paint.toys
3.33.186.135 Public Scan Open in urlscan Pro

Software

Netlify /

Resource Hash

fe22d7bc39aeadb33e17b218425d2a50939f49166eb696f087bf4be21a0308eb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://fytf.canadapowerline.com/wl3o928xoeseu6yhwbe86x91i2atpi5h9afqoy6d8u89xwd36vnfatf8lcfh1ohfjlet1h28ebRT05QWUxEeEZIMDA0SEt1ZmFZVEktNjE2OC0yNjc5OTE2MS0xMDQ4MDI3Zi0xMDcwOS10UjIzV2xPcGJubUNTbzZhYXU0ag/1wzfy6xxlkh/UlKUFn9vPYGNYPDcnfx2XT9BteaynAxadHwobRlHuUCQ/976072676093042215967966837951182/WTChwwGOSGIWJyn0yLUstnul2LrypkH84amq08r1l7de
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

accept-ranges: bytes
age: 6809
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-encoding: br
content-length: 2570
content-type: text/html; charset=UTF-8
date: Fri, 24 Apr 2026 17:54:30 GMT
etag: "52e8a2f9b67c548d54e3b976fd4a0a7d-ssl-df"
server: Netlify
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-nf-request-id: 01KQ0A20RVPZ1PM0AJXK8J4ZCS

Redirect headers

cache-status: "Netlify Edge"; fwd=miss
content-length: 98
content-type: text/html
date: Fri, 24 Apr 2026 17:54:30 GMT
location: /oil/
server: Netlify
strict-transport-security: max-age=31536000
x-nf-request-id: 01KQ0A20ERMDG9ZQR7ASAHK472

GET
H2 200 ramp_config.js Show response
cdn.intergient.com/1024872/74068/ 39 KB
7 KB 110ms
47ms Script
application/javascript 104.18.20.56
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/1024872/74068/ramp_config.js
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: b5f2a784265d0938eee26a8130ce624a531647ea8404e4ff748e2f0fd0216582

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cf-ray: 9f16f93f2a16434e-AMS
hw-country-code: NL
cache-control: max-age=600, public, must-revalidate
content-encoding: br
date: Fri, 24 Apr 2026 17:54:30 GMT
content-type: application/javascript
server: cloudflare

GET
H2 200 apps.css
paint.toys/ 6 KB
2 KB 24ms
23ms Stylesheet
text/css 3.33.186.135
Amazon.com

General

Check archive.org

Download Go to

Full URL

https://paint.toys/apps.css

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

Software

Netlify /

Resource Hash

96d3d9ab6c847374c0b14dbcd7be944e96c5ab99db9b1346d1fa214dd46c75fb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/oil/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
content-encoding: br
etag: "bcfef24d2405a41497bc188d920f182d-ssl-df"
age: 10429
accept-ranges: bytes
content-length: 1660
x-nf-request-id: 01KQ0A20T10FWTB0Q1TNWCBXGK
cache-status: "Netlify Edge"; hit
date: Fri, 24 Apr 2026 17:54:30 GMT
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: Netlify

GET
H2 200 index.js Show response
paint.toys/oil/ 4 KB
1 KB 25ms
23ms Script
application/javascript 3.33.186.135
Amazon.com

General

Check archive.org

Download Go to

Full URL

https://paint.toys/oil/index.js

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

Software

Netlify /

Resource Hash

169407eee9cacaa18777cd5ec7de3d39b9eb3d401e800296b0da7a2e761ad654

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/oil/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
content-encoding: br
etag: "bc71a337771d76feffad10991544618f-ssl-df"
age: 14690
accept-ranges: bytes
content-length: 1260
x-nf-request-id: 01KQ0A20T1H4MFF68PGEJNSDXH
cache-status: "Netlify Edge"; hit
date: Fri, 24 Apr 2026 17:54:30 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Netlify

GET
H2 200 art-icon.png
paint.toys/assets/ 33 KB
33 KB 35ms
34ms Image
image/png 3.33.186.135
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/art-icon.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

Software

Netlify /

Resource Hash

f4d368e4230539c778afbb020e0ea611b3e1d984179f5b3769b44081d6703f3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/oil/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "1394f8469f2ca5750397e3d7b6ec70a1-ssl"
age: 36502
accept-ranges: bytes
content-length: 33562
x-nf-request-id: 01KQ0A20TB2TBP7QTPMQ76AB58
cache-status: "Netlify Edge"; hit
date: Fri, 24 Apr 2026 17:54:30 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-hand.png
paint.toys/assets/ 27 KB
27 KB 52ms
51ms Image
image/png 3.33.186.135
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-hand.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

Software

Netlify /

Resource Hash

32aa05a5648678542ab9044647f0bf5549c0b53a070585edb773f0e92b72b97d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/oil/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "a0822110a4671ffdf710da1467460fba-ssl"
age: 36502
accept-ranges: bytes
content-length: 27394
x-nf-request-id: 01KQ0A20TBPJNN8V74ARWB6AAJ
cache-status: "Netlify Edge"; hit
date: Fri, 24 Apr 2026 17:54:30 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-disk.png
paint.toys/assets/ 13 KB
14 KB 23ms
23ms Image
image/png 3.33.186.135
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-disk.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

Software

Netlify /

Resource Hash

436814c2374a6d92a42a02d39969ef7c56b5f225667abecb218e692c5569943c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/oil/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "26852fa1548a91e004629b01e4abf1dd-ssl"
age: 36502
accept-ranges: bytes
content-length: 13766
x-nf-request-id: 01KQ0A20VRF0XXPKHGNA9BSCPC
cache-status: "Netlify Edge"; hit
date: Fri, 24 Apr 2026 17:54:30 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-trash.png
paint.toys/assets/ 50 KB
51 KB 24ms
23ms Image
image/png 3.33.186.135
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-trash.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

186.176.8.34.bc.googleusercontent.com

Software

Netlify /

Resource Hash

6ceb226c487cb85243545e768944e0e1ae0944be8fde6c1c43c7314a9287e6d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/oil/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "e91ef5e34b5154d392e8560031eaaa4c-ssl"
age: 36502
accept-ranges: bytes
content-length: 51680
x-nf-request-id: 01KQ0A20W216Z2XNZVG1A9JKZQ
cache-status: "Netlify Edge"; hit
date: Fri, 24 Apr 2026 17:54:30 GMT
content-type: image/png
server: Netlify

GET
H2 200 ramp_core.js Show response
cdn.intergient.com/ 3 KB
2 KB 23ms
23ms Script
application/javascript 104.18.20.56
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/ramp_core.js
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3005e9bb4946eeb560bfd86eed8d9abdd0ee9c5e691af82e939fd857c9aa4482

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cf-ray: 9f16f93f8b24434e-AMS
hw-country-code: NL
cache-control: max-age=600, public, must-revalidate
content-encoding: br
date: Fri, 24 Apr 2026 17:54:30 GMT
content-type: application/javascript
server: cloudflare

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 455 KB
155 KB 114ms
50ms Script
application/javascript 142.251.110.97
Google LLC

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.110.97 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

bz-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

ad3c3ce941c079bd83068901d74956d002192ebda7aa430522b2345d237e3a4f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
content-encoding: zstd
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Fri, 24 Apr 2026 17:54:31 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 158457
date: Fri, 24 Apr 2026 17:54:31 GMT
x-xss-protection: 0
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Google Tag Manager
access-control-allow-headers: Cache-Control

GET
H2 200 css2
fonts.googleapis.com/ 3 KB
574 B 1393ms
1336ms Stylesheet
text/css 142.251.13.95
Google LLC

General

Check archive.org

Download Go to

Full URL

https://fonts.googleapis.com/css2?family=DM+Sans:wght@300;400;500&family=DM+Serif+Display&display=swap

Requested by

Host: paint.toys
URL: https://paint.toys/apps.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

142.251.13.95 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

wt-in-f95.1e100.net

Software

ESF /

Resource Hash

0e43e66404ff234d0d874c9422542a2e6442c73246650d680490f46bedd60898

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Fri, 24 Apr 2026 17:54:31 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 24 Apr 2026 17:54:31 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Fri, 24 Apr 2026 17:54:31 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 2tiu3.vendor.js Show response
faucetfoot.com/public/hdbhl42/ 104 KB
36 KB 97ms
38ms Script
text/javascript 34.8.176.186
Google LLC

General

Check archive.org

Download Go to

Full URL

https://faucetfoot.com/public/hdbhl42/2tiu3.vendor.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.8.176.186 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),

Reverse DNS

Software

hoothoot/2455384222 /

Resource Hash

f49ebe4d924f5f0eca4550ab47ae09a3b8bb70c80ed2a118e6fc96b446ba2726

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=15724800; preload
cache-control: private, must-revalidate, max-age=21600
timing-allow-origin: *
content-encoding: zstd
etag: W/"17248a8c7e3098e5e25b81c41c055d02e73995e7072f659bbe0018ac1426158c"
via: fen-hoothoot-europe-west1-zrts.gce-europe-west1, 1.1 google
alt-svc: h3=":443"; ma=2592000
date: Fri, 24 Apr 2026 17:54:31 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding, Accept-Language
server: hoothoot/2455384222

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 108 KB
34 KB 76ms
39ms Script
text/javascript 192.178.183.154
Google LLC

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.183.154 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

lcfraw-in-f154.1e100.net

Software

cafe /

Resource Hash

aa6df81ac412a16b7e38c9f6ca8c651dbd44cb53a184ca387f29e655753ffdd7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
etag: 551 / 20567 / m202604200101 / config-hash: 2822625782254037421
x-content-type-options: nosniff
expires: Fri, 24 Apr 2026 17:54:31 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Fri, 24 Apr 2026 17:54:31 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 34771
x-xss-protection: 0
server: cafe

GET
H2 200 prebid.05eaa3284c60ad6e334d.js Show response
cdn.intergient.com/prebid/ 746 KB
222 KB 58ms
58ms Script
text/javascript 104.18.20.56
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/prebid/prebid.05eaa3284c60ad6e334d.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8f9757938ed08b400ae866b022739d2ea1f4db4369e324174661f11bd7ae6ad6

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

hw-country-code: NL
cache-control: public, max-age=31536000, immutable
content-encoding: br
cf-cache-status: HIT
etag: W/"2539bceaf323aef3b5bbf813e3bcbe07"
age: 686583
cf-ray: 9f16f9422a10434e-AMS
date: Fri, 24 Apr 2026 17:54:31 GMT
content-type: text/javascript
last-modified: Thu, 16 Apr 2026 19:07:06 GMT
server: cloudflare
vary: Accept-Encoding

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202604200101/ 600 KB
188 KB 26ms
26ms Script
text/javascript 192.178.183.154
Google LLC

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202604200101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.183.154 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

lcfraw-in-f154.1e100.net

Software

cafe /

Resource Hash

436e0efc33730cb1afa57e56883d6c4cbf139653f65ebc827d225af2e6264645

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
etag: 1572731063465355741
age: 26105
x-content-type-options: nosniff
expires: Sat, 24 Apr 2027 10:39:26 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Fri, 24 Apr 2026 10:39:26 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 192195
x-xss-protection: 0
server: cafe

GET
H2 200 154013155 Show response
fundingchoicesmessages.google.com/i/ 217 KB
70 KB 136ms
71ms Script
application/javascript 142.251.14.138
Google LLC

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/154013155?ers=3

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202604200101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.14.138 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

4815579e68b9720c66c564f238cca09589a839366aed30050fd74b2807969108

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-qBzckMElQhwTsYg3gdJ3Rw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 24 Apr 2026 17:54:31 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzj6mDU4pJicNeQYljEv4up9eY51qlAXLLoPGsLEHcB8SwgNlS4xOoIxB_qL7P-AOIiiSusTUD8qeoGq1D1DdZwLh-2eCD-VuzLxlbiy3Ziih_bDSB-AsRfgJjlrT-b2tEANjMgXjgtkG0lEN-JCWJ7AsSnVgezXQJiIR6O63fWnWcTWHGg-SyTkkZSfmF8cn5eSVFmUmlJflFaclpqcWpRWWpRvJGBkZmBiZGxnoFZfIEBALhfShA"
content-security-policy: script-src 'report-sample' 'nonce-qBzckMElQhwTsYg3gdJ3Rw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

POST
H3 204 AGSKWxWGMcuowAHvIOj7l4UFyp9GB6FB8NhkVWVyWUCPd7l3xDW2jBqHIc9EyM3LMTan2nspfERFAyKF_soDfhNH8T0FQD_kj1Hpfc95eyD_ruWdxUO5Ob3SPSKxSs3AogFGc58fcKUu9A== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 65ms
34ms XHR
text/html 142.251.14.138
Google LLC

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWGMcuowAHvIOj7l4UFyp9GB6FB8NhkVWVyWUCPd7l3xDW2jBqHIc9EyM3LMTan2nspfERFAyKF_soDfhNH8T0FQD_kj1Hpfc95eyD_ruWdxUO5Ob3SPSKxSs3AogFGc58fcKUu9A==

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.nl.VL3M-eBF5CA.es5.O/d=1/rs=AJlcJMw3A8_vPGS_NcYZOI75T0QwY4ydSA/m=kernel_loader,loader_js_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.14.138 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-W0-yhi1OQk4cy3uTB8b5kQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type: text/plain
sec-ch-ua-mobile: ?0

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 24 Apr 2026 17:54:31 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjMtDikmLw0pBi-FB_mfUHEIdz-bDFA_HCaYFsK4H4TkwQ2xMgPrU6mO0SEAvxcFy_s-48m0DH_lsNzEouSfmF8cn5eSWpeSW6iSnFuiB2UWZSaUl-EQo7tQykIic_PT0zLz3eyMDIzMDEyFjPwDy-wAAAn3kwOQ"
content-security-policy: script-src 'report-sample' 'nonce-W0-yhi1OQk4cy3uTB8b5kQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWGMcuowAHvIOj7l4UFyp9GB6FB8NhkVWVyWUCPd7l3xDW2jBqHIc9EyM3LMTan2nspfERFAyKF_soDfhNH8T0FQD_kj1Hpfc95eyD_ruWdxUO5Ob3SPSKxSs3AogFGc58fcKUu9A==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.14.138 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-2pC0kAPUmSy1I6iIEpprxA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type: text/plain
sec-ch-ua-mobile: ?0

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 24 Apr 2026 17:54:31 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjMtDikmLw1JBi-FB_mfUHEIdz-bDFA_HCaYFsK4H4TkwQ2xMgPrU6mO0SEAvxcFy_s-48m8CPD2dbmJVckvIL45Pz80pS80p0E1OKdUHsosyk0pL8IhR2ahlIRU5-enpmXnq8kYGRmYGJkbGegXl8gQEAy14w0A"
content-security-policy: script-src 'report-sample' 'nonce-2pC0kAPUmSy1I6iIEpprxA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H2 200 AGSKWxXhuKEhb3EgoQpwOnM8Fqd9Dd7qMwAQn8GZlW5WsA00FDuHNRmc6hFpPlOQCX-eaFeue8a6u7e6ORydyZKsEmCdiSII3D3is_zVa24EAObiFmBdjqWAiZRL6JouJ_pgeFqZYIFLUw== Show response
fundingchoicesmessages.google.com/f/ 889 KB
106 KB 123ms
122ms Script
application/javascript 142.251.14.138
Google LLC

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxXhuKEhb3EgoQpwOnM8Fqd9Dd7qMwAQn8GZlW5WsA00FDuHNRmc6hFpPlOQCX-eaFeue8a6u7e6ORydyZKsEmCdiSII3D3is_zVa24EAObiFmBdjqWAiZRL6JouJ_pgeFqZYIFLUw==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzc3MDUzMjcxLDc2MTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzddXSwiaHR0cHM6Ly9wYWludC50b3lzL29pbC8iLG51bGwsW1s4LCJWTDNNLWVCRjVDQSJdLFs5LCJubCJdLFszNSwiMTc3NzA1MzI3MSJdLFsxOSwiMSJdLFsxNywiWzBdIl0sWzI0LCJmeXRmLmNhbmFkYXBvd2VybGluZS5jb20iXSxbMjUsIltbOTUzNDAyNTMsOTUzNDAyNTVdXSJdLFsyOSwiZmFsc2UiXV1d

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.14.138 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

382ffe42634e32fb7a3b0ed0e411e610b2ec56f805992145b0e47ea8ed4dddc1

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-4xIUMVMM46aU3lDKGKOI1w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 24 Apr 2026 17:54:31 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjamHU4pJi8NSQYmi9eY51KhCXLDrP2gLEXUA8C4gNFS6xOgLxh_rLrD-AuEjiCmsTEH-qusEqVH2DNZzLhy0eiL8V-7KxlfiynZjix3YDiJ8A8RcgZnnrz6Z2NIDNDIgXTgtkWwnEd2KC2J4A8anVwWyXgFiIh-P6nXXn2QR23Pk4l1lJIym_MD45P6-kKDOptCS_KC05LbU4tagstSjeyMDIzMDEyFjPwCy-wAAAv4ZJDA"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-4xIUMVMM46aU3lDKGKOI1w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H2 200 css
fonts.googleapis.com/ 123 KB
6 KB 43ms
42ms Stylesheet
text/css 142.251.13.95
Google LLC

General

Check archive.org

Download Go to

Full URL

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.nl.VL3M-eBF5CA.es5.O/d=1/exm=kernel_loader,loader_js_executable/ed=1/rs=AJlcJMw3A8_vPGS_NcYZOI75T0QwY4ydSA/m=web_iab_tcf_v2_wall_executable

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

142.251.13.95 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

wt-in-f95.1e100.net

Software

ESF /

Resource Hash

f045c9ab803dcf309dc19739cadecdd6ff556f4fbb5969a9f57abe5737f4af50

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Fri, 24 Apr 2026 17:54:31 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 24 Apr 2026 17:54:31 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Fri, 24 Apr 2026 17:54:31 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 art-icon.png
paint.toys/assets/ 33 KB
63 B 25ms
24ms Image
image/png 3.33.186.135
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/art-icon.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

Software

Netlify /

Resource Hash

f4d368e4230539c778afbb020e0ea611b3e1d984179f5b3769b44081d6703f3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/oil/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "1394f8469f2ca5750397e3d7b6ec70a1-ssl"
age: 36502
accept-ranges: bytes
content-length: 33562
x-nf-request-id: 01KQ0A226G5HEG6FQ6KN7K2YHQ
cache-status: "Netlify Edge"; hit
date: Fri, 24 Apr 2026 17:54:32 GMT
content-type: image/png
server: Netlify

GET
H3 200 rP2Yp2ywxg089UriI5-g4vlH9VoD8Cmcqbu0-K4.woff2
fonts.gstatic.com/s/dmsans/v17/ 36 KB
36 KB 56ms
23ms Font
font/woff2 142.251.110.94
Google LLC

General

Check archive.org

Download Go to

Full URL

https://fonts.gstatic.com/s/dmsans/v17/rP2Yp2ywxg089UriI5-g4vlH9VoD8Cmcqbu0-K4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=DM+Sans:wght@300;400;500&family=DM+Serif+Display&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.110.94 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

bz-in-f94.1e100.net

Software

sffe /

Resource Hash

9fea608a947e67020c33cad9a6fe3d60c54119dfb8cff87768a8117a15ed7543

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://paint.toys
sec-ch-ua-platform: "Linux"
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

age: 448862
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Mon, 19 Apr 2027 13:13:30 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 19 Apr 2026 13:13:30 GMT
last-modified: Wed, 10 Sep 2025 16:31:03 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 36932
x-xss-protection: 0
server: sffe

GET
H3 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v40/ 47 KB
47 KB 60ms
26ms Font
font/woff2 142.251.110.94
Google LLC

General

Check archive.org

Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.110.94 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

bz-in-f94.1e100.net

Software

sffe /

Resource Hash

3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://paint.toys
sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

age: 369859
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Tue, 20 Apr 2027 11:10:13 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 20 Apr 2026 11:10:13 GMT
last-modified: Thu, 14 Dec 2023 02:08:40 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 48236
x-xss-protection: 0
server: sffe

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWGMcuowAHvIOj7l4UFyp9GB6FB8NhkVWVyWUCPd7l3xDW2jBqHIc9EyM3LMTan2nspfERFAyKF_soDfhNH8T0FQD_kj1Hpfc95eyD_ruWdxUO5Ob3SPSKxSs3AogFGc58fcKUu9A==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.14.138 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-e2STRsKYJ_hlEe25EG2RvA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type: text/plain
sec-ch-ua-mobile: ?0

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 24 Apr 2026 17:54:32 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjMtDikmLw15Bi-FB_mfUHEIdz-bDFA_HCaYFsK4H4TkwQ2xMgPrU6mO0SEAvxcNy4s-48m8CLX1_6GZVckvIL45Pz80pS80p0E1OKdUHsosyk0pL8IhR2ahlIRU5-enpmXnq8kYGRmYGJkbGegXl8gQEA2owxAQ"
content-security-policy: script-src 'report-sample' 'nonce-e2STRsKYJ_hlEe25EG2RvA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWGMcuowAHvIOj7l4UFyp9GB6FB8NhkVWVyWUCPd7l3xDW2jBqHIc9EyM3LMTan2nspfERFAyKF_soDfhNH8T0FQD_kj1Hpfc95eyD_ruWdxUO5Ob3SPSKxSs3AogFGc58fcKUu9A==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.14.138 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-WZpZlBwuip6q6kpmBirukA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type: text/plain
sec-ch-ua-mobile: ?0

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 24 Apr 2026 17:54:32 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjMtDikmII0pBi-FB_mfUHEIdz-bDFA_HCaYFsK4H4TkwQ2xMgPrU6mO0SEAvxcNy4s-48m8CNu7v6GZVckvIL45Pz80pS80p0E1OKdUHsosyk0pL8IhR2ahlIRU5-enpmXnq8kYGRmYGJkbGegXl8gQEAvnAwnQ"
content-security-policy: script-src 'report-sample' 'nonce-WZpZlBwuip6q6kpmBirukA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWGMcuowAHvIOj7l4UFyp9GB6FB8NhkVWVyWUCPd7l3xDW2jBqHIc9EyM3LMTan2nspfERFAyKF_soDfhNH8T0FQD_kj1Hpfc95eyD_ruWdxUO5Ob3SPSKxSs3AogFGc58fcKUu9A==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.14.138 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-Ds0ZRMbVoIBmYceAsrtVHA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type: text/plain
sec-ch-ua-mobile: ?0

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 24 Apr 2026 17:54:32 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjMtDikmII0pBi-FB_mfUHEIdz-bDFA_HCaYFsK4H4TkwQ2xMgPrU6mO0SEAvxcNy4s-48m8CJ99MnMCq5JOUXxifn55Wk5pXoJqYU64LYRZlJpSX5RSjs1DKQipz89PTMvPR4IwMjMwMTI2M9A_P4AgMAtUEwfQ"
content-security-policy: script-src 'report-sample' 'nonce-Ds0ZRMbVoIBmYceAsrtVHA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H2 200 prebid Show response
aax.amazon-adsystem.com/e/dtb/bid/977555.66/0/ 19 B
306 B 136ms
77ms Fetch
text/javascript 13.33.186.215
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://aax.amazon-adsystem.com/e/dtb/bid/977555.66/0/prebid?adunitid=$rs_300x250_$ri
Requested by: Host: faucetfoot.com
URL: https://faucetfoot.com/public/hdbhl42/2tiu3.vendor.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.186.215 New York, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-33-186-215.fra60.r.cloudfront.net
Software: Server /
Resource Hash: a1246500e54878521c20eaca060cdbff39b403619b4751d39bf8828246d51309

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
via: 1.1 d9636724d333576f23b5fcfb40d7830c.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
content-length: 39
x-amz-cf-id: EQjtvw76Iwy7d18RDADW3y013518NFwU9mOrJtuR-jJzx7Ghc3apzw==
date: Fri, 24 Apr 2026 17:54:31 GMT
content-type: text/javascript;charset=UTF-8
x-amz-cf-pop: FRA60-P9
server: Server

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 398 KB
141 KB 41ms
41ms Script
application/javascript 142.251.110.97
Google LLC

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-CEFZJ359V8&cx=c&gtm=4e64m2

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.110.97 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

bz-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

5a04c9951d25392f850fffe10735b854c9aa7edd0777a2dc9bea9c3c1f68aa3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
content-encoding: zstd
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Fri, 24 Apr 2026 17:54:32 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 144268
date: Fri, 24 Apr 2026 17:54:32 GMT
x-xss-protection: 0
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Google Tag Manager
access-control-allow-headers: Cache-Control

POST
H2 204 collect
region1.google-analytics.com/g/ 0
0 74ms
28ms Fetch
text/plain 216.239.32.36
Google LLC

General

Check archive.org

Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-VJBRK9986D&gtm=45je64m2v9101576445za200zd9101576445&_p=1777053270838&gcd=13l3l3l2l1l1&npa=1&dma_cps=a&dma=1&tcfd=10001&are=1&cid=1396362204.1777053272&frm=0&pscdl=noapi&rcb=0&sr=1600x1200&uaa=x86&uab=64&uafvl=Chromium%3B147.0.0.0%7CGoogle%2520Chrome%3B147.0.0.0%7CNot-A.Brand%3B24.0.0.0&uam=&uamb=0&uap=Linux&uapv=&uaw=0&ul=nl-nl&_s=1&tag_exp=0~115938465~115938469~117266400~117384405~117512542~118128922&sid=1777053272&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Ffytf.canadapowerline.com%2F&dt=Paint%20with%20Oils&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=2031
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 216.239.32.36 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:138:0
report-to: {"group":"ascnsrsggc:138:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:138:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:138:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 24 Apr 2026 17:54:32 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 favicon.ico
paint.toys/ 615 B
723 B 26ms
26ms Other
image/vnd.microsoft.icon 3.33.186.135
Amazon.com

General

Check archive.org

Download Go to

Full URL

https://paint.toys/favicon.ico

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

186.176.8.34.bc.googleusercontent.com

Software

Netlify /

Resource Hash

30a007a99e491d9e1b2b72c02e4a8454334c6ea2b3a03316d50135b20464fccc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/oil/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "6c77abc0123fbfdebbf702a90fb50938-ssl"
age: 6902
accept-ranges: bytes
content-length: 615
x-nf-request-id: 01KQ0A22BSF40JX9CMQD3RZ11Q
cache-status: "Netlify Edge"; hit
date: Fri, 24 Apr 2026 17:54:32 GMT
content-type: image/vnd.microsoft.icon
server: Netlify

GET
H2 200 pageos.js Show response
cdn.intergient.com/pageos/V.20260421.1/ 411 B
634 B 22ms
20ms Script
text/javascript 104.18.20.56
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20260421.1/pageos.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/ramp_core.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7dafb3532db66006e761beebb351648bb2b9fd353e11b02543da480bc2206774

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

hw-country-code: NL
cache-control: public, max-age=31536000
content-encoding: br
cf-cache-status: HIT
etag: W/"c848a7c333aff79c0045926b18ddc5c0"
age: 180732
cf-ray: 9f16f948cbe1434e-AMS
expires: Sat, 24 Apr 2027 17:54:32 GMT
date: Fri, 24 Apr 2026 17:54:32 GMT
content-type: text/javascript
last-modified: Wed, 22 Apr 2026 15:30:45 GMT
server: cloudflare
vary: Accept-Encoding

GET
H3 200 gpt
securepubads.g.doubleclick.net/pagead/managed/dict/m202604230101/ 63 KB
23 KB 32ms
31ms Other
text/plain 192.178.183.154
Google LLC

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/dict/m202604230101/gpt

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.183.154 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

lcfraw-in-f154.1e100.net

Software

cafe /

Resource Hash

077408d8ee0011d4f33dc19e27276daf79f6ca78c79d7da1ab2a3a5e54abe3b7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
etag: 11806928644267344966
age: 10355
x-content-type-options: nosniff
expires: Fri, 01 May 2026 15:01:57 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Fri, 24 Apr 2026 15:01:57 GMT
content-type: text/plain; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=604800, stale-while-revalidate=7200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 23368
x-xss-protection: 0
server: cafe
use-as-dictionary: match="/gampad/ads", id="m202604230101"

POST
H2 204 collect
region1.google-analytics.com/g/ 0
0 22ms
22ms Fetch
text/plain 216.239.32.36
Google LLC

General

Check archive.org

Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-CEFZJ359V8&gtm=45je64m2v9102396898za200zb9101576445zd9101576445&_p=1777053270838&gcd=13l3l3l2l1l1&npa=1&dma_cps=a&dma=1&tcfd=10001&are=1&cid=1396362204.1777053272&frm=0&pscdl=noapi&rcb=6&sr=1600x1200&uaa=x86&uab=64&uafvl=Chromium%3B147.0.0.0%7CGoogle%2520Chrome%3B147.0.0.0%7CNot-A.Brand%3B24.0.0.0&uam=&uamb=0&uap=Linux&uapv=&uaw=0&ul=nl-nl&_s=1&tag_exp=0~115938465~115938468~117266400~117512542~117884344&sid=1777053272&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Ffytf.canadapowerline.com%2F&dt=Paint%20with%20Oils&en=ramp_js&_fv=1&_ss=1&_ee=1&ep.pageview_id=1777053270838&tfd=2134
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-CEFZJ359V8&cx=c&gtm=4e64m2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 216.239.32.36 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:138:0
report-to: {"group":"ascnsrsggc:138:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:138:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:138:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 24 Apr 2026 17:54:32 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 runtime.04ca972e510171386322.js Show response
cdn.intergient.com/pageos/V.20260421.1/ 4 KB
2 KB 22ms
22ms Script
text/javascript 104.18.20.56
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20260421.1/runtime.04ca972e510171386322.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260421.1/pageos.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 02c09d6090beaca9d26f1b416cae8de060d02c5567da7b4caeb24ead776acaca

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

hw-country-code: NL
cache-control: public, max-age=31536000
content-encoding: br
cf-cache-status: HIT
etag: W/"8cb5e5da2dc99c1de470c0f8b7342d82"
age: 180732
cf-ray: 9f16f9494d41434e-AMS
expires: Sat, 24 Apr 2027 17:54:32 GMT
date: Fri, 24 Apr 2026 17:54:32 GMT
content-type: text/javascript
last-modified: Wed, 22 Apr 2026 15:30:46 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 main.282c283e39679935e999.js Show response
cdn.intergient.com/pageos/V.20260421.1/ 557 KB
171 KB 43ms
42ms Script
text/javascript 104.18.20.56
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20260421.1/main.282c283e39679935e999.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260421.1/pageos.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4f23a5fd77193be649361747878617945ddeb22e10fccf6e8d68ed19cfb080ed

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

hw-country-code: NL
cache-control: public, max-age=31536000
content-encoding: br
cf-cache-status: HIT
etag: W/"df3986bda38d49703103d22d8ccda7c0"
age: 180732
cf-ray: 9f16f9495d67434e-AMS
expires: Sat, 24 Apr 2027 17:54:32 GMT
date: Fri, 24 Apr 2026 17:54:32 GMT
content-type: text/javascript
last-modified: Wed, 22 Apr 2026 15:30:43 GMT
server: cloudflare
vary: Accept-Encoding

POST
H3 200 ql9qvl1bdg9eooe67 Show response
faucetfoot.com/q5o2lc/ 303 B
327 B 59ms
32ms Fetch
application/json 34.8.176.186
Google LLC

General

Check archive.org

Download Go to

Full URL

https://faucetfoot.com/q5o2lc/ql9qvl1bdg9eooe67

Requested by

Host: faucetfoot.com
URL: https://faucetfoot.com/public/hdbhl42/2tiu3.vendor.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.8.176.186 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),

Reverse DNS

Software

hoothoot/2455384222 /

Resource Hash

eb8f11d7ef0c8c74fd8524da5c664b179e467cab27db92790f0ff89ee23fa8e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=15724800; preload
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: POST, OPTIONS
via: fen-hoothoot-europe-west1-zrts.gce-europe-west1, 1.1 google
expires: Fri, 24 Apr 2026 17:54:31 GMT
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 303
date: Fri, 24 Apr 2026 17:54:32 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding, Origin
server: hoothoot/2455384222
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Cookie

GET
H2 200 videoCard.cea8a6bd8cad3ad73428.js Show response
cdn.intergient.com/pageos/V.20260421.1/ 552 B
675 B 22ms
22ms Script
text/javascript 104.18.20.56
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20260421.1/videoCard.cea8a6bd8cad3ad73428.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260421.1/runtime.04ca972e510171386322.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0a0a95fd080f68f2d8c0a916f30cdb5cde422c6908dd64bd98043ef5c160f0f1

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

hw-country-code: NL
cache-control: public, max-age=31536000
content-encoding: br
cf-cache-status: HIT
etag: W/"b923f9cae7c940f9f384e93b5120abff"
age: 180730
cf-ray: 9f16f949ef32434e-AMS
expires: Sat, 24 Apr 2027 17:54:32 GMT
date: Fri, 24 Apr 2026 17:54:32 GMT
content-type: text/javascript
last-modified: Wed, 22 Apr 2026 15:30:50 GMT
server: cloudflare

GET
H2 200 iframe.html Show response
cdn.intergient.com/pageos/V.20260421.1/iframe/ Frame 04F8 1 KB
1021 B 73ms
23ms Document
text/html 104.18.21.56
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20260421.1/iframe/iframe.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260421.1/main.282c283e39679935e999.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.21.56 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: ebdfeb8c9691ba109b224b26abaebff16663b4f9c528766007db748fbdf07150

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

age: 180730
cache-control: public, max-age=31536000
cf-cache-status: HIT
cf-ray: 9f16f94a3a49f18a-AMS
content-encoding: br
content-type: text/html
date: Fri, 24 Apr 2026 17:54:32 GMT
expires: Sat, 24 Apr 2027 17:54:32 GMT
hw-country-code: NL
last-modified: Wed, 22 Apr 2026 15:30:42 GMT
server: cloudflare

GET
H2 200 gdpr.c683187f44571d134588.js Show response
cdn.intergient.com/pageos/V.20260421.1/ 6 KB
2 KB 29ms
28ms Script
text/javascript 104.18.20.56
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20260421.1/gdpr.c683187f44571d134588.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260421.1/runtime.04ca972e510171386322.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: fe0d08fce4af40339a4535d4e5d34503a910cb7c87ad862bb2b09feec775a951

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

hw-country-code: NL
cache-control: public, max-age=31536000
content-encoding: br
cf-cache-status: HIT
etag: W/"1639782bcb3b68becf302ad559bfdfa4"
age: 180730
cf-ray: 9f16f949ff60434e-AMS
expires: Sat, 24 Apr 2027 17:54:32 GMT
date: Fri, 24 Apr 2026 17:54:32 GMT
content-type: text/javascript
last-modified: Wed, 22 Apr 2026 15:30:41 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 tag Show response
btloader.com/ 184 KB
50 KB 67ms
33ms Script
application/javascript 172.66.171.133
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260421.1/main.282c283e39679935e999.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.66.171.133 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5601cd2dcc2d7bc959cdcaf5eb6029ecbc8ac7bc25157da5a7c205be701a8f08

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-robots-tag: noindex, nofollow
cache-control: public, max-age=300, stale-if-error=3600, stale-while-revalidate=300
content-encoding: br
cf-cache-status: HIT
etag: W/"1858b36cf7ca791454f163535b3bedcd"
via: 1.1 google
cf-ray: 9f16f94a3a690bdc-AMS
access-control-allow-origin: *
date: Fri, 24 Apr 2026 17:54:32 GMT
content-type: application/javascript
last-modified: Fri, 24 Apr 2026 17:53:03 GMT
server: cloudflare
vary: Accept-Encoding, X-Acceptable-Ads, DNT

GET
H2 200 1x1.gif
raw.githubusercontent.com/easylist/easylist/master/docs/ 43 B
581 B 64ms
30ms Image
image/gif 185.199.111.133
Fastly

General

Check archive.org

Download Go to Show image

Full URL

https://raw.githubusercontent.com/easylist/easylist/master/docs/1x1.gif

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.199.111.133 , United States, ASN54113 (FASTLY - Fastly, Inc., US),

Reverse DNS

cdn-185-199-111-133.github.com

Software

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; style-src 'unsafe-inline'; sandbox
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-fastly-request-id: 74f9edb1df6a955c4651434751ba03c5b15552a7
etag: W/"0c4a5773f7e435c57c40bd270aef756513eba26bd7ba5317b5bd765569a7325d"
x-content-type-options: nosniff
x-github-request-id: F488:D3348:A74624:B8EB2D:69E41528
expires: Fri, 24 Apr 2026 17:59:32 GMT
x-cache: HIT
date: Fri, 24 Apr 2026 17:54:32 GMT
content-type: image/gif
x-served-by: cache-ams2100095-AMS
x-cache-hits: 13
source-age: 231
x-frame-options: deny
strict-transport-security: max-age=31536000
vary: Authorization,Accept-Encoding
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
cache-control: max-age=300
x-timer: S1777053273.670706,VS0,VE0
cross-origin-resource-policy: cross-origin
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
content-length: 43
x-xss-protection: 1; mode=block

GET
H2 200 iframe.js Show response
cdn.intergient.com/pageos/V.20260421.1/iframe/ Frame 04F8 17 KB
7 KB 53ms
52ms Script
text/javascript 104.18.21.56
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20260421.1/iframe/iframe.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260421.1/iframe/iframe.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.21.56 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: a1e9592b119e182885673d049ec2ead66dab57473f2f6da59f43d888cea5ac1e

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://cdn.intergient.com/pageos/V.20260421.1/iframe/iframe.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

hw-country-code: NL
cache-control: public, max-age=31536000
content-encoding: br
cf-cache-status: HIT
etag: W/"3eecc5d11812ac69fb4f2c63c5dea237"
age: 180730
cf-ray: 9f16f94a9b4af18a-AMS
expires: Sat, 24 Apr 2027 17:54:32 GMT
date: Fri, 24 Apr 2026 17:54:32 GMT
content-type: text/javascript
last-modified: Wed, 22 Apr 2026 15:30:42 GMT
server: cloudflare

GET
H2 200 cchecker.html Show response
cdn.btloader.com/ Frame 9BFC 366 B
711 B 71ms
27ms Document
text/html 104.20.20.189
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.btloader.com/cchecker.html?upapi=true
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.20.189 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: c700c58e763a5ae34f446713819957ed9755025d35b8497ec1150f428f5ff227

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

access-control-allow-origin: *
access-control-expose-headers: *
age: 5918
cache-control: public, max-age=86400, immutable
cf-cache-status: HIT
cf-ray: 9f16f94afe8efb8b-AMS
content-encoding: br
content-type: text/html
date: Fri, 24 Apr 2026 17:54:32 GMT
expires: Sat, 25 Apr 2026 16:01:01 GMT
last-modified: Thu, 16 Apr 2026 14:02:40 GMT
server: cloudflare
x-goog-generation: 1776348160499015
x-goog-hash: crc32c=/3eT+A== md5=WtMW8Jy4XJceDGzQqhOktA==
x-goog-metageneration: 1
x-goog-storage-class: MULTI_REGIONAL
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 366
x-guploader-uploadid: AMNfjG0tbCcq9SUdwqm5C_-FFPO2pQb-mcMLDo49wkcaPbj5HlRGT-0regOzOThYs6dlBwzktf2yGbQ

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
612 B 64ms
27ms Fetch
image/gif 104.20.47.80
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=2&e=0.0469410944385823
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.47.80 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 2
x-goog-stored-content-encoding: identity
expires: Fri, 17 Apr 2026 20:01:05 GMT
x-goog-stored-content-length: 43
date: Fri, 24 Apr 2026 17:54:32 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH89K2Yq4pnfcvUStBId9HlURvizPqf3MVWGgPxZrgZz6nkGA3_cdbcg0whsVowwYFR03VNFb3R4
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9f16f94aec5291f2-AMS
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico Show response
ad.doubleclick.net/ 1 KB
129 B 66ms
35ms Fetch
image/x-icon 142.251.13.149
Google LLC

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.7363430405316482

Requested by

Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.13.149 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Sat, 25 Apr 2026 17:54:32 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 24 Apr 2026 17:54:32 GMT
content-type: image/x-icon
vary: Accept-Encoding
last-modified: Tue, 08 May 2012 13:08:06 GMT
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
109 B 65ms
28ms Fetch
image/gif 104.20.47.80
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.8717930662722285
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.47.80 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 2
x-goog-stored-content-encoding: identity
expires: Fri, 17 Apr 2026 20:01:05 GMT
x-goog-stored-content-length: 43
date: Fri, 24 Apr 2026 17:54:32 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH89K2Yq4pnfcvUStBId9HlURvizPqf3MVWGgPxZrgZz6nkGA3_cdbcg0whsVowwYFR03VNFb3R4
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9f16f94aec4c91f2-AMS
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H2 200 dns Show response
ab.dns-finder.com/meta/ 2 B
233 B 176ms
129ms Fetch
text/plain 34.36.200.111
Google LLC

General

Check archive.org

Download Go to

Full URL: https://ab.dns-finder.com/meta/dns
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.36.200.111 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS: 111.200.36.34.bc.googleusercontent.com
Software: /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: private, max-age=180, stale-if-error=180, stale-while-revalidate=180
access-control-expose-headers: X-Resolver
x-resolver: default
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
date: Fri, 24 Apr 2026 17:54:32 GMT
content-type: text/plain; charset=utf-8
vary: Origin

GET
H2 200 trustedIframe.html Show response
btloader.com/ Frame F6D2 6 KB
2 KB 65ms
32ms Document
text/html 104.20.20.189
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://btloader.com/trustedIframe.html?o=5150306120761344&upapi=true
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.20.189 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: b11d97e368d4bf84852324f6c6592e41315107a11f6025dc63aa630e77cf6e4b

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

cache-control: public, max-age=3600, stale-while-revalidate=3600
cf-ray: 9f16f94aebae0ba4-AMS
content-encoding: br
content-type: text/html
date: Fri, 24 Apr 2026 17:54:32 GMT
server: cloudflare

GET
H2 200 device Show response
cdn.api.btloader.com/ 87 B
319 B 61ms
28ms Fetch
application/json 104.20.20.189
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.api.btloader.com/device?orgid=5150306120761344&fullVersionList=%5B%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22147.0.0.0%22%7D%2C%7B%22brand%22%3A%22Google+Chrome%22%2C%22version%22%3A%22147.0.0.0%22%7D%2C%7B%22brand%22%3A%22Not-A.Brand%22%2C%22version%22%3A%2224.0.0.0%22%7D%5D
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.20.189 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0d1140c720545957f3b2e4fbcda5ec195003863f2b1824166481589f5ab46fe1

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: public, max-age=7200
content-encoding: br
cf-cache-status: HIT
age: 4
x-ratelimit-reset: 1777053269
via: 1.1 google
cf-ray: 9f16f94aede149b6-AMS
x-ratelimit-remaining: 97
access-control-allow-origin: *
date: Fri, 24 Apr 2026 17:54:32 GMT
x-ratelimit-limit: 100
content-type: application/json
last-modified: Fri, 24 Apr 2026 17:54:28 GMT
server: cloudflare
vary: Origin

GET main.js
cdn.intergient.com/cdn-cgi/challenge-platform/scripts/jsd/ Frame DA06 0
0

POST
H3 204 ping
pagead2.googlesyndication.com/pagead/ 0
0 88ms
56ms Fetch
image/gif 192.178.183.155
Google LLC

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/ping?e=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202604200101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.183.155 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

lcfraw-in-f155.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Fri, 24 Apr 2026 17:54:32 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

POST
H2 204 exd
api.btloader.com/ 0
0 175ms
126ms Fetch 130.211.23.194
Google LLC

General

Check archive.org

Download Go to

Full URL: https://api.btloader.com/exd?tid=1sUQ7HIX0-txAakr13-9dc0a10a9d&sid=RausDk63-Yr5r0CGwj-9dc0a10a9d&cv=2.1.187-1-g24d1c87&upapi=true
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.23.194 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS: 194.23.211.130.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

via: 1.1 google
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000
date: Fri, 24 Apr 2026 17:54:32 GMT
vary: Origin

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
135 B 20ms
19ms Fetch
image/gif 104.20.47.80
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.864615110427856
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.47.80 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 3
x-goog-stored-content-encoding: identity
expires: Fri, 17 Apr 2026 20:01:05 GMT
x-goog-stored-content-length: 43
date: Fri, 24 Apr 2026 17:54:33 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH89K2Yq4pnfcvUStBId9HlURvizPqf3MVWGgPxZrgZz6nkGA3_cdbcg0whsVowwYFR03VNFb3R4
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9f16f94c58a791f2-AMS
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
110 B 20ms
19ms Fetch
image/gif 104.20.47.80
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=2&e=0.4931190610754912
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.47.80 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 3
x-goog-stored-content-encoding: identity
expires: Fri, 17 Apr 2026 20:01:05 GMT
x-goog-stored-content-length: 43
date: Fri, 24 Apr 2026 17:54:33 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH89K2Yq4pnfcvUStBId9HlURvizPqf3MVWGgPxZrgZz6nkGA3_cdbcg0whsVowwYFR03VNFb3R4
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9f16f94d9d4991f2-AMS
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico Show response
ad.doubleclick.net/ 1 KB
129 B 34ms
34ms Fetch
image/x-icon 142.251.13.149
Google LLC

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.48635889979274316

Requested by

Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.13.149 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Sat, 25 Apr 2026 17:54:33 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 24 Apr 2026 17:54:33 GMT
content-type: image/x-icon
vary: Accept-Encoding
last-modified: Tue, 08 May 2012 13:08:06 GMT
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
110 B 21ms
18ms Fetch
image/gif 104.20.47.80
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=2&e=0.6151872131886666
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.47.80 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 3
x-goog-stored-content-encoding: identity
expires: Fri, 17 Apr 2026 20:01:05 GMT
x-goog-stored-content-length: 43
date: Fri, 24 Apr 2026 17:54:33 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH89K2Yq4pnfcvUStBId9HlURvizPqf3MVWGgPxZrgZz6nkGA3_cdbcg0whsVowwYFR03VNFb3R4
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9f16f95199f391f2-AMS
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico Show response
ad.doubleclick.net/ 1 KB
129 B 39ms
39ms Fetch
image/x-icon 142.251.13.149
Google LLC

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.0603985574756547

Requested by

Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.13.149 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Sat, 25 Apr 2026 17:54:33 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 24 Apr 2026 17:54:33 GMT
content-type: image/x-icon
vary: Accept-Encoding
last-modified: Tue, 08 May 2012 13:08:06 GMT
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
110 B 45ms
43ms Fetch
image/gif 104.20.47.80
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.5933447918287249
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.47.80 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 3
x-goog-stored-content-encoding: identity
expires: Fri, 17 Apr 2026 20:01:05 GMT
x-goog-stored-content-length: 43
date: Fri, 24 Apr 2026 17:54:33 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH89K2Yq4pnfcvUStBId9HlURvizPqf3MVWGgPxZrgZz6nkGA3_cdbcg0whsVowwYFR03VNFb3R4
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9f16f9519a1891f2-AMS
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H2 200 dns Show response
ab.dns-finder.com/meta/ 2 B
0 1ms
0ms Fetch
text/plain 34.36.200.111
Google LLC

General

Check archive.org

Download Go to

Full URL: https://ab.dns-finder.com/meta/dns
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.36.200.111 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS: 111.200.36.34.bc.googleusercontent.com
Software: /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: private, max-age=180, stale-if-error=180, stale-while-revalidate=180
access-control-expose-headers: X-Resolver
x-resolver: default
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
date: Fri, 24 Apr 2026 17:54:32 GMT
content-type: text/plain; charset=utf-8
vary: Origin

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
135 B 19ms
19ms Fetch
image/gif 104.20.47.80
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.7513440511699032
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.47.80 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 4
x-goog-stored-content-encoding: identity
expires: Fri, 17 Apr 2026 20:01:05 GMT
x-goog-stored-content-length: 43
date: Fri, 24 Apr 2026 17:54:34 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH89K2Yq4pnfcvUStBId9HlURvizPqf3MVWGgPxZrgZz6nkGA3_cdbcg0whsVowwYFR03VNFb3R4
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9f16f9531f0591f2-AMS
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
110 B 26ms
26ms Fetch
image/gif 104.20.47.80
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=2&e=0.7589966514295177
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.47.80 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 4
x-goog-stored-content-encoding: identity
expires: Fri, 17 Apr 2026 20:01:05 GMT
x-goog-stored-content-length: 43
date: Fri, 24 Apr 2026 17:54:34 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH89K2Yq4pnfcvUStBId9HlURvizPqf3MVWGgPxZrgZz6nkGA3_cdbcg0whsVowwYFR03VNFb3R4
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9f16f9544ad691f2-AMS
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico Show response
ad.doubleclick.net/ 1 KB
129 B 36ms
36ms Fetch
image/x-icon 142.251.13.149
Google LLC

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.7389714397609104

Requested by

Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.13.149 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Sat, 25 Apr 2026 17:54:34 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 24 Apr 2026 17:54:34 GMT
content-type: image/x-icon
vary: Accept-Encoding
last-modified: Tue, 08 May 2012 13:08:06 GMT
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
110 B 20ms
19ms Fetch
image/gif 104.20.47.80
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=2&e=0.429033106641286
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.47.80 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 4
x-goog-stored-content-encoding: identity
expires: Fri, 17 Apr 2026 20:01:05 GMT
x-goog-stored-content-length: 43
date: Fri, 24 Apr 2026 17:54:34 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH89K2Yq4pnfcvUStBId9HlURvizPqf3MVWGgPxZrgZz6nkGA3_cdbcg0whsVowwYFR03VNFb3R4
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9f16f956fa6891f2-AMS
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico Show response
ad.doubleclick.net/ 1 KB
129 B 39ms
38ms Fetch
image/x-icon 142.251.13.149
Google LLC

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.6861042981276347

Requested by

Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.13.149 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Sat, 25 Apr 2026 17:54:34 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 24 Apr 2026 17:54:34 GMT
content-type: image/x-icon
vary: Accept-Encoding
last-modified: Tue, 08 May 2012 13:08:06 GMT
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
135 B 18ms
18ms Fetch
image/gif 104.20.47.80
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=2&e=0.040066566583851326
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.47.80 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 5
x-goog-stored-content-encoding: identity
expires: Fri, 17 Apr 2026 20:01:05 GMT
x-goog-stored-content-length: 43
date: Fri, 24 Apr 2026 17:54:35 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH89K2Yq4pnfcvUStBId9HlURvizPqf3MVWGgPxZrgZz6nkGA3_cdbcg0whsVowwYFR03VNFb3R4
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9f16f959aa9291f2-AMS
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico Show response
ad.doubleclick.net/ 1 KB
129 B 34ms
34ms Fetch
image/x-icon 142.251.13.149
Google LLC

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.5105763414908788

Requested by

Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.13.149 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Sat, 25 Apr 2026 17:54:35 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 24 Apr 2026 17:54:35 GMT
content-type: image/x-icon
vary: Accept-Encoding
last-modified: Tue, 08 May 2012 13:08:06 GMT
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
110 B 20ms
19ms Fetch
image/gif 104.20.47.80
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=2&e=0.09436289963478861
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.47.80 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 5
x-goog-stored-content-encoding: identity
expires: Fri, 17 Apr 2026 20:01:05 GMT
x-goog-stored-content-length: 43
date: Fri, 24 Apr 2026 17:54:35 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH89K2Yq4pnfcvUStBId9HlURvizPqf3MVWGgPxZrgZz6nkGA3_cdbcg0whsVowwYFR03VNFb3R4
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9f16f95c4adc91f2-AMS
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico Show response
ad.doubleclick.net/ 1 KB
129 B 34ms
33ms Fetch
image/x-icon 142.251.13.149
Google LLC

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.24316843224134221

Requested by

Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.13.149 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS