms Fetch
application/json 103.43.89.4
Xandr Inc.

General

Check archive.org

Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.05eaa3284c60ad6e334d.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

103.43.89.4 Singapore, Singapore, ASN29990 (ASN-APPNEXUS - Xandr Inc., US),

Reverse DNS

839.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net

Software

nginx/1.25.5 /

Resource Hash

1912474dbe6e8b10382cd9ad057047267d83a59907c462e0f10f87c1f18fcb4a

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
content-type: text/plain
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 103.108.231.228; 103.108.231.228; 839.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: https://paint.toys
server-timing: total;dur=11
content-length: 165
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Mon, 20 Apr 2026 16:52:53 GMT
x-xss-protection: 0
content-type: application/json; charset=utf-8
an-x-request-uuid: e1bfa600-ea97-4abe-b858-ab7cee041efd
server: nginx/1.25.5

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
110 B 51ms
50ms Fetch
image/gif 172.66.148.140
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.9554717037068793
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.66.148.140 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 926301
x-goog-stored-content-encoding: identity
expires: Thu, 09 Apr 2026 23:47:53 GMT
x-goog-stored-content-length: 43
date: Mon, 20 Apr 2026 16:52:53 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH8-8d6tsHANUa2r84JrwjQITmm63V7aSPrfwA9n_jkotwDDYByg5ASpAwhKW45wurAfWr-QyLYc
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9ef5a97a98cecf9d-PER
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
304 B 576ms
337ms Fetch 67.199.150.87
PubMatic

General

Check archive.org

Download Go to

Full URL

https://hbopenbid.pubmatic.com/translator?source=prebid-client&gzip=1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.05eaa3284c60ad6e334d.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

67.199.150.87 Singapore, Singapore, ASN62713 (AS-PUBMATIC - PubMatic, Inc., US),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400; includeSubDomains

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
content-type: text/plain
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=16070400; includeSubDomains
cache-control: no-cache, no-store, must-revalidate, no-store, no-cache, private
access-control-allow-credentials: true
observe-browsing-topics: ?1
pmfcgi-resp: TRUE
access-control-allow-origin: https://paint.toys
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Mon, 20 Apr 2026 16:52:54 GMT
server: nginx

POST
H2 204 request Show response
grid-bidder.criteo.com/openrtb_2_5/pbjs/auction/ 0
571 B 738ms
396ms Fetch 182.161.73.172
CRITEO-AS-AP Crit...

General

Check archive.org

Download Go to

Full URL

https://grid-bidder.criteo.com/openrtb_2_5/pbjs/auction/request?profileId=207&av=37&wv=10.23.0&cb=97368344678&lsavail=1&networkId=6163&gzip=1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.05eaa3284c60ad6e334d.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.172 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
content-type: text/plain
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000; preload;
x-criteo-endpoint-version: none
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
x-criteo-endpoint-action: OpenRtb25Endpoint
x-criteo-endpoint-controller: Bidding
access-control-allow-origin: https://paint.toys
date: Mon, 20 Apr 2026 16:52:53 GMT
vary: Origin
server: Kestrel

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 156 B
531 B 356ms
355ms XHR
application/json 52.221.85.145
Amazon.com

General

Check archive.org

Download Go to

Full URL

https://bcp.crwdcntrl.net/6/map?xcid=16576

Requested by

Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.221.85.145 Singapore, Singapore, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-52-221-85-145.ap-southeast-1.compute.amazonaws.com

Software

Resource Hash

158850151a797f7190998c1f08d882f9f196ba609fb39bbf03aff93956bfb485

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains
cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 156
date: Mon, 20 Apr 2026 16:52:53 GMT
content-type: application/json;charset=utf-8

GET j
rp.liadm.com/ 0
0

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 192ms
192ms Fetch
text/plain 172.217.25.206
Google LLC

General

Check archive.org

Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-CEFZJ359V8&gtm=45je64g0v9102396898za200zb9101576445zd9101576445&_p=1776703971482&gcd=13l3l3l3l1l1&npa=0&dma=0&are=1&cid=633749692.1776703973&frm=0&pscdl=noapi&rcb=4&sr=1600x1200&uaa=x86&uab=64&uafvl=Chromium%3B147.0.0.0%7CGoogle%2520Chrome%3B147.0.0.0%7CNot-A.Brand%3B24.0.0.0&uam=&uamb=0&uap=Linux&uapv=&uaw=0&ul=en-au&_s=1&tag_exp=0~115938466~115938468~117266401&sid=1776703973&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Fdfef.comlink-it.com.au%2F&dt=Paint%20with%20Oils&en=ramp_js&_fv=1&_ss=1&_ee=1&ep.pageview_id=1776703971482&tfd=3247
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-CEFZJ359V8&cx=c&gtm=4e64g0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.217.25.206 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: nrt12s13-in-f14.1e100.net
Software: Golfe2 /
Resource Hash

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:138:0
report-to: {"group":"ascnsrsggc:138:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:138:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:138:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 20 Apr 2026 16:52:53 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
116 B 51ms
51ms Fetch
image/gif 172.66.148.140
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=2&e=0.2755340023513154
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.66.148.140 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 926302
x-goog-stored-content-encoding: identity
expires: Thu, 09 Apr 2026 23:47:53 GMT
x-goog-stored-content-length: 43
date: Mon, 20 Apr 2026 16:52:53 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH8-8d6tsHANUa2r84JrwjQITmm63V7aSPrfwA9n_jkotwDDYByg5ASpAwhKW45wurAfWr-QyLYc
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9ef5a97bf9d8cf9d-PER
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm&google_sc&google_hm=Mm9abDNhSXQzZjlGSXVtd2VfQkFTVWt6VEhDb2VkT3hQb1BXNmJxSmwxWWs&gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer...
https://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm=&google_sc=&google_hm=Mm9abDNhSXQzZjlGSXVtd2VfQkFTVWt6VEhDb2VkT3hQb1BXNmJxSmwxWWs&gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referr...
https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_gid=CAESEFjvZ_mdSJkhoK9ZfeKCCD4&google_cver=1

70 B
450 B

95ms
95ms

Image
image/gif

13.237.11.119
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_gid=CAESEFjvZ_mdSJkhoK9ZfeKCCD4&google_cver=1
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 13.237.11.119 Sydney, Australia, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-13-237-11-119.ap-southeast-2.compute.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Mon, 20 Apr 2026 16:52:54 GMT
Content-Type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_gid=CAESEFjvZ_mdSJkhoK9ZfeKCCD4&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 375
date: Mon, 20 Apr 2026 16:52:54 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=eyeota&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmb/generic?ttd_pid=eyeota&ttd_tpi=1&gdpr=0&gdpr_consent=
https://ps.eyeota.net/match?uid=be2730b2-4a29-4f94-a883-ae0394c883c4&bid=1e2n4ou

70 B
450 B

95ms
94ms

Image
image/gif

13.237.11.119
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?uid=be2730b2-4a29-4f94-a883-ae0394c883c4&bid=1e2n4ou
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 13.237.11.119 Sydney, Australia, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-13-237-11-119.ap-southeast-2.compute.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Mon, 20 Apr 2026 16:52:54 GMT
Content-Type: image/gif

Redirect headers

location: https://ps.eyeota.net/match?uid=be2730b2-4a29-4f94-a883-ae0394c883c4&bid=1e2n4ou
content-length: 191
date: Mon, 20 Apr 2026 16:52:54 GMT
server: Kestrel

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fuid%3D%24UID%26bid%3D2cr76e1%26referrer_pid%3Dm51mh00
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fps.eyeota.net%252Fmatch%253Fuid%253D%2524UID%2526bid%253D2cr76e1%2526referrer_pid%253Dm51mh00
https://ps.eyeota.net/match?uid=8615208052258340763&bid=2cr76e1&referrer_pid=m51mh00

70 B
450 B

94ms
94ms

Image
image/gif

13.237.11.119
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?uid=8615208052258340763&bid=2cr76e1&referrer_pid=m51mh00
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 13.237.11.119 Sydney, Australia, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-13-237-11-119.ap-southeast-2.compute.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Mon, 20 Apr 2026 16:52:54 GMT
Content-Type: image/gif

Redirect headers

cache-control: no-store, no-cache, private
location: https://ps.eyeota.net/match?uid=8615208052258340763&bid=2cr76e1&referrer_pid=m51mh00
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 103.108.231.228; 103.108.231.228; 839.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: fb93bdc5-5924-4e05-a1e4-cf0c71565b6d
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Mon, 20 Apr 2026 16:52:53 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.25.5

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=eyeota
https://ps.eyeota.net/match?bid=tpm4omv&uid=NpktLDaYUCtzccKP0VD0aGds5-Q&gdpr=&gdpr_consent=

70 B
450 B

95ms
94ms

Image
image/gif

13.237.11.119
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?bid=tpm4omv&uid=NpktLDaYUCtzccKP0VD0aGds5-Q&gdpr=&gdpr_consent=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 13.237.11.119 Sydney, Australia, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-13-237-11-119.ap-southeast-2.compute.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Mon, 20 Apr 2026 16:52:55 GMT
Content-Type: image/gif

Redirect headers

Location: https://ps.eyeota.net/match?bid=tpm4omv&uid=NpktLDaYUCtzccKP0VD0aGds5-Q&gdpr=&gdpr_consent=
Content-Length: 126
Date: Mon, 20 Apr 2026 16:52:54 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://ups.analytics.yahoo.com/ups/58773/cms?partner_id=Eyeot&gdpr=0&gdpr_consent=
https://ups.analytics.yahoo.com/ups/58773/cms?partner_id=Eyeot&gdpr=0&gdpr_consent=&verify=true
https://ps.eyeota.net/match?bid=bhc9gd0&yahoo_ver=2&yahoo_id=y-hQToKVVE2pUP4g.oC0z844PcZZCS9QBJSh8-~A&gdpr=0

70 B
450 B

100ms
100ms

Image
image/gif

13.237.11.119
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?bid=bhc9gd0&yahoo_ver=2&yahoo_id=y-hQToKVVE2pUP4g.oC0z844PcZZCS9QBJSh8-~A&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 13.237.11.119 Sydney, Australia, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-13-237-11-119.ap-southeast-2.compute.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Mon, 20 Apr 2026 16:52:54 GMT
Content-Type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
location: https://ps.eyeota.net/match?bid=bhc9gd0&yahoo_ver=2&yahoo_id=y-hQToKVVE2pUP4g.oC0z844PcZZCS9QBJSh8-~A&gdpr=0
age: 0
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Mon, 20 Apr 2026 16:52:54 GMT
content-type: text/html
server: ATS

GET
H2 200 id5-api-js Show response
api.id5-sync.com/analytics/483/ 1 KB
691 B 1527ms
763ms Fetch
application/json 135.125.170.28
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://api.id5-sync.com/analytics/483/id5-api-js

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

135.125.170.28 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ns31872155.ip-135-125-170.eu

Software

Resource Hash

64731b0c4bddd9b69b5d748b611bcb8cc52a9dd00a6d9f4c9664dfac0a8d6e1b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: max-age=300
access-control-expose-headers: Access-Control-Allow-Origin
content-encoding: gzip
access-control-allow-origin: *
date: Mon, 20 Apr 2026 16:52:55 GMT
content-type: application/json
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding

GET
H2

200

usync.html Show response
eus.rubiconproject.com/ Frame 3797
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=
https://eus.rubiconproject.com/usync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=

269 B
379 B

411ms
179ms

Document
text/html

23.221.133.65
Akamai Technologies

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.05eaa3284c60ad6e334d.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.221.133.65 Sydney, Australia, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-221-133-65.deploy.static.akamaitechnologies.com
Software: Apache/2.4.65 (Debian) /
Resource Hash: e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Mon, 20 Apr 2026 16:52:54 GMT
etag: "10d-63d602600b800-gzip"
last-modified: Wed, 27 Aug 2025 22:17:04 GMT
server: Apache/2.4.65 (Debian)
vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Mon, 20 Apr 2026 16:52:54 GMT
location: https://eus.rubiconproject.com/usync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=
server: AkamaiGHost

GET
H3 200 favicon.ico Show response
ad.doubleclick.net/ 1 KB
129 B 194ms
194ms Fetch
image/x-icon 142.250.195.230
Google LLC

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.7525622652919696

Requested by

Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.195.230 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Tue, 21 Apr 2026 16:52:53 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 20 Apr 2026 16:52:53 GMT
content-type: image/x-icon
vary: Accept-Encoding
last-modified: Tue, 08 May 2012 13:08:06 GMT
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

POST
H3 204 AGSKWxWnhQji7v8mtew7oJDHgvNDZMPCMRWuPygqvK4O-BX7hOSFcpMBpBWKJcz8SROGpUcpvkt7zwTxNmJJFCCLCjS9tUc4BN83M-1swwnr132xujMCfw7tFgnJJzLqxmGjRd-yn7KKJg== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 865ms
672ms XHR
text/html 142.250.183.46
Google LLC

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWnhQji7v8mtew7oJDHgvNDZMPCMRWuPygqvK4O-BX7hOSFcpMBpBWKJcz8SROGpUcpvkt7zwTxNmJJFCCLCjS9tUc4BN83M-1swwnr132xujMCfw7tFgnJJzLqxmGjRd-yn7KKJg==

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_GB.dAXcwpB1nVU.es5.O/d=1/rs=AJlcJMw66PIVjTX2OBlV5esLwYrPjKpdZw/m=kernel_loader,loader_js_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.183.46 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-FzUl_WSxSpPhpu7B-gP8Sg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type: text/plain
sec-ch-ua-mobile: ?0

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 20 Apr 2026 16:52:54 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjMtDikmII1pBi-FB_mfUHEIdz-bDFA_HCaYFsK4H4TkwQ2xMgPrU6mO0SEAvxcDzbPPM8m8CMG7-mMyu5JOUXxifn55Wk5pXoJqYU64LYRZlJpSX5RSjs1DKQipz89PTMvPR4IwMjMwMTQzM9A_P4AgMAsPwwdQ"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-FzUl_WSxSpPhpu7B-gP8Sg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWnhQji7v8mtew7oJDHgvNDZMPCMRWuPygqvK4O-BX7hOSFcpMBpBWKJcz8SROGpUcpvkt7zwTxNmJJFCCLCjS9tUc4BN83M-1swwnr132xujMCfw7tFgnJJzLqxmGjRd-yn7KKJg==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.183.46 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-5ZHkxz1Wax1dKeUUM8sVkQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type: text/plain
sec-ch-ua-mobile: ?0

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 20 Apr 2026 16:52:54 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjMtDikmJw15Bi-FB_mfUHEIdz-bDFA_HCaYFsK4H4TkwQ2xMgPrU6mO0SEAvxcDzbPPM8m0DH9zXTmZVckvIL45Pz80pS80p0E1OKdUHsosyk0pL8IhR2ahlIRU5-enpmXnq8kYGRmYGJoZmegXl8gQEAmQQwKg"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-5ZHkxz1Wax1dKeUUM8sVkQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWnhQji7v8mtew7oJDHgvNDZMPCMRWuPygqvK4O-BX7hOSFcpMBpBWKJcz8SROGpUcpvkt7zwTxNmJJFCCLCjS9tUc4BN83M-1swwnr132xujMCfw7tFgnJJzLqxmGjRd-yn7KKJg==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.183.46 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-pTyQfx0XNyzhM9lnVwhbcg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type: text/plain
sec-ch-ua-mobile: ?0

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 20 Apr 2026 16:52:54 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjMtDikmLw0JBi-FB_mfUHEIdz-bDFA_HCaYFsK4H4TkwQ2xMgPrU6mO0SEAvxcDzbPPM8m0DDyy8zmJVckvIL45Pz80pS80p0E1OKdUHsosyk0pL8IhR2ahlIRU5-enpmXnq8kYGRmYGJoZmegXl8gQEAp_AwXg"
content-security-policy: script-src 'report-sample' 'nonce-pTyQfx0XNyzhM9lnVwhbcg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H2 200 AGSKWxWKRN8S6hagMlkdlVYMNX3ql1D6lLUMKiKhHLvbj1jcwf8QU_s9gRxhaA49l2cFICMwUNlL4GFZXZCiYZN7_wARdBXQVLOq0i2_UvsIW03BsMkbKk6hOjz09y02xnOJSn_dDqk3wA== Show response
fundingchoicesmessages.google.com/f/ 2 KB
2 KB 212ms
211ms Script
application/javascript 142.250.183.46
Google LLC

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxWKRN8S6hagMlkdlVYMNX3ql1D6lLUMKiKhHLvbj1jcwf8QU_s9gRxhaA49l2cFICMwUNlL4GFZXZCiYZN7_wARdBXQVLOq0i2_UvsIW03BsMkbKk6hOjz09y02xnOJSn_dDqk3wA==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzc2NzAzOTc0LDExMTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzddXSwiaHR0cHM6Ly9wYWludC50b3lzL29pbC8iLG51bGwsW1s4LCJkQVhjd3BCMW5WVSJdLFs5LCJlbi1HQiJdLFsxOCwiW1tbbnVsbCwyNzQ1XV1dIl0sWzM1LCIxNzc2NzAzOTc0Il0sWzE5LCIyIl0sWzE3LCJbMF0iXSxbMjQsImRmZWYuY29tbGluay1pdC5jb20uYXUiXSxbMjksImZhbHNlIl1dXQ

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.183.46 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

server-3-175-115-48.syd3.r.cloudfront.net

Software

ESF /

Resource Hash

78b66e6d293a46c77ae3197ca24c5e5375dde4c4197f8b8ccb6796e784e04b6d

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-dxdGqSkj5mSW0RW4OPN0CQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 20 Apr 2026 16:52:54 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjamHU4pJicNCQYmi9eY51OhCXLDrP2gbEXUA8B4gNFS6xOgPxh_rLrD-AuEjiCmsLEH-qusEqUn2DNZzLhy0eiL8V-7JxlPiynZjix3YLiJ8A8TcgZnnrz6Z2NIDNAogXTgtkWwnEd2KC2J4A8anVwWyXgFiIm-PZ5pnn2QQevL6Up6SRlF8Yn5yfV1KUmVRakl-UlpyWWpxaVJZaFG9kYGRmYGJoqWdgHl9gAAB7aEjT"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-dxdGqSkj5mSW0RW4OPN0CQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H2 200 connectId-gpt.js Show response
connectid.analytics.yahoo.com/ 9 KB
9 KB 420ms
184ms Script
application/javascript 3.175.115.48
Amazon.com

General

Check archive.org

Download Go to

Full URL

https://connectid.analytics.yahoo.com/connectId-gpt.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202604090101/pubads_impl.js?cb=31097905

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.175.115.48 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

56351c084d8d56437d41f1e58b7eb184b563871e88bab60f6b15486c39f13996

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

etag: "faa388a163b1b6d0377ee77a861591e5"
age: 665
x-cache: Hit from cloudfront
x-amz-cf-id: fYn6NFHWucmaiqc5mFqtf3PsF54An8dRkY3rwEBTAfAgtm22GixerA==
date: Mon, 20 Apr 2026 16:41:50 GMT
content-type: application/javascript
last-modified: Mon, 22 Apr 2024 18:18:45 GMT
x-amz-expiration: expiry-date="Mon, 23 Apr 2029 00:00:00 GMT", rule-id="webapp-standard-lifecycle"
content-security-policy: default-src 'self'
cache-control: max-age=3600
via: 1.1 24f360fd93fc7d5a758875518fa21000.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 8729
x-amz-cf-pop: SYD3-P3
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 esp.js Show response
oa.openxcdn.net/ 24 KB
8 KB 344ms
125ms Script
application/javascript 34.102.146.192
Google LLC

General

Check archive.org

Download Go to

Full URL: https://oa.openxcdn.net/esp.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202604090101/pubads_impl.js?cb=31097905
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.146.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS: 192.146.102.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-goog-metageneration: 1
content-encoding: gzip
x-goog-hash: crc32c=f21hYg==, md5=31VCuIvA42jGmZdUpbniug==
etag: "df5542b88bc0e368c6999754a5b9e2ba"
age: 97804
x-goog-stored-content-encoding: gzip
expires: Mon, 19 Apr 2027 13:42:50 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 7927
date: Sun, 19 Apr 2026 13:42:50 GMT
last-modified: Thu, 27 May 2021 18:30:51 GMT
content-type: application/javascript
x-guploader-uploadid: AMNfjG2jIJVhuueu2jxSW1fLFR7fLfqzV9EO5dMHtBw5GrwVl7IFXDfrzn2YLnzuIG2KYpUhGJ6N5R8
cache-control: no-transform
x-goog-storage-class: MULTI_REGIONAL
accept-ranges: bytes
x-goog-generation: 1622140251693895
content-length: 7927
server: UploadServer

GET
H2 200 encrypted-tag-g.js Show response
invstatic101.creativecdn.com/encrypted-signals/ 3 KB
3 KB 660ms
442ms Script
text/javascript 34.96.70.87
Google LLC

General

Check archive.org

Download Go to

Full URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202604090101/pubads_impl.js?cb=31097905
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.70.87 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS: 87.70.96.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 2e5f5cb912c0619933ea6c3ad8ac1466a005f792e3338d96a8432d144c63520f

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

etag: 861bdaf24bda5c0db45c6ebe1c94a9eb
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2729
date: Mon, 20 Apr 2026 16:52:54 GMT
content-type: text/javascript; charset=utf-8
last-modified: Wed, 05 Feb 2025 14:45:21 GMT
server: Google Frontend
x-cloud-trace-context: ff9b023e8a29be0e2ac9d3fb314ffe63

GET
H2 200 publishertag.ids.js Show response
static.criteo.net/js/ld/ 42 KB
15 KB 612ms
286ms Script
text/javascript 182.161.73.173
CRITEO-AS-AP Crit...

General

Check archive.org

Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.ids.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202604090101/pubads_impl.js?cb=31097905

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.173 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

13e01d9fe2d6d9908f2548ad93b296dc7e604f6c5ebdd795ef67731950689551

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: public, max-age=86400
timing-allow-origin: *
content-encoding: br
x-criteo-endpoint-version: none
cross-origin-resource-policy: cross-origin
expires: Tue, 21 Apr 2026 16:52:54 GMT
x-criteo-endpoint-controller: DynamicPublisherTag
access-control-allow-origin: *
x-criteo-endpoint-action: GetPublisherTag
date: Mon, 20 Apr 2026 16:52:54 GMT
content-type: text/javascript
vary: x-geo-country, Accept-Encoding
server: Kestrel

POST
H3 200 m1rvlrhta42a7_xccldi6ns4 Show response
faucetfoot.com/ 299 B
323 B 398ms
221ms Fetch
application/json 34.8.176.186
Google LLC

General

Check archive.org

Download Go to

Full URL

https://faucetfoot.com/m1rvlrhta42a7_xccldi6ns4

Requested by

Host: faucetfoot.com
URL: https://faucetfoot.com/j/mcppts5/4wf_dl

Protocol

Security

QUIC, , AES_128_GCM

Server

34.8.176.186 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),

Reverse DNS

186.176.8.34.bc.googleusercontent.com

Software

hoothoot/2455384222 /

Resource Hash

afcc227996a892b22656109bb96fa64e2df38a0c497eb5abedee1192d0f49473

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=15724800; preload
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: POST, OPTIONS
via: fen-hoothoot-asia-east1-spot-wzhx.gce-asia-east1, 1.1 google
expires: Mon, 20 Apr 2026 16:52:53 GMT
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 299
date: Mon, 20 Apr 2026 16:52:54 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding, Origin
server: hoothoot/2455384222
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Cookie

GET
H2 200 bounce Show response
id5-sync.com/ 29 B
519 B 450ms
448ms Fetch
text/plain 135.125.170.108
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/bounce

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

135.125.170.108 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ns3226757.ip-57-129-49.eu

Software

Resource Hash

aca701811d62eb608d12b174231be1ceae3449fe0f4bc847469ff22aab8ca9a5

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Mon, 20 Apr 2026 16:52:54 GMT
content-type: text/plain;charset=utf-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H2 200 v1 Show response
lbs.eu-1-id5-sync.com/lbs/ 54 B
155 B 1592ms
772ms Fetch
application/json 57.129.92.143
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://lbs.eu-1-id5-sync.com/lbs/v1
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 57.129.92.143 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),
Reverse DNS
Software: /
Resource Hash: 2dbdee1faaa40ab78a8907474906963268c2c43da19c72160b1df9ae8e37b56a

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

access-control-allow-origin: https://paint.toys
content-length: 54
date: Mon, 20 Apr 2026 16:52:55 GMT
content-type: application/json
vary: Origin

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 56 B
340 B 1598ms
775ms Fetch
application/json 57.129.49.181
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

57.129.49.181 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

acabc3261f6eace6684bb3e0a85b68fca1b89474a1f428189e9baff6412b56f6

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
content-encoding: gzip
date: Mon, 20 Apr 2026 16:52:54 GMT
content-type: application/json;charset=UTF-8
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding

GET
H2 200 location Show response
privacy-location-edge.ccgateway.net/privacy/ 5 B
191 B 1173ms
583ms XHR
text/plain 18.212.140.196
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://privacy-location-edge.ccgateway.net/privacy/location
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.212.140.196 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-18-212-140-196.compute-1.amazonaws.com
Software: /
Resource Hash: 1c55d9b826e8dfa994370e306ae8dc2e849f3e003381dc848a0b95f782c0c0e3

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

access-control-allow-origin: *
content-encoding: gzip
date: Mon, 20 Apr 2026 16:52:55 GMT
content-type: text/plain; charset=utf-8
vary: Accept-Encoding
access-control-allow-credentials: true

GET
H2 200 classification Show response
pogo.ccgateway.net/v1/p/5bb3e20859/ 216 B
360 B 1217ms
585ms XHR
application/json 3.237.175.195
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://pogo.ccgateway.net/v1/p/5bb3e20859/classification?url=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.237.175.195 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-3-237-175-195.compute-1.amazonaws.com
Software: /
Resource Hash: 180e9de553e30cebc7ab6f65f789d74b6994a74618fbb6fd48582b7c83617dc2

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

access-control-allow-origin: https://paint.toys
content-encoding: gzip
date: Mon, 20 Apr 2026 16:52:55 GMT
content-type: application/json
vary: Origin, Accept-Encoding
access-control-allow-credentials: true

POST
H3 204 AGSKWxU72H0gT02sf83VeuIS55xJcsebZxXVZsS0hxReb5wCK60iCRkbnZyknD47FbiG9nqufrXw6zMjZ_95nUjh6KsdVmgQHt7fMs9kpS31_XFo6oXj74Ge41Vus2NCV1QQfhjSwY0gAw== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 597ms
596ms XHR
text/html 142.250.183.46
Google LLC

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxU72H0gT02sf83VeuIS55xJcsebZxXVZsS0hxReb5wCK60iCRkbnZyknD47FbiG9nqufrXw6zMjZ_95nUjh6KsdVmgQHt7fMs9kpS31_XFo6oXj74Ge41Vus2NCV1QQfhjSwY0gAw==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.183.46 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-l3RYuZ3ciVSADmVAOQaWtg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type: text/plain
sec-ch-ua-mobile: ?0

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 20 Apr 2026 16:52:54 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjstDikmLw15BiOHHrNtMFIP5Qf5n1BxCHc_mwxQPxwmmBbCuB-E5MENsTID61OpjtEhAL8XA82zzzPJtAx_Hl85iVXJLyC-OT8_NKUvNKdBNTinVB7KLMpNKS_CIUdmoZSEVOfnp6Zl56vJGBkZmBiaGZnoF5fIEBACTkNRI"
content-security-policy: script-src 'report-sample' 'nonce-l3RYuZ3ciVSADmVAOQaWtg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H3 200 AGSKWxUz88eExNA3k26FzmYWacB18TLE4Vsr01S5kPo98SrAnNQTpJXIWSPn8uQfXPFkkmqhJkCjzPgNO2X7AGPishJH1yXb54xzOaRkABjgYVK448gH75UUi63XmWvyqW5dfmtTwFvl4g== Show response
fundingchoicesmessages.google.com/f/ 9 KB
4 KB 244ms
244ms Script
application/javascript 142.250.183.46
Google LLC

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxUz88eExNA3k26FzmYWacB18TLE4Vsr01S5kPo98SrAnNQTpJXIWSPn8uQfXPFkkmqhJkCjzPgNO2X7AGPishJH1yXb54xzOaRkABjgYVK448gH75UUi63XmWvyqW5dfmtTwFvl4g==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzc2NzAzOTc0LDM3NTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOV0sbnVsbCwyLG51bGwsImVuIl0sImh0dHBzOi8vcGFpbnQudG95cy9vaWwvIixudWxsLFtbOCwiZEFYY3dwQjFuVlUiXSxbOSwiZW4tR0IiXSxbMTgsIltbW251bGwsMjc0NV1dXSJdLFszNSwiMTc3NjcwMzk3NCJdLFsxOSwiMiJdLFsxNywiWzBdIl0sWzI0LCJkZmVmLmNvbWxpbmstaXQuY29tLmF1Il0sWzI5LCJmYWxzZSJdXV0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.183.46 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

4be34c5d681a1d7baf74d8d9916cd71f8c43e862c951a93e02364389dd80a464

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-IPhAC8GIZfeaTxcMUBfnig' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 20 Apr 2026 16:52:54 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjamHU4pJicNGQYmi9eY51OhCXLDrP2gbEXUA8B4gNFS6xOgPxh_rLrD-AuEjiCmsLEH-qusEqUn2DNZzLhy0eiL8V-7JxlPiynZjix3YLiJ8A8TcgZnnrz6Z2NIDNAogXTgtkWwnEd2KC2J4A8anVwWyXgFiIh-PZ5pnn2QRurDn0mVFJIym_MD45P6-kKDOptCS_KC05LbU4tagstSjeyMDIzMDE0FLPwDy-wAAAwGNJBw"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-IPhAC8GIZfeaTxcMUBfnig' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
139 B 51ms
50ms Fetch
image/gif 172.66.148.140
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=2&e=0.5114319785674739
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.66.148.140 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 926303
x-goog-stored-content-encoding: identity
expires: Thu, 09 Apr 2026 23:47:53 GMT
x-goog-stored-content-length: 43
date: Mon, 20 Apr 2026 16:52:54 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH8-8d6tsHANUa2r84JrwjQITmm63V7aSPrfwA9n_jkotwDDYByg5ASpAwhKW45wurAfWr-QyLYc
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9ef5a981cecccf9d-PER
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico Show response
ad.doubleclick.net/ 1 KB
129 B 193ms
193ms Fetch
image/x-icon 142.250.195.230
Google LLC

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.3399312516235409

Requested by

Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.195.230 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

ns3226757.ip-57-129-49.eu

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Tue, 21 Apr 2026 16:52:54 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 20 Apr 2026 16:52:54 GMT
content-type: image/x-icon
vary: Accept-Encoding
last-modified: Tue, 08 May 2012 13:08:06 GMT
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
110 B 96ms
95ms Fetch
image/gif 172.66.148.140
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.14740409718758563
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.66.148.140 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 926303
x-goog-stored-content-encoding: identity
expires: Thu, 09 Apr 2026 23:47:53 GMT
x-goog-stored-content-length: 43
date: Mon, 20 Apr 2026 16:52:54 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH8-8d6tsHANUa2r84JrwjQITmm63V7aSPrfwA9n_jkotwDDYByg5ASpAwhKW45wurAfWr-QyLYc
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9ef5a981cecfcf9d-PER
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H2 200 dns Show response
ab.dns-finder.com/meta/ 2 B
0 0ms
0ms Fetch
text/plain 34.36.200.111
Google LLC

General

Check archive.org

Download Go to

Full URL: https://ab.dns-finder.com/meta/dns
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.36.200.111 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS: 111.200.36.34.bc.googleusercontent.com
Software: /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: private, max-age=180, stale-if-error=180, stale-while-revalidate=180
access-control-expose-headers: X-Resolver
x-resolver: default
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
date: Mon, 20 Apr 2026 16:52:53 GMT
content-type: text/plain; charset=utf-8
vary: Origin

GET
H2 200 usync.js Show response
eus.rubiconproject.com/ Frame 3797 45 KB
12 KB 173ms
173ms Script
text/html 23.221.133.65
Akamai Technologies

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.221.133.65 Sydney, Australia, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-221-133-65.deploy.static.akamaitechnologies.com
Software: Apache/2.4.65 (Debian) / PHP/8.3.24
Resource Hash: 8ada07e886cb52e101be8dfebd437d41ba30f743edfb13d59f91bff13d65ce26

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://eus.rubiconproject.com/usync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: max-age=42943
content-encoding: gzip
expires: Tue, 21 Apr 2026 04:48:37 GMT
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
content-length: 11524
date: Mon, 20 Apr 2026 16:52:54 GMT
last-modified: Mon, 20 Apr 2026 04:48:37 GMT
x-powered-by: PHP/8.3.24
server: Apache/2.4.65 (Debian)
content-type: text/html;charset=UTF-8
vary: Accept-Encoding

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 56 B
339 B 1874ms
726ms Fetch
application/json 57.129.49.181
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.05eaa3284c60ad6e334d.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

57.129.49.181 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

acabc3261f6eace6684bb3e0a85b68fca1b89474a1f428189e9baff6412b56f6

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
content-encoding: gzip
date: Mon, 20 Apr 2026 16:52:55 GMT
content-type: application/json;charset=UTF-8
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame B1E1 12 KB
5 KB 643ms
319ms Document
text/html 182.161.73.131
CRITEO-AS-AP Crit...

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=paint.toys&gdpr=0&gdpr_consent=

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.ids.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.131 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

13e6c9d2b7d7fea86094dfc9583458e0abcb7137410dd136f1a1cfc2ab59e55e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Mon, 20 Apr 2026 16:52:54 GMT
server: Kestrel
server-processing-duration-in-ticks: 1264025
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding
x-robots-tag: noindex

POST
H2 200 encrypt Show response
esp.rtbhouse.com/ 265 B
530 B 641ms
423ms Fetch
application/json 35.190.39.111
Google LLC

General

Check archive.org

Download Go to

Full URL: https://esp.rtbhouse.com/encrypt
Requested by: Host: invstatic101.creativecdn.com
URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.39.111 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS: 111.39.190.35.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 07a8f1ce2d288e0139e387a48151a1a81ddc8ad91e4b838cf83b99b0b1d7121b

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type: text/plain
sec-ch-ua-mobile: ?0

Response headers

access-control-allow-credentials: true
access-control-allow-methods: POST
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 265
date: Mon, 20 Apr 2026 16:52:55 GMT
content-type: application/json
x-cloud-trace-context: 4e3d31408176dbe7f351b58711b8c219
server: Google Frontend
access-control-allow-headers: X-Requested-With

GET
H2 200 prbds2s Show response
rtb.gumgum.com/usync/ Frame 8315 0
68 B 878ms
394ms Document
text/plain 18.136.166.203
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://rtb.gumgum.com/usync/prbds2s?gdpr=&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fpbs.intergient.com%2Fsetuid%3Fbidder%3Dgumgum%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.05eaa3284c60ad6e334d.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.136.166.203 Singapore, Singapore, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-18-136-166-203.ap-southeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

content-length: 0
date: Mon, 20 Apr 2026 16:52:55 GMT
server: nginx
timing-allow-origin: *

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 34 KB
7 KB 746ms
745ms Fetch
text/plain 142.250.195.226
Google LLC

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=7450022176433074&correlator=2029079240708394&eid=31097907%2C31097905&output=ldjh&gdfp_req=1&vrg=202604090101&ptt=17&impl=fifs&gdpr=0&iu_parts=154013155%3A21762409181%2C1024872%2C74068%2Cpublisher%3A1024872-website%3A74068-160x600%2Cpublisher%3A1024872-website%3A74068-160x600-CP%2Cpublisher%3A1024872-website%3A74068-160x600-CP-160x600&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4%2F5&prev_iu_szs=160x600%7C120x600&ifi=1&dids=pw-160x600_atf&adfs=3640230632&sfv=1-0-45&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1776703974888&lmt=1776703974&adxs=20&adys=619&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=600&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE0Ny4wLjc3MjcuMTAxIixudWxsLDAsbnVsbCwiNjQiLFtbIkNocm9taXVtIiwiMTQ3LjAuMC4wIl0sWyJHb29nbGUgQ2hyb21lIiwiMTQ3LjAuMC4wIl0sWyJOb3QtQS5CcmFuZCIsIjI0LjAuMC4wIl1dLDBd&url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fdfef.comlink-it.com.au%2F&vis=1&psz=180x1062&msz=160x-1&fws=4&ohw=180&a3p=EjQKCnB1YmNpZC5vcmcSJDNkMGUwZjIzLTc1ZjEtNDUyYS1hMzcxLTllYThkMDA3ZDZhOVgBEpUBCgpjcml0ZW8uY29tEoQBQ3pWdkpWOXVRbEoxV1dSdlRVZFZObE5zZUZrMlVGTTRUV05zZEd0Q1ZTVXlSbWRWWkRGRFRqSklWREUzZDNaSFpXTTJVMlJCVFRGSWFFUXdURFoxT0RkTmR6TlBXblI0UTNsR2JtcFRTbHBKVUhkM01VZEJiMGRzUmxGbkpUTkVKVE5FWAES2AEKDmVzcC5jcml0ZW8uY29tErwBem5jbk1WOVlZa0pwYW5ORFVFTnNjREZ4YWpsMGRYUm5kME5FTTBZeVZEZFBaaVV5UmxOMk1UTk5jbmxhYkhjelNsTXlUak13WVV0U1VEazBjMGwyWkVaMmRUUm1UakJFU21nNEpUSkdPREYzWkdkeWNXVkhTM0ZUV2lVeVJrMHpOVFozU1dwQmNtOUJiaVV5Um1WeFRXNWxZM1ZsVEVkbVZqSmFSRkJLT1c1VU1WbHJUV1Z1VWxKcFlWWlMY89q83tozSAASGAoJeWFob28uY29tGI_ZvN7aM0gAUgIIbxIUCgVvcGVueBjI2Lze2jNIAFICCG8SFwoIcnRiaG91c2UY5NW83tozSABSAghk&dlt=1776703971442&idt=1706&prev_scp=pos%3Datf%26slot_id%3Dpw-160x600_atf%26refresh%3Dfalse%26amazonBid%3Dfalse%26custom_path%3D160x600%26lld_id%3Dd54f22f7221b465cba745ce2fd7921d703973392%26price_floor%3Dna%26amznbid%3D2%26amznp%3D2%26bid_type%3Dserver%26hb_format%3Dbanner%26hb_adid%3D2007910ae47f25e%26hb_size%3D160x600%26hb_pb%3D0.38%26hb_cache_path%3D%252Fcache%26hb_cache_host%3Dpbc.intergient.com%26hb_bidder%3Ds2s_rubicon%26hb_cache_host_s2s_ru%3Dpbc.intergient.com%26hb_format_s2s_rubico%3Dbanner%26hb_size_s2s_rubicon%3D160x600%26hb_pb_s2s_rubicon%3D0.38%26hb_adid_s2s_rubicon%3D2007910ae47f25e%26hb_bidder_s2s_rubico%3Ds2s_rubicon%26hb_format_s2s_gumgum%3Dbanner%26hb_size_s2s_gumgum%3D160x600%26hb_pb_s2s_gumgum%3D0.36%26hb_adid_s2s_gumgum%3D2370cec178afbc3%26hb_bidder_s2s_gumgum%3Ds2s_gumgum%26hb_format_s2s_ix%3Dbanner%26hb_size_s2s_ix%3D160x600%26hb_pb_s2s_ix%3D0.35%26hb_adid_s2s_ix%3D26315579ee2075e%26hb_bidder_s2s_ix%3Ds2s_ix%26hb_format_s2s_pubmat%3Dbanner%26hb_size_s2s_pubmatic%3D160x600%26hb_pb_s2s_pubmatic%3D0.28%26hb_adid_s2s_pubmatic%3D25a4b33337193e9%26hb_bidder_s2s_pubmat%3Ds2s_pubmatic%26hb_format_rubicon%3Dbanner%26hb_size_rubicon%3D160x600%26hb_pb_rubicon%3D0.28%26hb_adid_rubicon%3D16cc49ba07f19e9%26hb_bidder_rubicon%3Drubicon%26hb_format_ix%3Dbanner%26hb_size_ix%3D160x600%26hb_pb_ix%3D0.26%26hb_adid_ix%3D14bb8c2ad3728db8%26hb_bidder_ix%3Dix%26hb_format_s2s_triple%3Dbanner%26hb_size_s2s_tripleli%3D160x600%26hb_pb_s2s_triplelift%3D0.24%26hb_adid_s2s_tripleli%3D247a2d19290e818%26hb_bidder_s2s_triple%3Ds2s_triplelift%26hb_format_triplelift%3Dbanner%26hb_size_triplelift%3D160x600%26hb_pb_triplelift%3D0.24%26hb_adid_triplelift%3D18da89c4056189a8%26hb_bidder_triplelift%3Dtriplelift%26hb_format_s2s_vidazo%3Dbanner%26hb_size_s2s_vidazoo%3D160x600%26hb_pb_s2s_vidazoo%3D0.20%26hb_adid_s2s_vidazoo%3D27bfd511d7649ea8%26hb_bidder_s2s_vidazo%3Ds2s_vidazoo%26hb_format_openx%3Dbanner%26hb_size_openx%3D160x600%26hb_pb_openx%3D0.20%26hb_adid_openx%3D15413ffb39ef1ea%26hb_bidder_openx%3Dopenx%26hb_ver%3D1.17.2&cust_params=pf_src%3Dml%26li-module-enabled%3Dt1-e0%26salad%3Dkale%26dd%3Draspberry%26di%3Dpineapple%26vd%3Draspberry%26vi%3Dpineapple%26sitecont_cat%3Dgames_casual%26referrer%3Dhttps%253A%252F%252Fdfef.comlink-it.com.au%252F%26tyche_code%3DV.20260416.1%26pageos_code%3DV.20260416.1%26config_id%3D1024872_74068_primary_config%26hour%3D2%26day%3DTuesday%26referrer_domain%3Ddfef.comlink-it.com.au%26OS%3DLinux%2520null%26browser%3DChrome%2520147%26pagecount%3D1%26window_width%3D1600%26window_height%3D1200%26screen_orientation%3Dlandscape%26website_id%3D74068%26pub_id%3D1024872%26refresh_count%3D0%26tyche_version%3DV.20260416.1%26ab_test%3Dna_A%26ad_clicker%3Dfalse%26dmp_ids%3D65%26page_focus%3Dtrue&adks=2652516820&frm=20&eoidce=1&gblpids=%2F154013155%2C21762409181%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublishe&pb_szs=160x600%7C120x600&pbbce=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202604090101/pubads_impl.js?cb=31097905

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.195.226 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

tzsyda-ad-in-f1.1e100.net

Software

cafe /

Resource Hash

6ae12181a083803d792de8d61aad36ee498d61edebf34ee7cd3b408111dfa909

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: dcb
google-lineitem-id: -1
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: 1320085
google-mediationgroup-id: 739909
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Mon, 20 Apr 2026 16:52:55 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -1
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
content-length: 7386
x-xss-protection: 0
server: cafe

GET
H3 200 container.html Show response
f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com/safeframe/1-0-45/html/ Frame A08E 7 KB
3 KB 394ms
197ms Document
text/html 142.250.195.97
Google LLC

General

Check archive.org

Download Go to

Full URL

https://f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202604090101/pubads_impl.js?cb=31097905

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.195.97 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

f1a68bf826c55985468304f4284a09cb8a68e82503d764166e611a7c58a85a4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 3121
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 20 Apr 2026 16:52:55 GMT
expires: Mon, 20 Apr 2026 16:52:55 GMT
last-modified: Thu, 08 May 2025 23:15:48 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET j
rp.liadm.com/ 0
0

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
110 B 51ms
50ms Fetch
image/gif 172.66.148.140
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.47733205576671645
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.66.148.140 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 926303
x-goog-stored-content-encoding: identity
expires: Thu, 09 Apr 2026 23:47:53 GMT
x-goog-stored-content-length: 43
date: Mon, 20 Apr 2026 16:52:54 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH8-8d6tsHANUa2r84JrwjQITmm63V7aSPrfwA9n_jkotwDDYByg5ASpAwhKW45wurAfWr-QyLYc
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9ef5a983a834cf9d-PER
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

POST
H3 204 ping
pagead2.googlesyndication.com/pagead/ 0
0 435ms
226ms Fetch
image/gif 142.250.195.162
Google LLC

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/ping?e=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202604090101/pubads_impl.js?cb=31097905

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.195.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Mon, 20 Apr 2026 16:52:55 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
133 B 52ms
51ms Fetch
image/gif 172.66.148.140
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=2&e=0.5770343555227115
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.66.148.140 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 926303
x-goog-stored-content-encoding: identity
expires: Thu, 09 Apr 2026 23:47:53 GMT
x-goog-stored-content-length: 43
date: Mon, 20 Apr 2026 16:52:55 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH8-8d6tsHANUa2r84JrwjQITmm63V7aSPrfwA9n_jkotwDDYByg5ASpAwhKW45wurAfWr-QyLYc
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9ef5a984d92acf9d-PER
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 popundr. Show response
fundingchoicesmessages.google.com/f/AGSKWxWxHlitnh1cU_zSjCwe_3LkYUVZT_LqY5t01lHVsZo-7gu1Ytd6Nwh6-GVrolqDCjAefRbGLzq9eNQF-KnzUU7Iy3cHZsbnIxO3UYCKzUKLfoUzo65PEAo2Xp63hdjOUWcnRSGMAHW4Zc3m5zUkdMDH3_shT... 54 B
109 B 199ms
198ms Script
application/javascript 142.250.183.46
Google LLC

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxWxHlitnh1cU_zSjCwe_3LkYUVZT_LqY5t01lHVsZo-7gu1Ytd6Nwh6-GVrolqDCjAefRbGLzq9eNQF-KnzUU7Iy3cHZsbnIxO3UYCKzUKLfoUzo65PEAo2Xp63hdjOUWcnRSGMAHW4Zc3m5zUkdMDH3_shT8QDI7KbP_0yIUy0F3_bHj_dVSwbZ6uw/_-ads3.jpg/n2ad_/propadbl./adcast_/popundr.

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_GB.dAXcwpB1nVU.es5.O/d=1/exm=kernel_loader,loader_js_executable,web_iab_tcf_v2_signal_executable/ed=1/rs=AJlcJMw66PIVjTX2OBlV5esLwYrPjKpdZw/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.183.46 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

bdf71819c14cf3c15aa02d1aea504199ff47b167972e7eac6e8ca6ca83e641ef

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-XilKjvSszdHFithgDcnO7Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 20 Apr 2026 16:52:55 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzj6mHU4pJicNGQYjhx6zbTBSBuvXmOdToQlyw6z9oGxF1APAeIDRUusToD8Yf6y6w_gLhI4gprCxB_qrrBKlJ9gzWcy4ctHoi_FfuycZT4sp2Y4sd2C4ifAPE3IGZ568-mdjSAzQKIF04LZFsJxHdigtieAPGp1cFsl4BYiIfj-eaZ59kEOnbdW8iopJGUXxifnJ9XUpSZVFqSX5SWnJZanFpUlloUb2RgZGZgYmipZ2AeX2AAAF3sTZ4"
content-security-policy: script-src 'report-sample' 'nonce-XilKjvSszdHFithgDcnO7Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 lidar.js Show response
pagead2.googlesyndication.com/pagead/js/ 265 KB
83 KB 289ms
97ms Script
text/javascript 142.250.195.162
Google LLC

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/lidar.js?fcd=true

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_GB.dAXcwpB1nVU.es5.O/d=1/exm=kernel_loader,loader_js_executable,web_iab_tcf_v2_signal_executable/ed=1/rs=AJlcJMw66PIVjTX2OBlV5esLwYrPjKpdZw/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.195.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

40356065eed98e32aa78fb54ea86f3998636a78e6873947556be18a96c413927

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
etag: 6434647175275364150
age: 3188
x-content-type-options: nosniff
expires: Mon, 20 Apr 2026 16:59:47 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Mon, 20 Apr 2026 15:59:47 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 85061
x-xss-protection: 0
server: cafe

POST
H3 204 AGSKWxWnhQji7v8mtew7oJDHgvNDZMPCMRWuPygqvK4O-BX7hOSFcpMBpBWKJcz8SROGpUcpvkt7zwTxNmJJFCCLCjS9tUc4BN83M-1swwnr132xujMCfw7tFgnJJzLqxmGjRd-yn7KKJg== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 205ms
204ms XHR
text/html 142.250.183.46
Google LLC

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWnhQji7v8mtew7oJDHgvNDZMPCMRWuPygqvK4O-BX7hOSFcpMBpBWKJcz8SROGpUcpvkt7zwTxNmJJFCCLCjS9tUc4BN83M-1swwnr132xujMCfw7tFgnJJzLqxmGjRd-yn7KKJg==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.183.46 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-iTS7DcbOCXjIOOVQJoS5oA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type: text/plain
sec-ch-ua-mobile: ?0

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 20 Apr 2026 16:52:55 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjstDikmJw05BiOHHrNtMFIP5Qf5n1BxCHc_mwxQPxwmmBbCuB-E5MENsTID61OpjtEhAL8XA83zzzPJvAhxn7FzEquSTlF8Yn5-eVpOaV6CamFOuC2EWZSaUl-UUo7NQykIqc_PT0zLz0eCMDIzMDE0MzPQPz-AIDADi5NV0"
content-security-policy: script-src 'report-sample' 'nonce-iTS7DcbOCXjIOOVQJoS5oA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H3 200 favicon.ico Show response
ad.doubleclick.net/ 1 KB
129 B 194ms
193ms Fetch
image/x-icon 142.250.195.230
Google LLC

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.07257163851022375

Requested by

Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.195.230 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Tue, 21 Apr 2026 16:52:55 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 20 Apr 2026 16:52:55 GMT
content-type: image/x-icon
vary: Accept-Encoding
last-modified: Tue, 08 May 2012 13:08:06 GMT
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET j
rp.liadm.com/ 0
0

GET
H2 200 json Show response
gum.criteo.com/sid/ Frame B1E1 417 B
889 B 214ms
214ms Fetch
application/json 182.161.73.131
CRITEO-AS-AP Crit...

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=publishertagids&domain=paint.toys&sn=ChromeSyncframe&so=3&topUrl=paint.toys&bundle=zncnMV9YYkJpanNDUENscDFxajl0dXRnd0NEM0YyVDdPZiUyRlN2MTNNcnlabHczSlMyTjMwYUtSUDk0c0l2ZEZ2dTRmTjBESmg4JTJGODF3ZGdycWVHS3FTWiUyRk0zNTZ3SWpBcm9BbiUyRmVxTW5lY3VlTEdmVjJaRFBKOW5UMVlrTWVuUlJpYVZS

Requested by

Host: gum.criteo.com
URL: https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=paint.toys&gdpr=0&gdpr_consent=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.131 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

70dcfd833804802f26753a24d70c4e3c432bca6a45ec593058fb817ece7116e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=paint.toys&gdpr=0&gdpr_consent=
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
server-processing-duration-in-ticks: 640434
expires: 0
date: Mon, 20 Apr 2026 16:52:54 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame 3797 7 B
1 KB 566ms
141ms XHR
application/json 69.173.158.64
Magnite

General

Check archive.org

Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.158.64 Singapore, Singapore, ASN26667 (RUBICONPROJECT - Magnite, Inc., US),
Reverse DNS
Software: /
Resource Hash: a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

Cache-Control: no-cache,no-store,must-revalidate
Pragma: no-cache
access-control-allow-credentials: true
Expires: 0
access-control-allow-origin: https://eus.rubiconproject.com
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 4b9b5fe4fdc8ed94e0f7cdc225df187a
content-length: 7
content-type: application/json; charset=UTF-8

POST
H3 204 AGSKWxWnhQji7v8mtew7oJDHgvNDZMPCMRWuPygqvK4O-BX7hOSFcpMBpBWKJcz8SROGpUcpvkt7zwTxNmJJFCCLCjS9tUc4BN83M-1swwnr132xujMCfw7tFgnJJzLqxmGjRd-yn7KKJg== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 474ms
473ms XHR
text/html 142.250.183.46
Google LLC

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWnhQji7v8mtew7oJDHgvNDZMPCMRWuPygqvK4O-BX7hOSFcpMBpBWKJcz8SROGpUcpvkt7zwTxNmJJFCCLCjS9tUc4BN83M-1swwnr132xujMCfw7tFgnJJzLqxmGjRd-yn7KKJg==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.183.46 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

tzsyda-ad-in-f1.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-xmPQ39KMppgtFj-VFa8Wkg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type: text/plain
sec-ch-ua-mobile: ?0

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 20 Apr 2026 16:52:55 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjMtDikmLw0JBi-FB_mfUHEIdz-bDFA_HCaYFsK4H4TkwQ2xMgPrU6mO0SEAvxcDzfPPM8m0DHxXNNzEouSfmF8cn5eSWpeSW6iSnFuiB2UWZSaUl-EQo7tQykIic_PT0zLz3eyMDIzMDE0EzPwDy-wAAAkqMwEw"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-xmPQ39KMppgtFj-VFa8Wkg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

POST
H2 200 fb87a4ea41 Show response
cd836371f1d.cdn.intergient.com/ 0
95 B 426ms
425ms XHR
application/octet-stream 35.162.56.239
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://cd836371f1d.cdn.intergient.com/fb87a4ea41
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260416.1/main.121b53b8564b55f13382.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.162.56.239 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-35-162-56-239.us-west-2.compute.amazonaws.com
Software: nginx/1.24.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0

Response headers

access-control-allow-origin: *
date: Mon, 20 Apr 2026 16:52:55 GMT
content-type: application/octet-stream
server: nginx/1.24.0

GET
H2 200 userId Show response
script-api.ccgateway.net/1/ 446 B
706 B 586ms
585ms Script
text/javascript 3.237.175.195
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/1/userId
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.237.175.195 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-3-237-175-195.compute-1.amazonaws.com
Software: /
Resource Hash: 2e6d028ef6a7d3ff800676cfdc46afa39b12d3774dec9b3dbc94eec26d6e99c0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: private,max-age=3156000
content-encoding: gzip
date: Mon, 20 Apr 2026 16:52:55 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 user.js Show response
script-api.ccgateway.net/script/launcher/2/ 2 KB
677 B 540ms
539ms Script
text/javascript 3.237.175.195
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/script/launcher/2/user.js
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.237.175.195 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-3-237-175-195.compute-1.amazonaws.com
Software: /
Resource Hash: a11d3b4b6f2902037c365146ff80b5bf95923f3176f1a827355e45177314d423

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: private,max-age=604800
content-encoding: gzip
date: Mon, 20 Apr 2026 16:52:55 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 customevents.js Show response
script-api.ccgateway.net/script/launcher/1/ 5 KB
2 KB 539ms
538ms Script
text/javascript 3.237.175.195
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/script/launcher/1/customevents.js
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.237.175.195 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-3-237-175-195.compute-1.amazonaws.com
Software: /
Resource Hash: 04c94ecaae50f713607dd45d40c5756d0e6a9e58c6398433ac098bc9bee89f5d

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: private,max-age=604800
content-encoding: gzip
date: Mon, 20 Apr 2026 16:52:55 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 api.js Show response
script-api.ccgateway.net/script/launcher/6/ 4 KB
2 KB 294ms
293ms Script
text/javascript 3.237.175.195
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/script/launcher/6/api.js
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.237.175.195 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-3-237-175-195.compute-1.amazonaws.com
Software: /
Resource Hash: 880444af8f79aca9fdb01d819bb615c7d8ce8fb9327df856784f7027819de58b

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: private,max-age=604800
content-encoding: gzip
date: Mon, 20 Apr 2026 16:52:55 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET j
rp.liadm.com/ 0
0

GET
H3 200 container.html Show response
f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com/safeframe/1-0-45/html/ Frame 61F9 7 KB
0 0ms
0ms Document
text/html 142.250.195.97
Google LLC

General

Check archive.org

Download Go to

Full URL

https://f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202604090101/pubads_impl.js?cb=31097905

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.195.97 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

f1a68bf826c55985468304f4284a09cb8a68e82503d764166e611a7c58a85a4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 3121
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 20 Apr 2026 16:52:55 GMT
expires: Mon, 20 Apr 2026 16:52:55 GMT
last-modified: Thu, 08 May 2025 23:15:48 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2

200

usersync Show response
usersync.gumgum.com/ Frame 4BC2
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=1301&gdpr=0&gdpr_consent=
https://c1.adform.net/serving/cookie/match?CC=1&party=1301&gdpr=0&gdpr_consent=
https://usersync.gumgum.com/usersync?b=adf&i=5877196467477221807&gdpr=0&gdpr_consent=

35 B
169 B

713ms
312ms

Document
image/gif

52.74.33.174
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=adf&i=5877196467477221807&gdpr=0&gdpr_consent=
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.05eaa3284c60ad6e334d.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.74.33.174 Singapore, Singapore, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-74-33-174.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
content-length: 35
content-type: image/gif
date: Mon, 20 Apr 2026 16:52:57 GMT
expires: 0
pragma: no-cache

Redirect headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-length: 0
date: Mon, 20 Apr 2026 16:52:56 GMT
expires: -1
location: https://usersync.gumgum.com/usersync?b=adf&i=5877196467477221807&gdpr=0&gdpr_consent=
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

GET
H2

200

usersync Show response
usersync.gumgum.com/ Frame 53E3
Redirect Chain

https://creativecdn.com/cm-notify?pi=gumgum
https://creativecdn.com/cm-notify?pi=gumgum&tc=1
https://usersync.gumgum.com/usersync?b=rth&i=sqGOzMstS-5WPuIKMaMP-awfmuS9FQyUp_a1O1wpfUY&pi=gumgum&tc=1

35 B
168 B

177ms
177ms

Document
image/gif

52.74.33.174
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=rth&i=sqGOzMstS-5WPuIKMaMP-awfmuS9FQyUp_a1O1wpfUY&pi=gumgum&tc=1
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.05eaa3284c60ad6e334d.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.74.33.174 Singapore, Singapore, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-74-33-174.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
content-length: 35
content-type: image/gif
date: Mon, 20 Apr 2026 16:52:57 GMT
expires: 0
pragma: no-cache

Redirect headers

cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 0
date: Mon, 20 Apr 2026 16:52:57 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://usersync.gumgum.com/usersync?b=rth&i=sqGOzMstS-5WPuIKMaMP-awfmuS9FQyUp_a1O1wpfUY&pi=gumgum&tc=1
pragma: no-cache
vary: Accept-Encoding

GET
H2 200 sync Show response
eb2.3lift.com/ Frame 8C3C 1 KB
2 KB 709ms
309ms Document
text/html 47.131.64.132
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://eb2.3lift.com/sync?
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.05eaa3284c60ad6e334d.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 47.131.64.132 Singapore, Singapore, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-47-131-64-132.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 608662288a2b918624e3e75b4510ab37d2ad4cfdeeaa421ebd7abf8cfed4d86e

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 1126
content-type: text/html; charset=utf-8
date: Mon, 20 Apr 2026 16:52:56 GMT

GET
H2 200 / Show response
sync.cootlogix.com/api/sync/iframe/ Frame B4D7 109 B
422 B 1176ms
544ms Document
text/html 134.209.66.79
DigitalOcean

General

Check archive.org

Download Go to

Full URL: https://sync.cootlogix.com/api/sync/iframe/?cid=&gdpr=0&gdpr_consent=&us_privacy=&coppa=0
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.05eaa3284c60ad6e334d.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 134.209.66.79 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
Software: /
Resource Hash: a1aa01f31d4087317f5d4e5ef4ea70a73e38124a45f1553dbe8968ea16068b84

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
content-length: 109
content-type: text/html
date: Mon, 20 Apr 2026 16:52:56 GMT
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame CC32 52 KB
17 KB 190ms
47ms Document
text/html 151.101.193.108
Fastly

General

Check archive.org

Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.05eaa3284c60ad6e334d.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.193.108 , United States, ASN54113 (FASTLY - Fastly, Inc., US),
Reverse DNS
Software: nginx/1.24.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 18526
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Mon, 20 Apr 2026 16:52:55 GMT
ETag: W/"623de86a-cf34"
Expires: Wed, 10 Sep 2025 11:06:06 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.24.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish, 1.1 varnish
X-Cache: HIT, HIT
X-Cache-Hits: 755252, 10868
X-Served-By: cache-lga21982-LGA, cache-per-ypph1920023-PER
X-Timer: S1776703976.848998,VS0,VE0

GET
H2

200

usync.html Show response
eus.rubiconproject.com/ Frame A1C3
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=gumgum
https://eus.rubiconproject.com/usync.html?p=gumgum

269 B
379 B

99ms
98ms

Document
text/html

23.221.133.65
Akamai Technologies

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.05eaa3284c60ad6e334d.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.221.133.65 Sydney, Australia, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-221-133-65.deploy.static.akamaitechnologies.com
Software: Apache/2.4.65 (Debian) /
Resource Hash: e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Mon, 20 Apr 2026 16:52:55 GMT
etag: "10d-63d602600b800-gzip"
last-modified: Wed, 27 Aug 2025 22:17:04 GMT
server: Apache/2.4.65 (Debian)
vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Mon, 20 Apr 2026 16:52:55 GMT
location: https://eus.rubiconproject.com/usync.html?p=gumgum
server: AkamaiGHost

GET
H2

200

pd Show response
playwire-d.openx.net/w/1.0/ Frame 7C46
Redirect Chain

https://playwire-d.openx.net/w/1.0/pd
https://playwire-d.openx.net/w/1.0/pd?cc=1

537 B
621 B

207ms
206ms

Document
text/html

35.244.159.8
Google LLC

General

Check archive.org

Download Go to

Full URL: https://playwire-d.openx.net/w/1.0/pd?cc=1
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.05eaa3284c60ad6e334d.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: d95030eb7eaa22102b637a082944bafa1478ecdc69a7c4bb7cb7ee34ec3f2958

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

alt-svc: h3=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-encoding: br
content-length: 390
content-type: text/html
date: Mon, 20 Apr 2026 16:52:55 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 103.108.231.228

Redirect headers

alt-svc: h3=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 0
content-type: text/plain; charset=utf-8
date: Mon, 20 Apr 2026 16:52:55 GMT
location: https://playwire-d.openx.net/w/1.0/pd?cc=1
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 103.108.231.228

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 3699 22 KB
8 KB 388ms
142ms Document
text/html 2.18.109.37
Akamai Technologies

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.05eaa3284c60ad6e334d.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.109.37 Sydney, Australia, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-109-37.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 18236b81f82dd31b2cee21fbb9fbc39e6d3a590a88cc2c99242c633db70a5010

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

accept-ranges: bytes
cache-control: max-age=166773
content-encoding: gzip
content-length: 7463
content-type: text/html
date: Mon, 20 Apr 2026 16:52:56 GMT
expires: Wed, 22 Apr 2026 15:12:29 GMT
last-modified: Mon, 13 Apr 2026 10:17:03 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 usync.html Show response
eus.rubiconproject.com/ Frame 59A6 269 B
379 B 94ms
92ms Document
text/html 23.221.133.65
Akamai Technologies

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.05eaa3284c60ad6e334d.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.221.133.65 Sydney, Australia, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-221-133-65.deploy.static.akamaitechnologies.com
Software: Apache/2.4.65 (Debian) /
Resource Hash: e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Mon, 20 Apr 2026 16:52:55 GMT
etag: "10d-63d602600b800-gzip"
last-modified: Wed, 27 Aug 2025 22:17:04 GMT
server: Apache/2.4.65 (Debian)
vary: Accept-Encoding

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame 0A4D 12 KB
5 KB 188ms
188ms Document
text/html 182.161.73.131
CRITEO-AS-AP Crit...

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=criteoPrebidAdapter&topUrl=paint.toys&gpp=

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.05eaa3284c60ad6e334d.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.131 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

13e6c9d2b7d7fea86094dfc9583458e0abcb7137410dd136f1a1cfc2ab59e55e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Mon, 20 Apr 2026 16:52:55 GMT
server: Kestrel
server-processing-duration-in-ticks: 1136802
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding
x-robots-tag: noindex

GET
H2

200

URnmbSKM Show response
sync-tm.everesttech.net/ct/upi/pid/ Frame 8BD3
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/URnmbSKM?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent=
https://sync-tm.everesttech.net/ct/upi/pid/URnmbSKM?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent=&_test=aeZZ5wALUqLXBQAn

85 B
171 B

47ms
47ms

Document
image/png

151.101.66.49
Fastly

General

Check archive.org

Download Go to

Full URL: https://sync-tm.everesttech.net/ct/upi/pid/URnmbSKM?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent=&_test=aeZZ5wALUqLXBQAn
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.05eaa3284c60ad6e334d.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.66.49 , United States, ASN54113 (FASTLY - Fastly, Inc., US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

accept-ranges: bytes
age: 2260
cache-control: no-cache
content-length: 85
content-type: image/png
date: Mon, 20 Apr 2026 16:52:56 GMT
pragma: no-cache
server: Jetty(9.4.35.v20201120)
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 1467
x-robots-tag: noindex
x-served-by: cache-per-ypph1920034-PER
x-timer: S1776703976.100234,VS0,VE0

Redirect headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: no-cache
content-length: 0
date: Mon, 20 Apr 2026 16:52:56 GMT
location: https://sync-tm.everesttech.net/ct/upi/pid/URnmbSKM?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent=&_test=aeZZ5wALUqLXBQAn
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
pragma: no-cache
server: Jetty(9.4.35.v20201120)
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-robots-tag: noindex
x-served-by: cache-per-ypph1920034-PER
x-timer: S1776703976.812062,VS0,VE240

GET
H2 200 ixmatch.html Show response
js-sec.indexww.com/um/ Frame 662A 3 KB
2 KB 200ms
52ms Document
text/html 104.18.24.18
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.05eaa3284c60ad6e334d.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.24.18 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 82d2dc44aae1eda52abc17afd30c6031b7175c13ee6955410164c66ae755adfb

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

age: 1184
cache-control: public, max-age=14400
cf-cache-status: HIT
cf-ray: 9ef5a9892c288652-PER
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Mon, 20 Apr 2026 16:52:55 GMT
expires: Mon, 20 Apr 2026 20:52:55 GMT
last-modified: Mon, 25 Jul 2022 19:18:19 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
server: cloudflare

GET
H2

200

v1
match.sharethrough.com/sync/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=be2730b2-4a29-4f94-a883-ae0394c883c4&gdpr=0&gdpr_consent=

68 B
324 B

711ms
311ms

Image
image/png

13.228.29.185
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL

https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=be2730b2-4a29-4f94-a883-ae0394c883c4&gdpr=0&gdpr_consent=

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

13.228.29.185 Singapore, Singapore, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-13-228-29-185.ap-southeast-1.compute.amazonaws.com

Software

Resource Hash

6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

location: https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=be2730b2-4a29-4f94-a883-ae0394c883c4&gdpr=0&gdpr_consent=
content-length: 323
date: Mon, 20 Apr 2026 16:52:55 GMT
server: Kestrel

GET
H2

200

v1
match.sharethrough.com/sync/
Redirect Chain

https://cms.quantserve.com/pixel/p-_jQ037pSmtjhN.gif?idmatch=1&gdpr=0&gdpr_consent=
https://cms.quantserve.com/pixel/p-_jQ037pSmtjhN.gif?idmatch=1&gdpr=0&gdpr_consent=&__qcmcs=1
https://rtb-csync.smartadserver.com/redir/?issi=0&partnerid=177&partneruserid=06ESt9ChErnIqEGxgf1auN2qR7TIqEHi0KsEZa4U&gdpr=0&redirurl=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3...
https://match.sharethrough.com/sync/v1?source_id=mKgSocXAVa8Wq7r1ivjrQDkr&source_user_id=06ESt9ChErnIqEGxgf1auN2qR7TIqEHi0KsEZa4U&sasuid=4254593526229308516&gdpr=0&gdpr_consent=

68 B
323 B

178ms
178ms

Image
image/png

13.228.29.185
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL

https://match.sharethrough.com/sync/v1?source_id=mKgSocXAVa8Wq7r1ivjrQDkr&source_user_id=06ESt9ChErnIqEGxgf1auN2qR7TIqEHi0KsEZa4U&sasuid=4254593526229308516&gdpr=0&gdpr_consent=

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

13.228.29.185 Singapore, Singapore, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-13-228-29-185.ap-southeast-1.compute.amazonaws.com

Software

Resource Hash

6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

cache-control: no-cache,no-store
location: https://match.sharethrough.com/sync/v1?source_id=mKgSocXAVa8Wq7r1ivjrQDkr&source_user_id=06ESt9ChErnIqEGxgf1auN2qR7TIqEHi0KsEZa4U&sasuid=4254593526229308516&gdpr=0&gdpr_consent=
content-length: 0
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Mon, 20 Apr 2026 16:52:55 GMT
pragma: no-cache

GET
H2

200

v1
match.sharethrough.com/sync/
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=15&gdpr=0&gdpr_consent=
https://match.sharethrough.com/sync/v1?source_id=f832af09fdaea37e940528ab&source_user_id=0-36992d2c-3698-502b-7371-c28fd150f468$ip$103.108.231.228&gdpr=0&gdpr_consent=

68 B
323 B

306ms
305ms

Image
image/png

13.228.29.185
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL

https://match.sharethrough.com/sync/v1?source_id=f832af09fdaea37e940528ab&source_user_id=0-36992d2c-3698-502b-7371-c28fd150f468$ip$103.108.231.228&gdpr=0&gdpr_consent=

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

13.228.29.185 Singapore, Singapore, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-13-228-29-185.ap-southeast-1.compute.amazonaws.com

Software

Resource Hash

6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

Location: https://match.sharethrough.com/sync/v1?source_id=f832af09fdaea37e940528ab&source_user_id=0-36992d2c-3698-502b-7371-c28fd150f468$ip$103.108.231.228&gdpr=0&gdpr_consent=
Content-Length: 202
Date: Mon, 20 Apr 2026 16:52:56 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H2

200

ibs:dpid=903&dpuuid=be2730b2-4a29-4f94-a883-ae0394c883c4
dpm.demdex.net/
Redirect Chain

https://match.adsrvr.org/track/usersync?us_privacy=&gdpr=0&gdpr_consent=undefined&ust=image
https://dpm.demdex.net/ibs:dpid=903&dpuuid=be2730b2-4a29-4f94-a883-ae0394c883c4&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=903&dpuuid=be2730b2-4a29-4f94-a883-ae0394c883c4&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam
https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam
https://dpm.demdex.net/ibs:dpid=903&dpuuid=be2730b2-4a29-4f94-a883-ae0394c883c4

42 B
718 B

94ms
93ms

Image
image/gif

3.105.44.72
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=903&dpuuid=be2730b2-4a29-4f94-a883-ae0394c883c4

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

3.105.44.72 Sydney, Australia, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-3-105-44-72.ap-southeast-2.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-apse2-1-v085-0a12d06bb.edge-apse2.demdex.com 2 ms
content-encoding: gzip
pragma: no-cache
x-content-type-options: nosniff
x-tid: QxBCVTBgRQA=
expires: Thu, 01 Jan 1970 00:00:00 UTC
content-length: 59
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Mon, 20 Apr 2026 16:52:56 GMT
content-type: image/gif

Redirect headers

location: https://dpm.demdex.net/ibs:dpid=903&dpuuid=be2730b2-4a29-4f94-a883-ae0394c883c4
content-length: 189
date: Mon, 20 Apr 2026 16:52:56 GMT
server: Kestrel

GET sync
ssbsync.smartadserver.com/api/ 0
0

GET
H2

200

/
rtb-csync.smartadserver.com/redir/
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=sharethrough
https://sync.1rx.io/usersync2/rmpssp?sub=sharethrough&zcc=1&cb=1776703976268
https://ad.turn.com/r/cs?pid=45&id=RX-b543adef-0a1a-417c-b8b4-ef1a5ca2dd5f-004&rndcb=6903310430
https://sync.1rx.io/usersync/turn/8941175861696558629?dspret=1&gdpr=&gdpr_consent=&us_privacy=
https://sync.targeting.unrulymedia.com/csync/RX-b543adef-0a1a-417c-b8b4-ef1a5ca2dd5f-004?redir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D0%26partnerid%3D183%26partneruserid%3DRX...
https://rtb-csync.smartadserver.com/redir/?issi=0&partnerid=183&partneruserid=RX-b543adef-0a1a-417c-b8b4-ef1a5ca2dd5f-004&gdpr=0&gdpr_consent=

43 B
400 B

96ms
96ms

Image
image/gif

23.106.50.38
LEASEWEB-APAC-SIN...

General

Check archive.org

Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?issi=0&partnerid=183&partneruserid=RX-b543adef-0a1a-417c-b8b4-ef1a5ca2dd5f-004&gdpr=0&gdpr_consent=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 23.106.50.38 Singapore, Singapore, ASN59253 (LEASEWEB-APAC-SIN-11 LEASEWEB SINGAPORE PTE. LTD., SG),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache,no-store
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Mon, 20 Apr 2026 16:52:57 GMT
pragma: no-cache
content-type: image/gif

Redirect headers

location: https://rtb-csync.smartadserver.com/redir/?issi=0&partnerid=183&partneruserid=RX-b543adef-0a1a-417c-b8b4-ef1a5ca2dd5f-004&gdpr=0&gdpr_consent=
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
date: Mon, 20 Apr 2026 16:52:57 GMT
etag: RXb543adef0a1a417cb8b4ef1a5ca2dd5f004
content-type: text/html
server: Tengine

POST
H2 200 prebid Show response
id5-sync.com/api/config/ 195 B
451 B 820ms
816ms Fetch
application/json 135.125.170.108
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.05eaa3284c60ad6e334d.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

135.125.170.108 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

7e4d2c9111e1ca31b5e2e4bfd5a66925f07c0c232672f31481c6b66a89b26f16

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
content-encoding: gzip
date: Mon, 20 Apr 2026 16:52:55 GMT
content-type: application/json;charset=UTF-8
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding
access-control-allow-credentials: true

GET
H2 200 f Show response
fid.agkn.com/ 0
363 B 237ms
236ms Fetch 34.217.228.237
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://fid.agkn.com/f?apiKey=2104320612&r=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.05eaa3284c60ad6e334d.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.217.228.237 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-34-217-228-237.us-west-2.compute.amazonaws.com
Software: AAWebServer /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
content-type: text/plain
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
expires: 0
access-control-allow-origin: https://paint.toys
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
date: Mon, 20 Apr 2026 16:52:55 GMT
vary: Origin
server: AAWebServer
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type

GET
H2 200 envelope Show response
lexicon.33across.com/v1/ 1 KB
2 KB 319ms
318ms Fetch
application/json 79.127.255.1
CDN77 Datacamp Li...

General

Check archive.org

Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0014000001YrMoYAAV&gdpr=0&src=pbjs&ver=10.23.0&coppa=0&tp=DsYB7pt6XKomgqoptWkByuL%2FAleK7uZqzx%2Bg%2Bc4SU0Y%3D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.05eaa3284c60ad6e334d.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 79.127.255.1 San Jose, United States, ASN60068 (CDN77 Datacamp Limited, GB),
Reverse DNS: unn-79-127-255-1.datapacket.com
Software: /
Resource Hash: e63b56d3eb13a4b0c266a37fdd962286ebcaa2af3e719e577f305dda69b97692

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
content-type: text/plain
sec-ch-ua-mobile: ?0

Response headers

access-control-allow-origin: https://paint.toys
content-length: 1528
content-type: application/json
vary: origin
access-control-allow-credentials: true

GET
H2 204 any Show response
idx.liadm.com/idex/did-0046/ 0
0 1ms
1ms Fetch 52.44.224.167
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://idx.liadm.com/idex/did-0046/any?duid=8e413bd09c43--01kpnwy9r9yjj46pfmg6dpg3g6&did=did-0046&cd=.paint.toys&pu=https%3A%2F%2Fpaint.toys&resolve=nonId&resolve=uid2&resolve=index&resolve=bidswitch&resolve=pubmatic&resolve=magnite&resolve=openx&resolve=sorvrn&resolve=thetradedesk&resolve=medianet&resolve=vidazoo&resolve=sonobi&resolve=sharethrough&resolve=triplelift
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.05eaa3284c60ad6e334d.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.44.224.167 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-44-224-167.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
content-type: text/plain
sec-ch-ua-mobile: ?0

Response headers

cache-control: max-age=3599, private
trace-id: 1c051ce4c080a7f6
request-time: 1
access-control-allow-credentials: true
expires: Mon, 20 Apr 2026 17:52:54 GMT
access-control-allow-origin: https://paint.toys
date: Mon, 20 Apr 2026 16:52:54 GMT
vary: Origin

GET
H2 200 json Show response
gum.criteo.com/sid/ 429 B
1 KB 140ms
140ms Fetch
application/json 182.161.73.131
CRITEO-AS-AP Crit...

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&bundle=EsO4rV9YYkJpanNDUENscDFxajl0dXRnd0NJbHVIZ0hSc3hPMTBWbm5pV3VBRXV5Sjg3Z041N2pKTFV3eDVaWGhJbUhRR3NoS28xZ2RWQU51QnRnODBnREN5UENlV0t3dnp1MzY3cU1LSjZTRzBqdDdaVkhGayUyRjhTT3NTME1ZNmcwV2ZzUVZUR2g3RWhxbWFmJTJCZTMzSzZwSjZnJTNEJTNE&cw=1&pbt=1&lsw=1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.05eaa3284c60ad6e334d.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.131 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

70ca4952b31be1966df0766cef4e859e4180946b8714cd1bd84e5edd170bb952

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
content-type: application/json
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 682296
expires: 0
access-control-allow-origin: https://paint.toys
date: Mon, 20 Apr 2026 16:52:55 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 140ms
139ms Preflight
application/json 182.161.73.131
CRITEO-AS-AP Crit...

General

Check archive.org

Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.131 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://paint.toys
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Mon, 20 Apr 2026 16:52:55 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 206759
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
116 B 51ms
51ms Fetch
image/gif 172.66.148.140
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=2&e=0.5850670480098409
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.66.148.140 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 926304
x-goog-stored-content-encoding: identity
expires: Thu, 09 Apr 2026 23:47:53 GMT
x-goog-stored-content-length: 43
date: Mon, 20 Apr 2026 16:52:55 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH8-8d6tsHANUa2r84JrwjQITmm63V7aSPrfwA9n_jkotwDDYByg5ASpAwhKW45wurAfWr-QyLYc
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9ef5a9885c0acf9d-PER
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 61F9 0
0 437ms
245ms Fetch
text/html 142.250.195.226
Google LLC

General

Check archive.org

Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=C08_951nmaZTXBr6ejeYPh96pyATukrWTXL-ihcfkBcCNtwEQASD7m9VJYKWAgICoAcgBCeACAKgDAcgDAqoEhwNP0HkeMic0FEGzmzFin2qxJ0lmr3E2R58yor3_tA3G_l7PPJvI44W1lc07lzVCuFX9KNEkt6HpI8_0zBqADZDZ2cOMmC7FqXuYwX8EXHb0Uz8acfpMM6RylRh0arMi6p6QRb7v0j7ujtwerpzq08B8uzqL-Cf5AO1JmYriRH9ZPdDaazOXqC4CEu64FPgcL8UbCStEu5mwl6jLkqP5VnANMSaO1gpbjFCOq7L6EuOb_lM1rVuQGEBjnR0NKpIOTsflk12w_sWzDMwrCHm-jvE2LIfCDCuDcEE4efGydkiZ7uMHqqZkn88TqWUAmPUBP2D_g54XW1PWbxgK3TQheQgBtv9psWMYWfFfsQIOszsxbythwkaiprV_kqhDWP6SgSkt5Zvl4ui7uizbTRd7vQbIpCeqwJDxRG1tvHLd5oSQaxHZRV5YsNDtCnC3TYEs_mdAnykOeZiUIOvF__qc1VheJM7_paz1_DApfD68iRBHdO7507ttNM9MZeAqubJyLnwMIvbxghTg4AQBgAbS8JvUxtH815kBoAYhqAeT2LECqAeU2LECqAeV2LECqAea4bECqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAqgHrb6xAtgHANIILAiAYRABMgiKgoCAgICACDoNgECAwICAgICogAKoA0i9_cE6WO2DtYry_JMDgAoD-gsCCAGADAGqDQJBVeINEwjRp7WK8vyTAxU-T8MGHQdvCknqDRMInuC1ivL8kwMVPk_DBh0HbwpJiA7___________8B0BUBgBcBshcsChoSFHB1Yi01ODEyMzU3MzUyMzM1MDc1GNuiIRgLKgoyMTg0MzY3MzQ2UAGqGBcJZmZm1hfkH0ESCjIxODQzNjczNDYYAQ&sigh=b5MFKlksdss&uach_m=%5BUACH%5D&sreq=1&cid=CAQS0gEABaugfek4NQ9iYyRsHIWfwzujipBQ8Y1ERhdI9vr3R__Oyt0zd9U___S6n_5kbq9syfWkp-Um-icLSOcJMnW_MswDfmEQuh14l42f5Qpg688eJ86gfGy_yRn3aouEHEd58IfcLFkk--nPtgsSHSgxYmr0Jfyfk5Vcw_lPIRCrge2RMg9QpTHzbfbn6cBbro2zp7OZ59AYiGhtsYnLzEcqBMls17qdiGUn5xjWxStoQhKib1_2mlwYaLHVaC8XXIFa-s8lceFfC3NJ-3TwQQt3NYUYAQ
Requested by: Host: dfef.comlink-it.com.au
URL: https://dfef.comlink-it.com.au/8rv4antkas7digh9pi7glovg5mmewihwt27c8q9rn9df61npgny4ckbt6p8xbpx1lkuqjea9jqRN0gzalM4bmYzZGt2WlhpeURab2UtNjExOC0yNTc1NDQ1NC0wZmYxMDI3NS0xMDYyMy1XZE4zVUw0RnFwVDNQamFHR3Q4WA/hhz53m0jbbq/0G9CcQJr5IYfK8rMejRHSRr977HFQWnaFOCpa1hwpThl/520904034370726572938706541793457/t46PM6p8gsEqR6rndxp7CcKxC2BvcTW5TknZrojHWggx
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.195.226 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: maa03s43-in-f2.1e100.net
Software: /
Resource Hash

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

GET
H2 200 ttj Show response
ib.3lift.com/ Frame 61F9 14 KB
5 KB 388ms
146ms Script
application/javascript 18.67.93.105
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://ib.3lift.com/ttj?inv_code=pwm_general_RON_hdx&tid=206229
Requested by: Host: f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com
URL: https://f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.67.93.105 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-18-67-93-105.syd62.r.cloudfront.net
Software: /
Resource Hash: 13be02c6a1d55c8977e7a952e38d8c51527274476892361b415ec3bacacd23d2

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: max-age=900, public, s-maxage=300
content-encoding: br
etag: W/"2b3057bed3fe6635b3b7512853de2c38edc3ede3"
age: 23
via: 1.1 3437ef72cec711eb0ebed9222a22cf66.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: nnZnawYXQ89wPTQsnH9z8jiUgMtREy1v0-gO9P45gInNOe36_jYQEA==
date: Mon, 20 Apr 2026 16:52:56 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
x-amz-cf-pop: SYD62-P1

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20260417/r20110914/client/ Frame 61F9 3 KB
2 KB 476ms
144ms Script
text/javascript 142.250.195.129
Google LLC

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20260417/r20110914/client/window_focus_fy2021.js

Requested by

Host: f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com
URL: https://f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.195.129 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

maa03s40-in-f1.1e100.net

Software

cafe /

Resource Hash

73ef34ed57b69c5a35720bfc3ac6ebf6da3cf1289824112841d403c0fd169f97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
etag: 772434001065076922
age: 13163
x-content-type-options: nosniff
expires: Mon, 04 May 2026 13:13:33 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Mon, 20 Apr 2026 13:13:33 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 1235
x-xss-protection: 0
server: cafe

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20260417/r20110914/client/ Frame 61F9 21 KB
9 KB 477ms
145ms Script
text/javascript 142.250.195.129
Google LLC

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20260417/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com
URL: https://f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.195.129 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

maa03s40-in-f1.1e100.net

Software

cafe /

Resource Hash

e62f6d1bbf666e1e1fdd789ef87c63b8b0f09a734962a303fbafc57856eb3eb2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
etag: 11082569455730939277
age: 44430
x-content-type-options: nosniff
expires: Mon, 04 May 2026 04:32:26 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Mon, 20 Apr 2026 04:32:26 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 8705
x-xss-protection: 0
server: cafe

GET l
www.google.com/ads/measurement/ Frame 61F9 0
0

GET
H2 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-45/js/ Frame 61F9 23 KB
6 KB 584ms
252ms Script
text/javascript 142.250.195.129
Google LLC

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-45/js/ext.js

Requested by

Host: f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com
URL: https://f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.195.129 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

maa03s40-in-f1.1e100.net

Software

sffe /

Resource Hash

4c95e84767aed248594e7d485707c7ed904fd2fe4ec3ea98687fc2de59ddf231

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
x-content-type-options: nosniff
expires: Mon, 20 Apr 2026 16:52:56 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 20 Apr 2026 16:52:56 GMT
content-type: text/javascript
vary: Accept-Encoding
last-modified: Thu, 08 May 2025 23:15:48 GMT
cache-control: private, max-age=300
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
content-length: 6269
x-xss-protection: 0
server: sffe

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 61F9 237 KB
73 KB 289ms
96ms Script
text/javascript 142.250.195.162
Google LLC

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com
URL: https://f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.195.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

7ece648c6d1d12fe49579177747819737d024c57ef2decac49e2d9e5b5409309

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
etag: 3668408261107957543
age: 1962
x-content-type-options: nosniff
expires: Mon, 20 Apr 2026 17:20:13 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Mon, 20 Apr 2026 16:20:13 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=ISO-8859-1
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 74838
x-xss-protection: 0
server: cafe

GET
H2 200 notify
tlx.3lift.com/s2s/ Frame 61F9 37 B
192 B 707ms
307ms Image
image/gif 54.151.166.244
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://tlx.3lift.com/s2s/notify?px=1&pr=aeZZ5wABq5QGw08-AApvB2xjRzaQVoulMpfQ7A&ts=1776703975&aid=33384962471309340179540&ec=5563_66529_OADD2.7971509121968_1CM923YF36VLYINTTT&n=GrYDaHR0cHM6Ly93d3cuYmluZy5jb20vYXBpL3YxL21lZGlhdGlvbi90cmFja2luZz9hZFVuaXQ9MTE3MzAzNzQmYXVJZD1lZjhlYTAxNC1mZTA4LTQ5ZDAtYWRjNy04MGYyMWJhNGFjNzcmYmRjPWNoJmJpZElkPTImYmlkZGVySWQ9NCZjbUV4cElkPVJTViZpbXBJZD0xJmltcFR5PTEmbGRjPXhmb2N6ciZta3Q9ZW4tYXUmb0FkVW5pdD0xMTczMDM3NCZwSWQ9NSZwdWJsaXNoZXJJZD0yNTAxNTIyMzUmcklkPTg4ZDE1MTMzLWI2ZjYtNDFjMC1hNGFhLTBkNTI1MmQ1NWNhMSZyZWdpb249YXBhYyZydHlwZT1udXJsJnRhZ0lkPTM0MjI0JnRyYWZmaWNHcm91cD1nZXZjeXJ5dnNnX3BjeiZ0cmFmZmljU3ViR3JvdXA9ZXJmcmVpciZ1YmVyR3JvdXA9aG9yZV8zYyZ1YmVyU3ViR3JvdXA9cmFub3lyX2VybnFfZm5hdnEmYWlkPTMzMzg0OTYyNDcxMzA5MzQwMTc5NTQtOCZ3cD0wLjY08gL%2BAgjns5nPBhIXMzMzODQ5NjI0NzEzMDkzNDAxNzk1NDAYACABKLsrMOGHBEABSABQAWASaAhwk60VkAEAmAEAqAEAuAEKwAGmBMgBgAXwAZXLDPgBgAWAAqYEkQIAAAAAAADwP5kC1DVLyYjrwT%2BoAgCwAgHIAgLYAgD4AqU7kAMAmAMAoAMBqAMSqAMLuAMAyAMA0gMmT0FERDIuNzk3MTUwOTEyMTk2OF8xQ005MjNZRjM2VkxZSU5UVFTgA9uAp5UB6QMAAAAAAAAAAPADgAX5AwAAAAAAAAAAgAQJiQT2KFyPwvXYP7gE7SDABAjKBB8IAxkAAAAAAAAAACEAAAAAAAAAACl7FK5H4Xq0vzAA0AQA2gQZMzMzODQ5NjI0NzEzMDkzNDAxNzk1NDAgMeAEAPAEAIgFIJAFo0%2BaBRgzMzM4NDk2MjQ3MTMwOTM0MDE3OTU0LTiiBR4zMzM4NDk2MjQ3MTMwOTM0MDE3OTU0LTgtMC0wLTDQBQfYBRP4AgWIAwGSAwQ5ODk1mAMBoAOwiwKoAwC6Aw8xMDMuMTA4LjIzMS4yMjg%3D
Requested by: Host: f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com
URL: https://f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.151.166.244 Singapore, Singapore, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-54-151-166-244.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

expires: Thu, 15 Oct 1992 20:10:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
content-type: image/gif
vary: Accept-Encoding

GET
H2 200 pe
eb2.3lift.com/ Frame 61F9 37 B
140 B 660ms
307ms Image
image/gif 47.131.64.132
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/pe?fid=18&peid=0&aid=33384962471309340179540
Requested by: Host: f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com
URL: https://f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 47.131.64.132 Singapore, Singapore, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-47-131-64-132.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
date: Mon, 20 Apr 2026 16:52:56 GMT
content-type: image/gif

POST
H3 204 AGSKWxWnhQji7v8mtew7oJDHgvNDZMPCMRWuPygqvK4O-BX7hOSFcpMBpBWKJcz8SROGpUcpvkt7zwTxNmJJFCCLCjS9tUc4BN83M-1swwnr132xujMCfw7tFgnJJzLqxmGjRd-yn7KKJg== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 395ms
395ms XHR
text/html 142.250.183.46
Google LLC

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWnhQji7v8mtew7oJDHgvNDZMPCMRWuPygqvK4O-BX7hOSFcpMBpBWKJcz8SROGpUcpvkt7zwTxNmJJFCCLCjS9tUc4BN83M-1swwnr132xujMCfw7tFgnJJzLqxmGjRd-yn7KKJg==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.183.46 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-szr7HdwBhMJf6CsKoEvtbA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type: text/plain
sec-ch-ua-mobile: ?0

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 20 Apr 2026 16:52:56 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjstDikmJw15BiOHHrNtMFIP5Qf5n1BxCHc_mwxQPxwmmBbCuB-E5MENsTID61OpjtEhALcXO82DzzPJvAgs1N3EouSfmF8cn5eSWpeSW6iSnFuiB2UWZSaUl-EQo7tQykIic_PT0zLz3eyMDIzMDE0EzPwDy-wAAA0jg0VA"
content-security-policy: script-src 'report-sample' 'nonce-szr7HdwBhMJf6CsKoEvtbA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

POST
H3 204 AGSKWxWnhQji7v8mtew7oJDHgvNDZMPCMRWuPygqvK4O-BX7hOSFcpMBpBWKJcz8SROGpUcpvkt7zwTxNmJJFCCLCjS9tUc4BN83M-1swwnr132xujMCfw7tFgnJJzLqxmGjRd-yn7KKJg== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 668ms
667ms XHR
text/html 142.250.183.46
Google LLC

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWnhQji7v8mtew7oJDHgvNDZMPCMRWuPygqvK4O-BX7hOSFcpMBpBWKJcz8SROGpUcpvkt7zwTxNmJJFCCLCjS9tUc4BN83M-1swwnr132xujMCfw7tFgnJJzLqxmGjRd-yn7KKJg==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.183.46 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-l5ODGJ8t_j-JHvkWyWrKzw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type: text/plain
sec-ch-ua-mobile: ?0

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 20 Apr 2026 16:52:56 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjstDikmJw15BiOHHrNtMFIP5Qf5n1BxCHc_mwxQPxwmmBbCuB-E5MENsTID61OpjtEhAL8XC82DzzPJvAgk3T-xmVXJLyC-OT8_NKUvNKdBNTinVB7KLMpNKS_CIUdmoZSEVOfnp6Zl56vJGBkZmBiaGZnoF5fIEBABjmNO4"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-l5ODGJ8t_j-JHvkWyWrKzw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H3 200 AGSKWxUk8HbX6FULmG5TD3ifRZhVEx4_kbgupinM-bWtYkgeC04WzmDcWehyB-FI-itK5DWYbonS6VSv7O1rufPmQQaxpxZsUf-unnizT02nEQqZR3g_AqgadY0v36rsFxjcmTmV-Y72Pg== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 221ms
221ms Script
application/javascript 142.250.183.46
Google LLC

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxUk8HbX6FULmG5TD3ifRZhVEx4_kbgupinM-bWtYkgeC04WzmDcWehyB-FI-itK5DWYbonS6VSv7O1rufPmQQaxpxZsUf-unnizT02nEQqZR3g_AqgadY0v36rsFxjcmTmV-Y72Pg==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzc2NzAzOTc1LDczMjAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOSw2XSxudWxsLDIsbnVsbCwiZW4iLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCwxXSwiaHR0cHM6Ly9wYWludC50b3lzL29pbC8iLG51bGwsW1s4LCJkQVhjd3BCMW5WVSJdLFs5LCJlbi1HQiJdLFsxOCwiW1tbbnVsbCwyNzQ1XV1dIl0sWzM1LCIxNzc2NzAzOTc0Il0sWzE5LCIyIl0sWzE3LCJbMF0iXSxbMjQsImRmZWYuY29tbGluay1pdC5jb20uYXUiXSxbMjksImZhbHNlIl1dXQ

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.183.46 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

7a3987e3a0dedf5c9b50c2d3e25ebb75581c4eea231b6402319bf7bf4b6d7aa2

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-gOd6lju54CFJW-wxXnDR9g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 20 Apr 2026 16:52:55 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzj6mHU4pJicNGQYjhx6zbTBSBuvXmOdToQlyw6z9oGxF1APAeIDRUusToD8Yf6y6w_gLhI4gprCxB_qrrBKlJ9gzWcy4ctHoi_FfuycZT4sp2Y4sd2C4ifAPE3IGZ568-mdjSAzQKIF04LZFsJxHdigtieAPGp1cFsl4BYiIfj-eaZ59kEOh53TmdW0kjKL4xPzs8rKcpMKi3JL0pLTkstTi0qSy2KNzIwMjMwMbTUMzCPLzAAAFT3TWo"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-gOd6lju54CFJW-wxXnDR9g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 9D65 22 KB
8 KB 329ms
138ms Document
text/html 2.18.109.37
Akamai Technologies

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fpbs.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.05eaa3284c60ad6e334d.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.109.37 Sydney, Australia, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-109-37.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 18236b81f82dd31b2cee21fbb9fbc39e6d3a590a88cc2c99242c633db70a5010

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

accept-ranges: bytes
cache-control: max-age=166773
content-encoding: gzip
content-length: 7463
content-type: text/html
date: Mon, 20 Apr 2026 16:52:56 GMT
expires: Wed, 22 Apr 2026 15:12:29 GMT
last-modified: Mon, 13 Apr 2026 10:17:03 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 / Show response
d0.eu-3-id5-sync.com/ 1 B
143 B 1603ms
776ms Fetch
text/plain 51.195.73.74
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://d0.eu-3-id5-sync.com/
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 51.195.73.74 , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip74.ip-51-195-73.eu
Software: /
Resource Hash: d4735e3a265e16eee03f59718b9b5d03019c07d8b6c51f90da3a666eec13ab35

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

access-control-allow-headers: *
access-control-max-age: 3600
access-control-allow-origin: *
content-length: 1
content-type: text/plain
access-control-allow-methods: GET, OPTIONS

GET
H2 200 / Show response
d1.eu-3-id5-sync.com/ 1 B
143 B 1502ms
725ms Fetch
text/plain 51.195.127.100
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://d1.eu-3-id5-sync.com/
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 51.195.127.100 , Germany, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip100.ip-51-195-127.eu
Software: /
Resource Hash: f67ab10ad4e4c53121b6a5fe4da9c10ddee905b978d3788d2723d7bfacbe28a9

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

access-control-allow-headers: *
access-control-max-age: 3600
access-control-allow-origin: *
content-length: 1
content-type: text/plain
access-control-allow-methods: GET, OPTIONS

GET
H2 200 / Show response
d2.eu-3-id5-sync.com/ 1 B
143 B 1540ms
767ms Fetch
text/plain 51.195.73.74
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://d2.eu-3-id5-sync.com/
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 51.195.73.74 , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip74.ip-51-195-73.eu
Software: /
Resource Hash: d4735e3a265e16eee03f59718b9b5d03019c07d8b6c51f90da3a666eec13ab35

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

access-control-allow-headers: *
access-control-max-age: 3600
access-control-allow-origin: *
content-length: 1
content-type: text/plain
access-control-allow-methods: GET, OPTIONS

GET
H2 200 / Show response
d3.eu-3-id5-sync.com/ 1 B
143 B 1555ms
728ms Fetch
text/plain 135.125.145.78
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://d3.eu-3-id5-sync.com/
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 135.125.145.78 , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip78.ip-135-125-145.eu
Software: /
Resource Hash: ef2d127de37b942baad06145e54b0c619a1f22327b2ebbcfbec78f5564afe39d

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

access-control-allow-headers: *
access-control-max-age: 3600
access-control-allow-origin: *
content-length: 1
content-type: text/plain
access-control-allow-methods: GET, OPTIONS

GET
H2 200 / Show response
d4.eu-3-id5-sync.com/ 1 B
143 B 1593ms
771ms Fetch
text/plain 51.195.126.30
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://d4.eu-3-id5-sync.com/
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 51.195.126.30 , Germany, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip30.ip-51-195-126.eu
Software: /
Resource Hash: 7902699be42c8a8e46fbbb4501726517e86b22c56a189f7625a6da49081b2451

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

access-control-allow-headers: *
access-control-max-age: 3600
access-control-allow-origin: *
content-length: 1
content-type: text/plain
access-control-allow-methods: GET, OPTIONS

GET
H2 200 / Show response
d5.eu-3-id5-sync.com/ 1 B
143 B 1594ms
771ms Fetch
text/plain 135.125.140.162
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://d5.eu-3-id5-sync.com/
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 135.125.140.162 , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip162.ip-135-125-140.eu
Software: /
Resource Hash: 3f39d5c348e5b79d06e842c114e6cc571583bbf44e4b0ebfda1a01ec05745d43

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

access-control-allow-headers: *
access-control-max-age: 3600
access-control-allow-origin: *
content-length: 1
content-type: text/plain
access-control-allow-methods: GET, OPTIONS

GET
H2 200 / Show response
d6.eu-3-id5-sync.com/ 1 B
143 B 1494ms
721ms Fetch
text/plain 51.195.126.30
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://d6.eu-3-id5-sync.com/
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 51.195.126.30 , Germany, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip30.ip-51-195-126.eu
Software: /
Resource Hash: 7902699be42c8a8e46fbbb4501726517e86b22c56a189f7625a6da49081b2451

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

access-control-allow-headers: *
access-control-max-age: 3600
access-control-allow-origin: *
content-length: 1
content-type: text/plain
access-control-allow-methods: GET, OPTIONS

GET
H2 200 / Show response
d7.eu-3-id5-sync.com/ 1 B
143 B 1585ms
766ms Fetch
text/plain 51.195.127.100
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://d7.eu-3-id5-sync.com/
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 51.195.127.100 , Germany, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip100.ip-51-195-127.eu
Software: /
Resource Hash: f67ab10ad4e4c53121b6a5fe4da9c10ddee905b978d3788d2723d7bfacbe28a9

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

access-control-allow-headers: *
access-control-max-age: 3600
access-control-allow-origin: *
content-length: 1
content-type: text/plain
access-control-allow-methods: GET, OPTIONS

GET
H2 200 / Show response
d0.eu-4-id5-sync.com/ 1 B
143 B 1543ms
769ms Fetch
text/plain 51.195.34.220
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://d0.eu-4-id5-sync.com/
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 51.195.34.220 , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip220.ip-51-195-34.eu
Software: /
Resource Hash: 559aead08264d5795d3909718cdd05abd49572e84fe55590eef31a88a08fdffd

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

access-control-allow-headers: *
access-control-max-age: 3600
access-control-allow-origin: *
content-length: 1
content-type: text/plain
access-control-allow-methods: GET, OPTIONS

GET
H2 200 / Show response
d1.eu-4-id5-sync.com/ 1 B
143 B 1593ms
772ms Fetch
text/plain 135.125.145.78
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://d1.eu-4-id5-sync.com/
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 135.125.145.78 , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip78.ip-135-125-145.eu
Software: /
Resource Hash: ef2d127de37b942baad06145e54b0c619a1f22327b2ebbcfbec78f5564afe39d

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

access-control-allow-headers: *
access-control-max-age: 3600
access-control-allow-origin: *
content-length: 1
content-type: text/plain
access-control-allow-methods: GET, OPTIONS

GET
H2 200 / Show response
d2.eu-4-id5-sync.com/ 1 B
143 B 1547ms
726ms Fetch
text/plain 51.195.115.36
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://d2.eu-4-id5-sync.com/
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 51.195.115.36 , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip36.ip-51-195-115.eu
Software: /
Resource Hash: 4b227777d4dd1fc61c6f884f48641d02b4d121d3fd328cb08b5531fcacdabf8a

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

access-control-allow-headers: *
access-control-max-age: 3600
access-control-allow-origin: *
content-length: 1
content-type: text/plain
access-control-allow-methods: GET, OPTIONS

GET
H2 200 / Show response
d3.eu-4-id5-sync.com/ 1 B
143 B 1540ms
722ms Fetch
text/plain 51.195.115.36
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://d3.eu-4-id5-sync.com/
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 51.195.115.36 , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip36.ip-51-195-115.eu
Software: /
Resource Hash: 4b227777d4dd1fc61c6f884f48641d02b4d121d3fd328cb08b5531fcacdabf8a

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

access-control-allow-headers: *
access-control-max-age: 3600
access-control-allow-origin: *
content-length: 1
content-type: text/plain
access-control-allow-methods: GET, OPTIONS

GET
H2 200 / Show response
d4.eu-4-id5-sync.com/ 1 B
143 B 1503ms
727ms Fetch
text/plain 51.195.126.30
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://d4.eu-4-id5-sync.com/
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 51.195.126.30 , Germany, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip30.ip-51-195-126.eu
Software: /
Resource Hash: 7902699be42c8a8e46fbbb4501726517e86b22c56a189f7625a6da49081b2451

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

access-control-allow-headers: *
access-control-max-age: 3600
access-control-allow-origin: *
content-length: 1
content-type: text/plain
access-control-allow-methods: GET, OPTIONS

GET
H2 200 / Show response
d5.eu-4-id5-sync.com/ 1 B
143 B 1585ms
768ms Fetch
text/plain 135.125.146.80
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://d5.eu-4-id5-sync.com/
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 135.125.146.80 , Germany, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip80.ip-135-125-146.eu
Software: /
Resource Hash: df7e70e5021544f4834bbee64a9e3789febc4be81470df629cad6ddb03320a5c

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

access-control-allow-headers: *
access-control-max-age: 3600
access-control-allow-origin: *
content-length: 1
content-type: text/plain
access-control-allow-methods: GET, OPTIONS

GET
H2 200 / Show response
d6.eu-4-id5-sync.com/ 1 B
143 B 1562ms
734ms Fetch
text/plain 51.195.127.115
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://d6.eu-4-id5-sync.com/
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 51.195.127.115 , Germany, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip115.ip-51-195-127.eu
Software: /
Resource Hash: 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

access-control-allow-headers: *
access-control-max-age: 3600
access-control-allow-origin: *
content-length: 1
content-type: text/plain
access-control-allow-methods: GET, OPTIONS

GET
H2 200 / Show response
d7.eu-4-id5-sync.com/ 1 B
143 B 1539ms
768ms Fetch
text/plain 51.195.126.30
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://d7.eu-4-id5-sync.com/
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 51.195.126.30 , Germany, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip30.ip-51-195-126.eu
Software: /
Resource Hash: 7902699be42c8a8e46fbbb4501726517e86b22c56a189f7625a6da49081b2451

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

access-control-allow-headers: *
access-control-max-age: 3600
access-control-allow-origin: *
content-length: 1
content-type: text/plain
access-control-allow-methods: GET, OPTIONS

GET
H3 200 favicon.ico Show response
ad.doubleclick.net/ 1 KB
129 B 194ms
194ms Fetch
image/x-icon 142.250.195.230
Google LLC

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.997994125374312

Requested by

Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.195.230 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

592.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Tue, 21 Apr 2026 16:52:55 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 20 Apr 2026 16:52:55 GMT
content-type: image/x-icon
vary: Accept-Encoding
last-modified: Tue, 08 May 2012 13:08:06 GMT
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 usync.js Show response
eus.rubiconproject.com/ Frame 59A6 45 KB
0 173ms
173ms Script
text/html 23.221.133.65
Akamai Technologies

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.221.133.65 Sydney, Australia, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-221-133-65.deploy.static.akamaitechnologies.com
Software: Apache/2.4.65 (Debian) / PHP/8.3.24
Resource Hash: 8ada07e886cb52e101be8dfebd437d41ba30f743edfb13d59f91bff13d65ce26

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://eus.rubiconproject.com/usync.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: max-age=42943
content-encoding: gzip
expires: Tue, 21 Apr 2026 04:48:37 GMT
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
content-length: 11524
date: Mon, 20 Apr 2026 16:52:54 GMT
last-modified: Mon, 20 Apr 2026 04:48:37 GMT
x-powered-by: PHP/8.3.24
server: Apache/2.4.65 (Debian)
content-type: text/html;charset=UTF-8
vary: Accept-Encoding

GET
H2 200 usync.js Show response
eus.rubiconproject.com/ Frame A1C3 45 KB
0 173ms
173ms Script
text/html 23.221.133.65
Akamai Technologies

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.221.133.65 Sydney, Australia, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-221-133-65.deploy.static.akamaitechnologies.com
Software: Apache/2.4.65 (Debian) / PHP/8.3.24
Resource Hash: 8ada07e886cb52e101be8dfebd437d41ba30f743edfb13d59f91bff13d65ce26

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://eus.rubiconproject.com/usync.html?p=gumgum
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: max-age=42943
content-encoding: gzip
expires: Tue, 21 Apr 2026 04:48:37 GMT
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
content-length: 11524
date: Mon, 20 Apr 2026 16:52:54 GMT
last-modified: Mon, 20 Apr 2026 04:48:37 GMT
x-powered-by: PHP/8.3.24
server: Apache/2.4.65 (Debian)
content-type: text/html;charset=UTF-8
vary: Accept-Encoding

GET
H2 204 p
rp.liadm.com/ 0
34 B 380ms
379ms Image
text/plain 100.30.164.107
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://rp.liadm.com/p?dtstmp=1776703975956&did=did-0046&se=e30&duid=8e413bd09c43--01kpnwy9r9yjj46pfmg6dpg3g6&tv=10.23.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fdfef.comlink-it.com.au%2F&cd=.paint.toys
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 100.30.164.107 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-100-30-164-107.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

date: Mon, 20 Apr 2026 16:52:56 GMT

GET
H2 204 p
rp.liadm.com/ 0
34 B 294ms
293ms Image
text/plain 100.30.164.107
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://rp.liadm.com/p?dtstmp=1776703975957&did=did-0046&se=e30&duid=8e413bd09c43--01kpnwy9r9yjj46pfmg6dpg3g6&tv=10.23.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&ae=eyJtZXNzYWdlIjoiIiwibmFtZSI6IkFqYXhGYWlsZWQiLCJzdGFja1RyYWNlIjoiQWpheEZhaWxlZFxuICAgIGF0IEkgKGh0dHBzOi8vY2RuLmludGVyZ2llbnQuY29tL3ByZWJpZC9wcmViaWQuMDVlYWEzMjg0YzYwYWQ2ZTMzNGQuanM6MjoxNzAzNTgpXG4gICAgYXQgeC5lbWl0RXJyb3IgKGh0dHAuLi4iLCJmaWxlTmFtZSI6InVuZGVmaW5lZCJ9&wpn=prebid&refr=https%3A%2F%2Fdfef.comlink-it.com.au%2F&cd=.paint.toys
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 100.30.164.107 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-100-30-164-107.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

date: Mon, 20 Apr 2026 16:52:56 GMT

GET
H2 200 json Show response
gum.criteo.com/sid/ Frame 0A4D 2 KB
2 KB 146ms
145ms Fetch
application/json 182.161.73.131
CRITEO-AS-AP Crit...

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=criteoPrebidAdapter&domain=paint.toys&sn=ChromeSyncframe&so=0&topUrl=paint.toys

Requested by

Host: gum.criteo.com
URL: https://gum.criteo.com/syncframe?origin=criteoPrebidAdapter&topUrl=paint.toys&gpp=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.131 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

244127a88c33bb3dea0a54c9c7faa9d67ae3128e6a165ead2c20e7a207a2ef37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://gum.criteo.com/syncframe?origin=criteoPrebidAdapter&topUrl=paint.toys&gpp=
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
server-processing-duration-in-ticks: 1280948
expires: 0
date: Mon, 20 Apr 2026 16:52:55 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

GET
H2 200 async_usersync Show response
ib.adnxs.com/ Frame CC32 0
796 B 369ms
179ms Script
text/html 103.43.90.179
Xandr Inc.

General

Check archive.org

Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

103.43.90.179 Singapore, Singapore, ASN29990 (ASN-APPNEXUS - Xandr Inc., US),

Reverse DNS

Software

nginx/1.25.5 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin: 103.108.231.228; 103.108.231.228; 592.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid: 821ac1f7-9733-419a-b08b-ad3a1d6538fa
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Mon, 20 Apr 2026 16:52:56 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.25.5

POST
H3 204 AGSKWxVuJFFXduKo2aJb8kTVnUk03fCwleh0G3m6f7NOm6ztdVBYggmwG19E3LOpl9HI34DkB3P8_oKmrn8vkEf80a_0UBgq0-rGXu9iU2UjR0kr2ryjj0O5FsIZhTYmrtZruEhxkEzgdQ== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 438ms
437ms XHR
text/html 142.250.183.46
Google LLC

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxVuJFFXduKo2aJb8kTVnUk03fCwleh0G3m6f7NOm6ztdVBYggmwG19E3LOpl9HI34DkB3P8_oKmrn8vkEf80a_0UBgq0-rGXu9iU2UjR0kr2ryjj0O5FsIZhTYmrtZruEhxkEzgdQ==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.183.46 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

ec2-98-82-158-241.compute-1.amazonaws.com

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-K7AYJr854aN-a4-vIwzfHQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type: text/plain
sec-ch-ua-mobile: ?0

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 20 Apr 2026 16:52:56 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjMtDikmJw0JBi-FB_mfUHEIdz-bDFA_HCaYFsK4H4TkwQ2xMgPrU6mO0SEAvxcLzYPPM8m0DHwfuTGJVckvIL45Pz80pS80p0E1OKdUHsosyk0pL8IhR2ahlIRU5-enpmXnq8kYGRmYGJoZmegXl8gQEAkx8wGw"
content-security-policy: script-src 'report-sample' 'nonce-K7AYJr854aN-a4-vIwzfHQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H3

200

setuid
prebid.intergient.com/ Frame 3797
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=&khaos=MO7FO87F-20-8IVF
https://prebid.intergient.com/setuid?bidder=rubicon&uid=MO7FO87F-20-8IVF

0
1 KB

341ms
288ms

Image
text/html

104.18.20.56
Cloudflare

General

Check archive.org

Download Go to Show image

Full URL: https://prebid.intergient.com/setuid?bidder=rubicon&uid=MO7FO87F-20-8IVF
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H3
Server: 104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","endpoints":[{"url":"https://nel.heroku.com/reports?s=tJd0nID%2F9gQ%2FlKg4ShdfLexJiz9E7gQn8OHAvJCykEk%3D\u0026sid=1b10b0ff-8a76-4548-befa-353fc6c6c045\u0026ts=1776703976"}],"max_age":3600}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Mon, 20 Apr 2026 16:52:56 GMT
content-type: text/html
vary: Accept-Encoding, Origin
priority: u=3,i
reporting-endpoints: heroku-nel="https://nel.heroku.com/reports?s=tJd0nID%2F9gQ%2FlKg4ShdfLexJiz9E7gQn8OHAvJCykEk%3D&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&ts=1776703976"
cache-control: no-cache, no-store, must-revalidate
nel: {"report_to":"heroku-nel","response_headers":["Via"],"max_age":3600,"success_fraction":0.01,"failure_fraction":0.1}
pragma: no-cache
via: 2.0 heroku-router
cf-ray: 9ef5a98e8840863d-PER
server: cloudflare

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://prebid.intergient.com/setuid?bidder=rubicon&uid=MO7FO87F-20-8IVF
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: f60a7260b0ebb7a40a81234af4a9e826
content-length: 0
Content-Type: text/html

GET
H2 200 pbs_sync Show response
sync.cootlogix.com/api/user/html/ Frame 4DAE 4 KB
5 KB 769ms
549ms Document
text/html 134.209.66.79
DigitalOcean

General

Check archive.org

Download Go to

Full URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fpbs.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D&gpp=&gpp_sid=
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.05eaa3284c60ad6e334d.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 134.209.66.79 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
Software: /
Resource Hash: 27cebd489d6bd6f558f52fcf204952698b20a0acf5bbe32eb53cfb594809a2de

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
content-length: 4490
content-type: text/html
date: Mon, 20 Apr 2026 16:52:56 GMT
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"

GET
H/1.1 200
OK geo Show response
ut.pubmatic.com/ Frame 9D65 22 B
257 B 330ms
141ms XHR
application/json 67.199.150.77
PubMatic

General

Check archive.org

Download Go to

Full URL

https://ut.pubmatic.com/geo?pubid=0

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fpbs.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

67.199.150.77 Singapore, Singapore, ASN62713 (AS-PUBMATIC - PubMatic, Inc., US),

Reverse DNS

Software

Resource Hash

3e448774ba2817d085dfdd3cf021098a286343ee7f916df7c4a05217511b199b

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400; includeSubDomains

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

Strict-Transport-Security: max-age=16070400; includeSubDomains
Access-Control-Allow-Origin: *
Cache-Control: max-age=172800
Content-Length: 22
Date: Mon, 20 Apr 2026 16:52:56 GMT
Content-Type: application/json

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 3797
Redirect Chain

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1
https://ups.analytics.yahoo.com/ups/58912/cms?uid=iuw5UyPOCRUsZ7-rwS7Fmcn5EUdSAgOZEtemQ7w0kco&csrc=
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-bii5r4xE2oITlPw8RVo6qZWbeyHLMQB65gPjgw--~A

42 B
1 KB

296ms
275ms

Image
image/gif

69.173.158.64
Magnite

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-bii5r4xE2oITlPw8RVo6qZWbeyHLMQB65gPjgw--~A
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 69.173.158.64 Singapore, Singapore, ASN26667 (RUBICONPROJECT - Magnite, Inc., US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: d264e84c9dc1a645a3048554992c5d82
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
location: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-bii5r4xE2oITlPw8RVo6qZWbeyHLMQB65gPjgw--~A
age: 0
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Mon, 20 Apr 2026 16:52:56 GMT
content-type: text/html
server: ATS

GET
H/1.1

200

dcm
aax-eu.amazon-adsystem.com/s/ Frame 3797
Redirect Chain

https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=
https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=&dcc=t

43 B
853 B

427ms
426ms

Image
image/gif

52.95.115.196
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL

https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=&dcc=t

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

HTTP/1.1

Server

52.95.115.196 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: 0G41SJAAPM854BATS5W2
Content-Length: 43
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Mon, 20 Apr 2026 16:52:57 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

Redirect headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Location: https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=&dcc=t
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: HJSDN8CJVR152CPYQS9R
Content-Length: 0
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Mon, 20 Apr 2026 16:52:57 GMT
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 3797
Redirect Chain

https://match.adsrvr.org/track/cmf/rubicon
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=be2730b2-4a29-4f94-a883-ae0394c883c4&gdpr=0&gdpr_consent=&expires=30

42 B
1 KB

377ms
231ms

Image
image/gif

69.173.158.64
Magnite

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=be2730b2-4a29-4f94-a883-ae0394c883c4&gdpr=0&gdpr_consent=&expires=30
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 69.173.158.64 Singapore, Singapore, ASN26667 (RUBICONPROJECT - Magnite, Inc., US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 0ed95c36ed1932be3ba76fc523a6e179
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

location: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=be2730b2-4a29-4f94-a883-ae0394c883c4&gdpr=0&gdpr_consent=&expires=30
content-length: 289
date: Mon, 20 Apr 2026 16:52:56 GMT
server: Kestrel

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 3797
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc&process_consent=T
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEOpVz4gkbPj7GBwiJ3ApfYM&google_cver=1

42 B
1 KB

143ms
142ms

Image
image/gif

69.173.158.64
Magnite

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEOpVz4gkbPj7GBwiJ3ApfYM&google_cver=1
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 69.173.158.64 Singapore, Singapore, ASN26667 (RUBICONPROJECT - Magnite, Inc., US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 548ddf114c6f6bfbb66a4cdeb6a219f4
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEOpVz4gkbPj7GBwiJ3ApfYM&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 326
date: Mon, 20 Apr 2026 16:52:56 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

usersync
sync.springserve.com/ Frame 3797
Redirect Chain

https://pixel.rubiconproject.com/token?pid=52948
https://sync.springserve.com/usersync?aid=1000025&uuid=MO7FO87F-20-8IVF

43 B
206 B

1276ms
629ms

Image
image/gif

35.173.163.251
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://sync.springserve.com/usersync?aid=1000025&uuid=MO7FO87F-20-8IVF
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 35.173.163.251 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-35-173-163-251.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

access-control-allow-origin: *
content-length: 43
date: Mon, 20 Apr 2026 16:52:57 GMT
content-type: image/gif
server: nginx
access-control-allow-credentials: true
access-control-allow-methods: GET, OPTIONS

Redirect headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
Location: https://sync.springserve.com/usersync?aid=1000025&uuid=MO7FO87F-20-8IVF
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: c80248407eff6cf595ce43a76c04e23f
Pragma: no-cache
content-length: 0

GET
H2

200

setuid
px.ads.linkedin.com/ Frame 3797
Redirect Chain

https://token.rubiconproject.com/token?pid=36584
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=MO7FO87F-20-8IVF

0
470 B

401ms
354ms

Image
text/plain

150.171.22.12
Microsoft Corpora...

General

Check archive.org

Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=MO7FO87F-20-8IVF
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 150.171.22.12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lor1-x
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
x-msedge-ref: Ref A: 784174C5CC2642AAB6EA52039E8F191B Ref B: PER201000404029 Ref C: 2026-04-20T16:52:56Z
x-li-fabric: prod-lor1
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-uuid: AAZP5yFlCAAwE+FVPsa5bg==
x-li-proto: http/2
alt-svc: h3=":443"; ma=86400
x-cache: CONFIG_NOCACHE
content-length: 0
date: Mon, 20 Apr 2026 16:52:56 GMT

Redirect headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
Location: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=MO7FO87F-20-8IVF
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 550b0c1400f70e56269f7c1848fb3166
Pragma: no-cache
content-length: 0

GET
H/1.1

200

ecm3
s.amazon-adsystem.com/ Frame 3797
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=a9us
https://s.amazon-adsystem.com/ecm3?id=MO7FO87F-20-8IVF&ex=d-rubiconproject.com&status=ok

43 B
477 B

836ms
300ms

Image
image/gif

98.82.158.241
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?id=MO7FO87F-20-8IVF&ex=d-rubiconproject.com&status=ok

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

HTTP/1.1

Server

98.82.158.241 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: VCCTHFYH6D763JBX8TRY
Content-Length: 43
Date: Mon, 20 Apr 2026 16:52:57 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://s.amazon-adsystem.com/ecm3?id=MO7FO87F-20-8IVF&ex=d-rubiconproject.com&status=ok
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: d335433bbbe0efeac67146df47932f6f
content-length: 0
Content-Type: text/html

GET
H/1.1

200

dcm
s.amazon-adsystem.com/ Frame 3797
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=
https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&dcc=t

43 B
853 B

655ms
560ms

Image
image/gif

98.82.158.241
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&dcc=t

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

HTTP/1.1

Server

98.82.158.241 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-98-82-158-241.compute-1.amazonaws.com

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: PWW969ZHGP1QDBWZHCPJ
Content-Length: 43
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Mon, 20 Apr 2026 16:52:57 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

Redirect headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Location: https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&dcc=t
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: 56R6VXS2A50V1ZS1HMCZ
Content-Length: 0
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Mon, 20 Apr 2026 16:52:57 GMT
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

GET
H/1.1

204
No Content

esync
token.rubiconproject.com/ Frame 3797
Redirect Chain

https://id.rlcdn.com/709414.gif
https://token.rubiconproject.com/esync?pid=28028&puid=&pt=e

0
214 B

142ms
142ms

Image
text/plain

69.173.158.64
Magnite

General

Check archive.org

Download Go to Show image

Full URL: https://token.rubiconproject.com/esync?pid=28028&puid=&pt=e
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 69.173.158.64 Singapore, Singapore, ASN26667 (RUBICONPROJECT - Magnite, Inc., US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 0d2bd05215470efb17ae41aff76c3f98
Pragma: no-cache

Redirect headers

cache-control: no-cache, no-store
timing-allow-origin: *
location: https://token.rubiconproject.com/esync?pid=28028&puid=&pt=e
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 0
date: Mon, 20 Apr 2026 16:52:56 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3797
Redirect Chain

https://token.rubiconproject.com/token?pid=25470
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TU83Rk84N0YtMjAtOElWRg==
https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEGVFVX4oUgbDnL5E5dtXKHQ&google_cver=1
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TU83Rk84N0YtMjAtOElWRg==&google_push=

170 B
188 B

592ms
592ms

Image
image/png

142.250.195.130
Google LLC

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TU83Rk84N0YtMjAtOElWRg==&google_push=

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

142.250.195.130 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Mon, 20 Apr 2026 16:52:57 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TU83Rk84N0YtMjAtOElWRg==&google_push=
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: cc2b9026541f49c9c095b4cedfcedb9a
content-length: 0
Content-Type: text/html

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3797
Redirect Chain

https://token.rubiconproject.com/token?pid=2249&pt=n
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=ZmU0ZmMyNDE4MDFiZThiYWM4ZTdhZDhhYWI1MzJiYmFjM2U4OTFkOA

170 B
188 B

596ms
596ms

Image
image/png

142.250.195.130
Google LLC

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=ZmU0ZmMyNDE4MDFiZThiYWM4ZTdhZDhhYWI1MzJiYmFjM2U4OTFkOA

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

142.250.195.130 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

ec2-13-228-29-185.ap-southeast-1.compute.amazonaws.com

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Mon, 20 Apr 2026 16:52:57 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
Location: https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=ZmU0ZmMyNDE4MDFiZThiYWM4ZTdhZDhhYWI1MzJiYmFjM2U4OTFkOA
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: f60a7260b0ebb7a40a81234af4a9e826
Pragma: no-cache
content-length: 0

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 3797
Redirect Chain

https://match.prod.bidr.io/cookie-sync/rp?bee_sync_partners=rp
https://match.prod.bidr.io/cookie-sync/rp?bee_sync_partners=rp&_bee_ppp=1
https://pixel.rubiconproject.com/tap.php?v=183462&nid=4114&put=AAtGLE7TzLQAAAA8OC9tMw&expires=30

42 B
1 KB

142ms
141ms

Image
image/gif

69.173.158.64
Magnite

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=183462&nid=4114&put=AAtGLE7TzLQAAAA8OC9tMw&expires=30
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 69.173.158.64 Singapore, Singapore, ASN26667 (RUBICONPROJECT - Magnite, Inc., US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: c80248407eff6cf595ce43a76c04e23f
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

strict-transport-security: max-age=2592000; includeSubDomains
location: https://pixel.rubiconproject.com/tap.php?v=183462&nid=4114&put=AAtGLE7TzLQAAAA8OC9tMw&expires=30
content-length: 0
date: Mon, 20 Apr 2026 16:52:57 GMT
server: gunicorn

GET
H2

204

magnite
sync.a-mo.net/setuid/ Frame 3797
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-adaptmx
https://sync.a-mo.net/setuid/magnite?uid=MO7FO87F-20-8IVF

0
715 B

415ms
226ms

Image
text/plain

131.153.206.100
PHOENIXNAP-AS-SG1...

General

Check archive.org

Download Go to Show image

Full URL: https://sync.a-mo.net/setuid/magnite?uid=MO7FO87F-20-8IVF
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 131.153.206.100 , United States, ASN59210 (PHOENIXNAP-AS-SG1 PhoenixNAP, SG),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

cache-control: max-age=0, private, must-revalidate
date: Mon, 20 Apr 2026 16:52:56 GMT
x-envoy-upstream-service-time: 1
vary: accept-encoding, Accept-Encoding
server: envoy

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://sync.a-mo.net/setuid/magnite?uid=MO7FO87F-20-8IVF
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: da1c8a4a3f9301c03fbeb7a6212a0a54
content-length: 0
Content-Type: text/html

GET
H2

200

v1
match.sharethrough.com/sync/ Frame 3797
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=18694
https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=MO7FO87F-20-8IVF

68 B
323 B

425ms
315ms

Image
image/png

13.228.29.185
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL

https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=MO7FO87F-20-8IVF

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

13.228.29.185 Singapore, Singapore, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

Software

Resource Hash

6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=MO7FO87F-20-8IVF
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 550b0c1400f70e56269f7c1848fb3166
content-length: 0
Content-Type: text/html

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 3797
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=${ADELPHIC_CUID}&expires=30
https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=f1a9ff44-de8b-4598-a51b-eb13724eeb37&expires=30

42 B
1 KB

141ms
141ms

Image
image/gif

69.173.158.64
Magnite

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=f1a9ff44-de8b-4598-a51b-eb13724eeb37&expires=30
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 69.173.158.64 Singapore, Singapore, ASN26667 (RUBICONPROJECT - Magnite, Inc., US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: beb52df1a5a4b2f2cb3f37642c514298
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

X-CI-RTID: ebee0fca-fce6-4b14-a384-bc72bca9d790
Location: https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=f1a9ff44-de8b-4598-a51b-eb13724eeb37&expires=30
Content-Length: 144
Date: Mon, 20 Apr 2026 16:52:58 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET

ProfilesEngineServlet
sync.intentiq.com/profiles_engine/ Frame 3797
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=primis
https://live.primis.tech/live/liveCS.php?source=external&advId=100&advUuid=MO7FO87F-20-8IVF
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1725065545&3rdpcid=MO7FO87F-20-8IVF

0
0

GET
H/1.1 200
OK geo Show response
ut.pubmatic.com/ Frame 3699 22 B
257 B 378ms
143ms XHR
application/json 67.199.150.77
PubMatic

General

Check archive.org

Download Go to

Full URL

https://ut.pubmatic.com/geo?pubid=158326

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

67.199.150.77 Singapore, Singapore, ASN62713 (AS-PUBMATIC - PubMatic, Inc., US),

Reverse DNS

Software

Resource Hash

3e448774ba2817d085dfdd3cf021098a286343ee7f916df7c4a05217511b199b

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400; includeSubDomains

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

Strict-Transport-Security: max-age=16070400; includeSubDomains
Access-Control-Allow-Origin: *
Cache-Control: max-age=172800
Content-Length: 22
Date: Mon, 20 Apr 2026 16:52:56 GMT
Content-Type: application/json

GET
H2 200 setUser Show response
script-api.ccgateway.net/ 0
360 B 294ms
294ms Script
text/javascript 3.237.175.195
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/setUser?parent=5bb3e20859&site=paint.toys&ccuid=24a089b9-cb71-43bf-bbb6-23891fda6bbd&ccsid=98ea34d9-59c9-4202-a61a-ac0636a8e090
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.237.175.195 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-3-237-175-195.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: private,max-age=300
content-length: 0
date: Mon, 20 Apr 2026 16:52:56 GMT
content-type: text/javascript

GET
H2 200 bundle Show response
script-api.ccgateway.net/script/ 16 KB
5 KB 541ms
540ms Script
text/javascript 3.237.175.195
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/script/bundle?id=paint.toys&parentId=5bb3e20859
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.237.175.195 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-3-237-175-195.compute-1.amazonaws.com
Software: /
Resource Hash: c879e20b7fd8e872a394d588a3363a46561ca1bd1bdaabee0d213d4f429a4ed9

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: public,max-age=1200
content-encoding: gzip
date: Mon, 20 Apr 2026 16:52:56 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 bundle.js Show response
ib.3lift.com/rev/4c6c75912057371d1d0b66b02e3ef937c80969e8/dist/ Frame 61F9 308 KB
86 KB 169ms
168ms Script
text/javascript 18.67.93.105
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://ib.3lift.com/rev/4c6c75912057371d1d0b66b02e3ef937c80969e8/dist/bundle.js
Requested by: Host: ib.3lift.com
URL: https://ib.3lift.com/ttj?inv_code=pwm_general_RON_hdx&tid=206229
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.67.93.105 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-18-67-93-105.syd62.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 302628786e330f55b59a1dbd7363870620a6ff1594acd08b1e835d297f36af99

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

vary: Accept-Encoding
cache-control: max-age=31536000, immutable
content-encoding: br
etag: W/"4125bd90c6036079429513c5bda4c5f1"
age: 1124332
via: 1.1 3437ef72cec711eb0ebed9222a22cf66.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: QhQ0ID5spOSPUGLpA2dsD61VUj0nkP_tV0VxESjLOTFY-jrl9LZLYQ==
date: Tue, 07 Apr 2026 16:34:05 GMT
content-type: text/javascript
last-modified: Tue, 07 Apr 2026 16:30:54 GMT
server: AmazonS3
x-amz-cf-pop: SYD62-P1
x-amz-server-side-encryption: AES256

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame D8C4 1 KB
837 B 96ms
96ms Document
text/html 142.250.195.162
Google LLC

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com
URL: https://f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.195.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

bea1c5ab168f662fc9eb5bda3474e5b1bbd0d3ecc1d9c68e2a753f613c2ae0c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

age: 38620
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 812
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 20 Apr 2026 06:09:16 GMT
etag: 9725182468138058862
expires: Tue, 21 Apr 2026 06:09:16 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2

204

match
ssp-sync.criteo.com/user-sync/
Redirect Chain

https://x.bidswitch.net/sync?ssp=criteo&custom_data=VR53t194RldIczZhaE8yb2o4SGtWSkN6aU81bUdYR2kwVFl6NGZlOG5oQmJzWkxFJTNE&gpp=&gpp_sid=&gdpr=0&gdpr_consent=&us_privacy=&cr_user_id=k-ULZGycqv6wej5OHz...
https://x.bidswitch.net/ul_cb/sync?ssp=criteo&custom_data=VR53t194RldIczZhaE8yb2o4SGtWSkN6aU81bUdYR2kwVFl6NGZlOG5oQmJzWkxFJTNE&gpp=&gpp_sid=&gdpr=0&gdpr_consent=&us_privacy=&cr_user_id=k-ULZGycqv6w...
https://ssp-sync.criteo.com/user-sync/match?p=VR53t194RldIczZhaE8yb2o4SGtWSkN6aU81bUdYR2kwVFl6NGZlOG5oQmJzWkxFJTNE&u=58e0ad7d-0115-4499-a988-b8e035941e43

0
255 B

140ms
139ms

Image
text/plain

182.161.73.164
CRITEO-AS-AP Crit...

General

Check archive.org

Download Go to Show image

Full URL

https://ssp-sync.criteo.com/user-sync/match?p=VR53t194RldIczZhaE8yb2o4SGtWSkN6aU81bUdYR2kwVFl6NGZlOG5oQmJzWkxFJTNE&u=58e0ad7d-0115-4499-a988-b8e035941e43

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

182.161.73.164 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-store,max-age=0
x-criteo-endpoint-version: none
cross-origin-resource-policy: cross-origin
x-criteo-endpoint-action: StoreMatchResult
x-criteo-endpoint-controller: UserSync
date: Mon, 20 Apr 2026 16:52:56 GMT
server: Kestrel

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: //ssp-sync.criteo.com/user-sync/match?p=VR53t194RldIczZhaE8yb2o4SGtWSkN6aU81bUdYR2kwVFl6NGZlOG5oQmJzWkxFJTNE&u=58e0ad7d-0115-4499-a988-b8e035941e43
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 20 Apr 2026 16:52:57 GMT

GET
H2

204

match
ssp-sync.criteo.com/user-sync/
Redirect Chain

https://secure.adnxs.com/getuid?https%3a%2f%2fssp-sync.criteo.com%2fuser-sync%2fmatch%3fp%3dU5Jmo19Ya05ZbHpRejZQSFdlTHVRWmRHaFNkWkZkY0U2TyUyQndFTjZLMEZ2eGZaOU0lM0Q%26u%3d%24UID&gdpr=0&gdpr_consent=
https://ssp-sync.criteo.com/user-sync/match?p=U5Jmo19Ya05ZbHpRejZQSFdlTHVRWmRHaFNkWkZkY0U2TyUyQndFTjZLMEZ2eGZaOU0lM0Q&u=8615208052258340763&gdpr=0&gdpr_consent=

0
256 B

571ms
290ms

Image
text/plain

182.161.73.164
CRITEO-AS-AP Crit...

General

Check archive.org

Download Go to Show image

Full URL

https://ssp-sync.criteo.com/user-sync/match?p=U5Jmo19Ya05ZbHpRejZQSFdlTHVRWmRHaFNkWkZkY0U2TyUyQndFTjZLMEZ2eGZaOU0lM0Q&u=8615208052258340763&gdpr=0&gdpr_consent=

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

182.161.73.164 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-store,max-age=0
x-criteo-endpoint-version: none
cross-origin-resource-policy: cross-origin
x-criteo-endpoint-action: StoreMatchResult
x-criteo-endpoint-controller: UserSync
date: Mon, 20 Apr 2026 16:52:56 GMT
server: Kestrel

Redirect headers

cache-control: no-store, no-cache, private
location: https://ssp-sync.criteo.com/user-sync/match?p=U5Jmo19Ya05ZbHpRejZQSFdlTHVRWmRHaFNkWkZkY0U2TyUyQndFTjZLMEZ2eGZaOU0lM0Q&u=8615208052258340763&gdpr=0&gdpr_consent=
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 103.108.231.228; 103.108.231.228; 839.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 95fd982e-9958-4d59-89c8-53e6e48cb62a
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Mon, 20 Apr 2026 16:52:56 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.25.5

GET
H2

204

match
ssp-sync.criteo.com/user-sync/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=commerce_grid_dbm&google_hm=k-ULZGycqv6wej5OHzks9EzrWBLDdwrEPruU9FMw&google_cm&google_redir=https%3a%2f%2fssp-sync.criteo.com%2fuser-sync%2fmatch%3fp%3...
https://ssp-sync.criteo.com/user-sync/match?p=1_t08F9KTiUyQkZBJTJCaGttOERZVEhtTUxHeWVOTURQT3dkZU5YU2dTc1ZUeFpuNW1adyUzRA&u=CAESEF0Fwk6_7QpOw7Q3zcdahdE&gdpr=0&gdpr_consent=&google_cver=1

0
255 B

479ms
292ms

Image
text/plain

182.161.73.164
CRITEO-AS-AP Crit...

General

Check archive.org

Download Go to Show image

Full URL

https://ssp-sync.criteo.com/user-sync/match?p=1_t08F9KTiUyQkZBJTJCaGttOERZVEhtTUxHeWVOTURQT3dkZU5YU2dTc1ZUeFpuNW1adyUzRA&u=CAESEF0Fwk6_7QpOw7Q3zcdahdE&gdpr=0&gdpr_consent=&google_cver=1

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

182.161.73.164 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-store,max-age=0
x-criteo-endpoint-version: none
cross-origin-resource-policy: cross-origin
x-criteo-endpoint-action: StoreMatchResult
x-criteo-endpoint-controller: UserSync
date: Mon, 20 Apr 2026 16:52:56 GMT
server: Kestrel

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ssp-sync.criteo.com/user-sync/match?p=1_t08F9KTiUyQkZBJTJCaGttOERZVEhtTUxHeWVOTURQT3dkZU5YU2dTc1ZUeFpuNW1adyUzRA&u=CAESEF0Fwk6_7QpOw7Q3zcdahdE&gdpr=0&gdpr_consent=&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 398
date: Mon, 20 Apr 2026 16:52:56 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

bidder-initiated
ssp-sync.criteo.com/user-sync/
Redirect Chain

https://ad.turn.com/r/cs?pid=75&us_privacy=&gdpr=0&gdpr_consent=
https://ssp-sync.criteo.com/user-sync/bidder-initiated?gdpr_consent=&gdpr=0&us_privacy=&dsp=11&buyer_id=8941175861696558629

0
269 B

186ms
186ms

Image
text/plain

182.161.73.164
CRITEO-AS-AP Crit...

General

Check archive.org

Download Go to Show image

Full URL

https://ssp-sync.criteo.com/user-sync/bidder-initiated?gdpr_consent=&gdpr=0&us_privacy=&dsp=11&buyer_id=8941175861696558629

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

182.161.73.164 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-store,max-age=0
x-criteo-endpoint-version: none
cross-origin-resource-policy: cross-origin
x-criteo-endpoint-action: BidderInitiatedRedirectMode
x-criteo-endpoint-controller: UserSync
content-length: 0
date: Mon, 20 Apr 2026 16:52:55 GMT
server: Kestrel

Redirect headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Location: https://ssp-sync.criteo.com/user-sync/bidder-initiated?gdpr_consent=&gdpr=0&us_privacy=&dsp=11&buyer_id=8941175861696558629
P3P: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
Content-Length: 0
Date: Mon, 20 Apr 2026 16:52:56 GMT
Pragma: no-cache
Connection: keep-alive

GET
H2

200

bidder-initiated
ssp-sync.criteo.com/user-sync/
Redirect Chain

https://ds.uncn.jp/mg/0/sync_push
https://ssp-sync.criteo.com/user-sync/bidder-initiated?dsp=479&buyer_id=v_f35be829-2a6a-49e8-ae8e-ea8d75dbcb72

0
269 B

155ms
155ms

Image
text/plain

182.161.73.164
CRITEO-AS-AP Crit...

General

Check archive.org

Download Go to Show image

Full URL

https://ssp-sync.criteo.com/user-sync/bidder-initiated?dsp=479&buyer_id=v_f35be829-2a6a-49e8-ae8e-ea8d75dbcb72

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

182.161.73.164 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-store,max-age=0
x-criteo-endpoint-version: none
cross-origin-resource-policy: cross-origin
x-criteo-endpoint-action: BidderInitiatedRedirectMode
x-criteo-endpoint-controller: UserSync
content-length: 0
date: Mon, 20 Apr 2026 16:52:56 GMT
server: Kestrel

Redirect headers

location: https://ssp-sync.criteo.com/user-sync/bidder-initiated?dsp=479&buyer_id=v_f35be829-2a6a-49e8-ae8e-ea8d75dbcb72
content-length: 137
date: Mon, 20 Apr 2026 16:52:56 GMT
content-type: text/html; charset=utf-8
server: Apache

GET e805be652c9053b8f771665f0ac3c361.gif
cs.admanmedia.com/ 0
0

GET
H2

204

match
ssp-sync.criteo.com/user-sync/
Redirect Chain

https://t.adx.opera.com/pub/sync?pubid=pub13186530141056&gdpr=0&consent=&us_privacy=&gpp=&gpp_sid=&custom_data=R3WDx19vTFVlYUNVc0p1WDFCWnI4a2FYZVNZMmM0ajhsNU1nazI4THhnS1U2Q0xrJTNE
https://www.temu.com/api/adx/cm/pixel-opera?adx_uid=f85d6cc1c0e416a0&gdpr=0&gdpr_consent=&us_privacy=&redir=https%3A%2F%2Ft.oa.opera.com%2Fsync%3Fvendor%3D60369%26pubid%3Dpub13186530141056%26gdpr%3...
https://t.oa.opera.com/sync?vendor=60369&pubid=pub13186530141056&gdpr=0&consent=&us_privacy=&custom_data=R3WDx19vTFVlYUNVc0p1WDFCWnI4a2FYZVNZMmM0ajhsNU1nazI4THhnS1U2Q0xrJTNE
https://ssp-sync.criteo.com/user-sync/match?p=R3WDx19vTFVlYUNVc0p1WDFCWnI4a2FYZVNZMmM0ajhsNU1nazI4THhnS1U2Q0xrJTNE&u=OPU82a7d236c0704693aa0debc57f703bb2

0
255 B

141ms
140ms

Image
text/plain

182.161.73.164
CRITEO-AS-AP Crit...

General

Check archive.org

Download Go to Show image

Full URL

https://ssp-sync.criteo.com/user-sync/match?p=R3WDx19vTFVlYUNVc0p1WDFCWnI4a2FYZVNZMmM0ajhsNU1nazI4THhnS1U2Q0xrJTNE&u=OPU82a7d236c0704693aa0debc57f703bb2

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

182.161.73.164 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-store,max-age=0
x-criteo-endpoint-version: none
cross-origin-resource-policy: cross-origin
x-criteo-endpoint-action: StoreMatchResult
x-criteo-endpoint-controller: UserSync
date: Mon, 20 Apr 2026 16:52:58 GMT
server: Kestrel

Redirect headers

Cache-Control: no-cache, no-store, must-revalidate
Location: https://ssp-sync.criteo.com/user-sync/match?p=R3WDx19vTFVlYUNVc0p1WDFCWnI4a2FYZVNZMmM0ajhsNU1nazI4THhnS1U2Q0xrJTNE&u=OPU82a7d236c0704693aa0debc57f703bb2
Pragma: no-cache
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: POST, GET, OPTIONS
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Access-Control-Allow-Origin: *
Content-Length: 179
Date: Mon, 20 Apr 2026 16:52:58 GMT
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Headers: Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With

GET
H/1.1 200
OK geo Show response
ut.pubmatic.com/ Frame 9D65 22 B
0 234ms
234ms XHR
application/json 67.199.150.77
PubMatic

General

Check archive.org

Download Go to

Full URL: https://ut.pubmatic.com/geo?pubid=0
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fpbs.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 67.199.150.77 Singapore, Singapore, ASN62713 (AS-PUBMATIC - PubMatic, Inc., US),
Reverse DNS
Software: /
Resource Hash: 3e448774ba2817d085dfdd3cf021098a286343ee7f916df7c4a05217511b199b

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

Access-Control-Allow-Origin: *
Cache-Control: max-age=172800
Content-Length: 22
Date: Mon, 20 Apr 2026 16:52:56 GMT
Content-Type: application/json

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
133 B 52ms
51ms Fetch
image/gif 172.66.148.140
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=2&e=0.5824980270124843
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.66.148.140 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 926304
x-goog-stored-content-encoding: identity
expires: Thu, 09 Apr 2026 23:47:53 GMT
x-goog-stored-content-length: 43
date: Mon, 20 Apr 2026 16:52:56 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH8-8d6tsHANUa2r84JrwjQITmm63V7aSPrfwA9n_jkotwDDYByg5ASpAwhKW45wurAfWr-QyLYc
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9ef5a98b7e31cf9d-PER
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H/1.1 200
OK geo Show response
ut.pubmatic.com/ Frame 3699 22 B
0 282ms
282ms XHR
application/json 67.199.150.77
PubMatic

General

Check archive.org

Download Go to

Full URL: https://ut.pubmatic.com/geo?pubid=158326
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 67.199.150.77 Singapore, Singapore, ASN62713 (AS-PUBMATIC - PubMatic, Inc., US),
Reverse DNS
Software: /
Resource Hash: 3e448774ba2817d085dfdd3cf021098a286343ee7f916df7c4a05217511b199b

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

Access-Control-Allow-Origin: *
Cache-Control: max-age=172800
Content-Length: 22
Date: Mon, 20 Apr 2026 16:52:56 GMT
Content-Type: application/json

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame D8C4
Redirect Chain

https://px.ads.linkedin.com/setuid?partner=googleadxdb&google_gid=CAESENkCcxycqNaidKBlDJje6KY&google_cver=1&google_push=AXcoOmTA_3ZR1ugWqu-7CEa7w0schpDK4sMsYB097gRZb9HQIU9fznZUA-M7fcDqyZesvwj0Jp95L...
https://cm.g.doubleclick.net/pixel?google_nid=linkedin&google_push=AXcoOmTA_3ZR1ugWqu-7CEa7w0schpDK4sMsYB097gRZb9HQIU9fznZUA-M7fcDqyZesvwj0Jp95L3d187LzYJc6LH_w-r_G3ma5btjZiFwGkDTE7bMrZqNuSpoQxVCpkf...

170 B
232 B

667ms
667ms

Image
image/png

142.250.195.130
Google LLC

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=linkedin&google_push=AXcoOmTA_3ZR1ugWqu-7CEa7w0schpDK4sMsYB097gRZb9HQIU9fznZUA-M7fcDqyZesvwj0Jp95L3d187LzYJc6LH_w-r_G3ma5btjZiFwGkDTE7bMrZqNuSpoQxVCpkfEMRvLZBt7aVTwswgPIeH26iQ

Requested by

Host: f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com
URL: https://f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Server

142.250.195.130 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Mon, 20 Apr 2026 16:52:57 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
location: https://cm.g.doubleclick.net/pixel?google_nid=linkedin&google_push=AXcoOmTA_3ZR1ugWqu-7CEa7w0schpDK4sMsYB097gRZb9HQIU9fznZUA-M7fcDqyZesvwj0Jp95L3d187LzYJc6LH_w-r_G3ma5btjZiFwGkDTE7bMrZqNuSpoQxVCpkfEMRvLZBt7aVTwswgPIeH26iQ
x-msedge-ref: Ref A: 8CEFCDBAD2DA4E5B8B49430A69937505 Ref B: PER201000404029 Ref C: 2026-04-20T16:52:56Z
x-li-fabric: prod-lva1
x-li-uuid: AAZP5yFlVXpq5V3UNZWcYA==
x-li-proto: http/2
alt-svc: h3=":443"; ma=86400
x-cache: CONFIG_NOCACHE
content-length: 0
date: Mon, 20 Apr 2026 16:52:56 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D8C4
Redirect Chain

https://ads.travelaudience.com/google_pixel?google_gid=CAESEG1GccxYJyKfiNzZU4DEiBc&google_cver=1&google_push=AXcoOmTMmgX7KvBfrcknQ7CrHIf8XIe1DBcPUlvSh35e26ISNLhBnV92pYkfAgOOIt2upflC8tnqNIC6qWB4Aige...
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=15NCDOrkQS8gb07tiNh8Bg&google_push=AXcoOmTMmgX7KvBfrcknQ7CrHIf8XIe1DBcPUlvSh35e26ISNLhBnV92pYkfAgOOIt2upflC8tnqNIC6qWB4Aige9QTKKckOnwGOHrR...

170 B
188 B

344ms
343ms

Image
image/png

142.250.195.130
Google LLC

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=15NCDOrkQS8gb07tiNh8Bg&google_push=AXcoOmTMmgX7KvBfrcknQ7CrHIf8XIe1DBcPUlvSh35e26ISNLhBnV92pYkfAgOOIt2upflC8tnqNIC6qWB4Aige9QTKKckOnwGOHrRzXY0FB0LbkBrwYy830LEOwND36gdB-NcbbDTy-4jp9BFJ1WVlZqo

Requested by

Host: f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com
URL: https://f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Server

142.250.195.130 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Mon, 20 Apr 2026 16:52:57 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=15NCDOrkQS8gb07tiNh8Bg&google_push=AXcoOmTMmgX7KvBfrcknQ7CrHIf8XIe1DBcPUlvSh35e26ISNLhBnV92pYkfAgOOIt2upflC8tnqNIC6qWB4Aige9QTKKckOnwGOHrRzXY0FB0LbkBrwYy830LEOwND36gdB-NcbbDTy-4jp9BFJ1WVlZqo
x-host: tde-deliveryengine-production-db998cd68-kj4q7
via: 1.1 google
x-engine-version: 0.0.0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR LAW CUR DEV PSA PSD IVA OUR BUS UNI COM NAV INT CNT LOC"
date: Mon, 20 Apr 2026 16:52:56 GMT
server: nginx

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D8C4
Redirect Chain

https://match.prod.bidr.io/cookie-sync/adx?google_gid=CAESENoT8I75f2C8vtI4cHwKqok&google_cver=1&google_push=AXcoOmS394f-YH3wyC7cEBhf98Cz6HtAGTZi4cfA8FTIaKpSgc0AJE3m1rnc7EbxJ4EJuYs6W3XkXlEbtxMdJyM4o...
https://match.prod.bidr.io/cookie-sync/adx?google_gid=CAESENoT8I75f2C8vtI4cHwKqok&google_cver=1&google_push=AXcoOmS394f-YH3wyC7cEBhf98Cz6HtAGTZi4cfA8FTIaKpSgc0AJE3m1rnc7EbxJ4EJuYs6W3XkXlEbtxMdJyM4o...
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFxMFRVN1R6TFFBQUFDV1pvT1M5dw&google_push=AXcoOmS394f-YH3wyC7cEBhf98Cz6HtAGTZi4cfA8FTIaKpSgc0AJE3m1rnc7EbxJ4EJuYs6W3XkX...

170 B
188 B

324ms
323ms

Image
image/png

142.250.195.130
Google LLC

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFxMFRVN1R6TFFBQUFDV1pvT1M5dw&google_push=AXcoOmS394f-YH3wyC7cEBhf98Cz6HtAGTZi4cfA8FTIaKpSgc0AJE3m1rnc7EbxJ4EJuYs6W3XkXlEbtxMdJyM4o8FXeXWmq5KI7O6JM444AugfoPCc6GhFScuP1xoye9n462wor6N6f20ABu888h7LsA&bee_sync_partners=&bee_sync_current_partner=adx&bee_sync_hop_count=1

Requested by

Host: f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com
URL: https://f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Server

142.250.195.130 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Mon, 20 Apr 2026 16:52:57 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

strict-transport-security: max-age=2592000; includeSubDomains
location: https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFxMFRVN1R6TFFBQUFDV1pvT1M5dw&google_push=AXcoOmS394f-YH3wyC7cEBhf98Cz6HtAGTZi4cfA8FTIaKpSgc0AJE3m1rnc7EbxJ4EJuYs6W3XkXlEbtxMdJyM4o8FXeXWmq5KI7O6JM444AugfoPCc6GhFScuP1xoye9n462wor6N6f20ABu888h7LsA&bee_sync_partners=&bee_sync_current_partner=adx&bee_sync_hop_count=1
content-length: 0
date: Mon, 20 Apr 2026 16:52:57 GMT
server: gunicorn

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D8C4
Redirect Chain

https://dsp.adkernel.com/sync?exchange=11&google_gid=CAESEN81_rvUpuYRSXRtyYy15Y8&google_cver=1&google_push=AXcoOmREw4QWDPvS9Lm-79le_w5Z0QyPpvjrGgdDnPerpRCgxYfMLblbbti74NcOpIxq0AQ1gMCiX8f2nWQkCwZJ3m...
https://cm.g.doubleclick.net/pixel?google_nid=adkernel&google_hm=QTE3MTcyODQ5ODU5MDM4MDczNw&google_push=AXcoOmREw4QWDPvS9Lm-79le_w5Z0QyPpvjrGgdDnPerpRCgxYfMLblbbti74NcOpIxq0AQ1gMCiX8f2nWQkCwZJ3mvq_...

170 B
188 B

529ms
529ms

Image
image/png

142.250.195.130
Google LLC

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=adkernel&google_hm=QTE3MTcyODQ5ODU5MDM4MDczNw&google_push=AXcoOmREw4QWDPvS9Lm-79le_w5Z0QyPpvjrGgdDnPerpRCgxYfMLblbbti74NcOpIxq0AQ1gMCiX8f2nWQkCwZJ3mvq_GCFf4HcPHeE-dcoqfO2tKViw7nNfdQ66s6LVslKFDoG5A3-eVkywkykC5aGNho

Requested by

Host: f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com
URL: https://f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Server

142.250.195.130 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Mon, 20 Apr 2026 16:52:57 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=adkernel&google_hm=QTE3MTcyODQ5ODU5MDM4MDczNw&google_push=AXcoOmREw4QWDPvS9Lm-79le_w5Z0QyPpvjrGgdDnPerpRCgxYfMLblbbti74NcOpIxq0AQ1gMCiX8f2nWQkCwZJ3mvq_GCFf4HcPHeE-dcoqfO2tKViw7nNfdQ66s6LVslKFDoG5A3-eVkywkykC5aGNho
Content-Length: 0
Date: Mon, 20 Apr 2026 16:52:57 GMT
Server: nginx
Connection: keep-alive

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D8C4
Redirect Chain

https://analytics.pangle-ads.com/api/ad/union/gg_cookie_matching?google_gid=CAESEGJR7YKh0kVGWuWfnKgjNJE&google_cver=1&google_push=AXcoOmSjhO_aIVthEhwAlDtV_0WQh4CA5J53jvfUv2nWCKRG_nyZDRXDg2eGnlSj4Ao...
https://cm.g.doubleclick.net/pixel?google_nid=toutiao_usd&google_push=AXcoOmSjhO_aIVthEhwAlDtV_0WQh4CA5J53jvfUv2nWCKRG_nyZDRXDg2eGnlSj4Aop9nWGNMbO-m4IRsT8WXMRulLqDlMslc12ivrETqTgVUkKo9USIPeSYWrB_pw...

170 B
188 B

231ms
230ms

Image
image/png

142.250.195.130
Google LLC

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=toutiao_usd&google_push=AXcoOmSjhO_aIVthEhwAlDtV_0WQh4CA5J53jvfUv2nWCKRG_nyZDRXDg2eGnlSj4Aop9nWGNMbO-m4IRsT8WXMRulLqDlMslc12ivrETqTgVUkKo9USIPeSYWrB_pwAOGDBEW2YlEDGj12DvYXnDdJ0AGo

Requested by

Host: f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com
URL: https://f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Server

142.250.195.130 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Mon, 20 Apr 2026 16:52:57 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

access-control-max-age: 86400
x-cache-remote: TCP_MISS from a23-55-100-208.deploy.akamaitechnologies.com (AkamaiGHost/22.5.0-aaef44c942a33f2d231f7120051a5b09) (-)
x-bytefaas-request-id: 202604201652573D5F2C85E67B5E6530EF
access-control-allow-methods: *
expires: Mon, 20 Apr 2026 16:52:57 GMT
server-timing: cdn-cache; desc=MISS, edge; dur=71, origin; dur=14, inner; dur=5
x-cache: TCP_MISS from a23-35-16-208.deploy.akamaitechnologies.com (AkamaiGHost/22.5.0-aaef44c942a33f2d231f7120051a5b09) (-)
date: Mon, 20 Apr 2026 16:52:57 GMT
x-akamai-request-id: 8a698b99.53b5bdd2
x-bytefaas-execution-duration: 4.19
access-control-allow-headers: *
x-tt-trace-host: 01405f44059684132047a41c4e1495a8a19b2016cd01db3c74159379c1148506c1c07c33d422662b3145b8b3d59894da22c57bf820508d163b4fabb23280f2f0aa27d7cf6c55730a0c172a0105037c78611b21db06f041fab98394a009df0be427a2d4cff3e25eba645c15278f51d71b9a
x-origin-response-time: 15,23.55.100.208
cache-control: max-age=0, no-cache, no-store
location: https://cm.g.doubleclick.net/pixel?google_nid=toutiao_usd&google_push=AXcoOmSjhO_aIVthEhwAlDtV_0WQh4CA5J53jvfUv2nWCKRG_nyZDRXDg2eGnlSj4Aop9nWGNMbO-m4IRsT8WXMRulLqDlMslc12ivrETqTgVUkKo9USIPeSYWrB_pwAOGDBEW2YlEDGj12DvYXnDdJ0AGo
pragma: no-cache
x-gw-dst-psm: ad.union.pangle_web_traffic
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
access-control-allow-credentials: true
access-control-allow-origin: *
x-tt-trace-id: 00-2604201652573D5F2C85E67B5E6530EF-44B76FFF10FBD690-00
content-length: 0
x-parent-response-time: 85,23.35.16.208
x-tt-logid: 202604201652573D5F2C85E67B5E6530EF
server: nginx

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D8C4
Redirect Chain

https://ms-cookie-sync.presage.io/user-sync?partner=googleob&google_push=AXcoOmRcEHtONvyblXi8zaSipJ3bTSolkrfEif9MuhnK6Ebn7pDs1wW0bHNJro6GIOjKPqsth6TgHC9HkwmTTBHQ33AzLlu4O9rbm_IjD2SkUqig08Q8JfpOSkZZ...
https://cm.g.doubleclick.net/pixel?gdpr=0&gdpr_consent=&google_nid=ogury_ltd&google_hm=a95543db-9f00-4057-98ae-c54c07de6e58&google_push=AXcoOmRcEHtONvyblXi8zaSipJ3bTSolkrfEif9MuhnK6Ebn7pDs1wW0bHNJr...

170 B
188 B

507ms
507ms

Image
image/png

142.250.195.130
Google LLC

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?gdpr=0&gdpr_consent=&google_nid=ogury_ltd&google_hm=a95543db-9f00-4057-98ae-c54c07de6e58&google_push=AXcoOmRcEHtONvyblXi8zaSipJ3bTSolkrfEif9MuhnK6Ebn7pDs1wW0bHNJro6GIOjKPqsth6TgHC9HkwmTTBHQ33AzLlu4O9rbm_IjD2SkUqig08Q8JfpOSkZZ3ma6XZaCyTbGRZY_n1e9BUV4G7JgK_EE

Requested by

Host: f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com
URL: https://f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Server

142.250.195.130 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Mon, 20 Apr 2026 16:52:57 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

expires: Thu, 01 Jan 1970 00:00:00 GMT
cache-control: no-cache, no-store, no-transform, must-revalidate, private, max-age=0
location: https://cm.g.doubleclick.net/pixel?gdpr=0&gdpr_consent=&google_nid=ogury_ltd&google_hm=a95543db-9f00-4057-98ae-c54c07de6e58&google_push=AXcoOmRcEHtONvyblXi8zaSipJ3bTSolkrfEif9MuhnK6Ebn7pDs1wW0bHNJro6GIOjKPqsth6TgHC9HkwmTTBHQ33AzLlu4O9rbm_IjD2SkUqig08Q8JfpOSkZZ3ma6XZaCyTbGRZY_n1e9BUV4G7JgK_EE
content-length: 331
date: Mon, 20 Apr 2026 16:52:56 GMT
pragma: no-cache
content-type: text/html; charset=utf-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D8C4
Redirect Chain

https://cm-mx.advolve.io/pixel?google_gid=CAESEOgnTenslflmk9bN4fOgvhM&google_cver=1&google_push=AXcoOmT0ZkI07hM9oZtGDVQ_vNdZwjJ6vvSBjZJiqjwVcNV1RcaK6-TewdCOR_XoM2HeuFN_0QMhAJyPZ8HYlkAeRgf4JdW3-0DGV...
https://cm.g.doubleclick.net/pixel?google_nid=advolve&google_push=AXcoOmT0ZkI07hM9oZtGDVQ_vNdZwjJ6vvSBjZJiqjwVcNV1RcaK6-TewdCOR_XoM2HeuFN_0QMhAJyPZ8HYlkAeRgf4JdW3-0DGVMZU7KwJzGLXskpsbQy7MRL8UqJMv53...

170 B
188 B

343ms
342ms

Image
image/png

142.250.195.130
Google LLC

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=advolve&google_push=AXcoOmT0ZkI07hM9oZtGDVQ_vNdZwjJ6vvSBjZJiqjwVcNV1RcaK6-TewdCOR_XoM2HeuFN_0QMhAJyPZ8HYlkAeRgf4JdW3-0DGVMZU7KwJzGLXskpsbQy7MRL8UqJMv53IaHFBk1pl9eACq1SD40rE_VQi&google_hm=69e659e96de5ab43648e1632&google_ula=9190312969

Requested by

Host: f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com
URL: https://f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Server

142.250.195.130 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Mon, 20 Apr 2026 16:52:57 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=advolve&google_push=AXcoOmT0ZkI07hM9oZtGDVQ_vNdZwjJ6vvSBjZJiqjwVcNV1RcaK6-TewdCOR_XoM2HeuFN_0QMhAJyPZ8HYlkAeRgf4JdW3-0DGVMZU7KwJzGLXskpsbQy7MRL8UqJMv53IaHFBk1pl9eACq1SD40rE_VQi&google_hm=69e659e96de5ab43648e1632&google_ula=9190312969
Content-Length: 0
Date: Mon, 20 Apr 2026 16:52:57 GMT
x-envoy-upstream-service-time: 0
Server: nginx
Connection: keep-alive

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame D8C4 0
50 B 835ms
657ms Image
text/html 142.250.195.130
Google LLC

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KfE0gF9Jk5mo3N8NZRaIgIP0CSFM8t3gwpGlcCAnpPf7C0m0uGxJkVYLFV2_h22uUY-CkB7IW5

Requested by

Host: f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com
URL: https://f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.195.130 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Mon, 20 Apr 2026 16:52:57 GMT
x-xss-protection: 0
content-type: text/html
server: HTTP server (unknown)

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 61F9 0
0 315ms
314ms Fetch
image/gif 142.250.195.162
Google LLC

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=fle-fetch-start2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.195.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Mon, 20 Apr 2026 16:52:56 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 61F9 0
0 308ms
308ms Fetch
image/gif 142.250.195.162
Google LLC

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.195.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Mon, 20 Apr 2026 16:52:56 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
DATA 200
OK truncated
/ Frame 61F9 215 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d19548396c5b6c2c829ac9828511eead2b814303fd2f68d4a7bd6dbd5179b2d1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H3 200 reach_worklet.html Show response
www.googleadservices.com/pagead/managed/js/activeview/current/ Frame 87F7 93 B
93 B 384ms
194ms Document
text/html 172.217.25.194
Google LLC

General

Check archive.org

Download Go to

Full URL

https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.25.194 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

136b3dfa7c254f92a9a3513c191c87c05f7c7ff7f82c6d648a33496c3c380593

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=3600, stale-while-revalidate=3600
content-encoding: br
content-length: 69
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 20 Apr 2026 16:52:56 GMT
etag: 9658810392779322030
expires: Mon, 20 Apr 2026 16:52:56 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2

200

xuid
eb2.3lift.com/ Frame 8C3C
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=0&gdpr_consent=&gpp=&gpp_sid=
https://eb2.3lift.com/xuid?mid=3658&xuid=be2730b2-4a29-4f94-a883-ae0394c883c4&dongle=0cfd&gdpr=0&gdpr_consent=

37 B
249 B

343ms
342ms

Image
image/gif

47.131.64.132
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=3658&xuid=be2730b2-4a29-4f94-a883-ae0394c883c4&dongle=0cfd&gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Server: 47.131.64.132 Singapore, Singapore, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-47-131-64-132.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
date: Mon, 20 Apr 2026 16:52:56 GMT
content-type: image/gif

Redirect headers

location: https://eb2.3lift.com/xuid?mid=3658&xuid=be2730b2-4a29-4f94-a883-ae0394c883c4&dongle=0cfd&gdpr=0&gdpr_consent=
content-length: 251
date: Mon, 20 Apr 2026 16:52:56 GMT
server: Kestrel

GET
H2

200

xuid
eb2.3lift.com/ Frame 8C3C
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEIlOnjUqYxgOKPXnBiCSL0M&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1

37 B
249 B

283ms
283ms

Image
image/gif

47.131.64.132
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEIlOnjUqYxgOKPXnBiCSL0M&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Server: 47.131.64.132 Singapore, Singapore, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-47-131-64-132.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
date: Mon, 20 Apr 2026 16:52:56 GMT
content-type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEIlOnjUqYxgOKPXnBiCSL0M&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 332
date: Mon, 20 Apr 2026 16:52:56 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 8C3C
Redirect Chain

https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NDQ4NDk3NTc1NDU2NjgxMDQzNjg4Ng%3D%3D

170 B
232 B

551ms
551ms

Image
image/png

142.250.195.130
Google LLC

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NDQ4NDk3NTc1NDU2NjgxMDQzNjg4Ng%3D%3D

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?

Protocol

Server

142.250.195.130 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

ec2-54-80-176-179.compute-1.amazonaws.com

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Mon, 20 Apr 2026 16:52:57 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

date: Mon, 20 Apr 2026 16:52:56 GMT
location: https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NDQ4NDk3NTc1NDU2NjgxMDQzNjg4Ng%3D%3D
content-length: 0

GET
H2 200 setuid
px.ads.linkedin.com/ Frame 8C3C 0
655 B 273ms
267ms Image
text/plain 150.171.22.12
Microsoft Corpora...

General

Check archive.org

Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=4484975754566810436886&dbredirect=true&gdpr=0&consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 150.171.22.12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: DEF89BF8ED8D49EDA3C1C10713CB5474 Ref B: PER201000404029 Ref C: 2026-04-20T16:52:56Z
x-li-fabric: prod-lor1
x-li-uuid: AAZP5yFlB1KTaB62qf3U1w==
x-li-proto: http/2
alt-svc: h3=":443"; ma=86400
x-cache: CONFIG_NOCACHE
content-length: 0
date: Mon, 20 Apr 2026 16:52:56 GMT

GET
H2

204

ebda
eb2.3lift.com/ Frame 8C3C
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NDQ4NDk3NTc1NDU2NjgxMDQzNjg4Ng%3D%3D
https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=

0
153 B

177ms
177ms

Image
text/plain

47.131.64.132
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Server: 47.131.64.132 Singapore, Singapore, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-47-131-64-132.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

date: Mon, 20 Apr 2026 16:52:57 GMT

Redirect headers

cache-control: no-cache, must-revalidate
location: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 248
date: Mon, 20 Apr 2026 16:52:57 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET setuid
pbs.yahoo.com/ Frame 8C3C 0
0

GET
H/1.1 200
OK 88342
i.liadm.com/s/ Frame 8C3C 0
208 B 1218ms
293ms Image
text/plain 54.80.176.179
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL

https://i.liadm.com/s/88342?bidder_id=246498&bidder_uuid=4484975754566810436886&gpp_s=&gpp_as=

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.80.176.179 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Length: 0
Date: Mon, 20 Apr 2026 16:52:57 GMT
trace-id: 16b9dbe1531cf53a
Request-Time: 0
Connection: keep-alive

GET
H/1.1 200
OK 88342
i.liadm.com/s/ Frame 8C3C 0
208 B 1222ms
295ms Image
text/plain 54.80.176.179
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL

https://i.liadm.com/s/88342?bidder_id=246498&bidder_uuid=4484975754566810436886

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.80.176.179 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-54-80-176-179.compute-1.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Length: 0
Date: Mon, 20 Apr 2026 16:52:57 GMT
trace-id: 13821d4bd20cc6dd
Request-Time: 0
Connection: keep-alive

GET
H2

200

xuid
eb2.3lift.com/ Frame 8C3C
Redirect Chain

https://ups.analytics.yahoo.com/ups/58932/cms?gdpr=0&gdpr_consent=&gpp=&gpp_sid=
https://eb2.3lift.com/xuid?mid=2662&xuid=y-HdHbz3VE2oRSl1BhF8csuE7Jc4nNpvje3C1zjVx9bA--~A&dongle=0883&gdpr=0

37 B
249 B

1197ms
1197ms

Image
image/gif

47.131.64.132
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2662&xuid=y-HdHbz3VE2oRSl1BhF8csuE7Jc4nNpvje3C1zjVx9bA--~A&dongle=0883&gdpr=0
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Server: 47.131.64.132 Singapore, Singapore, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-47-131-64-132.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
date: Mon, 20 Apr 2026 16:52:57 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
location: https://eb2.3lift.com/xuid?mid=2662&xuid=y-HdHbz3VE2oRSl1BhF8csuE7Jc4nNpvje3C1zjVx9bA--~A&dongle=0883&gdpr=0
age: 0
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Mon, 20 Apr 2026 16:52:56 GMT
content-type: text/html
server: ATS

GET
H2

200

xuid
eb2.3lift.com/ Frame 8C3C
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=13&gdpr=0&gdpr_consent=&gpp=&gpp_sid=
https://eb2.3lift.com/xuid?mid=2319&xuid=0-36992d2c-3698-502b-7371-c28fd150f468$ip$103.108.231.228&dongle=4430

37 B
249 B

1281ms
1281ms

Image
image/gif

47.131.64.132
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2319&xuid=0-36992d2c-3698-502b-7371-c28fd150f468$ip$103.108.231.228&dongle=4430
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Server: 47.131.64.132 Singapore, Singapore, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-47-131-64-132.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
date: Mon, 20 Apr 2026 16:52:59 GMT
content-type: image/gif

Redirect headers

Location: https://eb2.3lift.com/xuid?mid=2319&xuid=0-36992d2c-3698-502b-7371-c28fd150f468$ip$103.108.231.228&dongle=4430
Content-Length: 141
Date: Mon, 20 Apr 2026 16:52:58 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 9D65 2 KB
3 KB 378ms
143ms Script
text/html 67.199.150.81
PubMatic

General

Check archive.org

Download Go to

Full URL

https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=34435056&p=0&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

67.199.150.81 Singapore, Singapore, ASN62713 (AS-PUBMATIC - PubMatic, Inc., US),

Reverse DNS

Software

Resource Hash

4f143aa391444181e7bef4c274c479ce4bb33bf44a760492edaabe8cce3cd4c6

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400; includeSubDomains

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=16070400; includeSubDomains
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Mon, 20 Apr 2026 16:52:56 GMT
content-type: text/html; charset=UTF-8

GET
H3 200 favicon.ico Show response
ad.doubleclick.net/ 1 KB
129 B 194ms
194ms Fetch
image/x-icon 142.250.195.230
Google LLC

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.2518784235133398

Requested by

Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.195.230 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

a23-33-238-114.deploy.static.akamaitechnologies.com

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Tue, 21 Apr 2026 16:52:56 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 20 Apr 2026 16:52:56 GMT
content-type: image/x-icon
vary: Accept-Encoding
last-modified: Tue, 08 May 2012 13:08:06 GMT
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 notify
tlx.3lift.com/s2s/ Frame 61F9 37 B
191 B 247ms
246ms Image
image/gif 54.151.166.244
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://tlx.3lift.com/s2s/notify?px=1&pr=aeZZ5wABq5QGw08-AApvB2xjRzaQVoulMpfQ7A&ts=1776703975&aid=33384962471309340179540&ec=5563_66529_OADD2.7971509121968_1CM923YF36VLYINTTT&n=GrYDaHR0cHM6Ly93d3cuYmluZy5jb20vYXBpL3YxL21lZGlhdGlvbi90cmFja2luZz9hZFVuaXQ9MTE3MzAzNzQmYXVJZD1lZjhlYTAxNC1mZTA4LTQ5ZDAtYWRjNy04MGYyMWJhNGFjNzcmYmRjPWNoJmJpZElkPTImYmlkZGVySWQ9NCZjbUV4cElkPVJTViZpbXBJZD0xJmltcFR5PTEmbGRjPXhmb2N6ciZta3Q9ZW4tYXUmb0FkVW5pdD0xMTczMDM3NCZwSWQ9NSZwdWJsaXNoZXJJZD0yNTAxNTIyMzUmcklkPTg4ZDE1MTMzLWI2ZjYtNDFjMC1hNGFhLTBkNTI1MmQ1NWNhMSZyZWdpb249YXBhYyZydHlwZT1udXJsJnRhZ0lkPTM0MjI0JnRyYWZmaWNHcm91cD1nZXZjeXJ5dnNnX3BjeiZ0cmFmZmljU3ViR3JvdXA9ZXJmcmVpciZ1YmVyR3JvdXA9aG9yZV8zYyZ1YmVyU3ViR3JvdXA9cmFub3lyX2VybnFfZm5hdnEmYWlkPTMzMzg0OTYyNDcxMzA5MzQwMTc5NTQtOCZ3cD0wLjY08gL%2BAgjns5nPBhIXMzMzODQ5NjI0NzEzMDkzNDAxNzk1NDAYACABKLsrMOGHBEABSABQAWASaAhwk60VkAEAmAEAqAEAuAEKwAGmBMgBgAXwAZXLDPgBgAWAAqYEkQIAAAAAAADwP5kC1DVLyYjrwT%2BoAgCwAgHIAgLYAgD4AqU7kAMAmAMAoAMBqAMSqAMLuAMAyAMA0gMmT0FERDIuNzk3MTUwOTEyMTk2OF8xQ005MjNZRjM2VkxZSU5UVFTgA9uAp5UB6QMAAAAAAAAAAPADgAX5AwAAAAAAAAAAgAQJiQT2KFyPwvXYP7gE7SDABAjKBB8IAxkAAAAAAAAAACEAAAAAAAAAACl7FK5H4Xq0vzAA0AQA2gQZMzMzODQ5NjI0NzEzMDkzNDAxNzk1NDAgMeAEAPAEAIgFIJAFo0%2BaBRgzMzM4NDk2MjQ3MTMwOTM0MDE3OTU0LTiiBR4zMzM4NDk2MjQ3MTMwOTM0MDE3OTU0LTgtMC0wLTDQBQfYBRP4AgWIAwGSAwQ5ODk1mAMBoAOwiwKoAwC6Aw8xMDMuMTA4LjIzMS4yMjg%3D&b=1
Requested by: Host: f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com
URL: https://f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.151.166.244 Singapore, Singapore, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-54-151-166-244.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

expires: Thu, 15 Oct 1992 20:10:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
content-type: image/gif
vary: Accept-Encoding

GET
H2 200 dyn
eb2.3lift.com/ Frame 61F9 37 B
139 B 272ms
272ms Image
image/gif 47.131.64.132
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/dyn?long1=65846956&string1=33384962471309340179540&string3=safeframe&cb=49646
Requested by: Host: f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com
URL: https://f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 47.131.64.132 Singapore, Singapore, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-47-131-64-132.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
date: Mon, 20 Apr 2026 16:52:56 GMT
content-type: image/gif

GET
H2 200 r
eb2.3lift.com/ Frame 61F9 37 B
139 B 274ms
273ms Image
image/gif 47.131.64.132
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/r?inv_code=pwm_general_RON_hdx&aid=33384962471309340179540&rev=4c6c759&pr=can%27t%2520access%2520top%2520document&bc=0.64&bmid=5563&biid=7589&sid=66529&brid=349843&adid=OADD2.7971509121968_1CM923YF36VLYINTTT&crid=313114715&ts=1776703975&bcud=640&ss=5&dmp_ids=ChZodHRwczovL3BhaW50LnRveXMvb2lsEjEKCXB1YmNvbW1vbhIkM2QwZTBmMjMtNzVmMS00NTJhLWEzNzEtOWVhOGQwMDdkNmE5GgNiMjUgAA&dcr=4&unid=0&domain=f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com&ref=https%253A%252F%252Fpaint.toys%252F&rr=creative&fid=18&rb=8&g=0&tmplid=206229&rid=0&ft=5&cb=81711
Requested by: Host: f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com
URL: https://f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 47.131.64.132 Singapore, Singapore, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-47-131-64-132.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
date: Mon, 20 Apr 2026 16:52:56 GMT
content-type: image/gif

GET
H2 200 c.gif
www.bing.com/aes/ Frame 61F9 0
713 B 558ms
311ms Image
text/plain 23.33.238.114
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to Show image

Full URL: https://www.bing.com/aes/c.gif?DI=0&DIS=SB_2-1?&RG=4be469c70b8d4444a79799d50fb47a4b&SNR=1&GV=2&med=10
Requested by: Host: f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com
URL: https://f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.33.238.114 Sydney, Australia, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS: a23-33-238-114.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: private,no-store
x-cdn-traceid: 0.26672817.1776703976.38a9cb0f
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: A120656E42D1434A8D9BFC45DC2F327B Ref B: SYD281080705029 Ref C: 2026-04-20T16:52:56Z
alt-svc: h3=":443"; ma=93600
p3p: CP=BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo
content-length: 0
date: Mon, 20 Apr 2026 16:52:57 GMT
vary: Origin

GET
H2 200 tracking
www.bing.com/api/v1/mediation/ Frame 61F9 0
716 B 471ms
224ms Image
text/plain 23.33.238.114
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to Show image

Full URL

https://www.bing.com/api/v1/mediation/tracking?adUnit=11730374&auId=ef8ea014-fe08-49d0-adc7-80f21ba4ac77&bdc=ch&bidId=2&bidderId=4&cmExpId=RSV&impId=1&impTy=1&ldc=xfoczr&mkt=en-au&oAdUnit=11730374&pId=5&publisherId=250152235&rId=88d15133-b6f6-41c0-a4aa-0d5252d55ca1&region=apac&rtype=miFeedbackURL&tagId=34224&trafficGroup=gevcyryvsg_pcz&trafficSubGroup=erfreir&uberGroup=hore_3c&uberSubGroup=ranoyr_ernq_fnavq&aid=3338496247130934017954-8&wp=0.64

Requested by

Host: f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com
URL: https://f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.33.238.114 Sydney, Australia, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache, no-store, must-revalidate
x-cdn-traceid: 0.26672817.1776703976.38a9cae0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 5B7D6DE29012485C909AD441F700D2E8 Ref B: SYD281080708052 Ref C: 2026-04-20T16:52:56Z
expires: 0
alt-svc: h3=":443"; ma=93600
content-length: 0
date: Mon, 20 Apr 2026 16:52:56 GMT
vary: Origin

GET
H2 200 th
www.bing.com/ Frame 61F9 30 KB
30 KB 337ms
95ms Image
image/jpeg 23.33.238.114
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to Show image

Full URL: https://www.bing.com/th?id=OADD2.7971509121968_1CM923YF36VLYINTTT&pid=21.2&c=17&roil=0.1666&roit=0&roir=0.8333&roib=1&w=300&h=300&dynsize=1&qlt=90
Requested by: Host: f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com
URL: https://f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.33.238.114 Sydney, Australia, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS: a23-33-238-114.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: ad9cb290822b46c8c592a873344ac4aacb741fa6b9c04df0ec8f52de037b99fe

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: public, max-age=2592000
timing-allow-origin: *
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
httpcacheability: 4
x-cdn-traceid: 0.26672817.1776703976.38a9cae1
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=nadatio"}]}
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
alt-svc: h3=":443"; ma=93600
content-length: 30371
date: Mon, 20 Apr 2026 16:52:56 GMT
content-type: image/jpeg
access-control-allow-headers: *

GET
H2 200 blank
img.3lift.com/ Frame 61F9 66 B
386 B 426ms
183ms Image
image/webp 3.175.115.39
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://img.3lift.com/blank?width=300&height=300
Requested by: Host: f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com
URL: https://f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.175.115.39 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-3-175-115-39.syd3.r.cloudfront.net
Software: /
Resource Hash: 39c2d5fa064925ce0e02d0eafdb6f8cc5f3a439e037116e89cedad87f4ddc143

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: public, max-age=604800
age: 288325
via: 1.1 b089b00224a18e318b083bd54ec53538.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
content-length: 66
x-amz-cf-id: XwKor-3vortTQBO4hIE2bEJEVg9GD8WbNCvBHwvsUqBUTi6yRyKPNw==
date: Fri, 17 Apr 2026 08:47:31 GMT
content-type: image/webp
last-modified: Fri, 17 Apr 2026 08:47:31 GMT
vary: Accept
x-amz-cf-pop: SYD3-P3

GET
H3 200 OBA_TRANS.webp
ib.3lift.com/static/buttons/edaa/ Frame 61F9 208 B
569 B 95ms
94ms Image
binary/octet-stream 18.67.93.105
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://ib.3lift.com/static/buttons/edaa/OBA_TRANS.webp
Requested by: Host: f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com
URL: https://f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 18.67.93.105 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-18-67-93-105.syd62.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: ef4b78a58b8f3b34f204965b23f8a8b912773456cd41cfb1a3673ef21d0408db

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

etag: "9e70edee3068444b08fa30d1655c7cc5"
age: 225982
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: xA17jAb4PdKlwsfiOM9LNvI7UX2XJWjitMF-Y-2eR6zVUHbqX9CXjA==
date: Sat, 18 Apr 2026 02:06:35 GMT
content-type: binary/octet-stream
vary: Accept-Encoding
last-modified: Tue, 24 Mar 2026 14:53:08 GMT
cache-control: max-age=604800,s-maxage=604800,public
via: 1.1 a8d63eee2fd456f0e1e6772e38461220.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 208
x-amz-cf-pop: SYD62-P1
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H3 200 OBA_UK.webp
ib.3lift.com/static/buttons/edaa/ Frame 61F9 330 B
690 B 96ms
95ms Image
binary/octet-stream 18.67.93.105
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://ib.3lift.com/static/buttons/edaa/OBA_UK.webp
Requested by: Host: f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com
URL: https://f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 18.67.93.105 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-18-67-93-105.syd62.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: adcb5bb9ecee926a2031fb93b8ef502ab70738d26428eacfb715508a6d688d1a

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

etag: "4de38cb44ea3ca6e141dd04c28c6508f"
age: 503409
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: G2Tgh7eAb21qBo611uMGTrbh8LCG1xcrzgALM9znIdXu8dzMTeinUg==
date: Tue, 14 Apr 2026 21:02:48 GMT
content-type: binary/octet-stream
vary: Accept-Encoding
last-modified: Tue, 24 Mar 2026 14:53:08 GMT
cache-control: max-age=604800,s-maxage=604800,public
via: 1.1 a8d63eee2fd456f0e1e6772e38461220.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 330
x-amz-cf-pop: SYD62-P1
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 204 highlight
eb2.3lift.com/ Frame 61F9 0
34 B 265ms
262ms Image
text/plain 47.131.64.132
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/highlight
Requested by: Host: f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com
URL: https://f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 47.131.64.132 Singapore, Singapore, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-47-131-64-132.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

date: Mon, 20 Apr 2026 16:52:56 GMT

GET
H2 200 ctar
eb2.3lift.com/ Frame 61F9 37 B
139 B 267ms
264ms Image
image/gif 47.131.64.132
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/ctar?inv_code=pwm_general_RON_hdx&aid=33384962471309340179540&rev=4c6c759&cta_render_method=2&cta_render_text=Learn%20more&cb=77464
Requested by: Host: f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com
URL: https://f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 47.131.64.132 Singapore, Singapore, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-47-131-64-132.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
date: Mon, 20 Apr 2026 16:52:56 GMT
content-type: image/gif

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 7C46
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEEaQ2YtciTq7VOz_DrHMHlU&google_cver=1

43 B
61 B

170ms
170ms

Image
image/gif

35.244.159.8
Google LLC

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEEaQ2YtciTq7VOz_DrHMHlU&google_cver=1
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?cc=1
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 103.108.231.228
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Mon, 20 Apr 2026 16:52:56 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: no-cache, must-revalidate
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEEaQ2YtciTq7VOz_DrHMHlU&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 295
date: Mon, 20 Apr 2026 16:52:57 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame 7C46 170 B
243 B 731ms
729ms Image
image/png 142.250.195.130
Google LLC

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=MmQ2OWQ2NGQtMzUwYy0yNzYzLWU2NGUtZTlhOTBjYjE5ZDdi

Requested by

Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?cc=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.195.130 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

ns3226757.ip-57-129-49.eu

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://playwire-d.openx.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Mon, 20 Apr 2026 16:52:57 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H2

200

sd
jp-u.openx.net/w/1.0/ Frame 7C46
Redirect Chain

https://cr-p3.ladsp.com/cookiesender/3
https://cr-p3.ladsp.com/cookiesender/3?cr=true
https://jp-u.openx.net/w/1.0/sd?id=537072451&val=AVd8aM7w_uroks8AKUaCkyl6lc8AAAGdq882nA

43 B
97 B

172ms
170ms

Image
image/gif

35.244.159.8
Google LLC

General

Check archive.org

Download Go to Show image

Full URL: https://jp-u.openx.net/w/1.0/sd?id=537072451&val=AVd8aM7w_uroks8AKUaCkyl6lc8AAAGdq882nA
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?cc=1
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 103.108.231.228
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Mon, 20 Apr 2026 16:52:57 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: no-cache
location: https://jp-u.openx.net/w/1.0/sd?id=537072451&val=AVd8aM7w_uroks8AKUaCkyl6lc8AAAGdq882nA
pragma: no-cache
via: 1.1 bc177ce25ddc555a7d303bc4d290a6ec.cloudfront.net (CloudFront)
expires: -1
x-cache: Miss from cloudfront
content-length: 0
x-amz-cf-id: xHZIUJm_2_CjGs67FHjBE5x07oHudN0_YNj0uszYHxLPJdz4O3NlHQ==
date: Mon, 20 Apr 2026 16:52:57 GMT
x-amz-cf-pop: SYD62-P2

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 7C46
Redirect Chain

https://match.adsrvr.org/track/cmf/openx?oxid=01060587-fc7b-79c7-f3ae-b310c653531b&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072971&val=be2730b2-4a29-4f94-a883-ae0394c883c4&ttd_puid=01060587-fc7b-79c7-f3ae-b310c653531b&gdpr=0&gdpr_consent=

43 B
136 B

170ms
169ms

Image
image/gif

35.244.159.8
Google LLC

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072971&val=be2730b2-4a29-4f94-a883-ae0394c883c4&ttd_puid=01060587-fc7b-79c7-f3ae-b310c653531b&gdpr=0&gdpr_consent=
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?cc=1
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 103.108.231.228
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Mon, 20 Apr 2026 16:52:56 GMT
content-type: image/gif
vary: Accept

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?id=537072971&val=be2730b2-4a29-4f94-a883-ae0394c883c4&ttd_puid=01060587-fc7b-79c7-f3ae-b310c653531b&gdpr=0&gdpr_consent=
content-length: 335
date: Mon, 20 Apr 2026 16:52:56 GMT
server: Kestrel

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 7C46
Redirect Chain

https://ad.turn.com/r/cs?pid=9&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537073061&val=8488344563759187747&gdpr=0&gdpr_consent=&us_privacy=

43 B
61 B

172ms
172ms

Image
image/gif

35.244.159.8
Google LLC

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073061&val=8488344563759187747&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?cc=1
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 103.108.231.228
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Mon, 20 Apr 2026 16:52:56 GMT
content-type: image/gif
vary: Accept

Redirect headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Location: https://us-u.openx.net/w/1.0/sd?id=537073061&val=8488344563759187747&gdpr=0&gdpr_consent=&us_privacy=
P3P: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
Content-Length: 0
Date: Mon, 20 Apr 2026 16:52:56 GMT
Pragma: no-cache
Connection: keep-alive

GET
H/1.1 200
OK send
sync-dsp.ad-m.asia/dsp/api/sync/ Frame 7C46 43 B
243 B 674ms
288ms Image
image/gif 220.150.223.50
BEKKOAME BEKKOAME...

General

Check archive.org

Download Go to Show image

Full URL: https://sync-dsp.ad-m.asia/dsp/api/sync/send?s=openx
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?cc=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 220.150.223.50 , Japan, ASN4686 (BEKKOAME BEKKOAME INTERNET INC., JP),
Reverse DNS: 50.223.150.220.in-addr.arpa
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://playwire-d.openx.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

Cache-Control: no-store,no-cache
Pragma: no-cache
Connection: close
expires: -1
Content-Length: 43
Date: Mon, 20 Apr 2026 16:52:57 GMT
Content-Type: image/gif
Server: nginx

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame A1C3 7 B
1 KB 143ms
142ms XHR
application/json 69.173.158.64
Magnite

General

Check archive.org

Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?khaos=MO7FO87F-20-8IVF
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.158.64 Singapore, Singapore, ASN26667 (RUBICONPROJECT - Magnite, Inc., US),
Reverse DNS
Software: /
Resource Hash: a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

Cache-Control: no-cache,no-store,must-revalidate
Pragma: no-cache
access-control-allow-credentials: true
Expires: 0
access-control-allow-origin: https://eus.rubiconproject.com
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: f60a7260b0ebb7a40a81234af4a9e826
content-length: 7
content-type: application/json; charset=UTF-8

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 56 B
339 B 440ms
388ms Fetch
application/json 57.129.49.181
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.05eaa3284c60ad6e334d.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

57.129.49.181 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

acabc3261f6eace6684bb3e0a85b68fca1b89474a1f428189e9baff6412b56f6

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
content-encoding: gzip
date: Mon, 20 Apr 2026 16:52:56 GMT
content-type: application/json;charset=UTF-8
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding

POST
H2 200 483.json Show response
id5-sync.com/g/v2/ 1 KB
1 KB 820ms
819ms Fetch
application/json 135.125.170.108
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/g/v2/483.json

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.05eaa3284c60ad6e334d.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

135.125.170.108 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

1cf02fae41775b751298bef8ada7e3e6aacda134d6132f3f45e498f125756315

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Mon, 20 Apr 2026 16:52:57 GMT
content-type: application/json
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers

GET
H2

200

usersync
usersync.gumgum.com/ Frame A1C3
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=gumgum&khaos=MO7FO87F-20-8IVF
https://usersync.gumgum.com/usersync?b=mag&i=MO7FO87F-20-8IVF

35 B
168 B

306ms
306ms

Image
image/gif

52.74.33.174
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=mag&i=MO7FO87F-20-8IVF
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 52.74.33.174 Singapore, Singapore, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-74-33-174.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

expires: 0
cache-control: private, no-store, must-revalidate, max-age=0
content-length: 35
date: Mon, 20 Apr 2026 16:52:57 GMT
pragma: no-cache
content-type: image/gif

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://usersync.gumgum.com/usersync?b=mag&i=MO7FO87F-20-8IVF
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 4290507b7388fb86809e552482e2fff0
content-length: 0
Content-Type: text/html

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
116 B 50ms
50ms Fetch
image/gif 172.66.148.140
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=2&e=0.637689414963973
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.66.148.140 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 926305
x-goog-stored-content-encoding: identity
expires: Thu, 09 Apr 2026 23:47:53 GMT
x-goog-stored-content-length: 43
date: Mon, 20 Apr 2026 16:52:56 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH8-8d6tsHANUa2r84JrwjQITmm63V7aSPrfwA9n_jkotwDDYByg5ASpAwhKW45wurAfWr-QyLYc
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9ef5a98e988fcf9d-PER
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

OPTIONS
H2 204 page_visit
pb-ing-02.ccgateway.net/v1.0/parent/5bb3e20859/engagement/trigger/ Frame 0
0 1029ms
511ms Preflight 44.245.27.70
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://pb-ing-02.ccgateway.net/v1.0/parent/5bb3e20859/engagement/trigger/page_visit
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.245.27.70 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-44-245-27-70.us-west-2.compute.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Content-Length,Accept-Encoding,Authorization,X-Forwarded-For
access-control-allow-methods: GET,POST
access-control-allow-origin: https://paint.toys
access-control-max-age: 86400
date: Mon, 20 Apr 2026 16:52:57 GMT
vary: Origin Access-Control-Request-Method Access-Control-Request-Headers

OPTIONS
H2 204 ad_impression
pb-ing-02.ccgateway.net/v1.0/parent/5bb3e20859/engagement/trigger/ Frame 0
0 1028ms
511ms Preflight 44.245.27.70
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://pb-ing-02.ccgateway.net/v1.0/parent/5bb3e20859/engagement/trigger/ad_impression
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.245.27.70 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-44-245-27-70.us-west-2.compute.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Content-Length,Accept-Encoding,Authorization,X-Forwarded-For
access-control-allow-methods: GET,POST
access-control-allow-origin: https://paint.toys
access-control-max-age: 86400
date: Mon, 20 Apr 2026 16:52:57 GMT
vary: Origin Access-Control-Request-Method Access-Control-Request-Headers

POST
H2 200 page_visit Show response
pb-ing-02.ccgateway.net/v1.0/parent/5bb3e20859/engagement/trigger/ 60 B
332 B 424ms
423ms Fetch
application/json 44.245.27.70
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://pb-ing-02.ccgateway.net/v1.0/parent/5bb3e20859/engagement/trigger/page_visit
Requested by: Host: script-api.ccgateway.net
URL: https://script-api.ccgateway.net/script/bundle?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.245.27.70 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-44-245-27-70.us-west-2.compute.amazonaws.com
Software: /
Resource Hash: 57df009fbf5b95b4648e1b75e83cfa852fc3bf317ac24e3099bea2a24c5f3863

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type: application/json
sec-ch-ua-mobile: ?0

Response headers

access-control-allow-origin: https://paint.toys
content-length: 60
date: Mon, 20 Apr 2026 16:52:57 GMT
content-type: application/json; charset=utf-8
vary: Origin
access-control-allow-credentials: true

POST
H2 200 ad_impression Show response
pb-ing-02.ccgateway.net/v1.0/parent/5bb3e20859/engagement/trigger/ 60 B
332 B 337ms
336ms Fetch
application/json 44.245.27.70
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://pb-ing-02.ccgateway.net/v1.0/parent/5bb3e20859/engagement/trigger/ad_impression
Requested by: Host: script-api.ccgateway.net
URL: https://script-api.ccgateway.net/script/bundle?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.245.27.70 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-44-245-27-70.us-west-2.compute.amazonaws.com
Software: /
Resource Hash: 57df009fbf5b95b4648e1b75e83cfa852fc3bf317ac24e3099bea2a24c5f3863

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type: application/json
sec-ch-ua-mobile: ?0

Response headers

access-control-allow-origin: https://paint.toys
content-length: 60
date: Mon, 20 Apr 2026 16:52:57 GMT
content-type: application/json; charset=utf-8
vary: Origin
access-control-allow-credentials: true

GET
H2

200

user_sync
pb-ing-02.ccgateway.net/v1.0/parent/5bb3e20859/engagement/trigger/
Redirect Chain

https://sync.crwdcntrl.net/qmap?c=18513&tp=MGNI&tpid=24a089b9-cb71-43bf-bbb6-23891fda6bbd&d=https%3A%2F%2Fpb-ing-02.ccgateway.net%2Fv1.0%2Fparent%2F5bb3e20859%2Fengagement%2Ftrigger%2Fuser_sync%3Fs...
https://pb-ing-02.ccgateway.net/v1.0/parent/5bb3e20859/engagement/trigger/user_sync?src=lotame&puid=dec962aa5f4245f036cb001d007aa6a4&id=paint.toys&parentId=5bb3e20859&ccsid=98ea34d9-59c9-4202-a61a-...

0
38 B

1027ms
509ms

Image
text/plain

44.245.27.70
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://pb-ing-02.ccgateway.net/v1.0/parent/5bb3e20859/engagement/trigger/user_sync?src=lotame&puid=dec962aa5f4245f036cb001d007aa6a4&id=paint.toys&parentId=5bb3e20859&ccsid=98ea34d9-59c9-4202-a61a-ac0636a8e090&ccuid=24a089b9-cb71-43bf-bbb6-23891fda6bbd&ccpt=0&pvid=0e11bacb-f24c-46bc-afd1-eb4c45dbb618&engid=2ded918b-bed4-42be-9527-0b6d6d55fd61&engcount=0&engttl=60
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 44.245.27.70 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-44-245-27-70.us-west-2.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

date: Mon, 20 Apr 2026 16:52:57 GMT
content-length: 0

Redirect headers

strict-transport-security: max-age=31536000 ; includeSubDomains
cache-control: no-cache
location: https://pb-ing-02.ccgateway.net/v1.0/parent/5bb3e20859/engagement/trigger/user_sync?src=lotame&puid=dec962aa5f4245f036cb001d007aa6a4&id=paint.toys&parentId=5bb3e20859&ccsid=98ea34d9-59c9-4202-a61a-ac0636a8e090&ccuid=24a089b9-cb71-43bf-bbb6-23891fda6bbd&ccpt=0&pvid=0e11bacb-f24c-46bc-afd1-eb4c45dbb618&engid=2ded918b-bed4-42be-9527-0b6d6d55fd61&engcount=0&engttl=60
pragma: no-cache
expires: 0
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 0
date: Mon, 20 Apr 2026 16:52:56 GMT

GET
H3 200 reach_worklet.js Show response
www.googleadservices.com/pagead/managed/js/activeview/current/ Frame 87F7 195 KB
62 KB 210ms
209ms Script
text/javascript 172.217.25.194
Google LLC

General

Check archive.org

Download Go to

Full URL

https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.25.194 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

66.33.110.136.bc.googleusercontent.com

Software

cafe /

Resource Hash

6ccb1d24b672a10a1bf92e29412ca29b46f5abdce36e20beae8f4b4c909b31a1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
etag: 6429351313867025537
x-content-type-options: nosniff
expires: Mon, 20 Apr 2026 16:52:56 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Mon, 20 Apr 2026 16:52:56 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 63404
x-xss-protection: 0
server: cafe

GET
H3 200 setuid
pbs.intergient.com/ Frame 4DAE 0
624 B 346ms
294ms Image
application/json 104.18.21.56
Cloudflare

General

Check archive.org

Download Go to Show image

Full URL: https://pbs.intergient.com/setuid?bidder=vidazoo&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=b&uid=fd68c33c-3e57-fb45-915b-49efa457ae47
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fpbs.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D&gpp=&gpp_sid=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.21.56 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://sync.cootlogix.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
access-control-allow-credentials: true
x-proxy-host: prebid.intergient.com
cf-ray: 9ef5a98fed1a3ea8-PER
access-control-allow-origin: https://pbs.intergient.com
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Mon, 20 Apr 2026 16:52:57 GMT
content-type: application/json
server: cloudflare
priority: u=1,i

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 4DAE
Redirect Chain

https://secure.adnxs.com/getuid?https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dappnexus%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D&gdpr=&gdpr_consent=
https://sync.cootlogix.com/api/cookie?partnerId=appnexus&userId=8615208052258340763&gdpr=&gdpr_consent=&us_privacy=&gdpr=&gdpr_consent=

43 B
496 B

466ms
466ms

Image
image/avif

134.209.66.79
DigitalOcean

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=appnexus&userId=8615208052258340763&gdpr=&gdpr_consent=&us_privacy=&gdpr=&gdpr_consent=
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fpbs.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D&gpp=&gpp_sid=
Protocol: H2
Server: 134.209.66.79 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Mon, 20 Apr 2026 16:52:57 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

cache-control: no-store, no-cache, private
location: https://sync.cootlogix.com/api/cookie?partnerId=appnexus&userId=8615208052258340763&gdpr=&gdpr_consent=&us_privacy=&gdpr=&gdpr_consent=
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 103.108.231.228; 103.108.231.228; 592.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: d6fb9618-4b15-42fa-8f1c-b337a2c7c164
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Mon, 20 Apr 2026 16:52:56 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.25.5

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 4DAE
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=159988&gdpr=&gdpr_consent=&us_privacy=&pu=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dpubmatics2s%26userId%3D%23PMUID%26gdpr%3D%26gd...
https://sync.cootlogix.com/api/cookie?partnerId=pubmatics2s&userId=54727A33-446E-4A17-B742-9F5365C53A97&gdpr=&gdpr_consent=&us_privacy=

43 B
496 B

435ms
435ms

Image
image/avif

134.209.66.79
DigitalOcean

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=pubmatics2s&userId=54727A33-446E-4A17-B742-9F5365C53A97&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fpbs.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D&gpp=&gpp_sid=
Protocol: H2
Server: 134.209.66.79 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Mon, 20 Apr 2026 16:52:57 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

strict-transport-security: max-age=16070400; includeSubDomains
cache-control: private,max-age=86400
location: https://sync.cootlogix.com/api/cookie?partnerId=pubmatics2s&userId=54727A33-446E-4A17-B742-9F5365C53A97&gdpr=&gdpr_consent=&us_privacy=
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 174
date: Mon, 20 Apr 2026 16:52:57 GMT
content-type: text/html; charset=utf-8

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 4DAE
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=vidazoo&us_privacy=&gdpr=&gdpr_consent=
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=2675237204
https://sync.1rx.io/usersync/tradedesk/be2730b2-4a29-4f94-a883-ae0394c883c4
https://sync.targeting.unrulymedia.com/csync/RX-b543adef-0a1a-417c-b8b4-ef1a5ca2dd5f-004?redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dunruly%26userId%3DRX-b543adef-0a1a-417c-...
https://sync.cootlogix.com/api/cookie?partnerId=unruly&userId=RX-b543adef-0a1a-417c-b8b4-ef1a5ca2dd5f-004

43 B
496 B

326ms
326ms

Image
image/avif

134.209.66.79
DigitalOcean

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=unruly&userId=RX-b543adef-0a1a-417c-b8b4-ef1a5ca2dd5f-004
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fpbs.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D&gpp=&gpp_sid=
Protocol: H2
Server: 134.209.66.79 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Mon, 20 Apr 2026 16:52:58 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

location: https://sync.cootlogix.com/api/cookie?partnerId=unruly&userId=RX-b543adef-0a1a-417c-b8b4-ef1a5ca2dd5f-004
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
date: Mon, 20 Apr 2026 16:52:58 GMT
etag: RXb543adef0a1a417cb8b4ef1a5ca2dd5f004
content-type: text/html
server: Tengine

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 4DAE
Redirect Chain

https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
https://bb.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D&sovrn_retry=true
https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=MiKUALZHZ-JPhJQlSeWRy-2w&gdpr=&gdpr_consent=&us_privacy=

43 B
496 B

364ms
364ms

Image
image/avif

134.209.66.79
DigitalOcean

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=MiKUALZHZ-JPhJQlSeWRy-2w&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fpbs.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D&gpp=&gpp_sid=
Protocol: H2
Server: 134.209.66.79 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Mon, 20 Apr 2026 16:52:59 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

location: https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=MiKUALZHZ-JPhJQlSeWRy-2w&gdpr=&gdpr_consent=&us_privacy=
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, DELETE, PUT
access-control-allow-origin: *
content-length: 0
date: Mon, 20 Apr 2026 16:52:58 GMT
vary: Accept-Encoding
access-control-allow-headers: X-Requested-With, Content-Type

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 4DAE
Redirect Chain

https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us...
https://x.bidswitch.net/ul_cb/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_conse...
https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=762ee269-9d7b-476a-b235-309119a39b4f&gdpr=&gdpr_consent=&us_privacy=

43 B
496 B

517ms
516ms

Image
image/avif

134.209.66.79
DigitalOcean

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=762ee269-9d7b-476a-b235-309119a39b4f&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fpbs.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D&gpp=&gpp_sid=
Protocol: H2
Server: 134.209.66.79 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Mon, 20 Apr 2026 16:52:58 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=762ee269-9d7b-476a-b235-309119a39b4f&gdpr=&gdpr_consent=&us_privacy=
content-length: 0
alt-svc: h3=":443"; ma=2592000
date: Mon, 20 Apr 2026 16:52:57 GMT

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 4DAE
Redirect Chain

https://eb2.3lift.com/getuid?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dtriplelift%26userId%3D$UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
https://sync.cootlogix.com/api/cookie?partnerId=triplelift&userId=4484975754566810436886&gdpr=&gdpr_consent=&us_privacy=

43 B
496 B

404ms
404ms

Image
image/avif

134.209.66.79
DigitalOcean

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=triplelift&userId=4484975754566810436886&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fpbs.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D&gpp=&gpp_sid=
Protocol: H2
Server: 134.209.66.79 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Mon, 20 Apr 2026 16:52:57 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

cache-control: no-cache, no-store, must-revalidate
location: https://sync.cootlogix.com/api/cookie?partnerId=triplelift&userId=4484975754566810436886&gdpr=&gdpr_consent=&us_privacy=
content-length: 0
date: Mon, 20 Apr 2026 16:52:56 GMT

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 4DAE
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=160318&gdpr=&gdpr_consent=&us_privacy=&pu=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dpubmaticut%26userId%3D%23PMUID%26gdpr%3D%26gdp...
https://sync.cootlogix.com/api/cookie?partnerId=pubmaticut&userId=54727A33-446E-4A17-B742-9F5365C53A97&gdpr=&gdpr_consent=&us_privacy=

43 B
496 B

433ms
432ms

Image
image/avif

134.209.66.79
DigitalOcean

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=pubmaticut&userId=54727A33-446E-4A17-B742-9F5365C53A97&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fpbs.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D&gpp=&gpp_sid=
Protocol: H2
Server: 134.209.66.79 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Mon, 20 Apr 2026 16:52:57 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

strict-transport-security: max-age=16070400; includeSubDomains
cache-control: private,max-age=86400
location: https://sync.cootlogix.com/api/cookie?partnerId=pubmaticut&userId=54727A33-446E-4A17-B742-9F5365C53A97&gdpr=&gdpr_consent=&us_privacy=
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 173
date: Mon, 20 Apr 2026 16:52:57 GMT
content-type: text/html; charset=utf-8

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 4DAE
Redirect Chain

https://ssp-sync.criteo.com/user-sync/redirect?profile=342&gdpr_consent=&gdpr=&gpp=&gpp_sid=&us_privacy=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dcriteo%26userId%3D%24%7B...
https://sync.cootlogix.com/api/cookie?partnerId=criteo&userId=k-ULZGycqv6wej5OHzks9EzrWBLDdwrEPruU9FMw&gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=c

43 B
496 B

457ms
457ms

Image
image/avif

134.209.66.79
DigitalOcean

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=criteo&userId=k-ULZGycqv6wej5OHzks9EzrWBLDdwrEPruU9FMw&gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=c
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fpbs.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D&gpp=&gpp_sid=
Protocol: H2
Server: 134.209.66.79 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Mon, 20 Apr 2026 16:52:57 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-store,max-age=0
location: https://sync.cootlogix.com/api/cookie?partnerId=criteo&userId=k-ULZGycqv6wej5OHzks9EzrWBLDdwrEPruU9FMw&gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=c
x-criteo-endpoint-version: none
cross-origin-resource-policy: cross-origin
x-criteo-endpoint-action: SyncWithRedirects
x-criteo-endpoint-controller: UserSync
content-length: 0
date: Mon, 20 Apr 2026 16:52:56 GMT
server: Kestrel

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 4DAE
Redirect Chain

https://match.sharethrough.com/universal/v1?supply_id=TAEWcTBw&gdpr=&gdpr_consent=
https://sync.cootlogix.com/api/cookie?partnerId=sharthrough&userId=ce1968a3-10a9-4f87-b099-18a72e244d40

43 B
496 B

386ms
386ms

Image
image/avif

134.209.66.79
DigitalOcean

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=sharthrough&userId=ce1968a3-10a9-4f87-b099-18a72e244d40
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fpbs.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D&gpp=&gpp_sid=
Protocol: H2
Server: 134.209.66.79 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Mon, 20 Apr 2026 16:52:57 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
location: https://sync.cootlogix.com/api/cookie?partnerId=sharthrough&userId=ce1968a3-10a9-4f87-b099-18a72e244d40
content-length: 0

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 4DAE
Redirect Chain

https://sync.ottadvisors.com/6f0476ca45e1d6b67e3ee8d57532a022.gif?&us_privacy=&gdpr=&gdpr_consent=&gpp=&gpp_sid=&puid=fd68c33c-3e57-fb45-915b-49efa457ae47&redir=https%3A%2F%2Fsync.cootlogix.com%2Fa...
https://sync.cootlogix.com/api/cookie?partnerId=ott&userId=e2bc683c-d0a9-4d0c-92d4-68e47af00c56&gdpr=[GDPR]&gdpr_consent=[GDPR_CONSENT]&us_privacy=[CCPA]&coppa=[COPPA]&gpp=[GPP]&gpp_sid=[GPP_SID]

43 B
496 B

331ms
331ms

Image
image/avif

134.209.66.79
DigitalOcean

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=ott&userId=e2bc683c-d0a9-4d0c-92d4-68e47af00c56&gdpr=[GDPR]&gdpr_consent=[GDPR_CONSENT]&us_privacy=[CCPA]&coppa=[COPPA]&gpp=[GPP]&gpp_sid=[GPP_SID]
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fpbs.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D&gpp=&gpp_sid=
Protocol: H2
Server: 134.209.66.79 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Mon, 20 Apr 2026 16:52:58 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

Cache-Control: no-cache, no-store, must-revalidate
Location: https://sync.cootlogix.com/api/cookie?partnerId=ott&userId=e2bc683c-d0a9-4d0c-92d4-68e47af00c56&gdpr=[GDPR]&gdpr_consent=[GDPR_CONSENT]&us_privacy=[CCPA]&coppa=[COPPA]&gpp=[GPP]&gpp_sid=[GPP_SID]
Pragma: no-cache
Connection: close
Expires: 0
Content-Length: 0
Date: Mon, 20 Apr 2026 16:52:58 GMT
Server: nginx

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 4DAE
Redirect Chain

https://cs.media.net/cksync?cs=30&type=vdz&gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dmedianet%26userId%3D%3Cvsid%3E%26gdpr%3D%26gdpr_con...
https://sync.cootlogix.com/api/cookie?partnerId=medianet&userId=4197055774531080000V10&gdpr=&gdpr_consent=&us_privacy=

43 B
496 B

438ms
438ms

Image
image/avif

134.209.66.79
DigitalOcean

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=medianet&userId=4197055774531080000V10&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fpbs.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D&gpp=&gpp_sid=
Protocol: H2
Server: 134.209.66.79 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Mon, 20 Apr 2026 16:52:58 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

location: https://sync.cootlogix.com/api/cookie?partnerId=medianet&userId=4197055774531080000V10&gdpr=&gdpr_consent=&us_privacy=
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA"
content-length: 200
date: Mon, 20 Apr 2026 16:52:57 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding

GET
H2

200

usync.html Show response
eus.rubiconproject.com/ Frame 080E
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=vidazoo&endpoint=us-east
https://eus.rubiconproject.com/usync.html?p=vidazoo&endpoint=us-east

269 B
379 B

93ms
93ms

Document
text/html

23.221.133.65
Akamai Technologies

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=vidazoo&endpoint=us-east
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fpbs.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D&gpp=&gpp_sid=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.221.133.65 Sydney, Australia, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-221-133-65.deploy.static.akamaitechnologies.com
Software: Apache/2.4.65 (Debian) /
Resource Hash: e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer: https://sync.cootlogix.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Mon, 20 Apr 2026 16:52:57 GMT
etag: "10d-63d602600b800-gzip"
last-modified: Wed, 27 Aug 2025 22:17:04 GMT
server: Apache/2.4.65 (Debian)
vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Mon, 20 Apr 2026 16:52:56 GMT
location: https://eus.rubiconproject.com/usync.html?p=vidazoo&endpoint=us-east
server: AkamaiGHost

GET
H2 200 cm Show response
u.openx.net/w/1.0/ Frame 5500 566 B
659 B 196ms
193ms Document
text/html 35.244.159.8
Google LLC

General

Check archive.org

Download Go to

Full URL: https://u.openx.net/w/1.0/cm?cc=1&id=4241c706-9fd2-4ae4-b2d7-c9f8d34e773c&ph=f4cc9fb1-057b-4e7a-b393-325ee9109574&gdpr=&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenx%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fpbs.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D&gpp=&gpp_sid=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: c9116393c3f3f3844f5f9847c5f43d60a64e1645f7df8ceec59a7ca80172812c

Request headers

Referer: https://sync.cootlogix.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

alt-svc: h3=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-encoding: br
content-length: 429
content-type: text/html
date: Mon, 20 Apr 2026 16:52:56 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 103.108.231.228

GET
H3 200 cm Show response
us-u.openx.net/w/1.0/ Frame 54CB 568 B
448 B 175ms
174ms Document
text/html 35.244.159.8
Google LLC

General

Check archive.org

Download Go to

Full URL: https://us-u.openx.net/w/1.0/cm?id=fba3d144-1026-4d31-a758-943b9545e305&gdpr=&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenxut%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fpbs.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D&gpp=&gpp_sid=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: d4c10dca35f38e840c88049b3521bb454557e561c2d78dc74c23df2507ee29bf

Request headers

Referer: https://sync.cootlogix.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-encoding: br
content-length: 427
content-type: text/html
date: Mon, 20 Apr 2026 16:52:56 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 103.108.231.228

GET
H2

200

usync.html Show response
eus.rubiconproject.com/ Frame A2A2
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=12776
https://eus.rubiconproject.com/usync.html?p=12776

269 B
379 B

138ms
137ms

Document
text/html

23.221.133.65
Akamai Technologies

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=12776
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fpbs.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D&gpp=&gpp_sid=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.221.133.65 Sydney, Australia, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-221-133-65.deploy.static.akamaitechnologies.com
Software: Apache/2.4.65 (Debian) /
Resource Hash: e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer: https://sync.cootlogix.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Mon, 20 Apr 2026 16:52:57 GMT
etag: "10d-63d602600b800-gzip"
last-modified: Wed, 27 Aug 2025 22:17:04 GMT
server: Apache/2.4.65 (Debian)
vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Mon, 20 Apr 2026 16:52:56 GMT
location: https://eus.rubiconproject.com/usync.html?p=12776
server: AkamaiGHost

GET
H2 200 match Show response
c1.adform.net/serving/cookie/ Frame F0A5 35 B
591 B 135ms
134ms Document
image/gif 185.84.60.23
ADFORM Adform A/S

General

Check archive.org

Download Go to

Full URL

https://c1.adform.net/serving/cookie/match?party=14&cid=54727A33-446E-4A17-B742-9F5365C53A97&gdpr=0&gdpr_consent=

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

185.84.60.23 , Denmark, ASN198622 (ADFORM Adform A/S, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-type: image/gif
date: Mon, 20 Apr 2026 16:52:56 GMT
expires: -1
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

GET
H2 200 pubmatic Show response
um.simpli.fi/ Frame 0BB6 43 B
614 B 534ms
220ms Document
image/gif 136.110.33.66
Google LLC

General

Check archive.org

Download Go to

Full URL

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

136.110.33.66 Singapore, Singapore, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),

Reverse DNS

Software

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
cache-control: no-cache
content-length: 43
content-type: image/gif
date: Mon, 20 Apr 2026 16:52:57 GMT
expires: Sun, 19 Apr 2026 16:52:57 GMT
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 51A6
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA%3D%3D%26piggybackCookie%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:88a269e6-59ea-4b00-a17e-ee7f7bd8cf25&gdpr=0&gdpr_consent=

42 B
291 B

95ms
94ms

Document
image/gif

67.199.150.86
PubMatic

General

Check archive.org

Download Go to

Full URL

https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:88a269e6-59ea-4b00-a17e-ee7f7bd8cf25&gdpr=0&gdpr_consent=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

67.199.150.86 Singapore, Singapore, ASN62713 (AS-PUBMATIC - PubMatic, Inc., US),

Reverse DNS

Software

nginx /

Resource Hash

1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400; includeSubDomains

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Mon, 20 Apr 2026 16:52:58 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx
strict-transport-security: max-age=16070400; includeSubDomains

Redirect headers

Access-Control-Allow-Origin: *
Cache-Control: no-cache,no-store,must-revalidate
Connection: keep-alive
Content-Length: 0
Content-Type: image/gif
Cross-Origin-Resource-Policy: cross-origin
Date: Mon, 20 Apr 2026 16:59:02 GMT
Keep-Alive: timeout=360
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Pragma: no-cache
Referrer-Policy: strict-origin
Server: MT3 2474 c641ef6 master iad iad-pixel-x8 config_version:"3286"
Strict-Transport-Security: 31536000
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: all
X-XSS-Protection: 0
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:88a269e6-59ea-4b00-a17e-ee7f7bd8cf25&gdpr=0&gdpr_consent=

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 845F
Redirect Chain

https://ups.analytics.yahoo.com/ups/58917/cms?uid=54727A33-446E-4A17-B742-9F5365C53A97&gpp=&gpp_sid=&us_privacy=&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQwNjQmdGw9NDMyMDA=&piggybackCookie=y-k772_2ZE2oBR8f.JlC125RIz2538X6YqWtV3QT8-~A&gdpr=0

42 B
612 B

237ms
139ms

Document
image/gif

67.199.150.86
PubMatic

General

Check archive.org

Download Go to

Full URL

https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQwNjQmdGw9NDMyMDA=&piggybackCookie=y-k772_2ZE2oBR8f.JlC125RIz2538X6YqWtV3QT8-~A&gdpr=0

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

67.199.150.86 Singapore, Singapore, ASN62713 (AS-PUBMATIC - PubMatic, Inc., US),

Reverse DNS

Software

nginx /

Resource Hash

1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400; includeSubDomains

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Mon, 20 Apr 2026 16:52:57 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx
strict-transport-security: max-age=16070400; includeSubDomains

Redirect headers

age: 2
content-length: 0
content-type: text/html
date: Mon, 20 Apr 2026 16:52:56 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQwNjQmdGw9NDMyMDA=&piggybackCookie=y-k772_2ZE2oBR8f.JlC125RIz2538X6YqWtV3QT8-~A&gdpr=0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
referrer-policy: no-referrer-when-downgrade
server: ATS
strict-transport-security: max-age=31536000
x-content-type-options: nosniff

GET
H2

200

cookie Show response
sync.cootlogix.com/api/ Frame 55BA
Redirect Chain

https://ups.analytics.yahoo.com/ups/58917/cms?uid=54727A33-446E-4A17-B742-9F5365C53A97&gpp=&gpp_sid=&us_privacy=&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQwNjQmdGw9NDMyMDA=&piggybackCookie=y-k772_2ZE2oBR8f.JlC125RIz2538X6YqWtV3QT8-~A&gdpr=0
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
https://sync.cootlogix.com/api/cookie?partnerId=pubmatics2s&userId=54727A33-446E-4A17-B742-9F5365C53A97&gdpr=&gdpr_consent=&us_privacy=

43 B
495 B

390ms
390ms

Document
text/html

134.209.66.79
DigitalOcean

General

Check archive.org

Download Go to

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=pubmatics2s&userId=54727A33-446E-4A17-B742-9F5365C53A97&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fpbs.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 134.209.66.79 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
Software: /
Resource Hash: f4eef8263281c0b26486637831251059757bc3fdc4c3a48045a8ef8646b36e8f

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
content-length: 43
content-type: text/html
date: Mon, 20 Apr 2026 16:52:57 GMT
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"

Redirect headers

cache-control: private,max-age=86400
content-length: 174
content-type: text/html; charset=utf-8
date: Mon, 20 Apr 2026 16:52:57 GMT
location: https://sync.cootlogix.com/api/cookie?partnerId=pubmatics2s&userId=54727A33-446E-4A17-B742-9F5365C53A97&gdpr=&gdpr_consent=&us_privacy=
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
strict-transport-security: max-age=16070400; includeSubDomains

GET
H2

200

SPug Show response
image4.pubmatic.com/AdServer/ Frame C49C
Redirect Chain

https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=54727A33-446E-4A17-B742-9F5365C53A97&redir=true&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-CrhAyNVE2uV47K7GzbzuXlFuJgD4oi0-~A&gdpr=0&us_privacy=

0
287 B

464ms
229ms

Document
text/plain

67.199.150.85
PubMatic

General

Check archive.org

Download Go to

Full URL

https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-CrhAyNVE2uV47K7GzbzuXlFuJgD4oi0-~A&gdpr=0&us_privacy=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

67.199.150.85 Singapore, Singapore, ASN62713 (AS-PUBMATIC - PubMatic, Inc., US),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400; includeSubDomains

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

cache-control: no-store, no-cache, private
date: Mon, 20 Apr 2026 16:52:57 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx
strict-transport-security: max-age=16070400; includeSubDomains

Redirect headers

age: 1
content-length: 0
content-type: text/html
date: Mon, 20 Apr 2026 16:52:57 GMT
location: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-CrhAyNVE2uV47K7GzbzuXlFuJgD4oi0-~A&gdpr=0&us_privacy=
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
referrer-policy: no-referrer-when-downgrade
server: ATS
strict-transport-security: max-age=31536000
x-content-type-options: nosniff

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame ACFB
Redirect Chain

https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=8941175861696558629&gdpr=0&gdpr_consent=&us_privacy=

1 B
482 B

338ms
185ms

Document
text/html

207.65.33.82
PubMatic

General

Check archive.org

Download Go to

Full URL

https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=8941175861696558629&gdpr=0&gdpr_consent=&us_privacy=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

207.65.33.82 , Singapore, ASN62713 (AS-PUBMATIC - PubMatic, Inc., US),

Reverse DNS

Software

nginx /

Resource Hash

36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400; includeSubDomains

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

cache-control: no-store, no-cache, private
content-length: 1
content-type: text/html; charset=utf-8
date: Mon, 20 Apr 2026 16:52:57 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx
strict-transport-security: max-age=16070400; includeSubDomains

Redirect headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Date: Mon, 20 Apr 2026 16:52:57 GMT
Location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=8941175861696558629&gdpr=0&gdpr_consent=&us_privacy=
P3P: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
Pragma: no-cache

GET
H3 200 setuid Show response
pbs.intergient.com/ Frame B0F3 0
590 B 326ms
296ms Document
application/json 104.18.21.56
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://pbs.intergient.com/setuid?bidder=pubmatic&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=b&uid=54727A33-446E-4A17-B742-9F5365C53A97
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fpbs.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.21.56 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

access-control-allow-credentials: true
access-control-allow-origin: https://pbs.intergient.com
alt-svc: h3=":443"; ma=86400
cf-ray: 9ef5a98fed183ea8-PER
content-encoding: br
content-type: application/json
date: Mon, 20 Apr 2026 16:52:57 GMT
priority: u=0,i
server: cloudflare
server-timing: cfExtPri
x-proxy-host: prebid.intergient.com

GET
H2 200 ibs:dpid=19566&dpuuid=54727A33-446E-4A17-B742-9F5365C53A97
dpm.demdex.net/ Frame 9D65 42 B
718 B 406ms
178ms Image
image/gif 52.62.165.234
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=19566&dpuuid=54727A33-446E-4A17-B742-9F5365C53A97

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.62.165.234 Sydney, Australia, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-52-62-165-234.ap-southeast-2.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-apse2-2-v085-0be8e3698.edge-apse2.demdex.com 2 ms
content-encoding: gzip
pragma: no-cache
x-content-type-options: nosniff
x-tid: Dvugm8npTTs=
expires: Thu, 01 Jan 1970 00:00:00 UTC
content-length: 59
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Mon, 20 Apr 2026 16:52:57 GMT
content-type: image/gif

GET
H2

200

sync
pippio.com/api/ Frame 9D65
Redirect Chain

https://idsync.rlcdn.com/420486.gif?partner_uid=54727A33-446E-4A17-B742-9F5365C53A97
https://pippio.com/api/sync?pid=5324&it=1&iv=3cf7392c70d8995a688eb33af0553e540eb4e3e3f835dc6faff6294b61e073c8791426b5417dce21&_=2

42 B
572 B

541ms
324ms

Image
image/gif

107.178.254.65
Google LLC

General

Check archive.org

Download Go to Show image

Full URL: https://pippio.com/api/sync?pid=5324&it=1&iv=3cf7392c70d8995a688eb33af0553e540eb4e3e3f835dc6faff6294b61e073c8791426b5417dce21&_=2
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 107.178.254.65 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS: 65.254.178.107.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-cache, no-store
timing-allow-origin: *
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 42
date: Mon, 20 Apr 2026 16:52:57 GMT
content-type: image/gif

Redirect headers

cache-control: no-cache, no-store
timing-allow-origin: *
location: https://pippio.com/api/sync?pid=5324&it=1&iv=3cf7392c70d8995a688eb33af0553e540eb4e3e3f835dc6faff6294b61e073c8791426b5417dce21&_=2
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 0
date: Mon, 20 Apr 2026 16:52:57 GMT

GET
H2

200

info
uipglob.semasio.net/adform/1/ Frame 9D65
Redirect Chain

https://uipglob.semasio.net/pubmatic/1/info?sType=sync&sExtCookieId=54727A33-446E-4A17-B742-9F5365C53A97&sInitiator=external&gdpr=0&gdpr_consent=
https://uipglob.semasio.net/pubmatic/1/info2?sType=sync&sExtCookieId=54727A33-446E-4A17-B742-9F5365C53A97&sInitiator=external&gdpr=0&gdpr_consent=
https://sg.semasio.net/sync/1/15927723?&gdpr=0&gdpr_consent=&sInitiator=external&sExtCookieId=54727A33-446E-4A17-B742-9F5365C53A97
https://match.adsrvr.org/track/cmf/generic?ttd_pid=semasio&ttd_tpi=1&gdpr=0&gdpr_consent=
https://uipglob.semasio.net/tradedesk/1/info?sType=sync&gdpr=0&gdpr_consent=&sInitiator=internal&sExtCookieId=be2730b2-4a29-4f94-a883-ae0394c883c4
https://sg.semasio.net/sync/1/32675800?&gdpr=0&gdpr_consent=&sInitiator=internal&sExtCookieId=be2730b2-4a29-4f94-a883-ae0394c883c4
https://ib.adnxs.com/getuid?https%3A%2F%2Fsa.semasio.net%2Fsync%2F1%2F4354957%3FsExtCookieId%3D%24UID%26sInitiator%3Dinternal&gdpr=0&gdpr_consent=
https://sa.semasio.net/sync/1/4354957?sExtCookieId=8615208052258340763&sInitiator=internal&gdpr=0&gdpr_consent=
https://ib.adnxs.com/getuid?https%3A%2F%2Fsa.semasio.net%2Fsync%2F1%2F4354957%3FsExtCookieId%3D%24UID%26sInitiator%3Dinternal&gdpr=0&gdpr_consent=
https://sa.semasio.net/sync/1/4354957?sExtCookieId=8615208052258340763&sInitiator=internal&gdpr=0&gdpr_consent=
https://track.adform.net/serving/cookie/match/?party=1008&gdpr=0&gdpr_consent=
https://uipglob.semasio.net/adform/1/info?sType=sync&sExtCookieId=5877196467477221807&sInitiator=internal&gdpr=0&gdpr_consent=
https://sg.semasio.net/sync/1/16266044?sExtCookieId=5877196467477221807&gdpr=0&gdpr_consent=&sInitiator=internal
https://track.adform.net/serving/cookie/match/?party=1008&gdpr=0&gdpr_consent=
https://uipglob.semasio.net/adform/1/info?sType=sync&sExtCookieId=5877196467477221807&sInitiator=internal&gdpr=0&gdpr_consent=

42 B
443 B

98ms
97ms

Image
image/gif

95.173.218.100
CDN77 Datacamp Li...

General

Check archive.org

Download Go to Show image

Full URL: https://uipglob.semasio.net/adform/1/info?sType=sync&sExtCookieId=5877196467477221807&sInitiator=internal&gdpr=0&gdpr_consent=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 95.173.218.100 Singapore, Singapore, ASN60068 (CDN77 Datacamp Limited, GB),
Reverse DNS: unn-95-173-218-100.datapacket.com
Software: /
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
routing-server-id: -1
frontend-id: 5
pragma: no-cache
expires: Sat, 01 Jan 2011 12:00:00 GMT
access-control-allow-origin: *
uip-response-status: Ok
content-length: 42
date: Mon, 20 Apr 2026 16:53:00 GMT
p3p: policyref="http://uip.semasio.net/w3c/p3p.xml", CP="NOI PSAa PSDa OUR IND UNI CNT"
content-type: image/gif

Redirect headers

strict-transport-security: max-age=31536000; includeSubDomains
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
location: https://uipglob.semasio.net/adform/1/info?sType=sync&sExtCookieId=5877196467477221807&sInitiator=internal&gdpr=0&gdpr_consent=
pragma: no-cache
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-methods: GET
expires: -1
access-control-allow-origin: *
content-length: 0
date: Mon, 20 Apr 2026 16:52:59 GMT
server: nginx
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 9D65
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=NTQ3MjdBMzMtNDQ2RS00QTE3LUI3NDItOUY1MzY1QzUzQTk3&gdpr=0&gdpr_consent=&google_cm
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEJdYnk67oqV4VF4OjiEihVc&google_cver=1

42 B
317 B

554ms
273ms

Image
image/gif

207.65.33.82
PubMatic

General

Check archive.org

Download Go to Show image

Full URL

https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEJdYnk67oqV4VF4OjiEihVc&google_cver=1

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

207.65.33.82 , Singapore, ASN62713 (AS-PUBMATIC - PubMatic, Inc., US),

Reverse DNS

Software

nginx /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

strict-transport-security: max-age=16070400; includeSubDomains
cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Mon, 20 Apr 2026 16:52:57 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

cache-control: no-cache, must-revalidate
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEJdYnk67oqV4VF4OjiEihVc&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 379
date: Mon, 20 Apr 2026 16:52:56 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 9D65
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=VHJ6M0RuShe3Qp9TZcU6lw%3D%3D&gdpr=0&gdpr_consent=&google_cm
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_gid=CAESEK04RxBaI_oEuEEtw89d1rg&google_cver=1

4 KB
4 KB

94ms
94ms

Image
text/html

2.18.109.37
Akamai Technologies

General

Check archive.org

Download Go to Show image

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_gid=CAESEK04RxBaI_oEuEEtw89d1rg&google_cver=1
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2.18.109.37 Sydney, Australia, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-109-37.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: max-age=166772
content-encoding: gzip
expires: Wed, 22 Apr 2026 15:12:29 GMT
accept-ranges: bytes
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 7463
date: Mon, 20 Apr 2026 16:52:57 GMT
last-modified: Mon, 13 Apr 2026 10:17:03 GMT
content-type: text/html
server: Apache
vary: Accept-Encoding

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_gid=CAESEK04RxBaI_oEuEEtw89d1rg&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 362
date: Mon, 20 Apr 2026 16:52:57 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 9D65
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEJdYnk67oqV4VF4OjiEihVc&google_cver=1

42 B
98 B

557ms
147ms

Image
image/gif

207.65.33.82
PubMatic

General

Check archive.org

Download Go to Show image

Full URL

https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEJdYnk67oqV4VF4OjiEihVc&google_cver=1

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

207.65.33.82 , Singapore, ASN62713 (AS-PUBMATIC - PubMatic, Inc., US),

Reverse DNS

Software

nginx /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

strict-transport-security: max-age=16070400; includeSubDomains
cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Mon, 20 Apr 2026 16:52:57 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

cache-control: no-cache, must-revalidate
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEJdYnk67oqV4VF4OjiEihVc&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 379
date: Mon, 20 Apr 2026 16:52:57 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 9D65
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=be2730b2-4a29-4f94-a883-ae0394c883c4&gdpr=0&gdpr_consent=

42 B
314 B

378ms
186ms

Image
image/gif

67.199.150.86
PubMatic

General

Check archive.org

Download Go to Show image

Full URL

https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=be2730b2-4a29-4f94-a883-ae0394c883c4&gdpr=0&gdpr_consent=

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

67.199.150.86 Singapore, Singapore, ASN62713 (AS-PUBMATIC - PubMatic, Inc., US),

Reverse DNS

Software

nginx /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

strict-transport-security: max-age=16070400; includeSubDomains
cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Mon, 20 Apr 2026 16:52:57 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=be2730b2-4a29-4f94-a883-ae0394c883c4&gdpr=0&gdpr_consent=
content-length: 355
date: Mon, 20 Apr 2026 16:52:56 GMT
server: Kestrel

GET
H2 200 css
fonts.googleapis.com/ Frame 61F9 11 KB
2 KB 676ms
346ms Stylesheet
text/css 142.250.183.42
Google LLC

General

Check archive.org

Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:600,900&display=swap

Requested by

Host: ib.3lift.com
URL: https://ib.3lift.com/rev/4c6c75912057371d1d0b66b02e3ef937c80969e8/dist/bundle.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

142.250.183.42 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

pnsyda-aj-in-f10.1e100.net

Software

ESF /

Resource Hash

56b6dee65c55458fd93d8a9b57bc76d57f4015a66fb0f6c2665a19b1d015e708

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 20 Apr 2026 16:52:57 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 20 Apr 2026 16:52:57 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Mon, 20 Apr 2026 16:30:55 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 css
fonts.googleapis.com/ Frame 61F9 6 KB
2 KB 575ms
245ms Stylesheet
text/css 142.250.183.42
Google LLC

General

Check archive.org

Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans&display=swap

Requested by

Host: ib.3lift.com
URL: https://ib.3lift.com/rev/4c6c75912057371d1d0b66b02e3ef937c80969e8/dist/bundle.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

142.250.183.42 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

pnsyda-aj-in-f10.1e100.net

Software

ESF /

Resource Hash

64c18f81af81ab6b2ebc8598ed900f7023e0e8788bedd348ab41a92d76f80655

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 20 Apr 2026 16:52:57 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 20 Apr 2026 16:52:57 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Mon, 20 Apr 2026 16:24:03 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 aop
eb2.3lift.com/ Frame 61F9 37 B
139 B 323ms
323ms Image
image/gif 47.131.64.132
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/aop?inv_code=pwm_general_RON_hdx&aid=33384962471309340179540&rev=4c6c759&pr=can%27t%2520access%2520top%2520document&bc=0.64&bmid=5563&biid=7589&sid=66529&brid=349843&adid=OADD2.7971509121968_1CM923YF36VLYINTTT&crid=313114715&ts=1776703975&bcud=640&ss=5&dmp_ids=ChZodHRwczovL3BhaW50LnRveXMvb2lsEjEKCXB1YmNvbW1vbhIkM2QwZTBmMjMtNzVmMS00NTJhLWEzNzEtOWVhOGQwMDdkNmE5GgNiMjUgAA&dcr=4&unid=0&domain=f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com&ref=https%253A%252F%252Fpaint.toys%252F&rr=creative&fid=18&rb=8&g=0&tmplid=206229&rid=0&ft=5&cb=77411
Requested by: Host: f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com
URL: https://f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 47.131.64.132 Singapore, Singapore, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-47-131-64-132.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
date: Mon, 20 Apr 2026 16:52:57 GMT
content-type: image/gif

GET
H2 200 dr
eb2.3lift.com/ Frame 61F9 37 B
139 B 322ms
321ms Image
image/gif 47.131.64.132
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/dr?inv_code=pwm_general_RON_hdx&aid=33384962471309340179540&rev=4c6c759&disclosure_render_method=3&disclosure_render_text=Sponsored%20By&cb=97713
Requested by: Host: f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com
URL: https://f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 47.131.64.132 Singapore, Singapore, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-47-131-64-132.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
date: Mon, 20 Apr 2026 16:52:57 GMT
content-type: image/gif

GET
H2 200 ev1
eb2.3lift.com/ Frame 61F9 37 B
139 B 267ms
267ms Image
image/gif 47.131.64.132
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/ev1?inv_code=pwm_general_RON_hdx&aid=33384962471309340179540&rev=4c6c759&pr=aeZZ5wABq5QGw08-AApvB2xjRzaQVoulMpfQ7A&bc=0.64&bmid=5563&biid=7589&sid=66529&brid=349843&adid=OADD2.7971509121968_1CM923YF36VLYINTTT&crid=313114715&ts=1776703975&bcud=640&ss=5&dmp_ids=ChZodHRwczovL3BhaW50LnRveXMvb2lsEjEKCXB1YmNvbW1vbhIkM2QwZTBmMjMtNzVmMS00NTJhLWEzNzEtOWVhOGQwMDdkNmE5GgNiMjUgAA&dcr=4&unid=0&cepos=0&ceid=-1&cb=56513
Requested by: Host: f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com
URL: https://f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 47.131.64.132 Singapore, Singapore, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-47-131-64-132.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
date: Mon, 20 Apr 2026 16:52:57 GMT
content-type: image/gif

POST
H2 200 483.json Show response
id5-sync.com/g/v2/ 1 KB
1 KB 434ms
432ms Fetch
application/json 135.125.170.108
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/g/v2/483.json

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.05eaa3284c60ad6e334d.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

135.125.170.108 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

aff41d47841092b437cef4c6231ee0e33935d31f2b2c1326d692e42eab3fca71

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Mon, 20 Apr 2026 16:52:57 GMT
content-type: application/json
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers

GET
H3 200 favicon.ico Show response
ad.doubleclick.net/ 1 KB
129 B 194ms
193ms Fetch
image/x-icon 142.250.195.230
Google LLC

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.5143992440211634

Requested by

Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.195.230 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

a2-18-108-25.deploy.static.akamaitechnologies.com

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Tue, 21 Apr 2026 16:52:57 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 20 Apr 2026 16:52:57 GMT
content-type: image/x-icon
vary: Accept-Encoding
last-modified: Tue, 08 May 2012 13:08:06 GMT
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 cookie
sync.cootlogix.com/api/ Frame 54CB 43 B
496 B 429ms
427ms Image
image/avif 134.209.66.79
DigitalOcean

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=openxut&userId=4a6b62a0-fcd4-45a4-992b-acd731ff7349&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=fba3d144-1026-4d31-a758-943b9545e305&gdpr=&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenxut%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 134.209.66.79 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Mon, 20 Apr 2026 16:52:57 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

GET
H3

200

dds
rtb.openx.net/sync/ Frame 54CB
Redirect Chain

https://rtb.openx.net/sync/dds
https://cm.g.doubleclick.net/pixel?google_nid=open&google_hm=3lCPu1X9wOkV2v-nFUppoQ==&ox_sc=1&ox_init=1
https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1

43 B
60 B

170ms
170ms

Image
image/gif

35.227.252.103
Google LLC

General

Check archive.org

Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=fba3d144-1026-4d31-a758-943b9545e305&gdpr=&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenxut%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
Protocol: H3
Server: 35.227.252.103 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://us-u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache, must-revalidate
pragma: no-cache
x-forwarded-for: 103.108.231.228
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Mon, 20 Apr 2026 16:52:57 GMT
content-type: image/gif
vary: Origin

Redirect headers

cache-control: no-cache, must-revalidate
location: https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 249
date: Mon, 20 Apr 2026 16:52:58 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET openx
cs.nex8.net/cs/ Frame 54CB 0
0

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 54CB
Redirect Chain

https://ups.analytics.yahoo.com/ups/58934/cms?gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-VQln8rJE2p_e.Y1HAldm.V7SqIII7cpzb_M-~A&gdpr=0

43 B
61 B

172ms
172ms

Image
image/gif

35.244.159.8
Google LLC

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-VQln8rJE2p_e.Y1HAldm.V7SqIII7cpzb_M-~A&gdpr=0
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=fba3d144-1026-4d31-a758-943b9545e305&gdpr=&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenxut%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://us-u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 103.108.231.228
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Mon, 20 Apr 2026 16:52:56 GMT
content-type: image/gif
vary: Accept

Redirect headers

strict-transport-security: max-age=31536000
location: https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-VQln8rJE2p_e.Y1HAldm.V7SqIII7cpzb_M-~A&gdpr=0
age: 0
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Mon, 20 Apr 2026 16:52:57 GMT
content-type: text/html
server: ATS

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 54CB
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=268
https://us-u.openx.net/w/1.0/sd?id=537082476&val=NpktLDaYUCtzccKP0VD0aGds5-Q&gdpr=&gdpr_consent=

43 B
61 B

173ms
172ms

Image
image/gif

35.244.159.8
Google LLC

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537082476&val=NpktLDaYUCtzccKP0VD0aGds5-Q&gdpr=&gdpr_consent=
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=fba3d144-1026-4d31-a758-943b9545e305&gdpr=&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenxut%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://us-u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 103.108.231.228
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Mon, 20 Apr 2026 16:52:57 GMT
content-type: image/gif
vary: Accept

Redirect headers

Location: https://us-u.openx.net/w/1.0/sd?id=537082476&val=NpktLDaYUCtzccKP0VD0aGds5-Q&gdpr=&gdpr_consent=
Content-Length: 131
Date: Mon, 20 Apr 2026 16:52:57 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET pxd
dps.jp.cinarra.com/ Frame 54CB 0
0

GET
H2 204 openx
tr.blismedia.com/v1/api/sync/ Frame 54CB 0
170 B 436ms
219ms Image
text/plain 34.96.105.8
Google LLC

General

Check archive.org

Download Go to Show image

Full URL: https://tr.blismedia.com/v1/api/sync/openx
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=fba3d144-1026-4d31-a758-943b9545e305&gdpr=&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenxut%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.105.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS: 8.105.96.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

via: 1.1 google
date: Mon, 20 Apr 2026 16:52:57 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H2 200 checksync.php Show response
hbx.media.net/ Frame E4D7 34 KB
12 KB 377ms
143ms Document
text/html 2.18.108.25
Akamai Technologies

General

Check archive.org

Download Go to

Full URL

https://hbx.media.net/checksync.php?cid=8CUEHS6F9&cs=87&type=mpbc&cv=37&vsSync=1&uspstring=&gdpr=&gdprstring=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fpbs.intergient.com%2Fsetuid%3Fbidder%3Dmedianet%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%3Cvsid%3E

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.05eaa3284c60ad6e334d.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.108.25 Sydney, Australia, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

Software

Apache /

Resource Hash

4458fecb66985050199d2ab7bd5781674a17ff7620a8178a347b20e3c818edea

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800 max-age=86400 ; includeSubDomains

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

alt-svc: h3=":443"; ma=93600
cache-control: max-age=172800
content-encoding: gzip
content-length: 11885
content-type: text/html; charset=UTF-8
date: Mon, 20 Apr 2026 16:52:57 GMT
expires: Wed, 22 Apr 2026 16:52:57 GMT
p3p: CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
pragma: max-age=604800
server: Apache
strict-transport-security: max-age=604800 max-age=86400 ; includeSubDomains
timing-allow-origin: *
vary: Accept-Encoding

GET
H2 200 usync.js Show response
eus.rubiconproject.com/ Frame 080E 45 KB
0 173ms
173ms Script
text/html 23.221.133.65
Akamai Technologies

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=vidazoo&endpoint=us-east
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.221.133.65 Sydney, Australia, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-221-133-65.deploy.static.akamaitechnologies.com
Software: Apache/2.4.65 (Debian) / PHP/8.3.24
Resource Hash: 8ada07e886cb52e101be8dfebd437d41ba30f743edfb13d59f91bff13d65ce26

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://eus.rubiconproject.com/usync.html?p=vidazoo&endpoint=us-east
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: max-age=42943
content-encoding: gzip
expires: Tue, 21 Apr 2026 04:48:37 GMT
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
content-length: 11524
date: Mon, 20 Apr 2026 16:52:54 GMT
last-modified: Mon, 20 Apr 2026 04:48:37 GMT
x-powered-by: PHP/8.3.24
server: Apache/2.4.65 (Debian)
content-type: text/html;charset=UTF-8
vary: Accept-Encoding

GET
H2 200 usync.js Show response
eus.rubiconproject.com/ Frame A2A2 45 KB
0 173ms
173ms Script
text/html 23.221.133.65
Akamai Technologies

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=12776
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.221.133.65 Sydney, Australia, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-221-133-65.deploy.static.akamaitechnologies.com
Software: Apache/2.4.65 (Debian) / PHP/8.3.24
Resource Hash: 8ada07e886cb52e101be8dfebd437d41ba30f743edfb13d59f91bff13d65ce26

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://eus.rubiconproject.com/usync.html?p=12776
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: max-age=42943
content-encoding: gzip
expires: Tue, 21 Apr 2026 04:48:37 GMT
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
content-length: 11524
date: Mon, 20 Apr 2026 16:52:54 GMT
last-modified: Mon, 20 Apr 2026 04:48:37 GMT
x-powered-by: PHP/8.3.24
server: Apache/2.4.65 (Debian)
content-type: text/html;charset=UTF-8
vary: Accept-Encoding

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 61F9 0
0 223ms
223ms Fetch
image/gif 142.250.195.162
Google LLC

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.195.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Mon, 20 Apr 2026 16:52:57 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 61F9 0
0 224ms
223ms Fetch
image/gif 142.250.195.162
Google LLC

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACYANgBGgD

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.195.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://f862c452165a4ee19009fdce9bdc43ab.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Mon, 20 Apr 2026 16:52:57 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 cookie
sync.cootlogix.com/api/ Frame 5500 43 B
496 B 609ms
608ms Image
image/avif 134.209.66.79
DigitalOcean

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=openx&userId=f38974e2-7320-4271-8ca4-f11477f4e770&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=4241c706-9fd2-4ae4-b2d7-c9f8d34e773c&ph=f4cc9fb1-057b-4e7a-b393-325ee9109574&gdpr=&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenx%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 134.209.66.79 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Mon, 20 Apr 2026 16:52:57 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

GET
H3

200

dds
rtb.openx.net/sync/ Frame 5500
Redirect Chain

https://rtb.openx.net/sync/dds
https://cm.g.doubleclick.net/pixel?google_nid=open&google_hm=3lCPu1X9wOkV2v-nFUppoQ==&ox_sc=1&ox_init=1
https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1

43 B
60 B

170ms
170ms

Image
image/gif

35.227.252.103
Google LLC

General

Check archive.org

Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=4241c706-9fd2-4ae4-b2d7-c9f8d34e773c&ph=f4cc9fb1-057b-4e7a-b393-325ee9109574&gdpr=&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenx%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
Protocol: H3
Server: 35.227.252.103 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache, must-revalidate
pragma: no-cache
x-forwarded-for: 103.108.231.228
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Mon, 20 Apr 2026 16:52:57 GMT
content-type: image/gif
vary: Origin

Redirect headers

cache-control: no-cache, must-revalidate
location: https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 249
date: Mon, 20 Apr 2026 16:52:58 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET openx
cs.nex8.net/cs/ Frame 5500 0
0

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 5500
Redirect Chain

https://ups.analytics.yahoo.com/ups/58934/cms?gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-VQln8rJE2p_e.Y1HAldm.V7SqIII7cpzb_M-~A&gdpr=0

43 B
61 B

172ms
172ms

Image
image/gif

35.244.159.8
Google LLC

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-VQln8rJE2p_e.Y1HAldm.V7SqIII7cpzb_M-~A&gdpr=0
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=4241c706-9fd2-4ae4-b2d7-c9f8d34e773c&ph=f4cc9fb1-057b-4e7a-b393-325ee9109574&gdpr=&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenx%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 103.108.231.228
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Mon, 20 Apr 2026 16:52:56 GMT
content-type: image/gif
vary: Accept

Redirect headers

strict-transport-security: max-age=31536000
location: https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-VQln8rJE2p_e.Y1HAldm.V7SqIII7cpzb_M-~A&gdpr=0
age: 0
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Mon, 20 Apr 2026 16:52:57 GMT
content-type: text/html
server: ATS

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 5500
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=268
https://us-u.openx.net/w/1.0/sd?id=537082476&val=NpktLDaYUCtzccKP0VD0aGds5-Q&gdpr=&gdpr_consent=

43 B
61 B

172ms
172ms

Image
image/gif

35.244.159.8
Google LLC

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537082476&val=NpktLDaYUCtzccKP0VD0aGds5-Q&gdpr=&gdpr_consent=
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=4241c706-9fd2-4ae4-b2d7-c9f8d34e773c&ph=f4cc9fb1-057b-4e7a-b393-325ee9109574&gdpr=&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenx%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 103.108.231.228
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Mon, 20 Apr 2026 16:52:57 GMT
content-type: image/gif
vary: Accept

Redirect headers

Location: https://us-u.openx.net/w/1.0/sd?id=537082476&val=NpktLDaYUCtzccKP0VD0aGds5-Q&gdpr=&gdpr_consent=
Content-Length: 131
Date: Mon, 20 Apr 2026 16:52:58 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET pxd
dps.jp.cinarra.com/ Frame 5500 0
0

GET
H2 204 openx
tr.blismedia.com/v1/api/sync/ Frame 5500 0
116 B 531ms
206ms Image
text/plain 34.96.105.8
Google LLC

General

Check archive.org

Download Go to Show image

Full URL: https://tr.blismedia.com/v1/api/sync/openx
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=4241c706-9fd2-4ae4-b2d7-c9f8d34e773c&ph=f4cc9fb1-057b-4e7a-b393-325ee9109574&gdpr=&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenx%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.105.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS: 8.105.96.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

via: 1.1 google
date: Mon, 20 Apr 2026 16:52:57 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H2 200 model_person_country_code_AU_person_region_code_5065727468.json Show response
www.googletagservices.com/agrp/prod/ Frame 87F7 613 KB
81 KB 477ms
145ms Fetch
application/json 142.250.195.226
Google LLC

General

Check archive.org

Download Go to

Full URL

https://www.googletagservices.com/agrp/prod/model_person_country_code_AU_person_region_code_5065727468.json

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.195.226 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

45e3cc030efd81acba4c34d8a73e9261da1adfd7884afae68098f35380af9a8c

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-people-metrics-releaser
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.googleadservices.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
age: 24408
report-to: {"group":"ads-people-metrics-releaser","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-people-metrics-releaser"}]}
x-content-type-options: nosniff
expires: Tue, 21 Apr 2026 10:06:09 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 20 Apr 2026 10:06:09 GMT
last-modified: Tue, 30 Jul 2024 19:25:57 GMT
content-type: application/json
vary: Accept-Encoding
content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-people-metrics-releaser
cache-control: public, max-age=86400
cross-origin-opener-policy: same-origin; report-to="ads-people-metrics-releaser"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
content-length: 82574
x-xss-protection: 0
server: sffe

POST
H3 200 report-shared-storage
www.googleadservices.com/.well-known/private-aggregation/ Frame 87F7 0
0 231ms
230ms Fetch
text/html 172.217.25.194
Google LLC

General

Check archive.org

Download Go to

Full URL

https://www.googleadservices.com/.well-known/private-aggregation/report-shared-storage

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.25.194 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0

Response headers

timing-allow-origin: *
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Mon, 20 Apr 2026 16:52:57 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: cafe

POST
H3 200 report-shared-storage
www.googleadservices.com/.well-known/private-aggregation/ Frame 87F7 0
0 369ms
368ms Fetch
text/html 172.217.25.194
Google LLC

General

Check archive.org

Download Go to

Full URL

https://www.googleadservices.com/.well-known/private-aggregation/report-shared-storage

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.25.194 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0

Response headers

timing-allow-origin: *
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Mon, 20 Apr 2026 16:52:57 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: cafe

POST
H3 200 report-shared-storage
www.googleadservices.com/.well-known/private-aggregation/ Frame 87F7 0
0 369ms
367ms Fetch
text/html 172.217.25.194
Google LLC

General

Check archive.org

Download Go to

Full URL

https://www.googleadservices.com/.well-known/private-aggregation/report-shared-storage

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.25.194 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0

Response headers

timing-allow-origin: *
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Mon, 20 Apr 2026 16:52:57 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 87F7 0
0 227ms
227ms Fetch
image/gif 142.250.195.162
Google LLC

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAESDk9wZXJhdGlvbkVycm9yGpgBc2hhcmVkU3RvcmFnZS53b3JrbGV0LmFkZE1vZHVsZSBpcyBkaXNhYmxlZCBiZWNhdXNlIGVpdGhlciBzaGFyZWRTdG9yYWdlIGlzIGRpc2FibGVkIG9yIGJvdGggc2hhcmVkU3RvcmFnZS5zZWxlY3RVUkwgYW5kIHByaXZhdGVBZ2dyZWdhdGlvbiBhcmUgZGlzYWJsZWQ%3D

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.195.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.googleadservices.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Mon, 20 Apr 2026 16:52:57 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

POST
H2 200 v3 Show response
id5-sync.com/gm/ 2 KB
2 KB 777ms
776ms XHR
application/json 135.125.170.108
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/gm/v3

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

135.125.170.108 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS