paint.toys
15.197.167.90 Public Scan Open in urlscan Pro

Software

Netlify /

Resource Hash

fe22d7bc39aeadb33e17b218425d2a50939f49166eb696f087bf4be21a0308eb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://tyj.armendane.com/f2nt053lyzaxa1tpihdqhxl0v02bp9utp6RNGtzNnNqb0lhQlUwUjZ3S1k1VjEtNjE2Mi0yNjczNTYzMC0wZmVjMDI3MC0xMDcxNi1uNFAxM3J3Z0RZYTYzVXltZUk5cw/ghdnpppwy2w2jv1f9qa6npirqpcp/cfqgtpsajpzqhmhorotwxbhv/HOBS318RN391G3XXP3NBIGZYC52EMWJE/vrluwrpvgvhxszghlclknsijwllaz/6463976892424105235560224068379008156
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

accept-ranges: bytes
age: 8322
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-encoding: br
content-length: 2570
content-type: text/html; charset=UTF-8
date: Fri, 24 Apr 2026 19:55:16 GMT
etag: "52e8a2f9b67c548d54e3b976fd4a0a7d-ssl-df"
server: Netlify
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-nf-request-id: 01KQ0GZ4S8Z6FCHVANJMYD2SSE

Redirect headers

cache-status: "Netlify Edge"; fwd=miss
content-length: 98
content-type: text/html
date: Fri, 24 Apr 2026 19:55:16 GMT
location: /oil/
server: Netlify
strict-transport-security: max-age=31536000
x-nf-request-id: 01KQ0GZ4N0E4SW7WKRC55Q17QW

GET
H2 200 ramp_config.js Show response
cdn.intergient.com/1024872/74068/ 39 KB
8 KB 90ms
54ms Script
application/javascript 2606:4700::6812:1438
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/1024872/74068/ramp_config.js
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: d7ea8d7575f7f885ff63d0fb944c37c874dca1daedc6343e87f6e898fc7481d9

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cf-ray: 9f17aa2568d15c39-AMS
hw-country-code: NL
cache-control: max-age=600, public, must-revalidate
content-encoding: br
date: Fri, 24 Apr 2026 19:55:16 GMT
content-type: application/javascript
server: cloudflare

GET
H2 200 apps.css
paint.toys/ 6 KB
2 KB 23ms
22ms Stylesheet
text/css 15.197.167.90
Amazon.com

General

Check archive.org

Download Go to

Full URL

https://paint.toys/apps.css

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.197.167.90 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

Software

Netlify /

Resource Hash

96d3d9ab6c847374c0b14dbcd7be944e96c5ab99db9b1346d1fa214dd46c75fb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/oil/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
content-encoding: br
etag: "bcfef24d2405a41497bc188d920f182d-ssl-df"
age: 14556
accept-ranges: bytes
content-length: 1656
x-nf-request-id: 01KQ0GZ4T4150EC6GEA5125BPR
cache-status: "Netlify Edge"; hit
date: Fri, 24 Apr 2026 19:55:16 GMT
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: Netlify

GET
H2 200 index.js Show response
paint.toys/oil/ 4 KB
1 KB 31ms
31ms Script
application/javascript 15.197.167.90
Amazon.com

General

Check archive.org

Download Go to

Full URL

https://paint.toys/oil/index.js

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.197.167.90 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

Software

Netlify /

Resource Hash

169407eee9cacaa18777cd5ec7de3d39b9eb3d401e800296b0da7a2e761ad654

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/oil/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
content-encoding: br
etag: "bc71a337771d76feffad10991544618f-ssl-df"
age: 8322
accept-ranges: bytes
content-length: 1296
x-nf-request-id: 01KQ0GZ4T4970N6VJEARRYJA8C
cache-status: "Netlify Edge"; hit
date: Fri, 24 Apr 2026 19:55:16 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Netlify

GET
H2 200 art-icon.png
paint.toys/assets/ 33 KB
33 KB 23ms
22ms Image
image/png 15.197.167.90
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/art-icon.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.197.167.90 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

Software

Netlify /

Resource Hash

f4d368e4230539c778afbb020e0ea611b3e1d984179f5b3769b44081d6703f3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/oil/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "1394f8469f2ca5750397e3d7b6ec70a1-ssl"
age: 40153
accept-ranges: bytes
content-length: 33562
x-nf-request-id: 01KQ0GZ4T4642KNYK57X4NCZ4S
cache-status: "Netlify Edge"; hit
date: Fri, 24 Apr 2026 19:55:16 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-hand.png
paint.toys/assets/ 27 KB
27 KB 29ms
29ms Image
image/png 15.197.167.90
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-hand.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.197.167.90 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

Software

Netlify /

Resource Hash

32aa05a5648678542ab9044647f0bf5549c0b53a070585edb773f0e92b72b97d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/oil/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "a0822110a4671ffdf710da1467460fba-ssl"
age: 63172
accept-ranges: bytes
content-length: 27394
x-nf-request-id: 01KQ0GZ4T4ABHZ8HBS93D3P8NR
cache-status: "Netlify Edge"; hit
date: Fri, 24 Apr 2026 19:55:16 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-disk.png
paint.toys/assets/ 13 KB
14 KB 22ms
22ms Image
image/png 15.197.167.90
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-disk.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.197.167.90 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

Software

Netlify /

Resource Hash

436814c2374a6d92a42a02d39969ef7c56b5f225667abecb218e692c5569943c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/oil/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "26852fa1548a91e004629b01e4abf1dd-ssl"
age: 63172
accept-ranges: bytes
content-length: 13766
x-nf-request-id: 01KQ0GZ4VFTH45RX2719Q17790
cache-status: "Netlify Edge"; hit
date: Fri, 24 Apr 2026 19:55:16 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-trash.png
paint.toys/assets/ 50 KB
51 KB 24ms
24ms Image
image/png 15.197.167.90
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-trash.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.197.167.90 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

Software

Netlify /

Resource Hash

6ceb226c487cb85243545e768944e0e1ae0944be8fde6c1c43c7314a9287e6d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/oil/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "e91ef5e34b5154d392e8560031eaaa4c-ssl"
age: 63172
accept-ranges: bytes
content-length: 51680
x-nf-request-id: 01KQ0GZ4VF2DMSTKE5KJ1CJG94
cache-status: "Netlify Edge"; hit
date: Fri, 24 Apr 2026 19:55:16 GMT
content-type: image/png
server: Netlify

GET
H2 200 ramp_core.js Show response
cdn.intergient.com/ 3 KB
2 KB 22ms
22ms Script
application/javascript 2606:4700::6812:1438
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/ramp_core.js
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0405d2b23c47024b7759c84ff2446eaca96805252f7077c54bd7e043a052fc58

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cf-ray: 9f17aa25c9215c39-AMS
hw-country-code: NL
cache-control: max-age=600, public, must-revalidate
content-encoding: br
date: Fri, 24 Apr 2026 19:55:16 GMT
content-type: application/javascript
server: cloudflare

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 454 KB
155 KB 147ms
58ms Script
application/javascript 2a00:1450:4001:c15::61
Google LLC

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:c15::61 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

02ae34bc65536ea6fc3c5d44b30175d8c9e7e52cdf3d2f4bf4d4bbf666e0b2b2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
content-encoding: zstd
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Fri, 24 Apr 2026 19:55:16 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 158286
date: Fri, 24 Apr 2026 19:55:16 GMT
x-xss-protection: 0
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Google Tag Manager
access-control-allow-headers: Cache-Control

GET
H2 200 css2
fonts.googleapis.com/ 3 KB
968 B 144ms
53ms Stylesheet
text/css 2a00:1450:4001:c13::5f
Google LLC

General

Check archive.org

Download Go to

Full URL

https://fonts.googleapis.com/css2?family=DM+Sans:wght@300;400;500&family=DM+Serif+Display&display=swap

Requested by

Host: paint.toys
URL: https://paint.toys/apps.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a00:1450:4001:c13::5f Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

0e43e66404ff234d0d874c9422542a2e6442c73246650d680490f46bedd60898

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Fri, 24 Apr 2026 19:55:16 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 24 Apr 2026 19:55:16 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Fri, 24 Apr 2026 19:55:16 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 2tiu3.vendor.js Show response
faucetfoot.com/public/hdbhl42/ 104 KB
36 KB 76ms
27ms Script
text/javascript 2600:1901:0:2b4c::1
Google LLC

General

Check archive.org

Download Go to

Full URL

https://faucetfoot.com/public/hdbhl42/2tiu3.vendor.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:1901:0:2b4c::1 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),

Reverse DNS

Software

hoothoot/2455384222 /

Resource Hash

302774dc1b415c281859a3ac16c9d02faf9cf359a8f8293fb5c12f448117d37a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=15724800; preload
cache-control: private, must-revalidate, max-age=21600
timing-allow-origin: *
content-encoding: zstd
etag: W/"df323c0faf9df90f30792abe9dfa5b23e23de826798ea30daca06ee3de48c486"
via: fen-hoothoot-europe-west1-test-1w44.gce-europe-west1, 1.1 google
alt-svc: h3=":443"; ma=2592000
date: Fri, 24 Apr 2026 19:55:16 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding, Accept-Language
server: hoothoot/2455384222

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 108 KB
34 KB 103ms
54ms Script
text/javascript 142.251.13.157
Google LLC

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.13.157 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

wt-in-f157.1e100.net

Software

cafe /

Resource Hash

7022b22fe9a41df05bd649c5d9dee0f033c8865c4f1431322c26a4591c6bb3d5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
etag: 857 / 20567 / m202604210101 / config-hash: 15722388766253327087
x-content-type-options: nosniff
expires: Fri, 24 Apr 2026 19:55:16 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Fri, 24 Apr 2026 19:55:16 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 34756
x-xss-protection: 0
server: cafe

GET
H2 200 prebid.05eaa3284c60ad6e334d.js Show response
cdn.intergient.com/prebid/ 746 KB
222 KB 42ms
42ms Script
text/javascript 2606:4700::6812:1438
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/prebid/prebid.05eaa3284c60ad6e334d.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8f9757938ed08b400ae866b022739d2ea1f4db4369e324174661f11bd7ae6ad6

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

hw-country-code: NL
cache-control: public, max-age=31536000, immutable
content-encoding: br
cf-cache-status: HIT
etag: W/"2539bceaf323aef3b5bbf813e3bcbe07"
age: 693828
cf-ray: 9f17aa2649985c39-AMS
date: Fri, 24 Apr 2026 19:55:16 GMT
content-type: text/javascript
last-modified: Thu, 16 Apr 2026 19:07:06 GMT
server: cloudflare
vary: Accept-Encoding

GET
H3 200 rP2Yp2ywxg089UriI5-g4vlH9VoD8Cmcqbu0-K4.woff2
fonts.gstatic.com/s/dmsans/v17/ 36 KB
36 KB 86ms
40ms Font
font/woff2 142.251.127.94
Google LLC

General

Check archive.org

Download Go to

Full URL

https://fonts.gstatic.com/s/dmsans/v17/rP2Yp2ywxg089UriI5-g4vlH9VoD8Cmcqbu0-K4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=DM+Sans:wght@300;400;500&family=DM+Serif+Display&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.127.94 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

lcfrai-in-f94.1e100.net

Software

sffe /

Resource Hash

9fea608a947e67020c33cad9a6fe3d60c54119dfb8cff87768a8117a15ed7543

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://paint.toys
sec-ch-ua-platform: "Linux"
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

age: 76240
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Fri, 23 Apr 2027 22:44:36 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 23 Apr 2026 22:44:36 GMT
last-modified: Wed, 10 Sep 2025 16:31:03 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 36932
x-xss-protection: 0
server: sffe

GET
H2 200 pageos.js Show response
cdn.intergient.com/pageos/V.20260421.1/ 411 B
613 B 24ms
23ms Script
text/javascript 2606:4700::6812:1438
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20260421.1/pageos.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/ramp_core.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7dafb3532db66006e761beebb351648bb2b9fd353e11b02543da480bc2206774

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

hw-country-code: NL
cache-control: public, max-age=31536000
content-encoding: br
cf-cache-status: HIT
etag: W/"c848a7c333aff79c0045926b18ddc5c0"
age: 187976
cf-ray: 9f17aa2699e45c39-AMS
expires: Sat, 24 Apr 2027 19:55:16 GMT
date: Fri, 24 Apr 2026 19:55:16 GMT
content-type: text/javascript
last-modified: Wed, 22 Apr 2026 15:30:45 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 runtime.04ca972e510171386322.js Show response
cdn.intergient.com/pageos/V.20260421.1/ 4 KB
2 KB 22ms
22ms Script
text/javascript 2606:4700::6812:1438
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20260421.1/runtime.04ca972e510171386322.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260421.1/pageos.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 02c09d6090beaca9d26f1b416cae8de060d02c5567da7b4caeb24ead776acaca

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

hw-country-code: NL
cache-control: public, max-age=31536000
content-encoding: br
cf-cache-status: HIT
etag: W/"8cb5e5da2dc99c1de470c0f8b7342d82"
age: 187976
cf-ray: 9f17aa26ba045c39-AMS
expires: Sat, 24 Apr 2027 19:55:16 GMT
date: Fri, 24 Apr 2026 19:55:16 GMT
content-type: text/javascript
last-modified: Wed, 22 Apr 2026 15:30:46 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 main.282c283e39679935e999.js Show response
cdn.intergient.com/pageos/V.20260421.1/ 557 KB
171 KB 38ms
37ms Script
text/javascript 2606:4700::6812:1438
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20260421.1/main.282c283e39679935e999.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260421.1/pageos.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4f23a5fd77193be649361747878617945ddeb22e10fccf6e8d68ed19cfb080ed

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

hw-country-code: NL
cache-control: public, max-age=31536000
content-encoding: br
cf-cache-status: HIT
etag: W/"df3986bda38d49703103d22d8ccda7c0"
age: 187976
cf-ray: 9f17aa26ca065c39-AMS
expires: Sat, 24 Apr 2027 19:55:16 GMT
date: Fri, 24 Apr 2026 19:55:16 GMT
content-type: text/javascript
last-modified: Wed, 22 Apr 2026 15:30:43 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 prebid Show response
aax.amazon-adsystem.com/e/dtb/bid/977555.66/0/ 19 B
304 B 135ms
86ms Fetch
text/javascript 13.33.186.215
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://aax.amazon-adsystem.com/e/dtb/bid/977555.66/0/prebid?adunitid=$rs_300x250_$ri
Requested by: Host: faucetfoot.com
URL: https://faucetfoot.com/public/hdbhl42/2tiu3.vendor.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.186.215 New York, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-33-186-215.fra60.r.cloudfront.net
Software: Server /
Resource Hash: a1246500e54878521c20eaca060cdbff39b403619b4751d39bf8828246d51309

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
via: 1.1 2ad26f5878b778b17955978bf962dc9a.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
content-length: 39
x-amz-cf-id: FHbLPsdkIsa2gYKX3cMM1NX4TFAeQpeE1zfW4RqdKqeWtceR9H72rA==
date: Fri, 24 Apr 2026 19:55:16 GMT
content-type: text/javascript;charset=UTF-8
x-amz-cf-pop: FRA60-P9
server: Server

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202604210101/ 599 KB
188 KB 48ms
47ms Script
text/javascript 142.251.13.157
Google LLC

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202604210101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.13.157 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

wt-in-f157.1e100.net

Software

cafe /

Resource Hash

d3e4676ba112da75dd757cd6698dec4ab775e631c32fc4862376a13dbac8329a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
etag: 5346976523452467383
age: 27634
x-content-type-options: nosniff
expires: Sat, 24 Apr 2027 12:14:43 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Fri, 24 Apr 2026 12:14:43 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 192007
x-xss-protection: 0
server: cafe

GET
H2 200 videoCard.cea8a6bd8cad3ad73428.js Show response
cdn.intergient.com/pageos/V.20260421.1/ 552 B
722 B 23ms
23ms Script
text/javascript 2606:4700::6812:1438
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20260421.1/videoCard.cea8a6bd8cad3ad73428.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260421.1/runtime.04ca972e510171386322.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0a0a95fd080f68f2d8c0a916f30cdb5cde422c6908dd64bd98043ef5c160f0f1

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

hw-country-code: NL
cache-control: public, max-age=31536000
content-encoding: br
cf-cache-status: HIT
etag: W/"b923f9cae7c940f9f384e93b5120abff"
age: 187975
cf-ray: 9f17aa27babe5c39-AMS
expires: Sat, 24 Apr 2027 19:55:17 GMT
date: Fri, 24 Apr 2026 19:55:17 GMT
content-type: text/javascript
last-modified: Wed, 22 Apr 2026 15:30:50 GMT
server: cloudflare

GET
H2 200 iframe.html Show response
cdn.intergient.com/pageos/V.20260421.1/iframe/ Frame 669E 1 KB
1018 B 76ms
24ms Document
text/html 2606:4700::6812:1538
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20260421.1/iframe/iframe.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260421.1/main.282c283e39679935e999.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: dbbd38e67f498d3794152c11a84a2f398b38f76a19076655c1ca0c3d5a747b56

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

age: 187975
cache-control: public, max-age=31536000
cf-cache-status: HIT
cf-ray: 9f17aa281f33b8bb-AMS
content-encoding: br
content-type: text/html
date: Fri, 24 Apr 2026 19:55:17 GMT
expires: Sat, 24 Apr 2027 19:55:17 GMT
hw-country-code: NL
last-modified: Wed, 22 Apr 2026 15:30:42 GMT
server: cloudflare

GET
H2 200 gdpr.c683187f44571d134588.js Show response
cdn.intergient.com/pageos/V.20260421.1/ 6 KB
2 KB 23ms
22ms Script
text/javascript 2606:4700::6812:1438
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20260421.1/gdpr.c683187f44571d134588.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260421.1/runtime.04ca972e510171386322.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: fe0d08fce4af40339a4535d4e5d34503a910cb7c87ad862bb2b09feec775a951

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

hw-country-code: NL
cache-control: public, max-age=31536000
content-encoding: br
cf-cache-status: HIT
etag: W/"1639782bcb3b68becf302ad559bfdfa4"
age: 187975
cf-ray: 9f17aa27bac15c39-AMS
expires: Sat, 24 Apr 2027 19:55:17 GMT
date: Fri, 24 Apr 2026 19:55:17 GMT
content-type: text/javascript
last-modified: Wed, 22 Apr 2026 15:30:41 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 tag Show response
btloader.com/ 184 KB
50 KB 66ms
32ms Script
application/javascript 2606:4700:10::6814:14bd
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260421.1/main.282c283e39679935e999.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:14bd -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5601cd2dcc2d7bc959cdcaf5eb6029ecbc8ac7bc25157da5a7c205be701a8f08

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-robots-tag: noindex, nofollow
cache-control: public, max-age=300, stale-if-error=3600, stale-while-revalidate=300
content-encoding: br
cf-cache-status: HIT
etag: W/"1858b36cf7ca791454f163535b3bedcd"
via: 1.1 google
cf-ray: 9f17aa27fdc61c8d-AMS
access-control-allow-origin: *
date: Fri, 24 Apr 2026 19:55:17 GMT
content-type: application/javascript
last-modified: Fri, 24 Apr 2026 19:13:11 GMT
server: cloudflare
vary: Accept-Encoding, X-Acceptable-Ads, DNT

GET
H2 200 1x1.gif
raw.githubusercontent.com/easylist/easylist/master/docs/ 43 B
580 B 49ms
15ms Image
image/gif 2606:50c0:8002::154
Fastly

General

Check archive.org

Download Go to Show image

Full URL

https://raw.githubusercontent.com/easylist/easylist/master/docs/1x1.gif

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:50c0:8002::154 , United States, ASN54113 (FASTLY - Fastly, Inc., US),

Reverse DNS

Software

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; style-src 'unsafe-inline'; sandbox
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-fastly-request-id: ea695d0f0217a310209012f8232534239dadc729
etag: W/"0c4a5773f7e435c57c40bd270aef756513eba26bd7ba5317b5bd765569a7325d"
x-content-type-options: nosniff
x-github-request-id: F488:D3348:A74624:B8EB2D:69E41528
expires: Fri, 24 Apr 2026 20:00:17 GMT
x-cache: HIT
date: Fri, 24 Apr 2026 19:55:17 GMT
content-type: image/gif
x-served-by: cache-ams2100145-AMS
x-cache-hits: 13
source-age: 262
x-frame-options: deny
strict-transport-security: max-age=31536000
vary: Authorization,Accept-Encoding
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
cache-control: max-age=300
x-timer: S1777060517.119369,VS0,VE0
cross-origin-resource-policy: cross-origin
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
content-length: 43
x-xss-protection: 1; mode=block

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 398 KB
141 KB 51ms
51ms Script
application/javascript 2a00:1450:4001:c15::61
Google LLC

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-CEFZJ359V8&cx=c&gtm=4e64n0h2

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:c15::61 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

1e29efeb57d46f17a010f7d9994e7a2b03b5032f5de53af1d68aa86205e6d2f3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
content-encoding: zstd
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Fri, 24 Apr 2026 19:55:17 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 144123
date: Fri, 24 Apr 2026 19:55:17 GMT
x-xss-protection: 0
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Google Tag Manager
access-control-allow-headers: Cache-Control

POST
H2 204 collect
region1.google-analytics.com/g/ 0
0 55ms
21ms Fetch
text/plain 2001:4860:4802:32::36
Google LLC

General

Check archive.org

Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-VJBRK9986D&gtm=45je64n0h2v9101576445za200zd9101576445&_p=1777060516672&gcd=13l3l3l2l1l1&npa=1&dma_cps=a&dma=1&are=1&cid=89804334.1777060517&frm=0&pscdl=noapi&rcb=1&sr=1600x1200&uaa=x86&uab=64&uafvl=Chromium%3B147.0.0.0%7CGoogle%2520Chrome%3B147.0.0.0%7CNot-A.Brand%3B24.0.0.0&uam=&uamb=0&uap=Linux&uapv=&uaw=0&ul=nl-nl&_s=1&tag_exp=0~115938466~115938468~117266401~117512543~117884344~118167060~118289195&sid=1777060517&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Ftyj.armendane.com%2F&dt=Paint%20with%20Oils&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=730
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:138:0
report-to: {"group":"ascnsrsggc:138:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:138:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:138:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 24 Apr 2026 19:55:17 GMT
content-type: text/plain
server: Golfe2

GET
H3 200 gpt
securepubads.g.doubleclick.net/pagead/managed/dict/m202604230101/ 63 KB
23 KB 48ms
47ms Other
text/plain 142.251.13.157
Google LLC

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/dict/m202604230101/gpt

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.13.157 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

wt-in-f157.1e100.net

Software

cafe /

Resource Hash

077408d8ee0011d4f33dc19e27276daf79f6ca78c79d7da1ab2a3a5e54abe3b7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
etag: 11806928644267344966
age: 17601
x-content-type-options: nosniff
expires: Fri, 01 May 2026 15:01:56 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Fri, 24 Apr 2026 15:01:56 GMT
content-type: text/plain; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=604800, stale-while-revalidate=7200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 23368
x-xss-protection: 0
server: cafe
use-as-dictionary: match="/gampad/ads", id="m202604230101"

GET
H2 200 iframe.js Show response
cdn.intergient.com/pageos/V.20260421.1/iframe/ Frame 669E 17 KB
7 KB 22ms
21ms Script
text/javascript 2606:4700::6812:1538
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20260421.1/iframe/iframe.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20260421.1/iframe/iframe.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: a1e9592b119e182885673d049ec2ead66dab57473f2f6da59f43d888cea5ac1e

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://cdn.intergient.com/pageos/V.20260421.1/iframe/iframe.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

hw-country-code: NL
cache-control: public, max-age=31536000
content-encoding: br
cf-cache-status: HIT
etag: W/"3eecc5d11812ac69fb4f2c63c5dea237"
age: 187975
cf-ray: 9f17aa283f52b8bb-AMS
expires: Sat, 24 Apr 2027 19:55:17 GMT
date: Fri, 24 Apr 2026 19:55:17 GMT
content-type: text/javascript
last-modified: Wed, 22 Apr 2026 15:30:42 GMT
server: cloudflare

GET
H2 200 cchecker.html Show response
cdn.btloader.com/ Frame 3DE0 366 B
712 B 51ms
21ms Document
text/html 2606:4700:10::ac42:ab85
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.btloader.com/cchecker.html?upapi=true
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac42:ab85 -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: c700c58e763a5ae34f446713819957ed9755025d35b8497ec1150f428f5ff227

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

access-control-allow-origin: *
access-control-expose-headers: *
age: 13162
cache-control: public, max-age=86400, immutable
cf-cache-status: HIT
cf-ray: 9f17aa288ee6f5b8-AMS
content-encoding: br
content-type: text/html
date: Fri, 24 Apr 2026 19:55:17 GMT
expires: Sat, 25 Apr 2026 16:01:01 GMT
last-modified: Thu, 16 Apr 2026 14:02:40 GMT
server: cloudflare
x-goog-generation: 1776348160499015
x-goog-hash: crc32c=/3eT+A== md5=WtMW8Jy4XJceDGzQqhOktA==
x-goog-metageneration: 1
x-goog-storage-class: MULTI_REGIONAL
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 366
x-guploader-uploadid: AMNfjG0tbCcq9SUdwqm5C_-FFPO2pQb-mcMLDo49wkcaPbj5HlRGT-0regOzOThYs6dlBwzktf2yGbQ

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
612 B 53ms
21ms Fetch
image/gif 2606:4700:10::ac42:948c
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=2&e=0.602732945506172
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac42:948c -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 2
x-goog-stored-content-encoding: identity
expires: Fri, 17 Apr 2026 20:01:05 GMT
x-goog-stored-content-length: 43
date: Fri, 24 Apr 2026 19:55:17 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH89K2Yq4pnfcvUStBId9HlURvizPqf3MVWGgPxZrgZz6nkGA3_cdbcg0whsVowwYFR03VNFb3R4
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9f17aa288bdc66db-AMS
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico Show response
ad.doubleclick.net/ 1 KB
129 B 117ms
53ms Fetch
image/x-icon 192.178.183.149
Google LLC

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.3872225392256742

Requested by

Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.183.149 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

186.176.8.34.bc.googleusercontent.com

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Sat, 25 Apr 2026 19:55:17 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 24 Apr 2026 19:55:17 GMT
content-type: image/x-icon
vary: Accept-Encoding
last-modified: Tue, 08 May 2012 13:08:06 GMT
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
109 B 55ms
24ms Fetch
image/gif 2606:4700:10::ac42:948c
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.13878099413487133
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac42:948c -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 2
x-goog-stored-content-encoding: identity
expires: Fri, 17 Apr 2026 20:01:05 GMT
x-goog-stored-content-length: 43
date: Fri, 24 Apr 2026 19:55:17 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH89K2Yq4pnfcvUStBId9HlURvizPqf3MVWGgPxZrgZz6nkGA3_cdbcg0whsVowwYFR03VNFb3R4
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9f17aa288bda66db-AMS
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H2 200 dns Show response
ab.dns-finder.com/meta/ 2 B
233 B 162ms
124ms Fetch
text/plain 34.36.200.111
Google LLC

General

Check archive.org

Download Go to

Full URL: https://ab.dns-finder.com/meta/dns
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.36.200.111 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS: 111.200.36.34.bc.googleusercontent.com
Software: /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: private, max-age=180, stale-if-error=180, stale-while-revalidate=180
access-control-expose-headers: X-Resolver
x-resolver: default
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
date: Fri, 24 Apr 2026 19:55:17 GMT
content-type: text/plain; charset=utf-8
vary: Origin

GET
H2 200 trustedIframe.html Show response
btloader.com/ Frame 4AE9 6 KB
2 KB 52ms
23ms Document
text/html 2606:4700:10::ac42:ab85
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://btloader.com/trustedIframe.html?o=5150306120761344&upapi=true
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac42:ab85 -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: b11d97e368d4bf84852324f6c6592e41315107a11f6025dc63aa630e77cf6e4b

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

cache-control: public, max-age=3600, stale-while-revalidate=3600
cf-ray: 9f17aa28881cee38-AMS
content-encoding: br
content-type: text/html
date: Fri, 24 Apr 2026 19:55:17 GMT
server: cloudflare

GET
H2 200 device Show response
cdn.api.btloader.com/ 87 B
319 B 56ms
25ms Fetch
application/json 2606:4700:10::6814:14bd
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.api.btloader.com/device?orgid=5150306120761344&fullVersionList=%5B%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22147.0.0.0%22%7D%2C%7B%22brand%22%3A%22Google+Chrome%22%2C%22version%22%3A%22147.0.0.0%22%7D%2C%7B%22brand%22%3A%22Not-A.Brand%22%2C%22version%22%3A%2224.0.0.0%22%7D%5D
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:14bd -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0d1140c720545957f3b2e4fbcda5ec195003863f2b1824166481589f5ab46fe1

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: public, max-age=7200
content-encoding: br
cf-cache-status: HIT
age: 26
x-ratelimit-reset: 1777060491
via: 1.1 google
cf-ray: 9f17aa28bbae2dde-AMS
x-ratelimit-remaining: 98
access-control-allow-origin: *
date: Fri, 24 Apr 2026 19:55:17 GMT
x-ratelimit-limit: 100
content-type: application/json
last-modified: Fri, 24 Apr 2026 19:54:50 GMT
server: cloudflare
vary: Origin

GET main.js
cdn.intergient.com/cdn-cgi/challenge-platform/scripts/jsd/ Frame 51AB 0
0

GET
H2 200 154013155 Show response
fundingchoicesmessages.google.com/i/ 217 KB
70 KB 354ms
264ms Script
application/javascript 2a00:1450:4001:c17::66
Google LLC

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/154013155?ers=3

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202604210101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:c17::66 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

fbd1483c567f6dd51aeba8ea9bd2b4fdf3fe1f90fad6634a58385be4a9c89f1b

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-QHW6vhrNqFDZRrBw_7lTQw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 24 Apr 2026 19:55:17 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzj6mHU4pJicNSQYmi9eY51OhCXLDrP2gbEXUA8B4gNFS6xOgPxh_rLrD-AuEjiCmsLEH-qusEqUn2DNZzLhy0eiL8V-7JxlPiynZjix3YLiJ8A8TcgZnnrz6Z2NIDNAogXTgtkWwnEz9cFsr0H4jsxQWxPgPjU6mC2S0AsxMOxdOr682wCK7pPtjApaSTlF8Yn5-eVFGUmlZbkF6Ulp6UWpxaVpRbFGxkYmRmYGBnrGZjFFxgAACtvS-U"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-QHW6vhrNqFDZRrBw_7lTQw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

POST
H2 204 exd
api.btloader.com/ 0
0 161ms
122ms Fetch 130.211.23.194
Google LLC

General

Check archive.org

Download Go to

Full URL: https://api.btloader.com/exd?tid=V5GDQdjHDx-rl7TNpidTi-9dc10f952e&sid=zP7Br5sL-hOtjza7H-9dc10f952e&cv=2.1.187-1-g24d1c87&upapi=true
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.23.194 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS: 194.23.211.130.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

via: 1.1 google
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000
date: Fri, 24 Apr 2026 19:55:17 GMT
vary: Origin

POST
H3 200 xgjxxg5cn844uz8 Show response
faucetfoot.com/r6rq68x5/ 303 B
327 B 57ms
33ms Fetch
application/json 34.8.176.186
Google LLC

General

Check archive.org

Download Go to

Full URL

https://faucetfoot.com/r6rq68x5/xgjxxg5cn844uz8

Requested by

Host: faucetfoot.com
URL: https://faucetfoot.com/public/hdbhl42/2tiu3.vendor.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.8.176.186 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),

Reverse DNS

Software

hoothoot/2455384222 /

Resource Hash

1c750e67ba0bffab7409a6c22a52f783f0118846bc8f73f8ad30bf731a0b0dd6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=15724800; preload
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: POST, OPTIONS
via: fen-hoothoot-europe-west1-test-1w44.gce-europe-west1, 1.1 google
expires: Fri, 24 Apr 2026 19:55:16 GMT
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000
content-length: 303
date: Fri, 24 Apr 2026 19:55:17 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding, Origin
server: hoothoot/2455384222
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Cookie

POST
H2 204 collect
region1.google-analytics.com/g/ 0
0 20ms
17ms Fetch
text/plain 2001:4860:4802:32::36
Google LLC

General

Check archive.org

Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-CEFZJ359V8&gtm=45je64n0h2v9102396898za200zb9101576445zd9101576445&_p=1777060516672&gcd=13l3l3l2l1l1&npa=1&dma_cps=a&dma=1&are=1&cid=89804334.1777060517&frm=0&pscdl=noapi&rcb=9&sr=1600x1200&uaa=x86&uab=64&uafvl=Chromium%3B147.0.0.0%7CGoogle%2520Chrome%3B147.0.0.0%7CNot-A.Brand%3B24.0.0.0&uam=&uamb=0&uap=Linux&uapv=&uaw=0&ul=nl-nl&_s=1&tag_exp=0~115938466~115938468~117266400~117512543~118289195&sid=1777060517&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Ftyj.armendane.com%2F&dt=Paint%20with%20Oils&en=ramp_js&_fv=1&_ss=1&_ee=1&ep.pageview_id=1777060516672&tfd=884
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-CEFZJ359V8&cx=c&gtm=4e64n0h2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:138:0
report-to: {"group":"ascnsrsggc:138:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:138:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:138:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 24 Apr 2026 19:55:17 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
110 B 20ms
20ms Fetch
image/gif 2606:4700:10::ac42:948c
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.5860405557511316
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac42:948c -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 2
x-goog-stored-content-encoding: identity
expires: Fri, 17 Apr 2026 20:01:05 GMT
x-goog-stored-content-length: 43
date: Fri, 24 Apr 2026 19:55:17 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH89K2Yq4pnfcvUStBId9HlURvizPqf3MVWGgPxZrgZz6nkGA3_cdbcg0whsVowwYFR03VNFb3R4
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9f17aa2a0d0266db-AMS
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
112 B 21ms
20ms Fetch
image/gif 2606:4700:10::ac42:948c
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=2&e=0.7474981050204953
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac42:948c -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 3
x-goog-stored-content-encoding: identity
expires: Fri, 17 Apr 2026 20:01:05 GMT
x-goog-stored-content-length: 43
date: Fri, 24 Apr 2026 19:55:17 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH89K2Yq4pnfcvUStBId9HlURvizPqf3MVWGgPxZrgZz6nkGA3_cdbcg0whsVowwYFR03VNFb3R4
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9f17aa2b4e2966db-AMS
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

POST
H3 204 AGSKWxX9QTrX6l49yt1O4NhEB8J2soUmsCI6zgdm3yTCx2Y9PVo61dQRL_0QYeeM3ebrWDTnaUz6tJMBRDdLVn8NkxIzo95XKTGOokRgIExq6Eq8lBhXXoRq2jzqeQcoeKfY7fH0QnwgnA== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 98ms
51ms XHR
text/html 142.251.20.100
Google LLC

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxX9QTrX6l49yt1O4NhEB8J2soUmsCI6zgdm3yTCx2Y9PVo61dQRL_0QYeeM3ebrWDTnaUz6tJMBRDdLVn8NkxIzo95XKTGOokRgIExq6Eq8lBhXXoRq2jzqeQcoeKfY7fH0QnwgnA==

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.nl.VL3M-eBF5CA.es5.O/d=1/rs=AJlcJMw3A8_vPGS_NcYZOI75T0QwY4ydSA/m=kernel_loader,loader_js_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.20.100 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-Ss7IRke7_S0XF8JhA3mmag' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type: text/plain
sec-ch-ua-mobile: ?0

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 24 Apr 2026 19:55:17 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjctDikmLw15BiOHHrNtMFIP5Qf5n1BxCHc_mwxQPxwmmBbCuB-Pm6QLb3QHwnJojtCRCfWh3MdgmIhXg4lk5df55NYMWfPXeZlFyS8gvjk_PzSlLzSnQTU4p1QeyizKTSkvwiFHZqGUhFTn56emZeeryRgZGZgYmRsZ6BeXyBAQBVAjlX"
content-security-policy: script-src 'report-sample' 'nonce-Ss7IRke7_S0XF8JhA3mmag' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxX9QTrX6l49yt1O4NhEB8J2soUmsCI6zgdm3yTCx2Y9PVo61dQRL_0QYeeM3ebrWDTnaUz6tJMBRDdLVn8NkxIzo95XKTGOokRgIExq6Eq8lBhXXoRq2jzqeQcoeKfY7fH0QnwgnA==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.20.100 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-iQZLSxq9OTYZRlGR0bjyQw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type: text/plain
sec-ch-ua-mobile: ?0

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 24 Apr 2026 19:55:17 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjstDikmJw1JBi-FB_mfUHEIdz-bDFA_HCaYFsK4H4-bpAtvdAfCcmiO0JEJ9aHcx2CYiFeDiWTl1_nk3gwsqX95mUXJLyC-OT8_NKUvNKdBNTinVB7KLMpNKS_CIUdmoZSEVOfnp6Zl56vJGBkZmBiZGxnoF5fIEBAJDMND8"
content-security-policy: script-src 'report-sample' 'nonce-iQZLSxq9OTYZRlGR0bjyQw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxX9QTrX6l49yt1O4NhEB8J2soUmsCI6zgdm3yTCx2Y9PVo61dQRL_0QYeeM3ebrWDTnaUz6tJMBRDdLVn8NkxIzo95XKTGOokRgIExq6Eq8lBhXXoRq2jzqeQcoeKfY7fH0QnwgnA==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.20.100 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-d9EbuHgDH1C4DBnkbIEccQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type: text/plain
sec-ch-ua-mobile: ?0

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 24 Apr 2026 19:55:17 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjstDikmII1pBi-FB_mfUHEIdz-bDFA_HCaYFsK4H4-bpAtvdAfCcmiO0JEJ9aHcx2CYiFeDiWTl1_nk3gxatV95iUXJLyC-OT8_NKUvNKdBNTinVB7KLMpNKS_CIUdmoZSEVOfnp6Zl56vJGBkZmBiZGxnoF5fIEBAKHvNGo"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-d9EbuHgDH1C4DBnkbIEccQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxX9QTrX6l49yt1O4NhEB8J2soUmsCI6zgdm3yTCx2Y9PVo61dQRL_0QYeeM3ebrWDTnaUz6tJMBRDdLVn8NkxIzo95XKTGOokRgIExq6Eq8lBhXXoRq2jzqeQcoeKfY7fH0QnwgnA==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.20.100 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-pJjfCUQNkwx-WTcTBQqF4w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type: text/plain
sec-ch-ua-mobile: ?0

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 24 Apr 2026 19:55:17 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjstDikmLw0JBi-FB_mfUHEIdz-bDFA_HCaYFsK4H4-bpAtvdAfCcmiO0JEJ9aHcx2CYiFeDiWTl1_nk3gRc-H-0xKLkn5hfHJ-XklqXkluokpxbogdlFmUmlJfhEKO7UMpCInPz09My893sjAyMzAxMhYz8A8vsAAAJUpNEg"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-pJjfCUQNkwx-WTcTBQqF4w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H2 200 AGSKWxW7ARhS6x8m2KSISMmJSFo2jiAWaeU5ivaado2gcCmEmfFRLu6bSkWNZcPBAvxkao7hTsFKDM5MiXkpSsZEAzxHSje2qBjKNatM3dN7FLphxhRoStdLKdqnR5WeS0rjsMaqUTNXAw== Show response
fundingchoicesmessages.google.com/f/ 889 KB
107 KB 132ms
131ms Script
application/javascript 2a00:1450:4001:c17::66
Google LLC

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxW7ARhS6x8m2KSISMmJSFo2jiAWaeU5ivaado2gcCmEmfFRLu6bSkWNZcPBAvxkao7hTsFKDM5MiXkpSsZEAzxHSje2qBjKNatM3dN7FLphxhRoStdLKdqnR5WeS0rjsMaqUTNXAw==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzc3MDYwNTE3LDY4MDAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzddXSwiaHR0cHM6Ly9wYWludC50b3lzL29pbC8iLG51bGwsW1s4LCJWTDNNLWVCRjVDQSJdLFs5LCJubCJdLFsxOCwiW1tbbnVsbCw4MjZdXV0iXSxbMzUsIjE3NzcwNjA1MTciXSxbMTksIjEiXSxbMTcsIlswXSJdLFsyNCwidHlqLmFybWVuZGFuZS5jb20iXSxbMjksImZhbHNlIl1dXQ

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:c17::66 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

f35c36a790e3502074691feb9f07855f0a91287f700230763549bbb9972bd8be

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-YBGceVRNvfQBjsn2v6Nyuw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 24 Apr 2026 19:55:17 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzj6mHU4pJiCNSQYmi9eY51OhCXLDrP2gbEXUA8B4gNFS6xOgPxh_rLrD-AuEjiCmsLEH-qusEqUn2DNZzLhy0eiL8V-7JxlPiynZjix3YLiJ8A8TcgZnnrz6Z2NIDNAogXTgtkWwnEz9cFsr0H4jsxQWxPgPjU6mC2S0AsxMOxdOr682wCE1Ye-sykpJGUXxifnJ9XUpSZVFqSX5SWnJZanFpUlloUb2RgZGZgYmSsZ2AWX2AAAEpETGM"
content-security-policy: script-src 'report-sample' 'nonce-YBGceVRNvfQBjsn2v6Nyuw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 favicon.ico Show response
ad.doubleclick.net/ 1 KB
129 B 51ms
50ms Fetch
image/x-icon 192.178.183.149
Google LLC

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.8506986454044555

Requested by

Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.183.149 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Sat, 25 Apr 2026 19:55:17 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 24 Apr 2026 19:55:17 GMT
content-type: image/x-icon
vary: Accept-Encoding
last-modified: Tue, 08 May 2012 13:08:06 GMT
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 css
fonts.googleapis.com/ 123 KB
6 KB 71ms
71ms Stylesheet
text/css 2a00:1450:4001:c13::5f
Google LLC

General

Check archive.org

Download Go to

Full URL

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.nl.VL3M-eBF5CA.es5.O/d=1/exm=kernel_loader,loader_js_executable/ed=1/rs=AJlcJMw3A8_vPGS_NcYZOI75T0QwY4ydSA/m=web_iab_tcf_v2_wall_executable

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a00:1450:4001:c13::5f Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

f045c9ab803dcf309dc19739cadecdd6ff556f4fbb5969a9f57abe5737f4af50

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Fri, 24 Apr 2026 19:55:17 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 24 Apr 2026 19:55:17 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Fri, 24 Apr 2026 19:55:17 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H3 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v40/ 47 KB
47 KB 45ms
44ms Font
font/woff2 142.251.127.94
Google LLC

General

Check archive.org

Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.127.94 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

lcfrai-in-f94.1e100.net

Software

sffe /

Resource Hash

3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://paint.toys
sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

age: 177675
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Thu, 22 Apr 2027 18:34:02 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 22 Apr 2026 18:34:02 GMT
last-modified: Thu, 14 Dec 2023 02:08:40 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 48236
x-xss-protection: 0
server: sffe

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxX9QTrX6l49yt1O4NhEB8J2soUmsCI6zgdm3yTCx2Y9PVo61dQRL_0QYeeM3ebrWDTnaUz6tJMBRDdLVn8NkxIzo95XKTGOokRgIExq6Eq8lBhXXoRq2jzqeQcoeKfY7fH0QnwgnA==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.20.100 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-cRRdhR83fiFpe-403HwxWw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type: text/plain
sec-ch-ua-mobile: ?0

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 24 Apr 2026 19:55:17 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjstDikmLw1JBi-FB_mfUHEIdz-bDFA_HCaYFsK4H4-bpAtvdAfCcmiO0JEJ9aHcx2CYiFeDiWTl1_nk1gxrL9Z5iVXJLyC-OT8_NKUvNKdBNTinVB7KLMpNKS_CIUdmoZSEVOfnp6Zl56vJGBkZmBiZGxnoF5fIEBAHK7M9A"
content-security-policy: script-src 'report-sample' 'nonce-cRRdhR83fiFpe-403HwxWw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxX9QTrX6l49yt1O4NhEB8J2soUmsCI6zgdm3yTCx2Y9PVo61dQRL_0QYeeM3ebrWDTnaUz6tJMBRDdLVn8NkxIzo95XKTGOokRgIExq6Eq8lBhXXoRq2jzqeQcoeKfY7fH0QnwgnA==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.20.100 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-JX4fVZ8Lxq89W8h_wV8Biw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type: text/plain
sec-ch-ua-mobile: ?0

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 24 Apr 2026 19:55:17 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjctDikmLw05BiOHnrNtNFIP5Qf5n1BxCHc_mwxQPxwmmBbCuB-Pm6QLb3QHwnJojtCRCfWh3MdgmIhXg4lk5df55N4MK1rrPMSi5J-YXxyfl5Jal5JbqJKcW6IHZRZlJpSX4RCju1DKQiJz89PTMvPd7IwMjMwMTIWM_APL7AAABDxzkZ"
content-security-policy: script-src 'report-sample' 'nonce-JX4fVZ8Lxq89W8h_wV8Biw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxX9QTrX6l49yt1O4NhEB8J2soUmsCI6zgdm3yTCx2Y9PVo61dQRL_0QYeeM3ebrWDTnaUz6tJMBRDdLVn8NkxIzo95XKTGOokRgIExq6Eq8lBhXXoRq2jzqeQcoeKfY7fH0QnwgnA==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.20.100 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-KDx43tbbi52llsJRVNMpLQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type: text/plain
sec-ch-ua-mobile: ?0

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 24 Apr 2026 19:55:17 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjstDikmLw0ZBi-FB_mfUHEIdz-bDFA_HCaYFsK4H4-bpAtvdAfCcmiO0JEJ9aHcx2CYiFeDiWTl1_nk3gwOP9Z5mVXJLyC-OT8_NKUvNKdBNTinVB7KLMpNKS_CIUdmoZSEVOfnp6Zl56vJGBkZmBiZGxnoF5fIEBAJH1NDk"
content-security-policy: script-src 'report-sample' 'nonce-KDx43tbbi52llsJRVNMpLQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H2 200 favicon.ico
paint.toys/ 615 B
747 B 24ms
23ms Other
image/vnd.microsoft.icon 15.197.167.90
Amazon.com

General

Check archive.org

Download Go to

Full URL

https://paint.toys/favicon.ico

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.197.167.90 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

Software

Netlify /

Resource Hash

30a007a99e491d9e1b2b72c02e4a8454334c6ea2b3a03316d50135b20464fccc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/oil/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "6c77abc0123fbfdebbf702a90fb50938-ssl"
age: 14062
accept-ranges: bytes
content-length: 615
x-nf-request-id: 01KQ0GZ64D0F84K1QDWN0EVKA2
cache-status: "Netlify Edge"; hit
date: Fri, 24 Apr 2026 19:55:18 GMT
content-type: image/vnd.microsoft.icon
server: Netlify

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
133 B 20ms
19ms Fetch
image/gif 2606:4700:10::ac42:948c
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=2&e=0.4332808924638767
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac42:948c -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 3
x-goog-stored-content-encoding: identity
expires: Fri, 17 Apr 2026 20:01:05 GMT
x-goog-stored-content-length: 43
date: Fri, 24 Apr 2026 19:55:18 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH89K2Yq4pnfcvUStBId9HlURvizPqf3MVWGgPxZrgZz6nkGA3_cdbcg0whsVowwYFR03VNFb3R4
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9f17aa2fba4a66db-AMS
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico Show response
ad.doubleclick.net/ 1 KB
129 B 51ms
50ms Fetch
image/x-icon 192.178.183.149
Google LLC

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.16697065831372293

Requested by

Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.183.149 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Sat, 25 Apr 2026 19:55:18 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 24 Apr 2026 19:55:18 GMT
content-type: image/x-icon
vary: Accept-Encoding
last-modified: Tue, 08 May 2012 13:08:06 GMT
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
110 B 20ms
19ms Fetch
image/gif 2606:4700:10::ac42:948c
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.9087586685515063
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac42:948c -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 3
x-goog-stored-content-encoding: identity
expires: Fri, 17 Apr 2026 20:01:05 GMT
x-goog-stored-content-length: 43
date: Fri, 24 Apr 2026 19:55:18 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH89K2Yq4pnfcvUStBId9HlURvizPqf3MVWGgPxZrgZz6nkGA3_cdbcg0whsVowwYFR03VNFb3R4
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9f17aa2fba4b66db-AMS
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H2 200 dns Show response
ab.dns-finder.com/meta/ 2 B
0 0ms
0ms Fetch
text/plain 34.36.200.111
Google LLC

General

Check archive.org

Download Go to

Full URL: https://ab.dns-finder.com/meta/dns
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.36.200.111 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS: 111.200.36.34.bc.googleusercontent.com
Software: /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: private, max-age=180, stale-if-error=180, stale-while-revalidate=180
access-control-expose-headers: X-Resolver
x-resolver: default
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
date: Fri, 24 Apr 2026 19:55:17 GMT
content-type: text/plain; charset=utf-8
vary: Origin

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
112 B 21ms
21ms Fetch
image/gif 2606:4700:10::ac42:948c
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.1656261032917411
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac42:948c -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 4
x-goog-stored-content-encoding: identity
expires: Fri, 17 Apr 2026 20:01:05 GMT
x-goog-stored-content-length: 43
date: Fri, 24 Apr 2026 19:55:18 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH89K2Yq4pnfcvUStBId9HlURvizPqf3MVWGgPxZrgZz6nkGA3_cdbcg0whsVowwYFR03VNFb3R4
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9f17aa31ac5d66db-AMS
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

POST
H3 204 ping
pagead2.googlesyndication.com/pagead/ 0
0 120ms
70ms Fetch
image/gif 142.251.13.156
Google LLC

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/ping?e=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202604210101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.13.156 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

wt-in-f156.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
Content-Type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Fri, 24 Apr 2026 19:55:18 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
110 B 21ms
20ms Fetch
image/gif 2606:4700:10::ac42:948c
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=2&e=0.9352615688032127
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac42:948c -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 4
x-goog-stored-content-encoding: identity
expires: Fri, 17 Apr 2026 20:01:05 GMT
x-goog-stored-content-length: 43
date: Fri, 24 Apr 2026 19:55:18 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH89K2Yq4pnfcvUStBId9HlURvizPqf3MVWGgPxZrgZz6nkGA3_cdbcg0whsVowwYFR03VNFb3R4
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9f17aa32ed9466db-AMS
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico Show response
ad.doubleclick.net/ 1 KB
129 B 48ms
48ms Fetch
image/x-icon 192.178.183.149
Google LLC

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.504755289379406

Requested by

Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.183.149 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Sat, 25 Apr 2026 19:55:18 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 24 Apr 2026 19:55:18 GMT
content-type: image/x-icon
vary: Accept-Encoding
last-modified: Tue, 08 May 2012 13:08:06 GMT
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
133 B 19ms
19ms Fetch
image/gif 2606:4700:10::ac42:948c
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=2&e=0.6307110708507527
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac42:948c -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 4
x-goog-stored-content-encoding: identity
expires: Fri, 17 Apr 2026 20:01:05 GMT
x-goog-stored-content-length: 43
date: Fri, 24 Apr 2026 19:55:19 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH89K2Yq4pnfcvUStBId9HlURvizPqf3MVWGgPxZrgZz6nkGA3_cdbcg0whsVowwYFR03VNFb3R4
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9f17aa35886766db-AMS
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico Show response
ad.doubleclick.net/ 1 KB
129 B 47ms
47ms Fetch
image/x-icon 192.178.183.149
Google LLC

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.7440421137519602

Requested by

Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.183.149 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Sat, 25 Apr 2026 19:55:19 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 24 Apr 2026 19:55:19 GMT
content-type: image/x-icon
vary: Accept-Encoding
last-modified: Tue, 08 May 2012 13:08:06 GMT
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
112 B 19ms
19ms Fetch
image/gif 2606:4700:10::ac42:948c
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=2&e=0.39251842697691064
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac42:948c -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 5
x-goog-stored-content-encoding: identity
expires: Fri, 17 Apr 2026 20:01:05 GMT
x-goog-stored-content-length: 43
date: Fri, 24 Apr 2026 19:55:19 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH89K2Yq4pnfcvUStBId9HlURvizPqf3MVWGgPxZrgZz6nkGA3_cdbcg0whsVowwYFR03VNFb3R4
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9f17aa382ab866db-AMS
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico Show response
ad.doubleclick.net/ 1 KB
129 B 52ms
52ms Fetch
image/x-icon 192.178.183.149
Google LLC

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.4466259235999447

Requested by

Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.183.149 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Sat, 25 Apr 2026 19:55:19 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 24 Apr 2026 19:55:19 GMT
content-type: image/x-icon
vary: Accept-Encoding
last-modified: Tue, 08 May 2012 13:08:06 GMT
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
133 B 19ms
19ms Fetch
image/gif 2606:4700:10::ac42:948c
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=2&e=0.7056022552271597
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac42:948c -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 5
x-goog-stored-content-encoding: identity
expires: Fri, 17 Apr 2026 20:01:05 GMT
x-goog-stored-content-length: 43
date: Fri, 24 Apr 2026 19:55:20 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH89K2Yq4pnfcvUStBId9HlURvizPqf3MVWGgPxZrgZz6nkGA3_cdbcg0whsVowwYFR03VNFb3R4
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9f17aa3add2266db-AMS
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico Show response
ad.doubleclick.net/ 1 KB
129 B 51ms
50ms Fetch
image/x-icon 192.178.183.149
Google LLC

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.08843951132543526

Requested by

Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.183.149 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS