paint.toys Open in urlscan Pro
15.197.167.90 Public Scan

Software

Netlify /

Resource Hash

70883a9270d54ca9914810ee600c39f62c1147243374c8b93b7095f9c78b4b66

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://dqxws.tombert.com/crbywxwzvRaHlzZEZEbXFMMnV6R3poSmVJRWUtMTc2NS0yNjcxNjAxOS0wZmZhMDI3NC0yNDM0LWRLZHBWSmFwbFJZMjhSMG5wU2dI/c1mhpt6x8ah/jpnflt
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 37866
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-encoding: br
content-length: 1632
content-type: text/html; charset=UTF-8
date: Tue, 18 Feb 2025 01:31:39 GMT
etag: "7afa2eee23cef4ed7f87aab76b5bc74d-ssl-df"
server: Netlify
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-nf-request-id: 01JMBAX9E3FWB2CPDTWKCG5A7F

Redirect headers

accept-ranges: bytes
age: 14901
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-length: 1671
content-type: text/html; charset=UTF-8
date: Tue, 18 Feb 2025 01:31:39 GMT
etag: "7afa2eee23cef4ed7f87aab76b5bc74d-ssl-df"
location: /oil/
server: Netlify
strict-transport-security: max-age=31536000
x-nf-request-id: 01JMBAX9C3GKWHAJR6K7NQNM3V

GET
H3 200 ramp_config.js Show response
cdn.intergient.com/1024872/74068/ 35 KB
7 KB 212ms
45ms Script
application/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/1024872/74068/ramp_config.js
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e8025d23c2598b658ff05134c61e78b7acef4fa9dfab4650aa99adeba6af14e5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: HIT
age: 196
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: feqVH9NUExh4pxcS3qH8PjX_w6qDAjZqOBD1TOZLhBeI7E4ISYRmyw==
date: Tue, 18 Feb 2025 01:31:39 GMT
last-modified: Tue, 18 Feb 2025 01:28:16 GMT
content-type: application/javascript
vary: Accept-Encoding
priority: u=3,i=?0
server-timing: cfExtPri
hw-country-code: US
cache-control: max-age=600, public, must-revalidate
via: 1.1 a5933b9e55bd48dbddd12a2ba8695eb4.cloudfront.net (CloudFront)
cf-ray: 913a42443f5ef5f4-EWR
x-amz-cf-pop: MIA3-P5
server: cloudflare

GET
H2 200 apps.css
paint.toys/ 5 KB
1 KB 40ms
37ms Stylesheet
text/css 15.197.167.90
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://paint.toys/apps.css

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.197.167.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

2ff696f311f1afa7aafddb260becd45331aab7ce1741821b0f3e2d9e683382b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
content-encoding: br
etag: "58d01e65c6625681e8891f6fbc8c18f5-ssl-df"
age: 16555
accept-ranges: bytes
content-length: 1395
x-nf-request-id: 01JMBAX9G7Q1ZXZT7WFHRS54YD
cache-status: "Netlify Edge"; hit
date: Tue, 18 Feb 2025 01:31:39 GMT
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: Netlify

GET
H2 200 index.js Show response
paint.toys/oil/ 4 KB
1 KB 38ms
37ms Script
application/javascript 15.197.167.90
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://paint.toys/oil/index.js

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.197.167.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

c91c09319c4b0a24c72c0036cef74c17b85d3c4e2a4abf8153f5710421fe5b4c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
content-encoding: br
etag: "687211e2ced405124b38663a13c97091-ssl-df"
age: 14900
accept-ranges: bytes
content-length: 1190
x-nf-request-id: 01JMBAX9G7A27W7FJ38B67N49A
cache-status: "Netlify Edge"; hit
date: Tue, 18 Feb 2025 01:31:39 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Netlify

GET
H2 200 art-icon.png
paint.toys/assets/ 33 KB
33 KB 51ms
49ms Image
image/png 15.197.167.90
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/art-icon.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.197.167.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

f4d368e4230539c778afbb020e0ea611b3e1d984179f5b3769b44081d6703f3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "1394f8469f2ca5750397e3d7b6ec70a1-ssl"
age: 16555
accept-ranges: bytes
content-length: 33562
x-nf-request-id: 01JMBAX9G7AC2AHGJ71THGGHPT
cache-status: "Netlify Edge"; hit
date: Tue, 18 Feb 2025 01:31:39 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-hand.png
paint.toys/assets/ 27 KB
27 KB 40ms
39ms Image
image/png 15.197.167.90
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-hand.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.197.167.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

32aa05a5648678542ab9044647f0bf5549c0b53a070585edb773f0e92b72b97d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "a0822110a4671ffdf710da1467460fba-ssl"
age: 16555
accept-ranges: bytes
content-length: 27394
x-nf-request-id: 01JMBAX9G7NY84EN4DBPGAMW19
cache-status: "Netlify Edge"; hit
date: Tue, 18 Feb 2025 01:31:39 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-disk.png
paint.toys/assets/ 13 KB
14 KB 41ms
39ms Image
image/png 15.197.167.90
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-disk.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.197.167.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

436814c2374a6d92a42a02d39969ef7c56b5f225667abecb218e692c5569943c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "26852fa1548a91e004629b01e4abf1dd-ssl"
age: 16555
accept-ranges: bytes
content-length: 13766
x-nf-request-id: 01JMBAX9HG4SBXVF72VFP4X2WT
cache-status: "Netlify Edge"; hit
date: Tue, 18 Feb 2025 01:31:39 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-trash.png
paint.toys/assets/ 50 KB
51 KB 35ms
33ms Image
image/png 15.197.167.90
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-trash.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.197.167.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

6ceb226c487cb85243545e768944e0e1ae0944be8fde6c1c43c7314a9287e6d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "e91ef5e34b5154d392e8560031eaaa4c-ssl"
age: 16555
accept-ranges: bytes
content-length: 51680
x-nf-request-id: 01JMBAX9HG5PM9KD6B0R4GVC1Y
cache-status: "Netlify Edge"; hit
date: Tue, 18 Feb 2025 01:31:39 GMT
content-type: image/png
server: Netlify

GET
H3 200 ramp_core.js Show response
cdn.intergient.com/ 3 KB
2 KB 232ms
112ms Script
application/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/ramp_core.js
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ef700adc6150e3c2108923fafd4f95464806b0fd37ab6978f3267bde8c51b12d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-amz-cf-id: 8Wug-HfNwYgkrnk7bGbe3BImOMpH_E2H5wbMZEmgSmEwK2LpPNbhjw==
date: Tue, 18 Feb 2025 01:31:39 GMT
x-lambda-function: us-east-1.pageos_production:851
content-type: application/javascript
vary: Accept-Encoding
priority: u=3,i=?0
server-timing: cfExtPri
hw-country-code: US
cache-control: max-age=600, public, must-revalidate
via: 1.1 284ac69616559909913fa0f0502158ea.cloudfront.net (CloudFront)
cf-ray: 913a42443f61f5f4-EWR
x-amz-cf-pop: JFK52-P8
server: cloudflare

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 334 KB
112 KB 163ms
63ms Script
application/javascript 2607:f8b0:4004:c17::61
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c17::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

900a827213998eb7ddf9bcb19beb3e1d7c59ec8dc94941557b43ad234ae91c6e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1003:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1003:0"}],}
expires: Tue, 18 Feb 2025 01:31:39 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 18 Feb 2025 01:31:39 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1003:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1003:0
content-length: 113621
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 55fa41bc8192edc6749bd247bf408a8e957c8b.bundle.js Show response
faucetfoot.com/bundles/695feb6450/ 67 KB
25 KB 183ms
68ms Script
text/javascript 2600:1901:0:2b4c::1
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL

https://faucetfoot.com/bundles/695feb6450/55fa41bc8192edc6749bd247bf408a8e957c8b.bundle.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:1901:0:2b4c::1 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Resource Hash

f95f8556fa7e96a1a10effbf1f13fa73d5d8b741d50a8abdbc2bf745208fb8ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=15724800; preload
cache-control: private, must-revalidate, max-age=21600
timing-allow-origin: *
content-encoding: zstd
etag: W/"9fb1105f90ebf6321958f205c112e84329286853ce5b9e2ee10f6b6dd0f504dc"
x-buildname: hoothoot
x-datacenter: gce-us-east1
via: 1.1 google
x-hostname: fen-hoothoot-us-east1-8xr3
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-buildnumber: 1657128696
date: Tue, 18 Feb 2025 01:31:39 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding, Accept-Language

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 105 KB
33 KB 169ms
51ms Script
text/javascript 2607:f8b0:4004:c1f::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1f::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3f7df1c09b048f75b72bafcd178e03165d71f25be07c99e0ba61226b6e7c4c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 98 / 20137 / m202502110101 / config-hash: 12653439138671085988
x-content-type-options: nosniff
expires: Tue, 18 Feb 2025 01:31:39 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Tue, 18 Feb 2025 01:31:39 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 34035
x-xss-protection: 0
server: cafe

GET
H3 200 prebid.js.br Show response
cdn.intergi.com/prebid/ 564 KB
179 KB 216ms
89ms Script
text/javascript 2606:4700::6812:18f2
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergi.com/prebid/prebid.js.br
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:18f2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 930f76466a9eb4f30d5eb615b47214dbde199ea4e41372f0a0f4234999effd26

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
cf-cache-status: HIT
x-amz-version-id: _TYiC0cw4jjhOm7gGxg9EGWYjsRSWSiG
etag: W/"d5acf230567b5490882977b27dffbdf1"
age: 6638
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-amz-cf-id: 6Q0KoJdTVPu4offPWl309zkRg_DBnUCxIJaZSEMHwuFy2dAchyz3Gw==
date: Tue, 18 Feb 2025 01:31:39 GMT
content-type: text/javascript
last-modified: Thu, 13 Feb 2025 14:00:05 GMT
vary: Accept-Encoding
priority: u=3,i=?0
server-timing: cfExtPri
via: 1.1 0a72bb7be10458e1aefa37a097f21894.cloudfront.net (CloudFront)
cf-ray: 913a42456e7941c3-EWR
x-amz-cf-pop: MIA3-C2
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 277 KB
98 KB 52ms
51ms Script
application/javascript 2607:f8b0:4004:c17::61
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-CEFZJ359V8&l=dataLayer&cx=c&gtm=45je52d0v9101576445za200

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c17::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b409fd9e71cc947c61337fda19aa02ba41b4266fffd6cb2ee49fc09100b76b65

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1003:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1003:0"}],}
expires: Tue, 18 Feb 2025 01:31:39 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 18 Feb 2025 01:31:39 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1003:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1003:0
content-length: 99862
x-xss-protection: 0
server: Google Tag Manager

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 203ms
99ms Fetch
text/plain 2607:f8b0:4004:c17::65
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-VJBRK9986D&gtm=45je52d0v9101576445za200&_p=1739842299417&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101732279~101732281~102067808~102482433~102539968~102558064~102587591~102605417~102640600&cid=1751889487.1739842300&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1739842299&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Fdqxws.tombert.com%2F&dt=Paint%20with%20Oils&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=1177
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c17::65 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to: {"group":"ascnsrsggc:86:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:86:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 18 Feb 2025 01:31:39 GMT
content-type: text/plain
server: Golfe2

GET
H3 200 pageos.js Show response
cdn.intergient.com/pageos/2.2.9/ 395 B
640 B 37ms
36ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/2.2.9/pageos.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/ramp_core.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f7ab42d5e0259ca8be28e5e474053d316d4c2fd9f1b45d3069769d37247ce224

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"052df36524512fdd96e430fb7dd10157"
age: 464449
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-amz-cf-id: 6gy7F7anC4IQuGKVD4pIVDwnElz6F98pCFySNyW3Jh1ykOklR9EGeg==
date: Tue, 18 Feb 2025 01:31:39 GMT
content-type: text/javascript
last-modified: Wed, 12 Feb 2025 15:59:26 GMT
vary: Accept-Encoding
priority: u=3,i=?0
server-timing: cfExtPri
hw-country-code: US
cache-control: public, max-age=31536000
via: 1.1 105461d7cafac06ca13585d24c8e94a8.cloudfront.net (CloudFront)
cf-ray: 913a424549edf5f4-EWR
x-amz-cf-pop: MIA3-P5
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H3 200 runtime.faf6509395f8efe38a8c.js Show response
cdn.intergient.com/pageos/2.2.9/ 3 KB
2 KB 45ms
44ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/2.2.9/runtime.faf6509395f8efe38a8c.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/2.2.9/pageos.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 159edf91c94b58e20383804c1964656e6fe4f3cd90202285851638ce73d6bc0c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"4ba8130edf5266b758f6c21acd563a2e"
age: 464449
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-amz-cf-id: R-PE9yfHD_gcZBDeerSnxGm7ypdqR2bv6liD2PkCeR6GSVLi5KmNZg==
date: Tue, 18 Feb 2025 01:31:39 GMT
content-type: text/javascript
last-modified: Wed, 12 Feb 2025 15:59:26 GMT
vary: accept-encoding
priority: u=3,i=?0
server-timing: cfExtPri
hw-country-code: US
cache-control: public, max-age=31536000
via: 1.1 e9ac74ac2d11bc967a3fd799b5b80994.cloudfront.net (CloudFront)
cf-ray: 913a42459a97f5f4-EWR
x-amz-cf-pop: MIA3-P5
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H3 200 main.884d984457b5c04043a0.js Show response
cdn.intergient.com/pageos/2.2.9/ 1 MB
294 KB 53ms
52ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/2.2.9/main.884d984457b5c04043a0.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/2.2.9/pageos.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5ef5006fc03b78e9714dd2efeb7662a0e0cd11714a9a3d5ab7a5f4a2f365d320

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"7958a6818d2bbcfd001d97d6c2096e53"
age: 464449
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-amz-cf-id: i4eEfHFGr7lCEUCyR3Zd5tDlvQ4-WeIGL1t9GMjaeplnVXeHiV5Lcg==
date: Tue, 18 Feb 2025 01:31:39 GMT
content-type: text/javascript
last-modified: Wed, 12 Feb 2025 15:59:26 GMT
vary: accept-encoding
priority: u=3,i=?0
server-timing: cfExtPri
hw-country-code: US
cache-control: public, max-age=31536000
via: 1.1 aab97f44d1fd9aa4917e5ee232773a52.cloudfront.net (CloudFront)
cf-ray: 913a42459a9df5f4-EWR
x-amz-cf-pop: MIA3-P5
server: cloudflare
x-amz-server-side-encryption: AES256

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 90ms
89ms Fetch
text/plain 2607:f8b0:4004:c17::65
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-CEFZJ359V8&gtm=45je52d0v9102396898za200zb9101576445&_p=1739842299417&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=102067808~102482432~102539968~102556566~102558064~102587591~102605417~102640600&cid=1751889487.1739842300&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1739842299&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Fdqxws.tombert.com%2F&dt=Paint%20with%20Oils&en=ramp_js&_fv=1&_ss=1&_ee=1&ep.pageview_id=1739842299417&tfd=1290
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-CEFZJ359V8&l=dataLayer&cx=c&gtm=45je52d0v9101576445za200
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c17::65 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to: {"group":"ascnsrsggc:86:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:86:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 18 Feb 2025 01:31:39 GMT
content-type: text/plain
server: Golfe2

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202502110101/ 516 KB
160 KB 32ms
31ms Script
text/javascript 2607:f8b0:4004:c1f::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202502110101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1f::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

acd4a684041ef9f274eaf0756a71b58268867e35ebfae3a3e8ded1997df8e1dc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 8491639107630334126
age: 53024
x-content-type-options: nosniff
expires: Tue, 17 Feb 2026 10:47:55 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Mon, 17 Feb 2025 10:47:55 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 163745
x-xss-protection: 0
server: cafe

GET
H2 200 skeleton.gif
static.adsafeprotected.com/ 43 B
483 B 244ms
47ms Image
image/gif 2600:9000:28a9:aa00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://static.adsafeprotected.com/skeleton.gif?ab=1&zoneid=6724608_advertisement_
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:28a9:aa00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: "45cf913e5d9d3c9b2058033056d3dd23"
x-amz-version-id: iiN8XkcmZQdDIQeKkzAiegPwcD.5WPja
age: 425152
x-cache: Hit from cloudfront
x-amz-cf-id: ZnhPVb_rg9CQLklotxVqI-fMAXNciUZWtB6dWC3Gzy4IgoH5GXQ-LQ==
date: Thu, 13 Feb 2025 03:25:49 GMT
content-type: image/gif
last-modified: Mon, 17 Aug 2020 23:55:15 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 04eae9f89d461f79682103da6d0e3f4e.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 43
x-amz-cf-pop: IAD89-P3
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H3 200 gpt
securepubads.g.doubleclick.net/pagead/managed/dict/m202502130101/ 64 KB
23 KB 83ms
81ms Other
text/plain 2607:f8b0:4004:c1f::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/dict/m202502130101/gpt

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1f::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7f4442b7df3166c285f18feed5c1d9bd46f15c41c0a7d899c171d5fc7343ceda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 8655983866465860880
age: 50016
x-content-type-options: nosniff
expires: Tue, 18 Feb 2025 11:38:03 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Mon, 17 Feb 2025 11:38:03 GMT
content-type: text/plain; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=86400, stale-while-revalidate=7200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 23671
x-xss-protection: 0
server: cafe
use-as-dictionary: match="/gampad/ads", id="m202502130101"

GET
H2 200 154013155 Show response
fundingchoicesmessages.google.com/i/ 192 KB
63 KB 237ms
134ms Script
application/javascript 2607:f8b0:4004:c09::65
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/154013155?ers=3

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202502110101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::65 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c82318b99ef5f1f85ce32356419fe868b7aa95cd8a144a26395449bb2c56d4a9

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-L_zuz2tL7jO2twzq_G1ZWA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 18 Feb 2025 01:31:40 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjStDikmLw1ZBiOHnrNtNFIG69eY51OhAbrT3P6gLEhgqXWJ2B-P66S6zPgfhD_WXWH0BcJHGFtQWIGb5eYeUA4pMuV1kvAvFlIL4NxFW_rrI2AbEQN8efo-f3sgl8eH8zTUkjKb8wPjk_r6QoM6m0JL8oLTkttTi1qCy1KN7IwMjUwMjQWM_ALL7AAABg-0Hc"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-L_zuz2tL7jO2twzq_G1ZWA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 videoCard.5ed8eb34c11835040def.js Show response
cdn.intergient.com/pageos/2.2.9/ 559 B
752 B 117ms
117ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/2.2.9/videoCard.5ed8eb34c11835040def.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/2.2.9/runtime.faf6509395f8efe38a8c.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 795041923e6338abe450ff9524ef70fd40432f278f32c9c35cdbb08239574fb1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"6880c1609e3243c11c7b4f1285e14d89"
age: 461806
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-amz-cf-id: vtA3k7xercyYT8cC-gTvqQUu0aOH6CrKpn4pPTEdEXACE1gAgv8szg==
date: Tue, 18 Feb 2025 01:31:40 GMT
content-type: text/javascript
last-modified: Wed, 12 Feb 2025 15:59:26 GMT
vary: Accept-Encoding
priority: u=3,i=?0
server-timing: cfExtPri
hw-country-code: US
cache-control: public, max-age=31536000
via: 1.1 23d9e67c276b83ea51d0d51c40d0b45e.cloudfront.net (CloudFront)
cf-ray: 913a4247c93bf5f4-EWR
x-amz-cf-pop: IAD61-P8
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H3 200 iframe.html
cdn.intergient.com/pageos/2.2.9/iframe/ Frame 5CB5 0
0 133ms
47ms Document
text/html 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/2.2.9/iframe/iframe.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/2.2.9/main.884d984457b5c04043a0.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36

Response headers

age: 464449
alt-svc: h3=":443"; ma=86400
cache-control: public, max-age=31536000
cf-cache-status: HIT
cf-ray: 913a42488bb08c63-EWR
content-encoding: br
content-type: text/html
date: Tue, 18 Feb 2025 01:31:40 GMT
hw-country-code: US
last-modified: Wed, 12 Feb 2025 15:59:26 GMT
priority: u=0,i
server: cloudflare
server-timing: cfExtPri
vary: Accept-Encoding
via: 1.1 03f9276da92da80a3b0608d865e60264.cloudfront.net (CloudFront)
x-amz-cf-id: bTjmPjQ8UTqHwgUgDyS8k_JLohvBIr5fmztx7HLadQ02RJ8v10-1wA==
x-amz-cf-pop: MIA3-P5
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront

GET
H3 200 iframe.html
cdn.intergient.com/pageos/2.2.9/iframe/ Frame 183E 0
0 131ms
131ms Document
text/html 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/2.2.9/iframe/iframe.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/2.2.9/main.884d984457b5c04043a0.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36

Response headers

age: 464449
alt-svc: h3=":443"; ma=86400
cache-control: public, max-age=31536000
cf-cache-status: HIT
cf-ray: 913a42488bb08c63-EWR
content-encoding: br
content-type: text/html
date: Tue, 18 Feb 2025 01:31:40 GMT
hw-country-code: US
last-modified: Wed, 12 Feb 2025 15:59:26 GMT
priority: u=0,i
server: cloudflare
server-timing: cfExtPri
vary: Accept-Encoding
via: 1.1 03f9276da92da80a3b0608d865e60264.cloudfront.net (CloudFront)
x-amz-cf-id: bTjmPjQ8UTqHwgUgDyS8k_JLohvBIr5fmztx7HLadQ02RJ8v10-1wA==
x-amz-cf-pop: MIA3-P5
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront

GET
H2 200 USA Show response
impression-inferences-edge-prod.playwire.com/websites/74068/v1/Mon/20/desktop/Chrome/ 583 B
920 B 235ms
86ms XHR
application/json 2600:9000:20aa:2e00:b:99e7:bb00:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://impression-inferences-edge-prod.playwire.com/websites/74068/v1/Mon/20/desktop/Chrome/USA
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/2.2.9/main.884d984457b5c04043a0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20aa:2e00:b:99e7:bb00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 0e6edcd5ae231e5f6c248379c0deef0e78d92c1080160bc5834de25039b60083

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=3600, public, must-revalidate
access-control-expose-headers: *
age: 1795
via: 1.1 ca8d1424de70ce439236d37048e65f54.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Hit from cloudfront
content-length: 583
x-amz-cf-id: 15uiTKAiqXrFrKpZMJC0pGKCqhAjvMHRA-zu-Il9XmChH1JgszQzEA==
date: Tue, 18 Feb 2025 01:01:45 GMT
content-type: application/json
x-amz-cf-pop: IAD89-C2
server: CloudFront

GET
H2 200 tag Show response
btloader.com/ 117 KB
32 KB 155ms
40ms Script
application/javascript 2606:4700:10::6816:4ad8
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/2.2.9/main.884d984457b5c04043a0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:4ad8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fe0f273f032b6760d7d04a5bab664f7fb0558215e5bdb6400b8d453547410de8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-robots-tag: noindex, nofollow
cache-control: public, max-age=300, must-revalidate, stale-if-error=3600, stale-while-revalidate=300
content-encoding: gzip
cf-cache-status: HIT
etag: "86ecd074da602dff42838c5368cca252"
age: 819
via: 1.1 google
cf-ray: 913a4248ca2d8c0c-EWR
accept-ranges: bytes
content-length: 32925
date: Tue, 18 Feb 2025 01:31:40 GMT
content-type: application/javascript
last-modified: Tue, 18 Feb 2025 01:17:59 GMT
vary: Origin, Accept-Encoding
server: cloudflare

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 371 KB
90 KB 256ms
69ms Script
application/javascript 3.171.86.171
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/2.2.9/main.884d984457b5c04043a0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.171.86.171 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-171-86-171.iad89.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 18b0908dea2280eb8758b7ce747dc97fd62b7a3eccc1510952569c76eecd1865

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: max-age=3600
content-encoding: gzip
etag: W/"46a2d8f444a52e826348e498ef3c21da"
age: 44
via: 1.1 e84404231b384141b3b0f51e40964ef6.cloudfront.net (CloudFront), 1.1 da2853f1f2064d28227e87fa7e317dec.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: XasIo5e-dTczW_HMICPY5W1VRXwNlZgNayr-xlXUywh4Xub-5tY-Uw==
date: Tue, 18 Feb 2025 01:30:57 GMT
content-type: application/javascript
last-modified: Wed, 05 Feb 2025 19:34:29 GMT
server: AmazonS3
x-amz-cf-pop: IAD55-P7, IAD89-P3
x-amz-server-side-encryption: AES256

GET
H2 200 1x1.gif
raw.githubusercontent.com/easylist/easylist/master/docs/ 43 B
592 B 175ms
55ms Image
image/gif 2606:50c0:8003::154
FASTLY

General

Check archive.org

Download Go to Show image

Full URL

https://raw.githubusercontent.com/easylist/easylist/master/docs/1x1.gif

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:50c0:8003::154 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; style-src 'unsafe-inline'; sandbox
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-fastly-request-id: da9095f3f719fa7553ae00248b0661d8cd5f4a9b
etag: W/"0c4a5773f7e435c57c40bd270aef756513eba26bd7ba5317b5bd765569a7325d"
x-content-type-options: nosniff
x-github-request-id: 10F3:32278E:BB2A95:CECD4A:67ABA308
expires: Tue, 18 Feb 2025 01:36:40 GMT
x-cache: HIT
date: Tue, 18 Feb 2025 01:31:40 GMT
content-type: image/gif
x-served-by: cache-ewr-kewr1740060-EWR
x-cache-hits: 32
source-age: 181
x-frame-options: deny
strict-transport-security: max-age=31536000
vary: Authorization,Accept-Encoding,Origin
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
cache-control: max-age=300
x-timer: S1739842300.303664,VS0,VE0
cross-origin-resource-policy: cross-origin
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
content-length: 43
x-xss-protection: 1; mode=block

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/17138/ 43 KB
13 KB 268ms
81ms Script
text/javascript 3.167.69.97
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/17138/sync.min.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/2.2.9/main.884d984457b5c04043a0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.167.69.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-167-69-97.iad61.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a1b70ca670ab8ac2ebf163fbedfd4d65b1a8e33c9277dee78468072d25aa605f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"7ac6dd54487d8f654726122eb9bd814d"
age: 61671
via: 1.1 8a67f3a2625586218c453e7ce85c3ef2.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: ReCi5BrXhB8qusjqJPDQY55zKl01mz-CiR3_V3tjUgBWtfeqBwv3fw==
date: Mon, 17 Feb 2025 08:23:50 GMT
content-type: text/javascript
last-modified: Tue, 20 Aug 2024 18:56:33 GMT
server: AmazonS3
x-amz-cf-pop: IAD61-P6
x-amz-server-side-encryption: AES256

GET
H2 200 AGSKWxWdLFmIGKctYqEdnUm0RJvjTP1a4_bfDdYnzHXcfXHk19Kdd18yzs2DKT4Kp2gtA4Pw15qNdFT0xTof86kcvRJL3qF7Xx6Mpvhl9pp00M4aH5uOrFfyGXyGvMZ6eTbZShkIOpbG6A== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 74ms
72ms Script
application/javascript 2607:f8b0:4004:c09::65
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxWdLFmIGKctYqEdnUm0RJvjTP1a4_bfDdYnzHXcfXHk19Kdd18yzs2DKT4Kp2gtA4Pw15qNdFT0xTof86kcvRJL3qF7Xx6Mpvhl9pp00M4aH5uOrFfyGXyGvMZ6eTbZShkIOpbG6A==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzM5ODQyMzAwLDM3NzAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzddXSwiaHR0cHM6Ly9wYWludC50b3lzL29pbC8iLG51bGwsW1s4LCJsLTczTUdzcnhUTSJdLFs5LCJlbi1VUyJdLFsyMCwiW251bGwsbnVsbCxbMzEwODIyNTNdLG51bGwsMTFdIl0sWzI2LCIxMSJdLFsxOSwiMiJdLFsxNywiWzBdIl0sWzI0LCJkcXh3cy50b21iZXJ0LmNvbSJdLFsyNSwiW1szMTA4MjI1M11dIl1dXQ

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.l-73MGsrxTM.es5.O/d=1/rs=AJlcJMxV77t-pDuoVx9092HFi-doieeJ1Q/m=kernel_loader,loader_js_executable

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::65 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e1ed14670204b2835c5a0726d8b1f2a6eb9e1aaec81009d0478e74b42a3f6b2c

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-naXX842HE_-6-YppxnO7aw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 18 Feb 2025 01:31:40 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjitDikmII0pBiaL15jnU6EButPc_qAsSGCpdYnYH4_rpLrM-B-EP9ZdYfQFwkcYW1BYgZvl5h5QDiky5XWS8C8WUgvg3EVb-usjYBsRAPx5-j5_eyCVyY3X-KUUkjKb8wPjk_r6QoM6m0JL8oLTkttTi1qCy1KN7IwMjUwMjQWM_ALL7AAACysDx5"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-naXX842HE_-6-YppxnO7aw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 topics_frame.html
securepubads.g.doubleclick.net/static/topics/ Frame 62B7 0
0 166ms
32ms Document
text/html 2607:f8b0:4004:c1b::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/static/topics/topics_frame.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202502110101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 1488
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000, stale-while-revalidate=3600
content-encoding: br
content-length: 29061
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 18 Feb 2025 01:06:52 GMT
expires: Tue, 18 Feb 2025 01:56:52 GMT
last-modified: Mon, 10 Feb 2025 20:42:44 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 esp.js Show response
oa.openxcdn.net/ 24 KB
8 KB 178ms
36ms Script
application/javascript 34.102.146.192
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://oa.openxcdn.net/esp.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202502110101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.146.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 192.146.102.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 1
content-encoding: gzip
x-goog-hash: crc32c=f21hYg==, md5=31VCuIvA42jGmZdUpbniug==
etag: "df5542b88bc0e368c6999754a5b9e2ba"
age: 2411403
x-goog-stored-content-encoding: gzip
expires: Wed, 21 Jan 2026 03:41:37 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 7927
date: Tue, 21 Jan 2025 03:41:37 GMT
last-modified: Thu, 27 May 2021 18:30:51 GMT
content-type: application/javascript
x-guploader-uploadid: AFIdbgTR5jhE9vJbJRIlBFMfAjNQ2a9A9tfsg36E7h-AHEnnaoegHjoiXG7uTXqrO2swdCdJKOGIcrE
cache-control: no-transform
x-goog-storage-class: MULTI_REGIONAL
accept-ranges: bytes
x-goog-generation: 1622140251693895
content-length: 7927
server: UploadServer

GET
H2 200 ob.js Show response
cdn-ima.33across.com/ 17 KB
7 KB 190ms
46ms Script
application/javascript 104.18.29.101
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn-ima.33across.com/ob.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202502110101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.29.101 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 72223c20f8ad08445b32a2b4843a0f04fe33cee40811ade04b21598cf67fbea3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: public, max-age=259200
content-encoding: gzip
cf-cache-status: HIT
etag: W/"678fc4ec-4599"
age: 314942
cf-ray: 913a424a7e5bde9b-EWR
expires: Fri, 21 Feb 2025 01:31:40 GMT
date: Tue, 18 Feb 2025 01:31:40 GMT
content-type: application/javascript
last-modified: Tue, 21 Jan 2025 16:01:48 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 encrypted-tag-g.js Show response
invstatic101.creativecdn.com/encrypted-signals/ 3 KB
3 KB 481ms
351ms Script
text/javascript 34.96.70.87
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202502110101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.70.87 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 87.70.96.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 2e5f5cb912c0619933ea6c3ad8ac1466a005f792e3338d96a8432d144c63520f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: 861bdaf24bda5c0db45c6ebe1c94a9eb
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2729
date: Tue, 18 Feb 2025 01:31:40 GMT
content-type: text/javascript; charset=utf-8
last-modified: Wed, 05 Feb 2025 14:45:21 GMT
server: Google Frontend
x-cloud-trace-context: ed513b07787a9ae4254f33a76b7a6151

GET
H2 200 publishertag.ids.js Show response
static.criteo.net/js/ld/ 42 KB
13 KB 218ms
45ms Script
text/javascript 2620:100:a00b::30
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.ids.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202502110101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::30 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

1635d2075d3343c86490d2229c1fb868ad59d92958ef65e04cb65767c703e9f6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: max-age=86400, public
timing-allow-origin: *
content-encoding: gzip
etag: W/"670e3454-a69c"
cross-origin-resource-policy: cross-origin
expires: Wed, 19 Feb 2025 01:31:40 GMT
access-control-allow-origin: *
date: Tue, 18 Feb 2025 01:31:40 GMT
content-type: text/javascript
last-modified: Tue, 15 Oct 2024 09:22:28 GMT
server: nginx

GET px.gif
ag.dns-finder.com/ 0
0

GET
H2 200 px.gif
ad-delivery.net/ 43 B
488 B 253ms
107ms Image
image/gif 2606:4700:20::ac43:4513
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=2
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4513 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 1771789
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=McXeAzyySUVP0TgPLGR5L5Njdl4O2oCgdMLCvB6XKVNLrhCBWwAjqtItZaieDMBwoq6CMR6Ot9tp5kCrHRt%2F080R5nkbP%2F3AvT68ThxayoGAiJ7r%2BfYkBG9UkxRP6fAmFyphltmBecGrVvQtfg%3D%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-encoding: identity
expires: Wed, 19 Feb 2025 01:31:40 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=8820&min_rtt=8736&rtt_var=2546&sent=8&recv=7&lost=0&retrans=0&sent_bytes=5421&recv_bytes=2287&delivery_rate=467032&cwnd=254&unsent_bytes=0&cid=c3be8dd9d85b7b1a&ts=64&x=0"
x-goog-stored-content-length: 43
date: Tue, 18 Feb 2025 01:31:40 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
vary: Accept-Encoding
x-guploader-uploadid: AFiumC5fOJmsht-QUre3wTwSlpLECbF36YFX9cY3okH60E02b16ZjFNHcF2PNgy9AQVGQN1U
cache-control: public, max-age=86400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 913a424a8b3f4286-EWR
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico
ad.doubleclick.net/ 1 KB
130 B 166ms
32ms Image
image/x-icon 142.251.111.148
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.148 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f148.1e100.net

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
age: 61011
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Tue, 18 Feb 2025 08:34:49 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 17 Feb 2025 08:34:49 GMT
last-modified: Tue, 08 May 2012 13:08:06 GMT
content-type: image/x-icon
vary: Accept-Encoding
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 px.gif
ad-delivery.net/ 43 B
1013 B 195ms
50ms Image
image/gif 2606:4700:20::ac43:4513
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.321709209669355
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4513 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 1771789
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WYQF3GU5Xxey09xKJXURlArzw9i1%2F3F3ihNCYtVjr%2Ftg7sdCaIMRluNN%2F6z7LWKC%2F0Fa23Rr1E5xj1Z%2FsXC1mB8yP9nB0T0L%2Bb8%2BSbQwQ3xvq0G3Be%2B2vEXECfHBmF2NEZtjwC13%2F2cifbUJZg%3D%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-encoding: identity
expires: Wed, 19 Feb 2025 01:31:40 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=8820&min_rtt=8736&rtt_var=2546&sent=5&recv=7&lost=0&retrans=0&sent_bytes=4342&recv_bytes=2287&delivery_rate=467032&cwnd=254&unsent_bytes=0&cid=c3be8dd9d85b7b1a&ts=59&x=0"
x-goog-stored-content-length: 43
date: Tue, 18 Feb 2025 01:31:40 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
vary: Accept-Encoding
x-guploader-uploadid: AFiumC5fOJmsht-QUre3wTwSlpLECbF36YFX9cY3okH60E02b16ZjFNHcF2PNgy9AQVGQN1U
cache-control: public, max-age=86400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 913a424a8b454286-EWR
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET d64321f7-adbe-4d1c-9ec8-80c5db5bbf40
https://paint.toys/ 0
0

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 197ms
77ms Preflight
application/json 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&cw=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://paint.toys
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Tue, 18 Feb 2025 01:31:39 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 208420
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 config.json Show response
config.playwire.com/audience_segments/ 330 KB
57 KB 216ms
72ms XHR
application/json 2606:4700::6812:acf
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://config.playwire.com/audience_segments/config.json
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/2.2.9/main.884d984457b5c04043a0.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5f5df321abfe53ef53ee1a9330e47ce6809751a3df65d716c99d8318a901cc74

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-max-age: 7200
access-control-expose-headers: hw-country-code
content-encoding: gzip
cf-cache-status: HIT
age: 542
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1739805744&sid=e11707d5-02a7-43ef-b45e-2cf4d2036f7d&s=Rcxn5cJySFZse4zy51hBKPNwyWuuQoxMHI9Dc4BjtY8%3D"}]}
access-control-allow-methods: GET
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: T6G9xGei19JV36b-Gqafp60La8hbKoMjMTbRqRE3roOx4vZNce4mDw==
date: Tue, 18 Feb 2025 01:31:40 GMT
last-modified: Tue, 18 Feb 2025 01:22:38 GMT
content-type: application/json
vary: Accept-Encoding
priority: u=1,i
server-timing: cfExtPri
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1739805744&sid=e11707d5-02a7-43ef-b45e-2cf4d2036f7d&s=Rcxn5cJySFZse4zy51hBKPNwyWuuQoxMHI9Dc4BjtY8%3D
hw-country-code: US
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: public, max-age=600
via: 1.1 vegur, 1.1 8ef35b07fe667674a2922c9d83a75c52.cloudfront.net (CloudFront)
cf-ray: 913a424a7d61425b-EWR
access-control-allow-origin: *
x-amz-cf-pop: JFK50-P3
server: cloudflare

GET
H3 200 474.9e5e7d94b0ad365e11fa.js Show response
cdn.intergient.com/pageos/2.2.9/ 3 KB
2 KB 51ms
50ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/2.2.9/474.9e5e7d94b0ad365e11fa.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/2.2.9/runtime.faf6509395f8efe38a8c.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1f0769b6ec00799d55c116b89a5b71d923e5ea0d9f0d7e1fac3fe1914599e658

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"f32f7966b1a24d5db4c7e8891271dc87"
age: 464448
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-amz-cf-id: eSsowD2E3yAjwzTuNzdyaXa5WG8LK_BMe5jWH7zqwuRD8Bg_A4dpmg==
date: Tue, 18 Feb 2025 01:31:40 GMT
content-type: text/javascript
last-modified: Wed, 12 Feb 2025 15:59:26 GMT
vary: accept-encoding
priority: u=3,i=?0
server-timing: cfExtPri
hw-country-code: US
cache-control: public, max-age=31536000
via: 1.1 a97e58ffc6f61ef3eab965cbc26fc6f0.cloudfront.net (CloudFront)
cf-ray: 913a4249ae0df5f4-EWR
x-amz-cf-pop: JFK52-P8
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 script Show response
carbon-cdn.ccgateway.net/ 26 KB
8 KB 225ms
42ms Script
text/javascript 18.212.140.196
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Requested by: Host: dqxws.tombert.com
URL: https://dqxws.tombert.com/crbywxwzvRaHlzZEZEbXFMMnV6R3poSmVJRWUtMTc2NS0yNjcxNjAxOS0wZmZhMDI3NC0yNDM0LWRLZHBWSmFwbFJZMjhSMG5wU2dI/c1mhpt6x8ah/jpnflt
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.212.140.196 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-212-140-196.compute-1.amazonaws.com
Software: /
Resource Hash: a3f6aabbea0c09dbe7e4d7643fed93d9d415d78bc9cd963cc70fc114d9e5fe26

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=900
content-encoding: gzip
date: Tue, 18 Feb 2025 01:31:40 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 ima3.js Show response
imasdk.googleapis.com/js/sdkloader/ 434 KB
138 KB 235ms
78ms Script
text/javascript 2607:f8b0:4004:c19::5f
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/ima3.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/2.2.9/main.884d984457b5c04043a0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c19::5f Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c9f2a552f5a1d61d114e06bdd0857c04c927473b738cafb2a38e12a8a156de6e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 7888984228249933305
x-content-type-options: nosniff
expires: Tue, 18 Feb 2025 01:31:40 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Tue, 18 Feb 2025 01:31:40 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 140473
x-xss-protection: 0
server: cafe

POST
H2 200 prebid Show response
id5-sync.com/api/config/ 194 B
659 B 801ms
200ms Fetch
application/json 162.19.138.117
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.117 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ec2-52-0-159-96.compute-1.amazonaws.com

Software

Resource Hash

1526f7f540b829baf0e6d1b491aa7b26b5e49fa160abca67c11695ccfa2cee82

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Tue, 18 Feb 2025 01:31:40 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
access-control-allow-credentials: true

GET
H2 200 id Show response
id.crwdcntrl.net/ 152 B
874 B 261ms
103ms Fetch
application/json 3.228.245.238
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://id.crwdcntrl.net/id?c=17262
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.228.245.238 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-228-245-238.compute-1.amazonaws.com
Software: /
Resource Hash: 9c40e8c64c6bafe76458586242d277e00d44f1330b2cb5aca1bfe4ebdebbacb3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 152
date: Tue, 18 Feb 2025 01:31:40 GMT
content-type: application/json;charset=utf-8
x-server: 10.40.54.127

GET
H2 200 f Show response
fid.agkn.com/ 130 B
660 B 237ms
48ms Fetch
application/javascript 34.197.17.91
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://fid.agkn.com/f?apiKey=2104320612&r=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.197.17.91 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-197-17-91.compute-1.amazonaws.com
Software: AAWebServer /
Resource Hash: cf36cd032f3c6f48b2490a8c0ab0b563484978f8d5e14a82b19a398907cb128e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 130
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
date: Tue, 18 Feb 2025 01:31:40 GMT
content-type: application/javascript;charset=iso-8859-1
vary: Origin
server: AAWebServer
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type

GET
H2 200 envelope Show response
lexicon.33across.com/v1/ 2 KB
2 KB 204ms
51ms Fetch
application/json 35.244.193.51
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0014000001YrMoYAAV&gdpr=0&src=pbjs&ver=9.11.0&coppa=0
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.193.51 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 51.193.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 7dabc4559be4a9ccd56abf97d66dfb1d5672103e400e86b08dd28b20b82cd978

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1552
date: Tue, 18 Feb 2025 01:31:40 GMT
content-type: application/json
vary: origin

GET
H2 204 any Show response
idx.liadm.com/idex/did-0046/ 0
366 B 200ms
75ms Fetch 52.0.159.96
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://idx.liadm.com/idex/did-0046/any?duid=8e413bd09c43--01jmbaxag6mym44v4bckr9wmav&did=did-0046&cd=.paint.toys&pu=https%3A%2F%2Fpaint.toys&resolve=nonId&resolve=uid2&resolve=index&resolve=bidswitch&resolve=pubmatic&resolve=magnite&resolve=openx&resolve=sorvrn&resolve=thetradedesk&resolve=medianet

Requested by

Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.0.159.96 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: max-age=3599, private
trace-id: 032c09ba80abb45c
request-time: 2
access-control-allow-credentials: true
expires: Tue, 18 Feb 2025 02:31:40 GMT
access-control-allow-origin: https://paint.toys
date: Tue, 18 Feb 2025 01:31:40 GMT
vary: Origin

GET
H2

200

sid Show response
mug.criteo.com/
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&cw=1&lsw=1
https://mug.criteo.com/sid?cpp=kWiSI3xlMXVDSlBZOWtDRmxKTjU0U3BiMUhmc0prczNGSjdDNmwxY3FwdnhROWF3T3YwMWFLQnp3WjdXSHRrWllDMzNXWFl0UjFRZzUvMGxuYkRhc1dQUHdaZHh6SUFlUkNhcnJGRmtGc1VMRkFHdkFyU1NrdWZIVGY2WD...

357 B
923 B

154ms
53ms

Fetch
application/json

74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://mug.criteo.com/sid?cpp=kWiSI3xlMXVDSlBZOWtDRmxKTjU0U3BiMUhmc0prczNGSjdDNmwxY3FwdnhROWF3T3YwMWFLQnp3WjdXSHRrWllDMzNXWFl0UjFRZzUvMGxuYkRhc1dQUHdaZHh6SUFlUkNhcnJGRmtGc1VMRkFHdkFyU1NrdWZIVGY2WDVhZ2FUM0dXSElTZ080RWQwMEJoQTNWY1pYaWM4Wmx2aHpQRUVIaC9Ddlc5ZmkvR1I2RkgyU0k5MEFLOVpSTkFlRmdtQmNFVUVmV3lEaThReU5kT1hld0tGamlQMmFkbmkyTUZycm1wTU9ZS3RJOVBiclJtVm0wNWE0ejdxWVF4dUp0LytHc001fA&cppv=2

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

f2af8cee6e3872edd1da5b646ac7463f9fd160e058016ee0ad4e9e43f36b9416

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 553183
expires: 0
access-control-allow-origin: null
date: Tue, 18 Feb 2025 01:31:40 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

Redirect headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
location: https://mug.criteo.com/sid?cpp=kWiSI3xlMXVDSlBZOWtDRmxKTjU0U3BiMUhmc0prczNGSjdDNmwxY3FwdnhROWF3T3YwMWFLQnp3WjdXSHRrWllDMzNXWFl0UjFRZzUvMGxuYkRhc1dQUHdaZHh6SUFlUkNhcnJGRmtGc1VMRkFHdkFyU1NrdWZIVGY2WDVhZ2FUM0dXSElTZ080RWQwMEJoQTNWY1pYaWM4Wmx2aHpQRUVIaC9Ddlc5ZmkvR1I2RkgyU0k5MEFLOVpSTkFlRmdtQmNFVUVmV3lEaThReU5kT1hld0tGamlQMmFkbmkyTUZycm1wTU9ZS3RJOVBiclJtVm0wNWE0ejdxWVF4dUp0LytHc001fA&cppv=2
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 373788
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 0
date: Tue, 18 Feb 2025 01:31:39 GMT
server: Kestrel

GET
H2

200

db_sync
px.ads.linkedin.com/
Redirect Chain

https://idsync.rlcdn.com/712453.gif?partner_uid=user_53984582-6467-459e-adad-e77a796c8a3f_1739842300386
https://idsync.rlcdn.com/1000.gif?memo=CIW-KxJDCj8IARDptAoaN3VzZXJfNTM5ODQ1ODItNjQ2Ny00NTllLWFkYWQtZTc3YTc5NmM4YTNmXzE3Mzk4NDIzMDAzODYQABoNCPzFz70GEgUI6AcQAEIASgA
https://pippio.com/api/sync?pid=5324&it=1&iv=367d988683e6d48224d4ebb0905c695b648d2cedc71771ddb4b8421a90b1b4d9791426b5417dce21&_=2
https://px.ads.linkedin.com/db_sync?pid=10339&puuid=367d988683e6d48224d4ebb0905c695b648d2cedc71771ddb4b8421a90b1b4d9791426b5417dce21&rand=05203126
https://px.ads.linkedin.com/db_sync?pid=10339&puuid=367d988683e6d48224d4ebb0905c695b648d2cedc71771ddb4b8421a90b1b4d9791426b5417dce21&rand=05203126&expected_cookie=b89aaba1-03d8-4aa1-b9d7-077cf1886820

0
143 B

90ms
89ms

Image
text/plain

2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://px.ads.linkedin.com/db_sync?pid=10339&puuid=367d988683e6d48224d4ebb0905c695b648d2cedc71771ddb4b8421a90b1b4d9791426b5417dce21&rand=05203126&expected_cookie=b89aaba1-03d8-4aa1-b9d7-077cf1886820
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: AA9AA313B3794574B8576896D7313283 Ref B: PHL30EDGE0121 Ref C: 2025-02-18T01:31:41Z
x-li-fabric: prod-ltx1
x-li-uuid: AAYuYJpXNfLcVyKUV8Nh7g==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Tue, 18 Feb 2025 01:31:40 GMT

Redirect headers

linkedin-action: 1
x-li-pop: afd-prod-ltx1-x
location: /db_sync?pid=10339&puuid=367d988683e6d48224d4ebb0905c695b648d2cedc71771ddb4b8421a90b1b4d9791426b5417dce21&rand=05203126&expected_cookie=b89aaba1-03d8-4aa1-b9d7-077cf1886820
x-msedge-ref: Ref A: 2AD9BD99544A42ED9E67480D43F0CBA7 Ref B: PHL30EDGE0121 Ref C: 2025-02-18T01:31:41Z
x-li-fabric: prod-ltx1
x-li-uuid: AAYuYJpVzDT/PTVe0LUg7A==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Tue, 18 Feb 2025 01:31:40 GMT

GET
H/1.1

200
OK

/ Show response
ps.eyeota.net/pixel/bounce/
Redirect Chain

https://ps.eyeota.net/pixel?pid=m51mh00&t=ajs&uid=user_53984582-6467-459e-adad-e77a796c8a3f_1739842300386
https://ps.eyeota.net/pixel/bounce/?pid=m51mh00&t=ajs&uid=user_53984582-6467-459e-adad-e77a796c8a3f_1739842300386

1 KB
2 KB

32ms
31ms

Script
application/javascript

18.214.54.215
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://ps.eyeota.net/pixel/bounce/?pid=m51mh00&t=ajs&uid=user_53984582-6467-459e-adad-e77a796c8a3f_1739842300386
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 18.214.54.215 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-214-54-215.compute-1.amazonaws.com
Software: /
Resource Hash: 98956488b597d435e9c58e2e4d9564bef532d8ceacf72a11fbc1cbe1181c09b7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 1247
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Tue, 18 Feb 2025 01:31:41 GMT
Content-Type: application/javascript

Redirect headers

Location: /pixel/bounce/?pid=m51mh00&t=ajs&uid=user_53984582-6467-459e-adad-e77a796c8a3f_1739842300386
Content-Length: 0
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Tue, 18 Feb 2025 01:31:41 GMT

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 115 B
543 B 213ms
92ms XHR
application/json 34.236.2.33
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/17138/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.236.2.33 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-236-2-33.compute-1.amazonaws.com
Software: /
Resource Hash: d5f0854256e1aad15d5f74f094c79e676b24a719cb6791044314737fd28faac9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 115
date: Tue, 18 Feb 2025 01:31:40 GMT
content-type: application/json;charset=utf-8
x-server: 10.40.58.242

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 215ms
65ms XHR
application/javascript 3.171.86.171
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.171.86.171 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-171-86-171.iad89.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-max-age: 3000
content-encoding: gzip
x-amz-version-id: r5.lR.LJ66XEXzxUUVo7iMemjL_F_GoE
etag: W/"a4d296427fc806b21335359e398c025c"
age: 76337
access-control-allow-methods: GET
x-cache: Hit from cloudfront
x-amz-cf-id: M-TdZqlP3klrh-1LY6HAuhrkwZKPTdqnyhywijfU1UjNnmKApEyClg==
date: Mon, 17 Feb 2025 04:19:24 GMT
content-type: application/javascript
vary: Origin,accept-encoding
last-modified: Thu, 29 Feb 2024 02:13:08 GMT
cache-control: public, max-age=86400
via: 1.1 7f7d9243d958ecc0cb433b766a106f4c.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: IAD89-P3
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 bd056b42-51db-43ce-9a8e-3b11319b5d1f Show response
config.aps.amazon-adsystem.com/configs/ 563 B
830 B 579ms
124ms Script
application/javascript 18.160.10.20
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://config.aps.amazon-adsystem.com/configs/bd056b42-51db-43ce-9a8e-3b11319b5d1f
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.160.10.20 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-160-10-20.iad12.r.cloudfront.net
Software: CloudFront /
Resource Hash: 5f61913ef2f4b2742638b1f485e0177ef0d6673fecade0ff8b6dadc907dbd7c0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=3600
age: 1223
via: 1.1 3c43e000c50d5633eb558057710f3c54.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
content-length: 563
x-amz-cf-id: PZ12UrVemvVFv5N1f3XCr5ClcNf6UX7MVZXHNST3IopuNnQomAco2w==
date: Tue, 18 Feb 2025 01:11:18 GMT
content-type: application/javascript
x-amz-cf-pop: IAD12-P3
server: CloudFront

GET
H2 200 config Show response
c.amazon-adsystem.com/cdn/prod/ 3 KB
4 KB 48ms
48ms XHR
application/json 3.171.86.171
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fpaint.toys&pubid=bd056b42-51db-43ce-9a8e-3b11319b5d1f
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.171.86.171 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-171-86-171.iad89.r.cloudfront.net
Software: Server /
Resource Hash: 57234c0361bef55cff0569a18aa6d5be13af21f714f8eea3d56e4a35badf0ff0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=21550, s-maxage=21600
age: 5011
access-control-allow-credentials: true
via: 1.1 da2853f1f2064d28227e87fa7e317dec.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Hit from cloudfront
content-length: 3516
x-amz-cf-id: cSAG8PxBDWntEOXtVXJ5shTEXMrDGVcOX4RJ_ZPXWXY8txePPGk6Fw==
date: Tue, 18 Feb 2025 00:08:09 GMT
content-type: application/json;charset=UTF-8
x-amz-cf-pop: IAD89-P3
server: Server

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 273 B
553 B 878ms
405ms XHR
text/javascript 18.160.23.83
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fpaint.toys%2Foil%2F&pr=https%3A%2F%2Fdqxws.tombert.com%2F&pid=USzGBPYw8oWbz&cb=0&ws=1600x1200&v=25.205.027&t=2500&slots=%5B%7B%22sd%22%3A%22pw-160x600_atf%22%2C%22s%22%3A%5B%22160x600%22%2C%22120x600%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600%22%7D%2C%7B%22sd%22%3A%22pw-160x600_btf%22%2C%22s%22%3A%5B%22160x600%22%2C%22120x600%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600%22%7D%2C%7B%22sd%22%3A%22leaderboard_atf%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%2C%22970x90%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-desktop_leaderboard%22%7D%2C%7B%22sd%22%3A%22leaderboard_btf%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%2C%22970x90%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-desktop_leaderboard%22%7D%5D&pj=%7B%22device%22%3A%7B%22sua%22%3A%7B%22mobile%22%3A0%2C%22source%22%3A1%2C%22platform%22%3A%7B%22brand%22%3A%22%22%7D%2C%22browsers%22%3A%5B%5D%7D%7D%7D&sg=%7B%22ortb2%22%3A%7B%22site%22%3A%7B%22cattax%22%3A6%2C%22cat%22%3A%5B%22693%22%5D%2C%22sectioncat%22%3A%5B%22693%22%5D%2C%22pagecat%22%3A%5B%22693%22%5D%7D%7D%7D&schain=1.0%2C1%21playwire.com%2C1024872%2C1%2C%2C%2C&sm=e7e2aa26-4485-4a6c-8d83-be323b29f094&pubid=bd056b42-51db-43ce-9a8e-3b11319b5d1f&gdpre=0&gdprl=%7B%22status%22%3A%22tcfv2-success%22%7D
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.160.23.83 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-160-23-83.iad12.r.cloudfront.net
Software: Server /
Resource Hash: 49133c56b765d1c54557e4684a638b5c86c730b3c5bd0c17d8066df5952782c0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
access-control-allow-credentials: true
via: 1.1 f7712655aa6587fbf06c55b40ebb2680.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Miss from cloudfront
content-length: 224
x-amz-cf-id: 09cF1Wzncv52BBDb0Gkn8dWBg6r6CFI6LFiBIsoP47xOpn4PvwCoDA==
date: Tue, 18 Feb 2025 01:31:40 GMT
content-type: text/javascript;charset=UTF-8
x-amz-cf-pop: IAD12-P4
server: Server

GET
H3 200 AGSKWxXZr2oODqJkqenfKqUHJTM12HmKyQxx6Z6hQX-Bo67NG1Tv6FN4IfpppwlftKdMe463MwamWdza7lnkY1GRllI0WcpsDRvjbUiv0h9Onw1hx6kJlG8e8gclXmre9k0G0-scPEhZsQ== Show response
fundingchoicesmessages.google.com/f/ 10 KB
4 KB 72ms
72ms Script
application/javascript 2607:f8b0:4004:c09::65
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxXZr2oODqJkqenfKqUHJTM12HmKyQxx6Z6hQX-Bo67NG1Tv6FN4IfpppwlftKdMe463MwamWdza7lnkY1GRllI0WcpsDRvjbUiv0h9Onw1hx6kJlG8e8gclXmre9k0G0-scPEhZsQ==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzM5ODQyMzAwLDUyMzAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOV0sbnVsbCwyLG51bGwsImVuIl0sImh0dHBzOi8vcGFpbnQudG95cy9vaWwvIixudWxsLFtbOCwibC03M01Hc3J4VE0iXSxbOSwiZW4tVVMiXSxbMjAsIltudWxsLG51bGwsWzMxMDgyMjUzXSxudWxsLDExXSJdLFsyNiwiMTEiXSxbMTksIjIiXSxbMTcsIlswXSJdLFsyNCwiZHF4d3MudG9tYmVydC5jb20iXSxbMjUsIltbMzEwODIyNTNdXSJdXV0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::65 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

690d399560a31239f90c55a2be2687695e016f7f61e6a687e85d66d512025387

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-4yI28zbyIzFH1hVrjUSFIA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 18 Feb 2025 01:31:40 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjitDikmJw0ZBiaL15jnU6EButPc_qAsSGCpdYnYH4_rpLrM-B-EP9ZdYfQFwkcYW1BYgZvl5h5QDiky5XWS8C8WUgvg3EVb-usjYBsRAPx5-j5_eyCVxYcH8Ck5JGUn5hfHJ-XklRZlJpSX5RWnJaanFqUVlqUbyRgZGpgZGhsZ6BWXyBAQCwMTyH"
content-security-policy: script-src 'report-sample' 'nonce-4yI28zbyIzFH1hVrjUSFIA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H2 200 pubcid.min.js Show response
secure.cdn.fastclick.net/js/pubcid/latest/ 54 KB
17 KB 558ms
117ms Script
application/javascript 23.201.174.84
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/pubcid/latest/pubcid.min.js
Requested by: Host: dqxws.tombert.com
URL: https://dqxws.tombert.com/crbywxwzvRaHlzZEZEbXFMMnV6R3poSmVJRWUtMTc2NS0yNjcxNjAxOS0wZmZhMDI3NC0yNDM0LWRLZHBWSmFwbFJZMjhSMG5wU2dI/c1mhpt6x8ah/jpnflt
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.201.174.84 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-201-174-84.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 43f804d38a294c6df1ce8ee64fb95ad0ff5a8d6d5685d9537df02212668a1dff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "d734-5f2f3919e751f-gzip"
expires: Tue, 18 Feb 2025 01:46:41 GMT
accept-ranges: bytes
content-length: 17407
date: Tue, 18 Feb 2025 01:31:41 GMT
last-modified: Mon, 23 Jan 2023 19:40:17 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16576/ 43 KB
13 KB 45ms
43ms Script
text/javascript 3.167.69.97
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Requested by: Host: dqxws.tombert.com
URL: https://dqxws.tombert.com/crbywxwzvRaHlzZEZEbXFMMnV6R3poSmVJRWUtMTc2NS0yNjcxNjAxOS0wZmZhMDI3NC0yNDM0LWRLZHBWSmFwbFJZMjhSMG5wU2dI/c1mhpt6x8ah/jpnflt
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.167.69.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-167-69-97.iad61.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5fd7fc4b8be9c2eeb3efb728f0483d444e4a8db80f0597e4ef7950105638bb08

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"ad78eaf46246cac6849005eb8b50ae6f"
age: 63571
via: 1.1 8a67f3a2625586218c453e7ce85c3ef2.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: 9WWUMgeygHkC3itqv7KQPGwKXfXfwsMtU6QLtRwKIK4VzXvLPdZROA==
date: Mon, 17 Feb 2025 07:52:10 GMT
content-type: text/javascript
last-modified: Tue, 20 Aug 2024 18:47:23 GMT
server: AmazonS3
x-amz-cf-pop: IAD61-P6
x-amz-server-side-encryption: AES256

GET
H2 200 hadron.js Show response
cdn.hadronid.net/ 58 KB
13 KB 471ms
54ms Script
text/javascript 2606:4700:10::6816:35ad
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fdqxws.tombert.com%2F&_it=amazon&partner_id=403
Requested by: Host: dqxws.tombert.com
URL: https://dqxws.tombert.com/crbywxwzvRaHlzZEZEbXFMMnV6R3poSmVJRWUtMTc2NS0yNjcxNjAxOS0wZmZhMDI3NC0yNDM0LWRLZHBWSmFwbFJZMjhSMG5wU2dI/c1mhpt6x8ah/jpnflt
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:35ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e15af0955b2d89d5bead4ccdf6a1cc160b4cf9baf7a48b910a1fe0674b4b2982

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: public, max-age=432000
content-encoding: br
cf-cache-status: HIT
etag: W/"1c0ab6bdb3305714ed591929e19ec06a"
age: 655
x-amz-request-id: FNSQQH8F3WPXSBND
expires: Sun, 23 Feb 2025 01:31:41 GMT
cf-ray: 913a424d9fbd42e7-EWR
date: Tue, 18 Feb 2025 01:31:41 GMT
content-type: text/javascript
last-modified: Mon, 06 Jan 2025 10:42:42 GMT
vary: Accept-Encoding
server: cloudflare
x-amz-id-2: Xjbo2O299n8TbufoennosJGzbtsUJaJZP8mDAIPV3T2UGxH5joesLb0RhTatLmbNEoIrR1Zwrsg=

GET
H2 200 id5-api.js Show response
cdn.id5-sync.com/api/1.0/ 102 KB
30 KB 486ms
102ms Script
text/javascript 2606:4700:10::6816:3456
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/id5-api.js

Requested by

Host: dqxws.tombert.com
URL: https://dqxws.tombert.com/crbywxwzvRaHlzZEZEbXFMMnV6R3poSmVJRWUtMTc2NS0yNjcxNjAxOS0wZmZhMDI3NC0yNDM0LWRLZHBWSmFwbFJZMjhSMG5wU2dI/c1mhpt6x8ah/jpnflt

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:3456 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c3b5f6e0901cff75304548d2b3ad58f4b6fd7ec21c2b09290e815e94700554a3

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"61687d9cdb029df0418aec370fca2d05"
age: 5
expires: Tue, 18 Feb 2025 02:31:41 GMT
date: Tue, 18 Feb 2025 01:31:41 GMT
content-type: text/javascript;charset=utf-8
last-modified: Fri, 07 Feb 2025 10:00:24 GMT
vary: Accept-Encoding
x-amz-id-2: c+jfQFh3DUyXJoqqSIkTCWVyT3VEQoo4y7fOdskLj9jRdBb5OOwjZTHvbXgcsttthQcQjXmsU2Q=
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: public, max-age=3600
x-amz-request-id: 23HAE06M1AP3CK8T
cf-ray: 913a424dad230fa9-EWR
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 launcher-stub.min.js Show response
secure.cdn.fastclick.net/js/cnvr-launcher/latest/ 14 KB
5 KB 519ms
145ms Script
application/javascript 23.201.174.84
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher-stub.min.js
Requested by: Host: dqxws.tombert.com
URL: https://dqxws.tombert.com/crbywxwzvRaHlzZEZEbXFMMnV6R3poSmVJRWUtMTc2NS0yNjcxNjAxOS0wZmZhMDI3NC0yNDM0LWRLZHBWSmFwbFJZMjhSMG5wU2dI/c1mhpt6x8ah/jpnflt
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.201.174.84 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-201-174-84.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: d3c286558922ca8c2c69167698cd61a8280cb03b81bb41d9bd633f80f18c274f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "38c0-5e92054540ea5-gzip"
expires: Tue, 18 Feb 2025 01:46:41 GMT
accept-ranges: bytes
content-length: 5252
date: Tue, 18 Feb 2025 01:31:41 GMT
last-modified: Tue, 20 Sep 2022 18:52:26 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H2 200 topics_frame.html
ads.pubmatic.com/AdServer/js/topics/ Frame 7BBE 0
0 489ms
48ms Document
text/html 23.209.57.17
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/topics/topics_frame.html?bidder=pubmatic
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.209.57.17 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-209-57-17.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=151503
content-encoding: gzip
content-length: 859
content-type: text/html
date: Tue, 18 Feb 2025 01:31:41 GMT
expires: Wed, 19 Feb 2025 19:36:44 GMT
last-modified: Tue, 21 Mar 2023 05:02:13 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 topics_frame.html
pa.openx.net/ Frame 1F4F 0
0 698ms
256ms Document
text/html 34.36.214.49
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://pa.openx.net/topics_frame.html?bidder=openx
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.36.214.49 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 49.214.36.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 3258
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public,max-age=3600
content-length: 1036
content-type: text/html; charset=utf-8
date: Tue, 18 Feb 2025 00:37:23 GMT
etag: "c5379e35e267deacc52e06ed0f5fa81f"
last-modified: Mon, 22 Jan 2024 14:38:43 GMT
server: UploadServer
supports-loading-mode: fenced-frame
vary: Origin
x-allow-fledge: true
x-goog-generation: 1705934323795552
x-goog-hash: crc32c=eLLIGA== md5=xTeeNeJn3qzFLgbtD1+oHw==
x-goog-metageneration: 1
x-goog-storage-class: STANDARD
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 1036
x-guploader-uploadid: AHMx-iFTafixJ1GShCfysbE276LAzDyl_AMnLjaGxYyBf3TIr2JUcyU5ueFEaYLj4vKYBvnpCgLEASo

POST
H3 200 cookie_sync Show response
prebid.intergient.com/ 2 KB
1 KB 537ms
92ms Fetch
application/json 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://prebid.intergient.com/cookie_sync
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f6c62ae79baeea6707f222fc569882f71560b5cf5fa695437e214692a7c0b313

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1739842301&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=opjg1q03mQG5khUJSTQKEv17%2FhYIb561QBoSuWuGt%2F0%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Tue, 18 Feb 2025 01:31:41 GMT
content-type: application/json; charset=utf-8
vary: Origin
priority: u=1,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1739842301&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=opjg1q03mQG5khUJSTQKEv17%2FhYIb561QBoSuWuGt%2F0%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 vegur
cf-ray: 913a424dcf3f72a5-EWR
access-control-allow-origin: https://paint.toys
server: cloudflare

POST
H3 200 auction Show response
prebid.intergient.com/openrtb2/ 55 KB
10 KB 860ms
422ms Fetch
application/json 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://prebid.intergient.com/openrtb2/auction
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: de701266d239e7a90361fdc8c4dc23aada18d7cf2eaea0625c54b79996cb43fa

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1739842301&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=opjg1q03mQG5khUJSTQKEv17%2FhYIb561QBoSuWuGt%2F0%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Tue, 18 Feb 2025 01:31:41 GMT
content-type: application/json
vary: Origin
priority: u=1,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1739842301&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=opjg1q03mQG5khUJSTQKEv17%2FhYIb561QBoSuWuGt%2F0%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 vegur
cf-ray: 913a424d8ecd72a5-EWR
access-control-allow-origin: https://paint.toys
x-prebid: pbs-go/unknown
server: cloudflare

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
116 B 487ms
62ms Fetch 34.201.209.246
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.201.209.246 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
access-control-allow-credentials: true

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
116 B 486ms
63ms Fetch 34.201.209.246
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.201.209.246 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
access-control-allow-credentials: true

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
117 B 482ms
60ms Fetch 34.201.209.246
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.201.209.246 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
access-control-allow-credentials: true

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
116 B 482ms
61ms Fetch 34.201.209.246
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.201.209.246 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

1041.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
access-control-allow-credentials: true

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 19 B
704 B 424ms
54ms Fetch
application/json 68.67.181.103
ASN-APPNEX

General

Check archive.org

Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.181.103 North Bergen, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 208.252.80.15; 208.252.80.15; 1041.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: https://paint.toys
an-x-request-uuid: a1f0e1f1-d64b-4fb9-b304-229e5f25051c
content-length: 19
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Tue, 18 Feb 2025 01:31:41 GMT
x-xss-protection: 0
content-type: application/json; charset=utf-8
server: nginx/1.23.4

POST
H2 200 hbjson Show response
grid.bidswitch.net/ 24 B
311 B 520ms
137ms Fetch
application/json 2620:100:a00b::5
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://grid.bidswitch.net/hbjson

Requested by

Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::5 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

608a5fd8a641fae227390262b44d56ea84945bec7094de825198480b5f10817a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-store, must-revalidate, no-cache
content-encoding: br
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
date: Tue, 18 Feb 2025 01:31:41 GMT
content-type: application/json
vary: Accept-Encoding, Origin
server: Kestrel

POST
H/1.1 200
OK 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 50 KB
22 KB 1032ms
645ms Fetch
application/json 209.38.60.172
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 209.38.60.172 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: 26c88c0703b51f1c1786fcd4ad1d6346b5b19dd86640cbaa0b8272b1931bc6dd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
content-encoding: gzip
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
content-length: 21615
date: Tue, 18 Feb 2025 01:31:41 GMT
content-type: application/json; charset=utf-8
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control

POST
H/1.1 200
OK 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 45 KB
26 KB 840ms
454ms Fetch
application/json 209.38.60.172
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 209.38.60.172 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: 81fe2a1ae06b103ae1116ae106e0e9194110a9a4140cccfe68415c4370662c69

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
content-encoding: gzip
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
content-length: 25534
date: Tue, 18 Feb 2025 01:31:41 GMT
content-type: application/json; charset=utf-8
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
1 KB 876ms
490ms Fetch 209.38.60.172
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 209.38.60.172 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Tue, 18 Feb 2025 01:31:41 GMT
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
1 KB 787ms
398ms Fetch 209.38.60.172
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 209.38.60.172 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Tue, 18 Feb 2025 01:31:41 GMT
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
277 B 485ms
95ms Fetch 207.65.37.179
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.179 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate, no-store, no-cache, private
access-control-allow-credentials: true
observe-browsing-topics: ?1
pmfcgi-resp: TRUE
access-control-allow-origin: https://paint.toys
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Tue, 18 Feb 2025 01:31:41 GMT
server: nginx

POST
H2 200 hb-multi Show response
hb.yellowblue.io/ 83 B
622 B 499ms
112ms Fetch
application/json 3.167.112.106
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://hb.yellowblue.io/hb-multi
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.167.112.106 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-167-112-106.iad55.r.cloudfront.net
Software: istio-envoy /
Resource Hash: 912e5f7c8a62099e6e14a5d1a60828dac63d1974a90921a5290fe72a3219da2f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: GET, OPTIONS
via: 1.1 5130f24afa7aed6f49e6e72496306d12.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Miss from cloudfront
content-length: 108
x-amz-cf-id: Uqoj8hlSCZDXN8arH2WwDCgG7Mf3vtrDz8WRtX1aJGS7jF-6zlkk-Q==
date: Tue, 18 Feb 2025 01:31:41 GMT
content-type: application/json
x-amz-cf-pop: IAD55-P8
server: istio-envoy
x-reason: domain is blacklisted
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

POST
H2 204 request Show response
grid-bidder.criteo.com/openrtb_2_5/pbjs/auction/ 0
462 B 811ms
447ms Fetch 2620:100:a00b::c
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://grid-bidder.criteo.com/openrtb_2_5/pbjs/auction/request?profileId=207&av=37&wv=9.11.0&cb=35316142845&lsavail=1&networkId=6163

Requested by

Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::c , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
access-control-allow-origin: https://paint.toys
date: Tue, 18 Feb 2025 01:31:40 GMT
vary: Origin
server: Kestrel
access-control-allow-credentials: true

POST
H3 200 pbjs Show response
htlb.casalemedia.com/openrtb/ 37 B
673 B 469ms
97ms Fetch
application/json 104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://htlb.casalemedia.com/openrtb/pbjs?s=1031634
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d269f03ccf511ac97b8463ffc7da395ffe4dd7cf602b3c9ba683fd407ae06de8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DyKeO1PPDRnPV%2BRDhvb7RDeHdoWp340aV97XikBMr%2BokVBGW8wDW2ZojQLZWrMIf3N9XbEP%2BrvjpphQmWOsb7zZK7EwoN87Es6MkxLAVkTsvK9%2FpdpKWRkNv%2FW2RYSv3WfCo6v7e"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Tue, 18 Feb 2025 01:31:41 GMT
content-type: application/json
vary: Accept-Encoding
priority: u=1,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
access-control-allow-credentials: true
cf-ray: 913a424d8f378c3f-EWR
access-control-allow-origin: https://paint.toys
content-length: 37
server: cloudflare

POST
H2 200 prebidjs Show response
rtb.openx.net/openrtbb/ 7 KB
3 KB 563ms
211ms Fetch
text/plain 35.227.252.103
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://rtb.openx.net/openrtbb/prebidjs
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: /
Resource Hash: ae0765132f82bc2d86b5b2ab5889394796b9c4e95fab2205b5781026453ec0b7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-forwarded-for: 208.252.80.15
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2946
date: Tue, 18 Feb 2025 01:31:41 GMT
content-type: text/plain
vary: Origin

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
243 B 412ms
45ms Fetch
application/json 3.213.92.204
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.11.0&lt=1739842300657&to=600&aun=pw-160x600_atf&pubcid=7ef5fe93-8212-4ce8-8bba-d0b4a3f8a62d&gpid=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600&t=8ylgv2wd&pi=3&maxw=160&maxh=600&si=1111716&bf=160x600%2C120x600&ae=true&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.11.0%22%7D&ogu=null&ns=10240
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.213.92.204 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-213-92-204.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Tue, 18 Feb 2025 01:31:41 GMT
content-type: application/json;charset=UTF-8
server: nginx

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
242 B 413ms
47ms Fetch
application/json 3.213.92.204
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.11.0&lt=1739842300658&to=600&aun=pw-160x600_btf&pubcid=7ef5fe93-8212-4ce8-8bba-d0b4a3f8a62d&gpid=pw-160x600_btf&t=8ylgv2wd&pi=3&maxw=160&maxh=600&si=1111716&bf=160x600%2C120x600&ae=true&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.11.0%22%7D&ogu=null&ns=10240
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.213.92.204 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-213-92-204.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Tue, 18 Feb 2025 01:31:41 GMT
content-type: application/json;charset=UTF-8
server: nginx

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
242 B 412ms
46ms Fetch
application/json 3.213.92.204
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.11.0&lt=1739842300658&to=600&aun=leaderboard_atf&pubcid=7ef5fe93-8212-4ce8-8bba-d0b4a3f8a62d&gpid=leaderboard_atf&t=8ylgv2wd&pi=3&maxw=970&maxh=250&si=1111709&bf=728x90%2C970x250%2C970x90&ae=true&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.11.0%22%7D&ogu=null&ns=10240
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.213.92.204 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-213-92-204.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Tue, 18 Feb 2025 01:31:41 GMT
content-type: application/json;charset=UTF-8
server: nginx

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
242 B 462ms
96ms Fetch
application/json 3.213.92.204
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.11.0&lt=1739842300658&to=600&aun=leaderboard_btf&pubcid=7ef5fe93-8212-4ce8-8bba-d0b4a3f8a62d&gpid=leaderboard_btf&t=8ylgv2wd&pi=3&maxw=970&maxh=250&si=1111709&bf=728x90%2C970x250%2C970x90&ae=true&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.11.0%22%7D&ogu=null&ns=10240
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.213.92.204 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-213-92-204.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Tue, 18 Feb 2025 01:31:41 GMT
content-type: application/json;charset=UTF-8
server: nginx

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 686 B
1 KB 514ms
180ms Fetch
application/json 2602:803:c002:200::32
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=9&alt_size_ids=8&p_pos=atf&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=7ef5fe93-8212-4ce8-8bba-d0b4a3f8a62d%5E1&eid_linkedin.com=e268c590-fc7c-47bd-8b52-6195f98d9444%5E1&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fdqxws.tombert.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.pos=atf&tg_i.sitecont_cat=games_casual&tg_i.adunit=pw-160x600_atf&tg_i.pbadslot=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600&tk_flint=pbjs_lite_v9.11.0&x_source.tid=66785673-efc6-44bb-8db7-d4bcbc5e8dc1&l_pb_bid_id=10854b7672c8ead6&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=dd52005a-08eb-4270-b2e7-b9ed69bf6777&rp_maxbids=1&p_gpid=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600&m_ch_mobile=%3F0&slots=1&rand=0.7514884938808519
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::32 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: ea6f906d7e9c4e67dcafa2ba03372e19d37a7388cef9053d96391a9a335cd218

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
date: Tue, 18 Feb 2025 01:31:41 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 6 KB
3 KB 465ms
131ms Fetch
application/json 2602:803:c002:200::32
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=9&alt_size_ids=8&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=7ef5fe93-8212-4ce8-8bba-d0b4a3f8a62d%5E1&eid_linkedin.com=e268c590-fc7c-47bd-8b52-6195f98d9444%5E1&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fdqxws.tombert.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.pos=btf&tg_i.sitecont_cat=games_casual&tg_i.adunit=pw-160x600_btf&tg_i.pbadslot=pw-160x600_btf&tk_flint=pbjs_lite_v9.11.0&x_source.tid=66785673-efc6-44bb-8db7-d4bcbc5e8dc1&l_pb_bid_id=1093240a9cbffd5a&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=ed3aec78-b3e7-4b34-be1b-7415a584a7fb&rp_maxbids=1&p_gpid=pw-160x600_btf&m_ch_mobile=%3F0&slots=1&rand=0.6356835629360382
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::32 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: ef0f2d3b070a969566866c2fcc96457ab66c71dd8c376f440c320890eba469b3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
date: Tue, 18 Feb 2025 01:31:41 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 524 B
1 KB 397ms
64ms Fetch
application/json 2602:803:c002:200::32
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=2&alt_size_ids=55%2C57&p_pos=atf&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=7ef5fe93-8212-4ce8-8bba-d0b4a3f8a62d%5E1&eid_linkedin.com=e268c590-fc7c-47bd-8b52-6195f98d9444%5E1&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fdqxws.tombert.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.pos=atf&tg_i.sitecont_cat=games_casual&tg_i.adunit=leaderboard_atf&tg_i.pbadslot=leaderboard_atf&tk_flint=pbjs_lite_v9.11.0&x_source.tid=66785673-efc6-44bb-8db7-d4bcbc5e8dc1&l_pb_bid_id=110034df0cb741ab&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=706af84e-4668-4dab-b1f8-474b8a597f02&rp_maxbids=1&p_gpid=leaderboard_atf&m_ch_mobile=%3F0&slots=1&rand=0.33459665973661545
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::32 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: 0b2737c872445bb21fddf195ce4d3cb23bdfc7ec06a715f30a25acd49bcde514

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
content-length: 524
date: Tue, 18 Feb 2025 01:31:41 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 524 B
874 B 461ms
128ms Fetch
application/json 2602:803:c002:200::32
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=2&alt_size_ids=55%2C57&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=7ef5fe93-8212-4ce8-8bba-d0b4a3f8a62d%5E1&eid_linkedin.com=e268c590-fc7c-47bd-8b52-6195f98d9444%5E1&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fdqxws.tombert.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.pos=btf&tg_i.sitecont_cat=games_casual&tg_i.adunit=leaderboard_btf&tg_i.pbadslot=leaderboard_btf&tk_flint=pbjs_lite_v9.11.0&x_source.tid=66785673-efc6-44bb-8db7-d4bcbc5e8dc1&l_pb_bid_id=111e43039aa7af05&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=11d1a1de-d55f-43c6-97f3-f32ee1b4d5bb&rp_maxbids=1&p_gpid=leaderboard_btf&m_ch_mobile=%3F0&slots=1&rand=0.9275056246650712
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::32 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: 0628f63c2564eafffdc93a5e810ee00d923d23ae874cce79f2ac025aa6151a26

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
content-length: 524
date: Tue, 18 Feb 2025 01:31:41 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
1 KB 445ms
104ms Fetch
application/json 3.218.122.15
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=9.11.0&referrer=https%3A%2F%2Fpaint.toys%2Foil%2F&tmax=2500&fledge=true

Requested by

Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.218.122.15 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-218-122-15.compute-1.amazonaws.com

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
accept-ch: sec-ch-width,sec-ch-viewport-height,sec-ch-save-data,sec-ch-ect,sec-ch-ua-model,sec-ch-ua-platform-version,sec-ch-device-memory,sec-ch-ua-bitness,sec-ch-ua,sec-ch-ua-full-version,sec-ch-ua-arch,sec-ch-rtt,sec-ch-ua-mobile,sec-ch-viewport-width,sec-ch-downlink,sec-ch-ua-full-version-list,sec-ch-prefers-color-scheme,sec-ch-ua-platform,sec-ch-dpr,user-agent
access-control-allow-credentials: true
expires: Thu, 15 Oct 1992 20:10:00 GMT
access-control-allow-origin: https://paint.toys
x-auction-status: 12, 12, 12, 12
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
x-xss-protection: 0
content-type: application/json; charset=utf-8
vary: Accept-Encoding

POST
H/1.1 200
OK playwire Show response
direct.adsrvr.org/bid/bidder/ 0
394 B 731ms
375ms Fetch
application/json 199.250.161.129
TTD-ASN-01

General

Check archive.org

Download Go to

Full URL: https://direct.adsrvr.org/bid/bidder/playwire
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 199.250.161.129 , United States, ASN26459 (TTD-ASN-01, US),
Reverse DNS
Software: Kestrel /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-openrtb-version: 2.3
cache-control: private
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
content-length: 0
date: Tue, 18 Feb 2025 01:31:40 GMT
content-type: application/json
server: Kestrel
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept

POST
H3 200 243cc92d47a0716379721791fca9d2ff5619aa9a4611235e7ee Show response
faucetfoot.com/u/ae8f91386ab7bc6/ 295 B
322 B 157ms
71ms Fetch
application/json 2600:1901:0:2b4c::1
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL

https://faucetfoot.com/u/ae8f91386ab7bc6/243cc92d47a0716379721791fca9d2ff5619aa9a4611235e7ee

Requested by

Host: faucetfoot.com
URL: https://faucetfoot.com/bundles/695feb6450/55fa41bc8192edc6749bd247bf408a8e957c8b.bundle.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2600:1901:0:2b4c::1 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Resource Hash

ff5caf601ce5be9c85682599b3ecf943ab8de730a1adffb7dbec1eb1546fb9d8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

x-buildname: hoothoot
access-control-allow-methods: POST, OPTIONS
x-hostname: fen-hoothoot-us-east1-8xr3
expires: Tue, 18 Feb 2025 01:31:39 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 18 Feb 2025 01:31:40 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding, Origin
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Cookie
strict-transport-security: max-age=15724800; preload
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
access-control-allow-credentials: true
x-datacenter: gce-us-east1
via: 1.1 google
access-control-allow-origin: https://paint.toys
x-buildnumber: 1657128696
content-length: 295

GET
H2 200 syncframe
gum.criteo.com/ Frame 1A8A 0
0 148ms
42ms Document
text/html 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=paint.toys&gdpr=0&gdpr_consent=

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.ids.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 18 Feb 2025 01:31:40 GMT
server: Kestrel
server-processing-duration-in-ticks: 383938
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding
x-robots-tag: noindex

GET
H2 200 location Show response
privacy-location-edge.ccgateway.net/privacy/ 5 B
191 B 347ms
52ms XHR
text/plain 18.212.140.196
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://privacy-location-edge.ccgateway.net/privacy/location
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.212.140.196 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-212-140-196.compute-1.amazonaws.com
Software: /
Resource Hash: 1c55d9b826e8dfa994370e306ae8dc2e849f3e003381dc848a0b95f782c0c0e3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-origin: *
content-encoding: gzip
date: Tue, 18 Feb 2025 01:31:41 GMT
content-type: text/plain; charset=utf-8
vary: Accept-Encoding
access-control-allow-credentials: true

GET
H2 200 classification Show response
pogo.ccgateway.net/v1/p/5bb3e20859/ 369 B
414 B 334ms
55ms XHR
application/json 18.212.140.196
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://pogo.ccgateway.net/v1/p/5bb3e20859/classification?url=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.212.140.196 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-212-140-196.compute-1.amazonaws.com
Software: /
Resource Hash: d81189b1d8c1ab9ccbf5e46b4b69123228de61922c239efd0b8fee5a6c16d63f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-origin: https://paint.toys
content-encoding: gzip
date: Tue, 18 Feb 2025 01:31:41 GMT
content-type: application/json
vary: Origin, Accept-Encoding
access-control-allow-credentials: true

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 235 B
582 B 60ms
60ms XHR
application/json 34.236.2.33
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.236.2.33 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-236-2-33.compute-1.amazonaws.com
Software: /
Resource Hash: 97539c71ffb1b3e8da236c010c9b7866b019975096c71518529260220973576b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 235
date: Tue, 18 Feb 2025 01:31:40 GMT
content-type: application/json;charset=utf-8
x-server: 10.40.52.228

GET
H3 200 ima_ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 67 B
59 B 57ms
56ms XHR
application/json 2607:f8b0:4004:c1f::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ima_ppub_config?ippd=https%3A%2F%2Fpaint.toys%2Foil%2F

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1f::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

641768f2d1d19839fc3cecfa5158382fa0d332d5e49e31bcaafbedc4af91995a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
content-encoding: br
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Tue, 18 Feb 2025 01:31:40 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 35
date: Tue, 18 Feb 2025 01:31:40 GMT
x-xss-protection: 0
content-type: application/json; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 325ms
84ms Preflight
application/json 74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Tue, 18 Feb 2025 01:31:41 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 197964
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

POST
H2 200 fb87a4ea41 Show response
cd836371f1d.cdn.intergient.com/ 0
96 B 199ms
48ms XHR
application/octet-stream 54.81.166.120
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://cd836371f1d.cdn.intergient.com/fb87a4ea41
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/2.2.9/main.884d984457b5c04043a0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.81.166.120 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-81-166-120.compute-1.amazonaws.com
Software: nginx/1.24.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

access-control-allow-origin: *
date: Tue, 18 Feb 2025 01:31:41 GMT
content-type: application/octet-stream
server: nginx/1.24.0

GET
H2

200

j Show response
rp4.liadm.com/
Redirect Chain

https://rp.liadm.com/j?dtstmp=1739842300932&did=did-0046&se=e30&duid=8e413bd09c43--01jmbaxag6mym44v4bckr9wmav&tv=9.11.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fdqxws.tomb...
https://rp4.liadm.com/j?dtstmp=1739842300932&did=did-0046&se=e30&duid=8e413bd09c43--01jmbaxag6mym44v4bckr9wmav&tv=9.11.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fdqxws.tom...

13 B
370 B

193ms
45ms

Fetch
application/json

34.236.80.128
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://rp4.liadm.com/j?dtstmp=1739842300932&did=did-0046&se=e30&duid=8e413bd09c43--01jmbaxag6mym44v4bckr9wmav&tv=9.11.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fdqxws.tombert.com%2F&cd=.paint.toys&i6=MjYwMDo4MDM6YTg4OjMwMTU6OjE1
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 34.236.80.128 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-236-80-128.compute-1.amazonaws.com
Software: /
Resource Hash: efabba3678b85fcab831b778ea2ddaad1e2a1e952584d3566bc39b7ccb3429d9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-pixel-event-id: 7a4a6033-eeca-425f-ae33-294a2e6d9433
access-control-max-age: 86400
access-control-expose-headers: *
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-origin: null
content-length: 13
date: Tue, 18 Feb 2025 01:31:41 GMT
content-type: application/json

Redirect headers

access-control-max-age: 86400
access-control-expose-headers: *
location: https://rp4.liadm.com/j?dtstmp=1739842300932&did=did-0046&se=e30&duid=8e413bd09c43--01jmbaxag6mym44v4bckr9wmav&tv=9.11.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fdqxws.tombert.com%2F&cd=.paint.toys&i6=MjYwMDo4MDM6YTg4OjMwMTU6OjE1
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-origin: https://paint.toys
content-length: 0
date: Tue, 18 Feb 2025 01:31:41 GMT

POST
H2 200 encrypt Show response
esp.rtbhouse.com/ 265 B
530 B 466ms
126ms Fetch
application/json 35.190.39.111
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://esp.rtbhouse.com/encrypt
Requested by: Host: invstatic101.creativecdn.com
URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.39.111 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 111.39.190.35.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 3af31cfb99ce4654a99f82a6253f9bc14e176b0eea453bee4ff5a6fc7037443e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: POST
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 265
date: Tue, 18 Feb 2025 01:31:41 GMT
content-type: application/json
x-cloud-trace-context: d9d374694ac61138e5a0c43e8b3a0d7a
server: Google Frontend
access-control-allow-headers: X-Requested-With

GET
H2 200 userId Show response
script-api.ccgateway.net/1/ 446 B
706 B 69ms
35ms Script
text/javascript 18.212.140.196
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/1/userId
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.212.140.196 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-212-140-196.compute-1.amazonaws.com
Software: /
Resource Hash: 5fee1ffb6977560d6f1fb9252a4f47b820de43843cbabb505af3c34a27e1182d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=3156000
content-encoding: gzip
date: Tue, 18 Feb 2025 01:31:41 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 user.js Show response
script-api.ccgateway.net/script/launcher/2/ 2 KB
677 B 65ms
31ms Script
text/javascript 18.212.140.196
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/script/launcher/2/user.js
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.212.140.196 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-212-140-196.compute-1.amazonaws.com
Software: /
Resource Hash: a11d3b4b6f2902037c365146ff80b5bf95923f3176f1a827355e45177314d423

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=604800
content-encoding: gzip
date: Tue, 18 Feb 2025 01:31:41 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 customevents.js Show response
script-api.ccgateway.net/script/launcher/1/ 5 KB
2 KB 68ms
34ms Script
text/javascript 18.212.140.196
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/script/launcher/1/customevents.js
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.212.140.196 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-212-140-196.compute-1.amazonaws.com
Software: /
Resource Hash: 04c94ecaae50f713607dd45d40c5756d0e6a9e58c6398433ac098bc9bee89f5d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=604800
content-encoding: gzip
date: Tue, 18 Feb 2025 01:31:41 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 api.js Show response
script-api.ccgateway.net/script/launcher/5/ 5 KB
2 KB 52ms
32ms Script
text/javascript 18.212.140.196
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/script/launcher/5/api.js
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.212.140.196 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-212-140-196.compute-1.amazonaws.com
Software: /
Resource Hash: 67942c522b8f0e187f291d3dde230596fa526a323a9f50a0d667b6956839d98e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=604800
content-encoding: gzip
date: Tue, 18 Feb 2025 01:31:41 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 prbds2s
rtb.gumgum.com/usync/ Frame E8F5 0
0 189ms
43ms Document
text/plain 34.192.210.53
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://rtb.gumgum.com/usync/prbds2s?gdpr=&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dgumgum%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.192.210.53 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-192-210-53.compute-1.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36

Response headers

content-length: 0
date: Tue, 18 Feb 2025 01:31:41 GMT
etag: "0d41d8cd98f00b204e9800998ecf8427e"
server: nginx
timing-allow-origin: *

GET
H2 200 setUser Show response
script-api.ccgateway.net/ 0
360 B 32ms
31ms Script
text/javascript 18.212.140.196
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/setUser?parent=5bb3e20859&site=paint.toys&ccuid=ef959ed9-ef8a-4078-b69e-db6478321279&ccsid=d451efa1-cadb-4b87-825e-052087ed242d
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.212.140.196 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-212-140-196.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=300
content-length: 0
date: Tue, 18 Feb 2025 01:31:41 GMT
content-type: text/javascript

GET
H2 200 bundle Show response
script-api.ccgateway.net/script/ 14 KB
4 KB 34ms
33ms Script
text/javascript 18.212.140.196
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/script/bundle?id=paint.toys&parentId=5bb3e20859
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.212.140.196 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-212-140-196.compute-1.amazonaws.com
Software: /
Resource Hash: eaa7e3d32d237bf9271ddb57b4068ec273bea7ce8efcf3b3eb36f3b6b5b31206

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: public,max-age=1200
content-encoding: gzip
date: Tue, 18 Feb 2025 01:31:41 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 launcher.min.js Show response
secure.cdn.fastclick.net/js/cnvr-launcher/latest/ 49 KB
17 KB 121ms
120ms Script
application/javascript 23.201.174.84
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher-stub.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.201.174.84 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-201-174-84.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 938c64115ce60b98ee8151d7eb28208567753f3d4ebbe0aa0f56618c555a18fb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "c4b6-5e920545406d3-gzip"
expires: Tue, 18 Feb 2025 01:46:41 GMT
accept-ranges: bytes
content-length: 17042
date: Tue, 18 Feb 2025 01:31:41 GMT
last-modified: Tue, 20 Sep 2022 18:52:26 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H2 200 script-load
ingestion-router-api.ccgateway.net/v1/event/record/ 0
44 B 151ms
91ms Image
text/plain 18.212.140.196
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ingestion-router-api.ccgateway.net/v1/event/record/script-load?engttl=60&engcount=0&engid=7edc461c-be10-4cb4-9546-a34c4175b12b&prevPvid=&pageVisits=1&landingUrl=https%3A%2F%2Fpaint.toys%2Foil%2F&extReferer=dqxws.tombert.com&url=https%3A%2F%2Fpaint.toys%2Foil%2F&pvid=63dc5219-0ff5-40f8-8977-46373c111851&ccuid=ef959ed9-ef8a-4078-b69e-db6478321279&sid=d451efa1-cadb-4b87-825e-052087ed242d&nct=1739842301000&r=https%3A%2F%2Fdqxws.tombert.com%2F&ns=true&lang=en-US&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F133.0.0.0%20Safari%2F537.36&devicefp=208.252.80.15%3A2&browserCache=true&localCache=false&cookieType=0&nocookies=false&ios=false&parentId=5bb3e20859&scriptId=paint.toys&skey=68e30d5f-cc5d-455f-b9e0-e8e8a7282355&url=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.212.140.196 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-212-140-196.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

date: Tue, 18 Feb 2025 01:31:41 GMT
content-length: 0

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
282 B 520ms
224ms Fetch
application/json 141.95.98.64
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.64 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ns3216658.ip-141-95-98.eu

Software

Resource Hash

508a8865915348f7d084ffcecc7edce40e9014cecf0cc6658a06ecd58c9722c6

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Tue, 18 Feb 2025 01:31:41 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H2 200 403 Show response
a.ad.gt/api/v1/u/matches/ 9 KB
5 KB 204ms
62ms Script
application/javascript 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://a.ad.gt/api/v1/u/matches/403?_it=amazon
Requested by: Host: cdn.hadronid.net
URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fdqxws.tombert.com%2F&_it=amazon&partner_id=403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 37f858517e508fa198c628f4e6af6a5fabf833ebc8ab3396d52ab75642eacd0a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=14400
content-encoding: gzip
cf-cache-status: HIT
age: 127
cross-origin-resource-policy: cross-origin
cf-ray: 913a424fcf3119bf-EWR
date: Tue, 18 Feb 2025 01:31:41 GMT
content-type: application/javascript
vary: accept-encoding
server: cloudflare
last-modified: Tue, 18 Feb 2025 01:29:07 GMT

GET
H2 200 hadron.json Show response
id.hadron.ad.gt/v1/ 109 B
267 B 75ms
72ms XHR
application/json 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://id.hadron.ad.gt/v1/hadron.json?_it=amazon&partner_id=403&sync=0&domain=paint.toys&url=https://paint.toys/oil/&v=06
Requested by: Host: cdn.hadronid.net
URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fdqxws.tombert.com%2F&_it=amazon&partner_id=403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b601a6d11b1f387e1db0bece1887a3c7d4cfeb7a4301260de3ecdb0ea9360bf3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Content-Type: application/json
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
access-control-allow-methods: HEAD,GET,POST,PUT,DELETE,OPTIONS
cf-ray: 913a425038184258-EWR
access-control-allow-origin: *
date: Tue, 18 Feb 2025 01:31:41 GMT
content-type: application/json
server: cloudflare
access-control-allow-headers: authorization,content-type

OPTIONS
H2 200 hadron.json
id.hadron.ad.gt/v1/ Frame 0
0 204ms
52ms Preflight
text/plain 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://id.hadron.ad.gt/v1/hadron.json?_it=amazon&partner_id=403&sync=0&domain=paint.toys&url=https://paint.toys/oil/&v=06
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-origin: *
allow: POST, OPTIONS, GET
cache-control: max-age=31536000 public, no-transform
cf-cache-status: DYNAMIC
cf-ray: 913a424fcf654258-EWR
content-length: 0
content-type: text/plain
date: Tue, 18 Feb 2025 01:31:41 GMT
expires: Wed, 18 Feb 2026 01:31:41 GMT
server: cloudflare

GET
H3 200 ad._zedo. Show response
fundingchoicesmessages.google.com/f/AGSKWxUrC0d46ku7YJF40eNrgHPWdewSzhn_ZtwsLmdeYJYBlT8VJr7HuCJHMxA0s7e2XThfg5tvdHkJvztAG3keKU5Hbhs2REcifQAifiVgjCng8KHNpxXan9MhH1gYZPIfeAUquVWdXsuv_PqSdzj3ihjxhKJMW... 54 B
109 B 249ms
248ms Script
application/javascript 2607:f8b0:4004:c09::65
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxUrC0d46ku7YJF40eNrgHPWdewSzhn_ZtwsLmdeYJYBlT8VJr7HuCJHMxA0s7e2XThfg5tvdHkJvztAG3keKU5Hbhs2REcifQAifiVgjCng8KHNpxXan9MhH1gYZPIfeAUquVWdXsuv_PqSdzj3ihjxhKJMWBf34lBafEiUaI1EwOEake06Hok5bFse/_/meme_ad./advertising-/ad/top1./tools/ad._zedo.

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.l-73MGsrxTM.es5.O/d=1/exm=kernel_loader,loader_js_executable,web_iab_tcf_v2_signal_executable/ed=1/rs=AJlcJMxV77t-pDuoVx9092HFi-doieeJ1Q/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::65 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

9b7f999ce381003c8a56940c988c7367cdabe40ccff23ca2db9e3b828a51ed0c

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-2FzZ4ASe1g_6HNzczxZ-iA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 18 Feb 2025 01:31:41 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjitDikmII1JBiaL15jnU6EButPc_qAsSGCpdYnYH4_rpLrM-B-EP9ZdYfQFwkcYW1BYgZvl5h5QDiky5XWS8C8WUgvg3EVb-usjYBsRAPx9-j5_eyCTScXNzEpKSRlF8Yn5yfV1KUmVRakl-UlpyWWpxaVJZaFG9kYGRqYGRorGdgFl9gAACjPDwk"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-2FzZ4ASe1g_6HNzczxZ-iA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 153 KB
53 KB 464ms
63ms Script
text/javascript 2607:f8b0:4004:c06::9b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?fcd=true

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.l-73MGsrxTM.es5.O/d=1/exm=kernel_loader,loader_js_executable,web_iab_tcf_v2_signal_executable/ed=1/rs=AJlcJMxV77t-pDuoVx9092HFi-doieeJ1Q/m=ad_blocking_detection_executable

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c06::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1705d99c3474a29b2c1c023cceede9ea482cd53c4e7a85745a2cd95268160241

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 12779002848859285837
x-content-type-options: nosniff
expires: Tue, 18 Feb 2025 01:31:41 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Tue, 18 Feb 2025 01:31:41 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
link: <https://googleads.g.doubleclick.net>; rel="preconnect"; crossorigin
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 53262
x-xss-protection: 0
server: cafe

POST
H3 204 AGSKWxVUB25u5_gcwQD6btqW_rTCGQJKGDNdDi5H1E__vEGOJjXkIqKp9eDiCQ3rDetsjwWRSY9T3yjoV53Gow63U7oevB4RDPZlpS4x2viH5ri-D2cKpooF-5ms1KsSmyvdmDVg6Jd_bA== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 140ms
54ms XHR
text/html 2607:f8b0:4004:c09::65
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxVUB25u5_gcwQD6btqW_rTCGQJKGDNdDi5H1E__vEGOJjXkIqKp9eDiCQ3rDetsjwWRSY9T3yjoV53Gow63U7oevB4RDPZlpS4x2viH5ri-D2cKpooF-5ms1KsSmyvdmDVg6Jd_bA==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::65 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-HmRtzuL3grOkFCHQlrWYAg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 18 Feb 2025 01:31:41 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzj0tDikmJw1pBi-FB_mfUHEDN8vcLKAcQnXa6yXgTiy0B8G4iFeDj-Hj2_l03gxJXHZxmVXJLyC-OT8_NKUvNKdBNTinVB7KLMpNKS_CIUdmoZSEVOfnp6Zl56vJGBkamBkaGxnoF5fIEBAI24MPM"
content-security-policy: script-src 'report-sample' 'nonce-HmRtzuL3grOkFCHQlrWYAg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET

usync.html
eus.rubiconproject.com/
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=
https://eus.rubiconproject.com/usync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=

0
0

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=eyeota&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmb/generic?ttd_pid=eyeota&ttd_tpi=1&gdpr=0&gdpr_consent=
https://ps.eyeota.net/match?uid=06684dbc-6eee-434b-bb51-fed7d7e7a7f1&bid=1e2n4ou

70 B
440 B

35ms
34ms

Image
image/gif

18.214.54.215
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?uid=06684dbc-6eee-434b-bb51-fed7d7e7a7f1&bid=1e2n4ou
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 18.214.54.215 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-214-54-215.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Tue, 18 Feb 2025 01:31:41 GMT
Content-Type: image/gif

Redirect headers

location: https://ps.eyeota.net/match?uid=06684dbc-6eee-434b-bb51-fed7d7e7a7f1&bid=1e2n4ou
content-length: 191
date: Tue, 18 Feb 2025 01:31:41 GMT
server: Kestrel

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm&google_sc&google_hm=Mjk0VWpzZVZzQklnR00yR1AwNHpad3B4RU9uMmkza21CRTJIYlVPWmd0TnM&gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer...
https://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm=&google_sc=&google_hm=Mjk0VWpzZVZzQklnR00yR1AwNHpad3B4RU9uMmkza21CRTJIYlVPWmd0TnM&gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referr...
https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_gid=CAESEKpTA8Hq1dbX06cYTCOkytA&google_cver=1

70 B
440 B

32ms
31ms

Image
image/gif

18.214.54.215
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_gid=CAESEKpTA8Hq1dbX06cYTCOkytA&google_cver=1
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 18.214.54.215 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-214-54-215.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Tue, 18 Feb 2025 01:31:41 GMT
Content-Type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_gid=CAESEKpTA8Hq1dbX06cYTCOkytA&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 375
date: Tue, 18 Feb 2025 01:31:41 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://ups.analytics.yahoo.com/ups/58773/cms?partner_id=Eyeot&gdpr=0&gdpr_consent=
https://ups.analytics.yahoo.com/ups/58773/cms?partner_id=Eyeot&gdpr=0&gdpr_consent=&verify=true
https://ps.eyeota.net/match?bid=bhc9gd0&yahoo_ver=2&yahoo_id=y-iLylPZlE2pXL4i0O_.aks2OUYOXjB393Qqg-~A&gdpr=0

70 B
440 B

33ms
31ms

Image
image/gif

18.214.54.215
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?bid=bhc9gd0&yahoo_ver=2&yahoo_id=y-iLylPZlE2pXL4i0O_.aks2OUYOXjB393Qqg-~A&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 18.214.54.215 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-214-54-215.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Tue, 18 Feb 2025 01:31:41 GMT
Content-Type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
location: https://ps.eyeota.net/match?bid=bhc9gd0&yahoo_ver=2&yahoo_id=y-iLylPZlE2pXL4i0O_.aks2OUYOXjB393Qqg-~A&gdpr=0
age: 0
referrer-policy: no-referrer-when-downgrade
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Tue, 18 Feb 2025 01:31:41 GMT
content-type: text/html
server: ATS

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMjg0NTA1NDYvdC8w/url/https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=$!{TURN_UUID}&newuser=1&referrer_pid=m51mh00
https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=3540777071787955069&newuser=1&referrer_pid=m51mh00

70 B
440 B

32ms
32ms

Image
image/gif

18.214.54.215
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=3540777071787955069&newuser=1&referrer_pid=m51mh00
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 18.214.54.215 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-214-54-215.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Tue, 18 Feb 2025 01:31:41 GMT
Content-Type: image/gif

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=3540777071787955069&newuser=1&referrer_pid=m51mh00
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Tue, 18 Feb 2025 01:31:39 GMT

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fuid%3D%24UID%26bid%3D2cr76e1%26referrer_pid%3Dm51mh00
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fps.eyeota.net%252Fmatch%253Fuid%253D%2524UID%2526bid%253D2cr76e1%2526referrer_pid%253Dm51mh00
https://ps.eyeota.net/match?uid=4074714444682889800&bid=2cr76e1&referrer_pid=m51mh00

70 B
440 B

38ms
38ms

Image
image/gif

18.214.54.215
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?uid=4074714444682889800&bid=2cr76e1&referrer_pid=m51mh00
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 18.214.54.215 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-214-54-215.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Tue, 18 Feb 2025 01:31:41 GMT
Content-Type: image/gif

Redirect headers

cache-control: no-store, no-cache, private
location: https://ps.eyeota.net/match?uid=4074714444682889800&bid=2cr76e1&referrer_pid=m51mh00
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 208.252.80.15; 208.252.80.15; 1041.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 14e45b88-b5b4-4a25-9b7e-3bb6103a3f71
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Tue, 18 Feb 2025 01:31:41 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2 200 launcher Show response
proc.ad.cpe.dotomi.com/cvx/client/direct/ 190 B
459 B 302ms
105ms XHR
application/json 2606:ae80:1471:16::820
CNVR-US-EAST

General

Check archive.org

Download Go to

Full URL: https://proc.ad.cpe.dotomi.com/cvx/client/direct/launcher?version=1.1.1&lid=681
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:ae80:1471:16::820 , United States, ASN26762 (CNVR-US-EAST, US),
Reverse DNS
Software: nginx /
Resource Hash: 71f0c958e33905cb028dfd76ff7fcffa9d57a260845594e84d116530e3f80a36

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=1800
accept-ch: Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness
access-control-allow-credentials: true
expires: Tue, 18 Feb 2025 02:01:41 GMT
access-control-allow-origin: https://paint.toys
content-length: 190
date: Tue, 18 Feb 2025 01:31:41 GMT
content-type: application/json
vary: Origin
server: nginx

GET
H/1.1

200
OK

iu3
s.amazon-adsystem.com/ Frame A29B
Redirect Chain

https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=gg_n-mediagrid_n-index_n-adMediaV1_rx_snb_n-MediaNet_n-Beeswax_n-colossusMedia_n-inmobi_n-adman-v2_n-sharethrough_pm-db5_n-simp...
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=gg_n-mediagrid_n-index_n-adMediaV1_rx_snb_n-MediaNet_n-Beeswax_n-colossusMedia_n-inmobi_n-adman-v2_n-sharethrough_pm-db5_n-simp...

0
0

51ms
51ms

Document
text/html

98.82.157.137
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=gg_n-mediagrid_n-index_n-adMediaV1_rx_snb_n-MediaNet_n-Beeswax_n-colossusMedia_n-inmobi_n-adman-v2_n-sharethrough_pm-db5_n-simpli.fi_ym_rbd_n-nativo_sovrn_3lift_n-Outbrain&dcc=t

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

98.82.157.137 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-98-82-157-137.compute-1.amazonaws.com

Software

Server /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 443
Content-Type: text/html;charset=ISO-8859-1
Date: Tue, 18 Feb 2025 01:31:41 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: 2XG8042PCH2RRHFGS5W5

Redirect headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Date: Tue, 18 Feb 2025 01:31:41 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Location: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=gg_n-mediagrid_n-index_n-adMediaV1_rx_snb_n-MediaNet_n-Beeswax_n-colossusMedia_n-inmobi_n-adman-v2_n-sharethrough_pm-db5_n-simpli.fi_ym_rbd_n-nativo_sovrn_3lift_n-Outbrain&dcc=t
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: 86TSNQC63V72DGDEZV2Y

POST
H3 204 AGSKWxVUB25u5_gcwQD6btqW_rTCGQJKGDNdDi5H1E__vEGOJjXkIqKp9eDiCQ3rDetsjwWRSY9T3yjoV53Gow63U7oevB4RDPZlpS4x2viH5ri-D2cKpooF-5ms1KsSmyvdmDVg6Jd_bA== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 50ms
50ms XHR
text/html 2607:f8b0:4004:c09::65
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxVUB25u5_gcwQD6btqW_rTCGQJKGDNdDi5H1E__vEGOJjXkIqKp9eDiCQ3rDetsjwWRSY9T3yjoV53Gow63U7oevB4RDPZlpS4x2viH5ri-D2cKpooF-5ms1KsSmyvdmDVg6Jd_bA==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::65 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-THeBcoG9J_eIaxPNM-lrIA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 18 Feb 2025 01:31:41 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzj0tDikmII0pBi-FB_mfUHEDN8vcLKAcQnXa6yXgTiy0B8G4iFeDj-Hj2_l03gRvvf2UxKLkn5hfHJ-XklqXkluokpxbogdlFmUmlJfhEKO7UMpCInPz09My893sjAyNTAyNBYz8A8vsAAAHzPMK4"
content-security-policy: script-src 'report-sample' 'nonce-THeBcoG9J_eIaxPNM-lrIA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H2 200 403 Show response
p.ad.gt/api/v1/p/ 40 KB
14 KB 146ms
50ms Script
application/javascript 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/p/403
Requested by: Host: a.ad.gt
URL: https://a.ad.gt/api/v1/u/matches/403?_it=amazon
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c4653c7bb1290f0607fa346e22d665b3d80a4bf7f58b64e6b875ec1ac1bdc70f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=14400
content-encoding: gzip
cf-cache-status: HIT
age: 219
cf-ray: 913a4251c8550f8b-EWR
date: Tue, 18 Feb 2025 01:31:41 GMT
content-type: application/javascript
vary: accept-encoding
server: cloudflare
last-modified: Tue, 18 Feb 2025 01:27:33 GMT

GET
H2 200 halo_match
ids.ad.gt/api/v1/ 43 B
94 B 333ms
128ms Image
image/gif 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/halo_match?id=AU1D-0100-001739842302-U6SAMDY8-ZA1G&halo_id=060ixebju6a65agek6il8lclhifj8gjccg8uomgwi0e0yeqmy0u040i0suow4qwii
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 913a425268c30f6f-EWR
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Tue, 18 Feb 2025 01:31:41 GMT
content-type: image/gif
server: cloudflare

GET
H2 200 ip_match
ids4.ad.gt/api/v1/ 0
244 B 459ms
213ms Image
text/html 54.69.234.31
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://ids4.ad.gt/api/v1/ip_match?id=AU1D-0100-001739842302-U6SAMDY8-ZA1G
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.69.234.31 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-69-234-31.us-west-2.compute.amazonaws.com
Software: timberwolf /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-length: 0
date: Tue, 18 Feb 2025 01:31:41 GMT
content-type: text/html; charset=utf-8
server: timberwolf

GET
H2

200

match
ids.ad.gt/api/v1/
Redirect Chain

https://secure.adnxs.com/getuid?https://ids.ad.gt/api/v1/match?id=AU1D-0100-001739842302-U6SAMDY8-ZA1G&adnxs_id=$UID&gdpr=0
https://ids.ad.gt/api/v1/match?id=AU1D-0100-001739842302-U6SAMDY8-ZA1G&adnxs_id=4074714444682889800&gdpr=0

43 B
95 B

278ms
129ms

Image
image/gif

2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/match?id=AU1D-0100-001739842302-U6SAMDY8-ZA1G&adnxs_id=4074714444682889800&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 913a425268bd0f6f-EWR
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Tue, 18 Feb 2025 01:31:41 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: no-store, no-cache, private
location: https://ids.ad.gt/api/v1/match?id=AU1D-0100-001739842302-U6SAMDY8-ZA1G&adnxs_id=4074714444682889800&gdpr=0
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 208.252.80.15; 208.252.80.15; 1041.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: da20243d-d496-40d6-9888-cae20cbbb932
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Tue, 18 Feb 2025 01:31:41 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2

200

openx
ids.ad.gt/api/v1/
Redirect Chain

https://u.openx.net/w/1.0/cm?id=998eaf06-9905-4eae-9e26-9fac75960c53&r=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fopenx%3Fopenx_id%3D%7BOPENX_ID%7D%26id%3DAU1D-0100-001739842302-U6SAMDY8-ZA1G%26auid%3DAU...
https://u.openx.net/w/1.0/cm?cc=1&id=998eaf06-9905-4eae-9e26-9fac75960c53&r=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fopenx%3Fopenx_id%3D%7BOPENX_ID%7D%26id%3DAU1D-0100-001739842302-U6SAMDY8-ZA1G%26auid...
https://ids.ad.gt/api/v1/openx?openx_id=f0670836-ea38-4411-acb9-7ac36752a31e&id=AU1D-0100-001739842302-U6SAMDY8-ZA1G&auid=AU1D-0100-001739842302-U6SAMDY8-ZA1G

43 B
95 B

125ms
122ms

Image
image/gif

2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/openx?openx_id=f0670836-ea38-4411-acb9-7ac36752a31e&id=AU1D-0100-001739842302-U6SAMDY8-ZA1G&auid=AU1D-0100-001739842302-U6SAMDY8-ZA1G
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 913a4253199a0f6f-EWR
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Tue, 18 Feb 2025 01:31:42 GMT
content-type: image/gif
server: cloudflare

Redirect headers

location: https://ids.ad.gt/api/v1/openx?openx_id=f0670836-ea38-4411-acb9-7ac36752a31e&id=AU1D-0100-001739842302-U6SAMDY8-ZA1G&auid=AU1D-0100-001739842302-U6SAMDY8-ZA1G
content-encoding: gzip
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Tue, 18 Feb 2025 01:31:41 GMT
content-type: image/gif
vary: Accept, Accept-Encoding
server: OXGW/0.0.0

GET
H2

200

pbm_match
ids.ad.gt/api/v1/
Redirect Chain

https://image2.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fpbm_match%3Fpbm%3D%23PM_USER_ID%26id%3DAU1D-0100-001739842302-U6SAMDY8-ZA1G
https://image2.pubmatic.com/AdServer/UCookieSetPug?ird=1&rd=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fpbm_match%3Fpbm%3D%23PM_USER_ID%26id%3DAU1D-0100-001739842302-U6SAMDY8-ZA1G
https://ids.ad.gt/api/v1/pbm_match?pbm=28A10BCD-8F29-4606-AB75-CD77376839E9&id=AU1D-0100-001739842302-U6SAMDY8-ZA1G

43 B
95 B

170ms
170ms

Image
image/gif

2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/pbm_match?pbm=28A10BCD-8F29-4606-AB75-CD77376839E9&id=AU1D-0100-001739842302-U6SAMDY8-ZA1G
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 913a425359e00f6f-EWR
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Tue, 18 Feb 2025 01:31:42 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: no-store, no-cache, private
location: https://ids.ad.gt/api/v1/pbm_match?pbm=28A10BCD-8F29-4606-AB75-CD77376839E9&id=AU1D-0100-001739842302-U6SAMDY8-ZA1G
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Mon, 17 Feb 2025 22:10:51 GMT
server: nginx

GET
H2

200

rub_match
ids.ad.gt/api/v1/
Redirect Chain

https://token.rubiconproject.com/token?pid=50242&puid=AU1D-0100-001739842302-U6SAMDY8-ZA1G&gdpr=0
https://ids.ad.gt/api/v1/rub_match?id=AU1D-0100-001739842302-U6SAMDY8-ZA1G&rub=M79T6NAF-W-2367&gdpr=0

43 B
118 B

129ms
129ms

Image
image/gif

2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/rub_match?id=AU1D-0100-001739842302-U6SAMDY8-ZA1G&rub=M79T6NAF-W-2367&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 913a4252e9630f6f-EWR
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Tue, 18 Feb 2025 01:31:42 GMT
content-type: image/gif
server: cloudflare

Redirect headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
Location: https://ids.ad.gt/api/v1/rub_match?id=AU1D-0100-001739842302-U6SAMDY8-ZA1G&rub=M79T6NAF-W-2367&gdpr=0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 314e432eb2d967cf733b82bdbbe35231
Pragma: no-cache
content-length: 0

GET
H2

200

t_match
ids.ad.gt/api/v1/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=8gkxb6n&ttd_tpi=1&ttd_puid=AU1D-0100-001739842302-U6SAMDY8-ZA1G&gdpr=0
https://ids.ad.gt/api/v1/t_match?tdid=06684dbc-6eee-434b-bb51-fed7d7e7a7f1&id=AU1D-0100-001739842302-U6SAMDY8-ZA1G

43 B
95 B

302ms
133ms

Image
image/gif

2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/t_match?tdid=06684dbc-6eee-434b-bb51-fed7d7e7a7f1&id=AU1D-0100-001739842302-U6SAMDY8-ZA1G
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 913a425268c40f6f-EWR
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Tue, 18 Feb 2025 01:31:41 GMT
content-type: image/gif
server: cloudflare

Redirect headers

location: https://ids.ad.gt/api/v1/t_match?tdid=06684dbc-6eee-434b-bb51-fed7d7e7a7f1&id=AU1D-0100-001739842302-U6SAMDY8-ZA1G
content-length: 259
date: Tue, 18 Feb 2025 01:31:41 GMT
server: Kestrel

GET
H2

200

tapad_match
ids.ad.gt/api/v1/
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_id=3185&partner_device_id=AU1D-0100-001739842302-U6SAMDY8-ZA1G&partner_url=https://ids.ad.gt%2Fapi%2Fv1%2Ftapad_match%3Fid%3DAU1D-0100-001739842302...
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3185&partner_device_id=AU1D-0100-001739842302-U6SAMDY8-ZA1G&partner_url=https://ids.ad.gt%2Fapi%2Fv1%2Ftapad_match%3Fid%3DAU1D-0100-001739...
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=127be99b-bf18-4797-a143-444a31ee549f%252Chttps%25253A%25252F%25252Fids.ad.gt%25252Fapi%25252Fv1%25252Ftapad_match%25253Fi...
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=06684dbc-6eee-434b-bb51-fed7d7e7a7f1&ttd_puid=127be99b-bf18-4797-a143-444a31ee549f%2Chttps%253A%252F%252Fids.ad.gt%252Fap...
https://ids.ad.gt/api/v1/tapad_match?id=AU1D-0100-001739842302-U6SAMDY8-ZA1G&tapad_id=127be99b-bf18-4797-a143-444a31ee549f

43 B
95 B

163ms
144ms

Image
image/gif

2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/tapad_match?id=AU1D-0100-001739842302-U6SAMDY8-ZA1G&tapad_id=127be99b-bf18-4797-a143-444a31ee549f
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 913a4254cbf40f6f-EWR
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Tue, 18 Feb 2025 01:31:42 GMT
content-type: image/gif
server: cloudflare

Redirect headers

strict-transport-security: max-age=31536000
location: https://ids.ad.gt/api/v1/tapad_match?id=AU1D-0100-001739842302-U6SAMDY8-ZA1G&tapad_id=127be99b-bf18-4797-a143-444a31ee549f
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 0
date: Tue, 18 Feb 2025 01:31:42 GMT
server: Jetty(11.0.13)

GET
H2 200 pixel
cm.g.doubleclick.net/ 170 B
243 B 48ms
46ms Image
image/png 142.251.179.156
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_cm&google_sc&google_ula=450542624&id=AU1D-0100-001739842302-U6SAMDY8-ZA1G

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.179.156 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Tue, 18 Feb 2025 01:31:41 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H2

200

amo_match
ids.ad.gt/api/v1/
Redirect Chain

https://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMTc0ODI0MTY1OC90LzA/url/https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Famo_match%3Fturn_id%3D%24!%7BTURN_UUID%7D%26id%3DAU1D-0100-001739842302-U6SAMDY8-ZA1G
https://ids.ad.gt/api/v1/amo_match?turn_id=3540777071787955069&id=AU1D-0100-001739842302-U6SAMDY8-ZA1G

43 B
170 B

291ms
125ms

Image
image/gif

2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/amo_match?turn_id=3540777071787955069&id=AU1D-0100-001739842302-U6SAMDY8-ZA1G
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 913a425268c10f6f-EWR
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Tue, 18 Feb 2025 01:31:41 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://ids.ad.gt/api/v1/amo_match?turn_id=3540777071787955069&id=AU1D-0100-001739842302-U6SAMDY8-ZA1G
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Tue, 18 Feb 2025 01:31:35 GMT

GET
H2

200

son_match
ids.ad.gt/api/v1/
Redirect Chain

https://sync.go.sonobi.com/us?https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001739842302-U6SAMDY8-ZA1G&uid=[UID]&gdpr=0
https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001739842302-U6SAMDY8-ZA1G&uid=e651ce9c-1a88-4d51-87db-e17222ffb3e2&gdpr=0

43 B
95 B

131ms
131ms

Image
image/gif

2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001739842302-U6SAMDY8-ZA1G&uid=e651ce9c-1a88-4d51-87db-e17222ffb3e2&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 913a4253ba670f6f-EWR
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Tue, 18 Feb 2025 01:31:42 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: no-cache, no-store, private
location: https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001739842302-U6SAMDY8-ZA1G&uid=e651ce9c-1a88-4d51-87db-e17222ffb3e2&gdpr=0
pragma: no-cache
expires: Sat, 26 Jul 1997 05:00:00 GMT
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
date: Tue, 18 Feb 2025 01:31:41 GMT
tcn: Choice
content-type: text/plain; charset=utf8
vary: negotiate,Accept-Encoding
server: sonobi-go
x-go-server: go-iad-2-6-50
x-xss-protection: 0

GET
H3

200

pixel
cm.g.doubleclick.net/
Redirect Chain

https://ids.ad.gt/api/v1/g_hosted?id=AU1D-0100-001739842302-U6SAMDY8-ZA1G
https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_hm=QVUxRC0wMTAwLTAwMTczOTg0MjMwMi1VNlNBTURZOC1aQTFH

170 B
188 B

60ms
58ms

Image
image/png

142.251.179.156
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_hm=QVUxRC0wMTAwLTAwMTczOTg0MjMwMi1VNlNBTURZOC1aQTFH

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

142.251.179.156 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Tue, 18 Feb 2025 01:31:41 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cf-ray: 913a425268c60f6f-EWR
location: https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_hm=QVUxRC0wMTAwLTAwMTczOTg0MjMwMi1VNlNBTURZOC1aQTFH
cf-cache-status: DYNAMIC
date: Tue, 18 Feb 2025 01:31:41 GMT
content-type: text/html; charset=utf-8
vary: accept-encoding
server: cloudflare

GET
H2 200 coreid.min.js Show response
secure.cdn.fastclick.net/js/cnvr-coreid/latest/ 229 KB
66 KB 41ms
40ms Script
application/javascript 23.201.174.84
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-coreid/latest/coreid.min.js
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.201.174.84 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-201-174-84.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: eb87c0447bd19366919bdb8913f775caca732ac31cbc5e5d42e4db5df39437ce

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "394d0-60864a57eaadc-gzip"
expires: Tue, 18 Feb 2025 01:46:41 GMT
accept-ranges: bytes
content-length: 67550
date: Tue, 18 Feb 2025 01:31:41 GMT
last-modified: Mon, 23 Oct 2023 16:23:46 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 30 KB
3 KB 334ms
333ms Fetch
text/plain 2607:f8b0:4004:c1f::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=82217179974331&correlator=4396525374112878&eid=31086814%2C83321072&output=ldjh&gdfp_req=1&vrg=202502110101&ptt=17&impl=fifs&gdpr=0&iu_parts=154013155%2C1024872%2C74068%2Cpublisher%3A1024872-website%3A74068-160x600%2Cpublisher%3A1024872-website%3A74068-160x600-CP%2Cpublisher%3A1024872-website%3A74068-160x600-CP-160x600&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4%2F5&prev_iu_szs=160x600%7C120x600&ifi=1&dids=pw-160x600_atf&adfs=3640230632&sfv=1-0-41&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1739842301703&lmt=1739842301&adxs=20&adys=614&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fdqxws.tombert.com%2F&vis=1&psz=180x1097&msz=160x-1&fws=4&ohw=180&topics=1&tps=1&htps=10&a3p=Eh0KDmVzcC5jcml0ZW8uY29tGODTurXRMkgAUgIIZBIUCgVvcGVueBiY1rq10TJIAFICCG8SGwoMMzNhY3Jvc3MuY29tGODTurXRMkgAUgIIZBLuAQoIcnRiaG91c2US2AFHSE5Ga3JVT2taU3UrWXR5TTJHZ25HVlljVnpiNlNtSG9lSVVXL2c5VXE3WUFSbE1UbTAxSHoyazFFSk9sUEN2eU1lYldjUjJFcTAxU3RVdG8vMVBUdmZsN0FCckVDdkN1aFN0RVJpQi96N3F6Y013VG9xanEvd2Y0MHlrS1BRNlI5TXg0NithcCt0QnJQSmFUY0paNXQ2NmhkbE9xdjJwdEw2UURhMlFYQmJ0cXpCTTFtSkRXbzhNM3NtcE9CV1R1T3lyRFBNWUFISFZZa0k0Tlc0c2VBPT0Y-9u6tdEySAA.&nt=1&psd=WzE1LFtdLG51bGwsM10.&dlt=1739842299373&idt=584&prev_scp=pos%3Datf%26slot_id%3Dpw-160x600_atf%26refresh%3Dfalse%26amazonBid%3Dfalse%26custom_path%3D160x600%26lld_id%3D2dd47f40e637498eaa4dee68a780d66342300482%26price_floor%3Dna%26amznbid%3D2%26amznp%3D2%26hb_format_vidazoo%3Dbanner%26hb_size_vidazoo%3D160x600%26hb_pb_vidazoo%3D0.26%26hb_adid_vidazoo%3D1302f4b44abd6dde%26hb_bidder_vidazoo%3Dvidazoo%26hb_cache_host_s2s_ix%3Dprebid.adnxs.com%26hb_format_s2s_ix%3Dbanner%26hb_size_s2s_ix%3D160x600%26hb_pb_s2s_ix%3D0.10%26hb_adid_s2s_ix%3D127f2dab8eec81fd%26hb_bidder_s2s_ix%3Ds2s_ix%26hb_format_openx%3Dbanner%26hb_deal_openx%3DOX-bef-JrE1lI%26hb_size_openx%3D160x600%26hb_pb_openx%3D0.23%26hb_adid_openx%3D12484684623adf78%26hb_bidder_openx%3Dopenx%26hb_cache_path%3D%252Fpbc%252Fv1%252Fcache%26hb_format%3Dbanner%26hb_size%3D160x600%26hb_pb%3D0.26%26hb_adid%3D1302f4b44abd6dde%26hb_bidder%3Dvidazoo%26bid_type%3Dclient&cust_params=pf_src%3Dml%26li-module-enabled%3Dt1-e0%26cc-intent-id%3D469762048%252C218890240%26cc-iab-class-id%3D482%252C283%26cc-iab-name%3DShopping.Children%27s%2520Games%2520and%2520Toys%252CHome%2520%2526%2520Garden.Interior%2520Decorating%26brand_safety_checked%3Dtrue%26salad%3Dchef%26dd%3Draspberry%26di%3Dpineapple%26vd%3Draspberry%26vi%3Dpineapple%26sitecont_cat%3Dgames_casual%26referrer%3Dhttps%253A%252F%252Fdqxws.tombert.com%252F%26tyche_code%3D2.2.9%26pageos_code%3D2.2.9%26hour%3D15%26day%3DMonday%26referrer_domain%3Ddqxws.tombert.com%26OS%3DLinux%2520null%26browser%3DChrome%2520133%26pagecount%3D1%26window_width%3D1600%26window_height%3D1200%26screen_orientation%3Dlandscape%26website_id%3D74068%26refresh_count%3D0%26tyche_version%3D2.2.9%26ab_test%3Dna_A%26ad_clicker%3Dfalse%26dmp_ids%3D65%26page_focus%3Dtrue&adks=2747221344&frm=20&eoidce=1&td=1&egid=50342&tan=8f061a89-9f2c-4be0-9326-91f686ac1ffb&tdf=2

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202502110101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1f::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2c608446431de76c3f2bf7c177a2e23005b86881918b426b8d77798e9a9bd321

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: dcb
google-lineitem-id: 6855579024
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Tue, 18 Feb 2025 01:31:42 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: 138492506432
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
content-length: 3036
x-xss-protection: 0
server: cafe

GET
H2 200 container.html
37b72d6b97c7dfd9803ae80ce5d25942.safeframe.googlesyndication.com/safeframe/1-0-41/html/ Frame 96D3 0
0 170ms
44ms Document
text/html 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://37b72d6b97c7dfd9803ae80ce5d25942.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202502110101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 3024
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 18 Feb 2025 01:31:41 GMT
expires: Tue, 18 Feb 2025 01:31:41 GMT
last-modified: Thu, 30 Jan 2025 19:28:58 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 bounce Show response
id5-sync.com/ 30 B
228 B 109ms
108ms Fetch
text/plain 162.19.138.117
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/bounce

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.117 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ns3216658.ip-141-95-98.eu

Software

Resource Hash

b04cd869cfd41a48c006458f71969a0eb26f33fec12f3cfe00408f8b73bf3ff8

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Tue, 18 Feb 2025 01:31:41 GMT
content-type: text/plain;charset=utf-8
vary: Origin
access-control-allow-credentials: true

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
281 B 271ms
246ms Fetch
application/json 141.95.98.64
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.64 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

00b535b786e4153d852c88494b0b67a40bc537b1d40512f65e540fb28a90a7f3

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Tue, 18 Feb 2025 01:31:41 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 288 KB
100 KB 46ms
45ms Script
application/javascript 2607:f8b0:4004:c17::61
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-FVWZ0RM4DH&l=audDataLayer

Requested by

Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

4b2095f6a1d19696857e55f09cc93dc6a3ce13119d43e3a35ccf4235dd05718a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1003:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1003:0"}],}
expires: Tue, 18 Feb 2025 01:31:41 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 18 Feb 2025 01:31:41 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1003:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1003:0
content-length: 102720
x-xss-protection: 0
server: Google Tag Manager

POST
H2 200 483.json Show response
id5-sync.com/g/v2/ 853 B
1 KB 180ms
174ms Fetch
application/json 162.19.138.117
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/g/v2/483.json

Requested by

Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.117 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ec2-52-202-124-0.compute-1.amazonaws.com

Software

Resource Hash

44259fa2db59ac44b46e3d48009955478cb00008bb55bb0d3568ed7b1d7a6dda

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Tue, 18 Feb 2025 01:31:41 GMT
content-type: application/json
vary: Origin

POST
H2 204 collect Show response
a.ad.gt/api/v1/ 0
89 B 172ms
167ms XHR
text/plain 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://a.ad.gt/api/v1/collect
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Content-type: text/plain
Referer: https://paint.toys/

Response headers

cf-ray: 913a42522a7519bf-EWR
access-control-allow-origin: https://paint.toys
cf-cache-status: DYNAMIC
date: Tue, 18 Feb 2025 01:31:41 GMT
vary: Origin
server: cloudflare
access-control-allow-credentials: true

GET
H2 204 getpixels Show response
pixels.ad.gt/api/v1/ 0
88 B 376ms
170ms Script
text/plain 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://pixels.ad.gt/api/v1/getpixels?tagger_id=edcc42ebc2b19550d2248e1d537f3ab2&url=https%3A%2F%2Fpaint.toys%2Foil%2F&code=%27none%27
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 913a4253bb6442d5-EWR
cf-cache-status: DYNAMIC
date: Tue, 18 Feb 2025 01:31:42 GMT
server: cloudflare

POST
H2 200 match Show response
seg.ad.gt/api/v2/ 846 B
259 B 167ms
165ms XHR
application/json 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://seg.ad.gt/api/v2/match
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 15bcced8f5b25e8a168420c2ca1d665e0eafa188311824fabd128d8aaac1ee5a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Content-type: application/json
Referer: https://paint.toys/

Response headers

access-control-expose-headers: *
content-encoding: br
cf-cache-status: DYNAMIC
cf-ray: 913a4253bd1780cd-EWR
access-control-allow-origin: *
date: Tue, 18 Feb 2025 01:31:42 GMT
content-type: application/json
vary: origin, access-control-request-method, access-control-request-headers, accept-encoding
server: cloudflare

GET
H3

200

setuid
prebid.intergient.com/
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dappnexus%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%24UID
https://prebid.intergient.com/setuid?bidder=appnexus&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=4074714444682889800

86 B
863 B

57ms
57ms

Image
image/png

2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://prebid.intergient.com/setuid?bidder=appnexus&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=4074714444682889800
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H3
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1739842301&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=opjg1q03mQG5khUJSTQKEv17%2FhYIb561QBoSuWuGt%2F0%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Tue, 18 Feb 2025 01:31:41 GMT
content-type: image/png
vary: Origin
priority: u=3,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1739842301&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=opjg1q03mQG5khUJSTQKEv17%2FhYIb561QBoSuWuGt%2F0%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 vegur
cf-ray: 913a42529e0072a5-EWR
server: cloudflare

Redirect headers

cache-control: no-store, no-cache, private
location: https://prebid.intergient.com/setuid?bidder=appnexus&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=4074714444682889800
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 208.252.80.15; 208.252.80.15; 1041.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 29e7c616-0a30-4b9a-8f30-5f558266676c
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Tue, 18 Feb 2025 01:31:41 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

OPTIONS
H2 200 match
seg.ad.gt/api/v2/ Frame 0
0 254ms
145ms Preflight 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://seg.ad.gt/api/v2/match
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: *
access-control-allow-methods: *
access-control-allow-origin: *
allow: POST
cf-cache-status: DYNAMIC
cf-ray: 913a4252dc4c80cd-EWR
date: Tue, 18 Feb 2025 01:31:42 GMT
server: cloudflare
vary: origin, access-control-request-method, access-control-request-headers

POST
H3 204 AGSKWxVUB25u5_gcwQD6btqW_rTCGQJKGDNdDi5H1E__vEGOJjXkIqKp9eDiCQ3rDetsjwWRSY9T3yjoV53Gow63U7oevB4RDPZlpS4x2viH5ri-D2cKpooF-5ms1KsSmyvdmDVg6Jd_bA== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 55ms
54ms XHR
text/html 2607:f8b0:4004:c09::65
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxVUB25u5_gcwQD6btqW_rTCGQJKGDNdDi5H1E__vEGOJjXkIqKp9eDiCQ3rDetsjwWRSY9T3yjoV53Gow63U7oevB4RDPZlpS4x2viH5ri-D2cKpooF-5ms1KsSmyvdmDVg6Jd_bA==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::65 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-kAoNtVHiGn1EmnVVK6nRyQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 18 Feb 2025 01:31:41 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzj0tDikmLw0ZBi-FB_mfUHEDN8vcLKAcQnXa6yXgTiy0B8G4iFeDj-Hj2_l03gx_G785mVXJLyC-OT8_NKUvNKdBNTinVB7KLMpNKS_CIUdmoZSEVOfnp6Zl56vJGBkamBkaGxnoF5fIEBAI4mMO0"
content-security-policy: script-src 'report-sample' 'nonce-kAoNtVHiGn1EmnVVK6nRyQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

POST
H3 204 AGSKWxVUB25u5_gcwQD6btqW_rTCGQJKGDNdDi5H1E__vEGOJjXkIqKp9eDiCQ3rDetsjwWRSY9T3yjoV53Gow63U7oevB4RDPZlpS4x2viH5ri-D2cKpooF-5ms1KsSmyvdmDVg6Jd_bA== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 54ms
53ms XHR
text/html 2607:f8b0:4004:c09::65
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxVUB25u5_gcwQD6btqW_rTCGQJKGDNdDi5H1E__vEGOJjXkIqKp9eDiCQ3rDetsjwWRSY9T3yjoV53Gow63U7oevB4RDPZlpS4x2viH5ri-D2cKpooF-5ms1KsSmyvdmDVg6Jd_bA==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::65 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-HihgN07tj87g_1wfv8ZQWw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 18 Feb 2025 01:31:41 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzj0tDikmII0JBi-FB_mfUHEDN8vcLKAcQnXa6yXgTiy0B8G4iFeDj-Hj2_l03gxITT85mVXJLyC-OT8_NKUvNKdBNTinVB7KLMpNKS_CIUdmoZSEVOfnp6Zl56vJGBkamBkaGxnoF5fIEBAGzuMHg"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-HihgN07tj87g_1wfv8ZQWw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H3 200 AGSKWxXxo518hV6KRvcm66zoaQXq7ZSITcc1i_MhxZlMaCqLNskbO5klW4sYz_buTvQAeOG-5AeRsFh3FexfANNNf543A8tygUz-i3c1Xmzcx0GMsA_-PnYqkG3dc0s5DJ26nYyJqCcZmQ== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 77ms
76ms Script
application/javascript 2607:f8b0:4004:c09::65
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxXxo518hV6KRvcm66zoaQXq7ZSITcc1i_MhxZlMaCqLNskbO5klW4sYz_buTvQAeOG-5AeRsFh3FexfANNNf543A8tygUz-i3c1Xmzcx0GMsA_-PnYqkG3dc0s5DJ26nYyJqCcZmQ==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzM5ODQyMzAxLDg0MzAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOSw2XSxudWxsLDIsbnVsbCwiZW4iLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCwxXSwiaHR0cHM6Ly9wYWludC50b3lzL29pbC8iLG51bGwsW1s4LCJsLTczTUdzcnhUTSJdLFs5LCJlbi1VUyJdLFsyMCwiW251bGwsbnVsbCxbMzEwODIyNTNdLG51bGwsMTFdIl0sWzI2LCIxMSJdLFsxOSwiMiJdLFsxNywiWzBdIl0sWzI0LCJkcXh3cy50b21iZXJ0LmNvbSJdLFsyNSwiW1szMTA4MjI1M11dIl1dXQ

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::65 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

0c7f30d78826e097fddf24729604e16ebc0c044de27fc2665fe9ba225600777d

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-ICw9OM7ClmW6rljUPjaSEg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 18 Feb 2025 01:31:41 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjitDikmLw0JBiaL15jnU6EButPc_qAsSGCpdYnYH4_rpLrM-B-EP9ZdYfQFwkcYW1BYgZvl5h5QDiky5XWS8C8WUgvg3EVb-usjYBsRAPx9-j5_eyCbz493IFs5JGUn5hfHJ-XklRZlJpSX5RWnJaanFqUVlqUbyRgZGpgZGhsZ6BWXyBAQDN7z0l"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-ICw9OM7ClmW6rljUPjaSEg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H2 422 v1
match.sharethrough.com/FGMrCMMc/ 0
228 B 141ms
45ms Image
text/plain 52.202.124.0
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://match.sharethrough.com/FGMrCMMc/v1?redirectUri=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dsharethrough%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%24UID

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.202.124.0 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
content-length: 0

POST
H3 204 AGSKWxV09AqQ26OVBnQ-Xy7w-b6h1eo32LfEON80Gvr5Pd5pt0MbD6dchqS2mktZr1HgWy929oifqyrhdSt4tLWfxF5YbopRRMnTK-BRxUvhGyF1IbEaE97mKDbHw82nCfmxDZeAEkDcRA== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 73ms
72ms XHR
text/html 2607:f8b0:4004:c09::65
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxV09AqQ26OVBnQ-Xy7w-b6h1eo32LfEON80Gvr5Pd5pt0MbD6dchqS2mktZr1HgWy929oifqyrhdSt4tLWfxF5YbopRRMnTK-BRxUvhGyF1IbEaE97mKDbHw82nCfmxDZeAEkDcRA==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::65 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-uMkaQgOa_9XXX5ueaQDrPQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 18 Feb 2025 01:31:41 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzj0tDikmJw1pBi-FB_mfUHEDN8vcLKAcQnXa6yXgTiy0B8G4iFeDj-Hj2_l03gx6wvx5iVXJLyC-OT8_NKUvNKdBNTinVB7KLMpNKS_CIUdmoZSEVOfnp6Zl56vJGBkamBkaGxnoF5fIEBAI5zMPU"
content-security-policy: script-src 'report-sample' 'nonce-uMkaQgOa_9XXX5ueaQDrPQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

POST
H3 200 243cc92d47a0716379721791fca9d2ff5619aa9a4611235e7ee
faucetfoot.com/aa8f91386ab7bc6/ 2 B
28 B 134ms
52ms Ping
application/json 2600:1901:0:2b4c::1
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL

https://faucetfoot.com/aa8f91386ab7bc6/243cc92d47a0716379721791fca9d2ff5619aa9a4611235e7ee

Requested by

Host: faucetfoot.com
URL: https://faucetfoot.com/bundles/695feb6450/55fa41bc8192edc6749bd247bf408a8e957c8b.bundle.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2600:1901:0:2b4c::1 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Resource Hash

4355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

x-buildname: hoothoot
access-control-allow-methods: POST, OPTIONS
x-hostname: fen-hoothoot-us-east1-8xr3
expires: Tue, 18 Feb 2025 01:31:41 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 18 Feb 2025 01:31:42 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding, Origin
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Cookie
strict-transport-security: max-age=15724800; preload
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
access-control-allow-credentials: true
x-datacenter: gce-us-east1
via: 1.1 google
access-control-allow-origin: https://paint.toys
x-buildnumber: 1657128696
content-length: 2

POST
H2 200 v3 Show response
id5-sync.com/gm/ 921 B
1 KB 219ms
216ms XHR
application/json 162.19.138.117
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/gm/v3

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.117 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

8dbdd45db313a7abec2bc4bab47e52dbdf2431ea0cf11f14edea32fcc3c40457

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Tue, 18 Feb 2025 01:31:42 GMT
content-type: application/json
vary: Origin

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 7809 0
0 80ms
79ms Fetch
image/gif 2607:f8b0:4004:c1f::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsv4SZNeT2huXT2Z9q6on4temSfwgD1_bhaq3bqaCdCy_ggErWJMJIjM1vR6EpmSPUKk2GGBKxIQNW_ENGiMwbQQOYBt9UVZ6rfovrvULF3RK3A_LuctJzVD4yDQiLFE_NXpPWUF_r5sTZQUYXsJ4feCZZVwu706elzwgMeXjG7j5TH5OhUhfiT2aUmKoab37t0AJnczB81sKlOncdpdDrjlLYKXYgK13t9b_xuxNHA9tWFHjUqLjP_oO0OGdKKLjDDwt8h95uQKmMUu1xMtJ7HiISSYIbZFfLW-WTrcDjXXO1MKyi5IwdyvoyeMlFreqsKi8JzJkaEINj7zGwTSBqPAn2ZBiwWhXh_b4Q_KOhiYX3TXk-NOp1obCS-XiyXctXddeuMZ3eV6ShXYx4bMgyBoeQL3T5KRHXks4dwV76T8U11y6wsYXs_-bnx9FQfAg1wiGAZW9wanvfxaw0xqaTxmXexsojA9OKi0T8OHoLqWfzJLjkdQaR2FbI_L0dS6jtFDv8qy-XDWAShFFkWCJEwwGwWF0SruRIYgwZTINZ_-CdTfUnvSVG2qHpk414sK_L14Dyy53kKpbYiT_TH2DKZ-khmC&sai=AMfl-YQ7iuC7sH0pcMqNH5sR47Men25MeVp5TwOcnGu5AR_QxyFEv2nDpIaQbzcFCCU7gj2FlinqF-NKCM9y8Vl6R3TKIg1ATdbqOXxdS_ueuoNZ7Z2_-vd1rVlvfSI&sig=Cg0ArKJSzFeNfwzpaKlcEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Host: dqxws.tombert.com
URL: https://dqxws.tombert.com/crbywxwzvRaHlzZEZEbXFMMnV6R3poSmVJRWUtMTc2NS0yNjcxNjAxOS0wZmZhMDI3NC0yNDM0LWRLZHBWSmFwbFJZMjhSMG5wU2dI/c1mhpt6x8ah/jpnflt

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1f::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Tue, 18 Feb 2025 01:31:42 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H/1.1 200
OK js Show response
mpd.mxptint.net/1/S1/G1/T83/ Frame 7809 2 KB
2 KB 237ms
41ms Script
text/javascript 38.98.69.170
COGENT-174

General

Check archive.org

Download Go to

Full URL

https://mpd.mxptint.net/1/S1/G1/T83/js?siz=160x600&cpd=334632&ssl=1&mid=B35EB9_123E7233E_8257C9A&bp=0.4666529&dm=48E3D5BE379758C60B19422361F1F915&ri=0&adid=1&uuid=BIPCt-ilqVP9w1ebCtTsHDA&gve=B2D1E0914D684F09EB68F9C6E145DD81&ghc=65CB7D1A0023&pub=159988&dt=2&sppm=0.466653&clb=

Requested by

Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

38.98.69.170 North Bergen, United States, ASN174 (COGENT-174, US),

Reverse DNS

Software

Resource Hash

1e55d173a6d5e999c0365405a304350d53b011f27d67b9a28a98b43a00a8a26f

Security Headers

Name	Value
Strict-Transport-Security	max-age=-422847102; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Strict-Transport-Security: max-age=-422847102; includeSubDomains
Cache-Control: no-cache
Pragma: no-cache
Expires: -1
P3P: CP="NON CUR ADM DEVo PSAo PSDo OUR IND UNI COM NAV DEM STA PRE"
Content-Length: 2033
Date: Tue, 18 Feb 2025 01:31:41 GMT
Content-Type: text/javascript; charset=utf-8
Vary: Origin

GET
H2 200 widget.serverless.js Show response
static.vidazoo.com/basev/wgt/odin/1.0.17/ Frame 7809 173 KB
47 KB 236ms
68ms Script
application/javascript 2a04:4e42:4f::820
FASTLY

General

Check archive.org

Download Go to

Full URL: https://static.vidazoo.com/basev/wgt/odin/1.0.17/widget.serverless.js
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:4f::820 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 84c35a3865d2b995861424b2bf1fa123a36ad19b6c5aaccd40f31d6bd3b1df92

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-expose-headers: Origin,Accept,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Length,Accept-Language,Accept-Encoding,Referer,Range
content-encoding: gzip
etag: "07577ce4b8f8b89723a0d1299e3f93d3"
age: 129813
access-control-allow-methods: GET,OPTIONS,HEAD
x-cache: HIT, HIT
date: Tue, 18 Feb 2025 01:31:42 GMT
last-modified: Tue, 28 Jan 2025 13:30:51 GMT
x-served-by: cache-iad-kcgs7200162-IAD, cache-ewr-kewr1740051-EWR
x-cache-hits: 32, 3302
content-type: application/javascript
x-amz-id-2: A/AG4LROZWYCH8e5nCuTjnD+EB1qDv15nilJnABdJ4OtcNd7cgiBzNpLTTu8YBbaAZN6pMLY2lF/uK8pOKV46n1sbfeQtOPQmmB2o31pfaM=
access-control-allow-headers: Origin,Accept,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Length,Accept-Language,Accept-Encoding,Referer,Range
vary: Accept-Encoding
x-ioriver: Fastly
x-timer: S1739842302.284784,VS0,VS0,VE0
via: 1.1 varnish, 1.1 varnish
x-amz-request-id: 1M6JKH9XCJQ9RGWS
accept-ranges: bytes
access-control-allow-origin: *
content-length: 47667
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 7809 217 KB
67 KB 36ms
35ms Script
text/javascript 2607:f8b0:4004:c06::9b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202502110101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c06::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0329901e051004607d2a93c6e46bb4d831ad2c3e43b14a6615093e507bde9515

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 8897683182947181450
age: 898
x-content-type-options: nosniff
expires: Tue, 18 Feb 2025 02:16:44 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Tue, 18 Feb 2025 01:16:44 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 68447
x-xss-protection: 0
server: cafe

GET
H2 200 syncframe
gum.criteo.com/ Frame 1582 0
0 53ms
52ms Document
text/html 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=criteoPrebidAdapter&topUrl=paint.toys&gpp=

Requested by

Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 18 Feb 2025 01:31:41 GMT
server: Kestrel
server-processing-duration-in-ticks: 4868438
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding
x-robots-tag: noindex

GET
H2 200 /
sync.cootlogix.com/api/sync/iframe/ Frame 17C3 0
0 232ms
22ms Document
text/html 159.65.219.25
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://sync.cootlogix.com/api/sync/iframe/?cid=665db4754b2ec067196b8f78&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 159.65.219.25 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
content-length: 3631
content-type: text/html
date: Tue, 18 Feb 2025 01:31:42 GMT
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"

GET
H2 200 pd
playwire-d.openx.net/w/1.0/ Frame AD9C 0
0 118ms
57ms Document
text/html 35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://playwire-d.openx.net/w/1.0/pd
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 803
content-type: text/html
date: Tue, 18 Feb 2025 01:31:41 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 208.252.80.15

GET
H2 200 user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 8B90 0
0 41ms
8ms Document
text/html 23.209.57.17
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.209.57.17 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-209-57-17.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=109536
content-encoding: gzip
content-length: 6694
content-type: text/html
date: Tue, 18 Feb 2025 01:31:42 GMT
expires: Wed, 19 Feb 2025 07:57:18 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H/1.1 200
OK async_usersync.html
acdn.adnxs.com/dmp/ Frame 945F 0
0 251ms
49ms Document
text/html 184.26.41.186
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 184.26.41.186 Billerica, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS: a184-26-41-186.deploy.static.akamaitechnologies.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Tue, 18 Feb 2025 01:31:42 GMT
ETag: W/"623de86a-cf34"
Expires: Wed, 19 Feb 2025 01:31:44 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding

GET
H2 200 sync
eb2.3lift.com/ Frame 61A8 0
0 64ms
23ms Document
text/html 52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://eb2.3lift.com/sync?
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 1093
content-type: text/html; charset=utf-8
date: Tue, 18 Feb 2025 01:31:42 GMT
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 usync.html
eus.rubiconproject.com/ Frame A0AC 0
0 59ms
22ms Document
text/html 23.48.9.103
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.html
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.48.9.103 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-48-9-103.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) /
Resource Hash

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Tue, 18 Feb 2025 01:31:42 GMT
etag: "10d-629840acea280-gzip"
last-modified: Wed, 18 Dec 2024 04:42:34 GMT
server: Apache/2.4.62 (Debian)
vary: Accept-Encoding

GET
H2 200 ixmatch.html
js-sec.indexww.com/um/ Frame 7274 0
0 225ms
41ms Document
text/html 104.18.24.18
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.24.18 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36

Response headers

age: 699
cache-control: public, max-age=14400
cf-cache-status: HIT
cf-ray: 913a4255bde44268-EWR
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Tue, 18 Feb 2025 01:31:42 GMT
expires: Tue, 18 Feb 2025 05:31:42 GMT
last-modified: Mon, 25 Jul 2022 19:18:19 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
server: cloudflare
vary: Accept-Encoding

POST
H2 200 prebid Show response
id5-sync.com/api/config/ 195 B
470 B 210ms
163ms Fetch
application/json 162.19.138.117
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.117 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ec2-34-239-69-92.compute-1.amazonaws.com

Software

Resource Hash

7e4d2c9111e1ca31b5e2e4bfd5a66925f07c0c232672f31481c6b66a89b26f16

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Tue, 18 Feb 2025 01:31:42 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
access-control-allow-credentials: true

GET
H2 200 f Show response
fid.agkn.com/ 130 B
659 B 71ms
46ms Fetch
application/javascript 34.197.17.91
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://fid.agkn.com/f?apiKey=2104320612&r=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.197.17.91 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-197-17-91.compute-1.amazonaws.com
Software: AAWebServer /
Resource Hash: cf36cd032f3c6f48b2490a8c0ab0b563484978f8d5e14a82b19a398907cb128e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 130
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
date: Tue, 18 Feb 2025 01:31:42 GMT
content-type: application/javascript;charset=iso-8859-1
vary: Origin
server: AAWebServer
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type

GET
H2 200 envelope Show response
lexicon.33across.com/v1/ 2 KB
2 KB 70ms
46ms Fetch
application/json 35.244.193.51
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0014000001YrMoYAAV&gdpr=0&src=pbjs&ver=9.11.0&coppa=0&tp=4Q7jQcfjO8T%2FVq2BhIYM9r5yUlSKI%2BKyBhAyO8eMfnQ%3D
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.193.51 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 51.193.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 7dabc4559be4a9ccd56abf97d66dfb1d5672103e400e86b08dd28b20b82cd978

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1552
date: Tue, 18 Feb 2025 01:31:41 GMT
content-type: application/json
vary: origin

GET
H2 204 any Show response
idx.liadm.com/idex/did-0046/ 0
0 14ms
14ms Fetch 52.0.159.96
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://idx.liadm.com/idex/did-0046/any?duid=8e413bd09c43--01jmbaxag6mym44v4bckr9wmav&did=did-0046&cd=.paint.toys&pu=https%3A%2F%2Fpaint.toys&resolve=nonId&resolve=uid2&resolve=index&resolve=bidswitch&resolve=pubmatic&resolve=magnite&resolve=openx&resolve=sorvrn&resolve=thetradedesk&resolve=medianet
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.0.159.96 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-0-159-96.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: max-age=3599, private
trace-id: 032c09ba80abb45c
request-time: 2
access-control-allow-credentials: true
expires: Tue, 18 Feb 2025 02:31:40 GMT
access-control-allow-origin: https://paint.toys
date: Tue, 18 Feb 2025 01:31:40 GMT
vary: Origin

GET
H2

200

sid Show response
mug.criteo.com/
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&bundle=yY2ebl9jRE9sV1gwMXNOQkVQZVQ5YlZwNWhuY0hxOHloJTJCWSUyQjBhZFBDZlE2OHVaY2lWTyUyQlolMkZtWWtnQUN...
https://mug.criteo.com/sid?cpp=bjS5g3xMVll3SC8vZHdtSEpXeGJzWU1wNTVjcnpLVXo0bFZKRUpGTnpNRThyY0tXQjhjcXl5NDBWa29KVy9aclhIRTBkN054b2U2Y2pWMmpvYkR5cEtwZ29xeWtjeGppS2RWMDY4TGtLQ3Q2WXFSeXJ1YWM2UTBXU0w3dm...

428 B
1 KB

45ms
42ms

Fetch
application/json

74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://mug.criteo.com/sid?cpp=bjS5g3xMVll3SC8vZHdtSEpXeGJzWU1wNTVjcnpLVXo0bFZKRUpGTnpNRThyY0tXQjhjcXl5NDBWa29KVy9aclhIRTBkN054b2U2Y2pWMmpvYkR5cEtwZ29xeWtjeGppS2RWMDY4TGtLQ3Q2WXFSeXJ1YWM2UTBXU0w3dm4ySnZjVnNUVkNpeUpIUS9DY1p1TkI5a0lFVU1hbEs0bFhHWEpiUk1ZNzhIb01WZnJXYjN4Nnd6eHNVZ21HNGFZdkNneENJcUExMTBhMko4MS9RTkY3Ky8zTXFVRStJSVlaM0lxeVVyR004Z1Y0RHNnU1NiOVN1aHkvQ3RYVWk5WnFTTis1LzVuSUFKK0NhYUY0U2JOM0dXZHpMMERmTEh4N3pZMWNXR2g3aHpyekNBOTd2TjFXTXdRUnB0RHhvZGlDdDVnU1FVTi9JdE9HUGZEVG90R0dPTGMzY2t4clE9PXw&cppv=2

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

c9c00d728d8bb553af49017ad372a5172a3c6972ad8bb171657efe901ff82ef1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 752429
expires: 0
access-control-allow-origin: null
date: Tue, 18 Feb 2025 01:31:42 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

Redirect headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
location: https://mug.criteo.com/sid?cpp=bjS5g3xMVll3SC8vZHdtSEpXeGJzWU1wNTVjcnpLVXo0bFZKRUpGTnpNRThyY0tXQjhjcXl5NDBWa29KVy9aclhIRTBkN054b2U2Y2pWMmpvYkR5cEtwZ29xeWtjeGppS2RWMDY4TGtLQ3Q2WXFSeXJ1YWM2UTBXU0w3dm4ySnZjVnNUVkNpeUpIUS9DY1p1TkI5a0lFVU1hbEs0bFhHWEpiUk1ZNzhIb01WZnJXYjN4Nnd6eHNVZ21HNGFZdkNneENJcUExMTBhMko4MS9RTkY3Ky8zTXFVRStJSVlaM0lxeVVyR004Z1Y0RHNnU1NiOVN1aHkvQ3RYVWk5WnFTTis1LzVuSUFKK0NhYUY0U2JOM0dXZHpMMERmTEh4N3pZMWNXR2g3aHpyekNBOTd2TjFXTXdRUnB0RHhvZGlDdDVnU1FVTi9JdE9HUGZEVG90R0dPTGMzY2t4clE9PXw&cppv=2
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 326332
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 0
date: Tue, 18 Feb 2025 01:31:41 GMT
server: Kestrel

GET
H2

200

sync
x.bidswitch.net/
Redirect Chain

https://x.bidswitch.net/sync?ssp=themediagrid
https://ads.creative-serving.com/bsw_sync?bidswitch_ssp_id=themediagrid&bsw_custom_parameter=d0c5befc-3fe9-43e1-a38a-a95c866c0ab6&gdpr=&gdpr_consent=
https://ads.creative-serving.com/ul_cb/bsw_sync?bidswitch_ssp_id=themediagrid&bsw_custom_parameter=d0c5befc-3fe9-43e1-a38a-a95c866c0ab6&gdpr=&gdpr_consent=
https://x.bidswitch.net/sync?dsp_id=4&user_id=3ee9f617-cdf6-4f0a-b115-013363da83ff&ssp=themediagrid&expires=30&user_group=5&bsw_param=d0c5befc-3fe9-43e1-a38a-a95c866c0ab6

43 B
103 B

49ms
48ms

Image
image/gif

35.211.202.130
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://x.bidswitch.net/sync?dsp_id=4&user_id=3ee9f617-cdf6-4f0a-b115-013363da83ff&ssp=themediagrid&expires=30&user_group=5&bsw_param=d0c5befc-3fe9-43e1-a38a-a95c866c0ab6
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 35.211.202.130 North Charleston, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 130.202.211.35.bc.googleusercontent.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
date: Tue, 18 Feb 2025 01:31:42 GMT
content-type: image/gif

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: https://x.bidswitch.net/sync?dsp_id=4&user_id=3ee9f617-cdf6-4f0a-b115-013363da83ff&ssp=themediagrid&expires=30&user_group=5&bsw_param=d0c5befc-3fe9-43e1-a38a-a95c866c0ab6
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 18 Feb 2025 01:31:42 GMT

GET
H2

200

ibs:dpid=903&dpuuid=06684dbc-6eee-434b-bb51-fed7d7e7a7f1
dpm.demdex.net/
Redirect Chain

https://match.adsrvr.org/track/usersync?us_privacy=&gdpr=0&gdpr_consent=undefined&ust=image
https://dpm.demdex.net/ibs:dpid=903&dpuuid=06684dbc-6eee-434b-bb51-fed7d7e7a7f1&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=903&dpuuid=06684dbc-6eee-434b-bb51-fed7d7e7a7f1&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam
https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam
https://dpm.demdex.net/ibs:dpid=903&dpuuid=06684dbc-6eee-434b-bb51-fed7d7e7a7f1

42 B
714 B

41ms
31ms

Image
image/gif

34.239.69.92
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=903&dpuuid=06684dbc-6eee-434b-bb51-fed7d7e7a7f1

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

34.239.69.92 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-va6-1-v071-08717f96d.edge-va6.demdex.com 3 ms
content-encoding: gzip
pragma: no-cache
x-content-type-options: nosniff
x-tid: L203Igw8Sbs=
expires: Thu, 01 Jan 1970 00:00:00 UTC
content-length: 59
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Tue, 18 Feb 2025 01:31:42 GMT
content-type: image/gif

Redirect headers

location: https://dpm.demdex.net/ibs:dpid=903&dpuuid=06684dbc-6eee-434b-bb51-fed7d7e7a7f1
content-length: 189
date: Tue, 18 Feb 2025 01:31:42 GMT
server: Kestrel

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 52ms
28ms Preflight
application/json 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&bundle=yY2ebl9jRE9sV1gwMXNOQkVQZVQ5YlZwNWhuY0hxOHloJTJCWSUyQjBhZFBDZlE2OHVaY2lWTyUyQlolMkZtWWtnQUN4N01OMm9QOEZKaGpvZHRQQjE4d0F5dVhlQUhRSkpGOWRUVm9wa0tneVVLQ1ZTV1lONkVWVm1BNnlDT21kRzZmSzlLQmc0JTJGeVR0TFkzOGlIR00lMkZlM25nWCUyRlo0ZVd4QSUzRCUzRA&cw=1&pbt=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://paint.toys
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Tue, 18 Feb 2025 01:31:41 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 294110
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 user_sync.html
ads.pubmatic.com/AdServer/js/ Frame EA84 0
0 39ms
37ms Document
text/html 23.209.57.17
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.209.57.17 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-209-57-17.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=109536
content-encoding: gzip
content-length: 6694
content-type: text/html
date: Tue, 18 Feb 2025 01:31:42 GMT
expires: Wed, 19 Feb 2025 07:57:18 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 join-ad-interest-groups.html
proton.ad.gt/ Frame C0F3 0
0 268ms
84ms Document
text/html 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://proton.ad.gt/join-ad-interest-groups.html
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36

Response headers

access-control-allow-origin: *
ad-auction-allowed: true
age: 1917
apigw-requestid: GJ31NjuhvHcESMg=
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 913a42565f430f9d-EWR
content-encoding: br
content-type: text/html
date: Tue, 18 Feb 2025 01:31:42 GMT
last-modified: Tue, 18 Feb 2025 00:24:52 GMT
server: cloudflare
supports-loading-mode: fenced-frame
vary: Accept-Encoding

GET
H2

200

9.gif
id5-sync.com/c/483/1241/0/
Redirect Chain

https://id5-sync.com/i/483/8.gif?o=api&id5id=ID5*TUOfYQ5lK2taJRhOE6jg4g8C4tOVBJfWy06GpjdUYjr6ZdiNJI41JAl3X2nQFrVY&gdpr_consent=undefined&gdpr=false
https://match.adsrvr.org/track/cmf/generic?ttd_pid=8h9u11h&ttd_tpi=1&gdpr=0&gdpr_consent=
https://id5-sync.com/k/264.gif?puid=06684dbc-6eee-434b-bb51-fed7d7e7a7f1&ttl=%%TTL%%
https://match.prod.bidr.io/cookie-sync/id5?us_privacy=
https://id5-sync.com/k/155.gif?puid=AAERUk7PZ8YAABVD5-nHBA&id5AccountNum=155&numCascadesAllowed=9
https://ce.lijit.com/merge?pid=27&3pid=06684dbc-6eee-434b-bb51-fed7d7e7a7f1&us_privacy=&gdpr=0&gdpr_consent=&location=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F1245%2F5%2F4.gif%3Fpuid%3D%5BSOVRNID%5D%...
https://id5-sync.com/c/483/1245/5/4.gif?puid=KMK7APZHVWHcwv8vSZqhrAPm&gdpr=0&gdpr_consent=
https://pixel.tapad.com/idsync/ex/push?partner_id=2922&partner_url=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F108%2F4%2F5.gif%3Fpuid%3D%24%7BTA_DEVICE_ID%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_con...
https://id5-sync.com/c/483/108/4/5.gif?puid=127be99b-bf18-4797-a143-444a31ee549f&gdpr=0&gdpr_consent=
https://sync.go.sonobi.com/us?loc=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F434%2F3%2F6.gif%3Fpuid%3D%5BUID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&consent=
https://id5-sync.com/c/483/434/3/6.gif?puid=e651ce9c-1a88-4d51-87db-e17222ffb3e2&gdpr=0&gdpr_consent=
https://ib.adnxs.com/getuid?https://id5-sync.com/c/483/2/2/7.gif?puid=$UID&gdpr=0&gdpr_consent=
https://id5-sync.com/c/483/2/2/7.gif?puid=4074714444682889800&gdpr=0&gdpr_consent=
https://rtb.gumgum.com/getuid/id5?r=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F441%2F1%2F8.gif%3Fpuid%3D%5BUID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=
https://id5-sync.com/c/483/441/1/8.gif?puid=u_e8dde061-e6ad-4da7-9845-c0426902db55&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=85&3pid=AAERUk7PZ8YAABVD5-nHBA&us_privacy=&gdpr=0&gdpr_consent=&location=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F1241%2F0%2F9.gif%3Fpuid%3D%5BSOVRNID%5D%26gdpr%3D0%26g...
https://id5-sync.com/c/483/1241/0/9.gif?puid=KMK7APZHVWHcwv8vSZqhrAPm&gdpr=0&gdpr_consent=

43 B
1 KB

119ms
118ms

Image
image/gif

162.19.138.117
OVH OVH SAS

General

Check archive.org

Download Go to Show image

Full URL

https://id5-sync.com/c/483/1241/0/9.gif?puid=KMK7APZHVWHcwv8vSZqhrAPm&gdpr=0&gdpr_consent=

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

162.19.138.117 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
p3p: CP="CAO PSA OUR"
date: Tue, 18 Feb 2025 01:31:43 GMT
content-type: image/gif;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers

Redirect headers

cache-control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
location: https://id5-sync.com/c/483/1241/0/9.gif?puid=KMK7APZHVWHcwv8vSZqhrAPm&gdpr=0&gdpr_consent=
pragma: no-cache
expires: Fri, 20 Mar 2009 00:00:00 GMT
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Tue, 18 Feb 2025 01:31:44 GMT
vary: Accept-Encoding

GET
H3 200 usermatch
ssum-sec.casalemedia.com/ Frame BAE5 0
0 85ms
68ms Document
text/html 104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?s=184674&gdpr=&gdpr_consent=&us_privacy=&gpp=&gppsid=&cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 913a42559b244385-EWR
content-encoding: br
content-type: text/html
date: Tue, 18 Feb 2025 01:31:42 GMT
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
priority: u=0,i
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QyVIzBfl6A8hnGe0NGJk9OQHgj0WEa1y9rKdazvzF66zRA9EF4TEeRHQCwYhQF7nRE%2FptEY%2BlbKSeUqRA0h1sUzIVF4V2sYSyAiUrc57FVH0AONczUXOKxnB34hu73kZQxTaJXZKaDLrJw%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfExtPri
vary: Accept-Encoding

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 56ms
19ms Preflight
application/json 74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Tue, 18 Feb 2025 01:31:41 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 267785
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 dcmads.js Show response
www.googletagservices.com/dcm/ Frame 7809 22 KB
10 KB 60ms
54ms Script
text/javascript 142.251.179.156
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagservices.com/dcm/dcmads.js

Requested by

Host: mpd.mxptint.net
URL: https://mpd.mxptint.net/1/S1/G1/T83/js?siz=160x600&cpd=334632&ssl=1&mid=B35EB9_123E7233E_8257C9A&bp=0.4666529&dm=48E3D5BE379758C60B19422361F1F915&ri=0&adid=1&uuid=BIPCt-ilqVP9w1ebCtTsHDA&gve=B2D1E0914D684F09EB68F9C6E145DD81&ghc=65CB7D1A0023&pub=159988&dt=2&sppm=0.466653&clb=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.179.156 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ns3216658.ip-141-95-98.eu

Software

sffe /

Resource Hash

254d4b3e4a93148d098972cdaa190594649d258e9d93c3351a1e76de5fff010a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
age: 829
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
x-content-type-options: nosniff
expires: Tue, 18 Feb 2025 02:17:53 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 18 Feb 2025 01:17:53 GMT
last-modified: Thu, 23 Jan 2025 15:42:25 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=3600
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
accept-ranges: bytes
content-length: 9339
x-xss-protection: 0
server: sffe

GET
H/1.1 200
OK dvtp_src.js Show response
cdn.doubleverify.com/ Frame 7809 8 KB
4 KB 229ms
38ms Script
text/javascript 2600:1408:5400:23::b819:7f4a
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL: https://cdn.doubleverify.com/dvtp_src.js?ctx=3891363&cmp=DV100620&sid=valassis&plc=dv_mxpt_js_disp&adsrv=0&advid=3891363&btreg=D33647_123E72347_BEB1F9&btadsrv=D33647_123E72347_BEB1F9&autt=1&dvtagver=6.1.src&ppid=224&auevent=D33647_123E72347_BEB1F9&aufilter2=IQMFV&c1=45466&c2=332794&c3=160x600
Requested by: Host: mpd.mxptint.net
URL: https://mpd.mxptint.net/1/S1/G1/T83/js?siz=160x600&cpd=334632&ssl=1&mid=B35EB9_123E7233E_8257C9A&bp=0.4666529&dm=48E3D5BE379758C60B19422361F1F915&ri=0&adid=1&uuid=BIPCt-ilqVP9w1ebCtTsHDA&gve=B2D1E0914D684F09EB68F9C6E145DD81&ghc=65CB7D1A0023&pub=159988&dt=2&sppm=0.466653&clb=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1408:5400:23::b819:7f4a Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software: /
Resource Hash: dfeedf8d2a8817c13b2b5537271e785fc1c4221c4e8e22b1ca4556dfc0f118ef

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Access-Control-Expose-Headers: *
Cache-Control: max-age=900
Content-Encoding: br
ETag: "ccc779b9656ec862c4c90739d57b666c"
Connection: keep-alive
Expires: Tue, 18 Feb 2025 01:46:42 GMT
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Length: 3225
Date: Tue, 18 Feb 2025 01:31:42 GMT
Last-Modified: Mon, 17 Feb 2025 08:52:26 GMT
Content-Type: text/javascript

GET
H/1.1 200
OK mpiv.js Show response
mpd.mxptint.net/js/ Frame 7809 5 KB
6 KB 60ms
59ms Script
application/javascript 38.98.69.170
COGENT-174

General

Check archive.org

Download Go to

Full URL

https://mpd.mxptint.net/js/mpiv.js

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

38.98.69.170 North Bergen, United States, ASN174 (COGENT-174, US),

Reverse DNS

Software

Resource Hash

1f43b59d58023fde8b5196755ae0c80b53bbccc1a361f4d2cef00f86f3ef9a9a

Security Headers

Name	Value
Strict-Transport-Security	max-age=-422847102; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Strict-Transport-Security: max-age=-422847102; includeSubDomains
Cache-Control: public
ETag: "1DB2B21C402E200"
Expires: Wed, 19 Feb 2025 01:31:39 GMT
Accept-Ranges: bytes
Content-Length: 5483
Date: Tue, 18 Feb 2025 01:31:41 GMT
Content-Type: application/javascript
Last-Modified: Wed, 30 Oct 2024 23:16:36 GMT

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
281 B 134ms
129ms Fetch
application/json 141.95.98.64
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.64 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

8acfb7b8412023eff4ee04d2419721adb69229afc4ea4c193327f6b9a3a5ad79

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Tue, 18 Feb 2025 01:31:41 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H3 200 impl_v104.js Show response
www.googletagservices.com/dcm/ Frame 7809 71 KB
27 KB 36ms
35ms Script
text/javascript 142.251.179.156
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagservices.com/dcm/impl_v104.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/dcmads.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.179.156 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a8eda1bf7f3b78a01b79865c34d7741d3237cf2d1acb90da3ab5b189b29df2a8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
age: 319500
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
x-content-type-options: nosniff
expires: Sat, 14 Feb 2026 08:46:42 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 14 Feb 2025 08:46:42 GMT
last-modified: Mon, 13 Jan 2025 15:03:03 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=31536000
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
accept-ranges: bytes
content-length: 27364
x-xss-protection: 0
server: sffe

POST
H2 200 483.json Show response
id5-sync.com/g/v2/ 853 B
1 KB 148ms
135ms Fetch
application/json 162.19.138.117
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/g/v2/483.json

Requested by

Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.117 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

fe232e8d9356e0f4730ef52317a42d6da9b55c6a4ca5074e7eb013e9e8f66bb7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Tue, 18 Feb 2025 01:31:42 GMT
content-type: application/json
vary: Origin

POST
H2 204 event Show response
p.ad.gt/api/v1/ 0
34 B 125ms
123ms XHR
text/plain 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/event
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Content-type: application/json
Referer: https://paint.toys/

Response headers

cf-ray: 913a4258582742f5-EWR
access-control-allow-origin: https://paint.toys
cf-cache-status: DYNAMIC
date: Tue, 18 Feb 2025 01:31:42 GMT
vary: Origin
server: cloudflare
access-control-allow-credentials: true

OPTIONS
H2 200 event
p.ad.gt/api/v1/ Frame 0
0 222ms
130ms Preflight
text/html 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT
access-control-allow-origin: https://paint.toys
allow: OPTIONS, POST
cf-cache-status: DYNAMIC
cf-ray: 913a42579f0342f5-EWR
content-encoding: br
content-type: text/html; charset=utf-8
date: Tue, 18 Feb 2025 01:31:42 GMT
server: cloudflare
vary: Origin

GET
H/1.1 200
OK dv-measurements7285.js Show response
cdn.doubleverify.com/ Frame 1629 431 KB
85 KB 35ms
34ms Script
text/javascript 2600:1408:5400:23::b819:7f4a
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL: https://cdn.doubleverify.com/dv-measurements7285.js
Requested by: Host: dqxws.tombert.com
URL: https://dqxws.tombert.com/crbywxwzvRaHlzZEZEbXFMMnV6R3poSmVJRWUtMTc2NS0yNjcxNjAxOS0wZmZhMDI3NC0yNDM0LWRLZHBWSmFwbFJZMjhSMG5wU2dI/c1mhpt6x8ah/jpnflt
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1408:5400:23::b819:7f4a Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software: /
Resource Hash: 1b2105e00fae52c55c864a1796a3c76d0ff06992624296622aa3fa53e77f0013

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Access-Control-Expose-Headers: *
Cache-Control: max-age=31536000
Content-Encoding: br
ETag: "5729e5b75be3b666d4e0500dba43a73b"
Connection: keep-alive
Expires: Wed, 18 Feb 2026 01:31:42 GMT
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Length: 86991
Date: Tue, 18 Feb 2025 01:31:42 GMT
Last-Modified: Mon, 17 Feb 2025 07:00:35 GMT
Content-Type: text/javascript

GET
H/1.1 204
No Content misc=v:3.0.0,rand:51269,ao:eydodHRwczovL3BhaW50LnRveXMnfQ
mpc.mxptint.net/1S29S97663593SB19AS51B28SA0S258S53SB35EB9_123E7233E_8257C9ASD33647_123E72347_BEB1F9S0%3fhttps://noredir.mxptint.net/ Frame 7809 0
186 B 180ms
36ms Image
text/plain 204.2.226.11
NTT-DATA-2914

General

Check archive.org

Download Go to Show image

Full URL

https://mpc.mxptint.net/1S29S97663593SB19AS51B28SA0S258S53SB35EB9_123E7233E_8257C9ASD33647_123E72347_BEB1F9S0%3fhttps://noredir.mxptint.net/misc=v:3.0.0,rand:51269,ao:eydodHRwczovL3BhaW50LnRveXMnfQ

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

204.2.226.11 , United States, ASN2914 (NTT-DATA-2914, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=-422847102; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Strict-Transport-Security: max-age=-422847102; includeSubDomains
Expires: -1
Cache-Control: no-cache
Pragma: no-cache
Date: Tue, 18 Feb 2025 01:31:41 GMT

GET
H2 200 showad.js
ads.pubmatic.com/AdServer/js/ Frame 5FF4 0
0 44ms
31ms Document
text/html 23.209.57.17
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/showad.js
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.209.57.17 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-209-57-17.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=150399
content-encoding: gzip
content-length: 15624
content-type: text/html
date: Tue, 18 Feb 2025 01:31:42 GMT
expires: Wed, 19 Feb 2025 19:18:21 GMT
last-modified: Wed, 13 Nov 2024 05:15:17 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 AdDisplayTrackerServlet
st.pubmatic.com/AdServer/ Frame A96B 0
0 197ms
45ms Document
text/plain 8.28.7.95
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://st.pubmatic.com/AdServer/AdDisplayTrackerServlet?operId=1&pubId=159988&siteId=984764&adId=4635259&imprId=B9E84C4B-EC06-4746-8B35-C1DDAC6CEF18&cksum=4100B5DDDECEC72B&adType=10&adServerId=243&kefact=0.396989&kaxefact=0.396989&kadNetFrequecy=0&kadwidth=160&kadheight=600&kadsizeid=10&kltstamp=1739842301&indirectAdId=0&adServerOptimizerId=2&ranreq=0.1&kpbmtpfact=0.466653&dcId=2&tldId=0&passback=0&svr=BIDVA20136&adsver=_2138058407&adsabzcid=0&cls=BID&i0=0x2100000000000000&ekefact=_eKzZ0xvBQD58eeVrieQXONQaEI5Hl_51ZnZPc4etwaYpehd&ekaxefact=_eKzZ1dvBQDLUbWh1TCiW70W3SddyAwa6arM6ToSXUq-6JhI&ekpbmtpfact=_eKzZ2JvBQAKCVAgvmro0uAAYTv8enUD2Aio4AdF3CahpNEb&enpp=_eKzZ2tvBQDAACzr0d4NXEHhpOG_xSdNd27Ufcj8Q4mMOUpl&pmr_m=_eKzZ3VvBQDztz_67flj_qzzZQEG55h3fcGIdLvyM_XSO3L_&mdsp=_eKzZ4BvBQAXdhKj2RsmS9pvQwXSqu4ECPZLQqKTPIcm9TWK&pfi=1&domId=12914365086030784464&dc=VA1&pubBuyId=24640&crID=334632_160x600&lpu=skyrizi.com&ucrid=10510785847702045067&wAdType=10&campaignId=22772&creativeId=0&pctr=0.000000&wDSPByrId=1&wDspId=52&wbId=0&wrId=0&wAdvID=1211224&wDspCampId=45466&isRTB=1&rtbId=D96329CB-BB2A-4D97-AA52-B85783D1C0E0B&ver=29&dateHr=2025021801&usrgen=0&usryob=0&layeringebl=1&usrip=208.252.80.15&gctry=us&greg=ny&uid=0&mid=0&wccookied=0&qpsladszid=10&oid=B9E84C4B-EC06-4746-8B35-C1DDAC6CEF18&country=US&cntryId=232&domain=paint.toys&sec=1&pAuSt=2&wops=0&sURL=paint.toys&BrID=5&oiabdvt=2&te=1
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.95 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36

Response headers

access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
content-length: 0
date: Tue, 18 Feb 2025 01:31:42 GMT
expires: 0
pragma: no-cache

POST
H/1.1 204
No Content bid_won
exchange.cootlogix.com/api/v1/ Frame 7809 0
347 B 90ms
83ms Ping
text/plain 209.38.60.172
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/api/v1/bid_won
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 209.38.60.172 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Tue, 18 Feb 2025 01:31:42 GMT
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control

POST
H2 200 aggregate_beacon
bisrtb.cootlogix.com/ Frame 7809 0
183 B 172ms
57ms Ping
text/plain 2604:a880:400:d1::94be:3001
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://bisrtb.cootlogix.com/aggregate_beacon
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2604:a880:400:d1::94be:3001 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

access-control-allow-origin: *
p3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Tue, 18 Feb 2025 01:31:42 GMT
content-type: text/plain
access-control-allow-headers: *

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7809 0
0 114ms
111ms Fetch
image/gif 2607:f8b0:4004:c06::9b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Tue, 18 Feb 2025 01:31:42 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 7809 0
0 46ms
46ms Fetch
image/gif 2607:f8b0:4004:c1f::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjss1wXLZ1-yR8Ye40HWEpi_KLEmh6341X32bMyIJ7-WVZf0n6dToBD74NCg9y5xqmUAX0A3gOxxqySKwFOiD_QMFfK0BjzMYtylJXB6EDVzamanOOLjSCHcGZde7Rso8M_tBxv18yBcjYyJJKoQfQQ-IClO91yveYNjQoAnN3OUvwJfFp1GlSUdY1i5fr5Khe9iLLwTsQbH82NlZ25LWR-FFLxvZYRbJoyFr2nk-dQR8BUzbHV9RTWqvc8R3i8jIXPR4Je3cwqxIL8gFn9D2AZF2yhWqn7b8lestPX2BJTRU1jfqVj8GzgNRg5ZT7clLHN4pc-o9w7Uw3xd_UYv6eHG44L2BGOKVUgjiDEZCktyAhRzU3VH6BrYaQBhes71PW1ozMDVH073sn7Kmq_sPlseETmiPxABLUTLevMtw-4BCbqKOJBz5iGiUIoyeMuONEmmSg5S9D3urJVpS6zTDg0WBwlsKJdsT5jNwYRC3-evRgKTCFaQJ3plow5QYMYUbbt6fMhsiaDAlCU9wNBU_qi351Ie8Mpjbjy1MdMxk5Mu3cFVfPmwd49jkR0bhRIE099smmEXu2pD-vqGuH5few1056y20fq8&sai=AMfl-YTetJSRdzGCOYW5yh92_YMwBLFu02w1Aa5rUlbKsXNIxIaumYzeiu0jOY5xNIgLN3ZXIt4fU3GvJN57qryPGFBWxEF4DoFGG_9qpuU0-pBo-t-npz0CCfSmmTw&sig=Cg0ArKJSzDrnJGvQaiubEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1f::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Tue, 18 Feb 2025 01:31:42 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Tue, 18 Feb 2025 01:31:42 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7809 0
0 67ms
67ms Fetch
image/gif 2607:f8b0:4004:c06::9b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Tue, 18 Feb 2025 01:31:42 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
DATA 200
OK truncated
/ Frame 7809 210 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f59a9ffec05cc47efb259287002d992c1cce39fb1598fa118feee192e7c05d16

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H2 200 cm
u.openx.net/w/1.0/ Frame 25BA 0
0 54ms
53ms Document
text/html 35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 549
content-type: text/html
date: Tue, 18 Feb 2025 01:31:42 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
via: 1.1 google

GET
H/1.1 200
OK visit.js Show response
tps.doubleverify.com/ Frame 1629 2 KB
962 B 395ms
111ms Script
text/javascript 35.201.101.243
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://tps.doubleverify.com/visit.js?gdpr=&gdpr_consent=&flvr=0&ttmms=181&ttfrms=36&brid=96&bridua=3&bds=1&tstype=2&eparams=DC4FC%3Dl9EEADTbpTauTauA2%3A%3FE%5DE%40JDTau%40%3A%3DTauU2%3F4r92%3A%3Fl9EEADTbpTauTauA2%3A%3FE%5DE%40JDTar9EEADTbpTauTauA2%3A%3FE%5DE%40JD&srcurlD=0&aUrlD=0&ssl=https:&dfs=258&ddur=230&uid=1739842302786503&jsCallback=dvCallback_1739842302786254&dvtagver=6.1.src&navUa=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F133.0.0.0%20Safari%2F537.36&htmlmsging=1&chro=1&hist=2&winh=1200&winw=1600&wouh=1200&wouw=1600&scah=1200&scaw=1600&jsver=7285&tgjsver=7285&lvvn=28&m1=96&refD=1&referrer=https%3A%2F%2Fpaint.toys%2Foil%2F&fwc=0&fcl=1801&flt=0&fec=152&fcifrms=26&brh=2&dvp_epl=139&noc=48&nav_pltfrm=Linux%20x86_64&ctx=3891363&cmp=DV100620&sid=valassis&plc=dv_mxpt_js_disp&btreg=D33647_123E72347_BEB1F9&btadsrv=D33647_123E72347_BEB1F9&adsrv=0&advid=3891363&c1=45466&c2=332794&c3=160x600&errorURL=https://tps.doubleverify.com/visit.jpg&ppid=224&auevent=D33647_123E72347_BEB1F9&aufilter2=IQMFV&autt=1&mib=0&dvp_rcp=2&dvp_htec=2&dvp_seem=2&dvp_tuk=1&dvp_sukv=301195487965.17377&ee_dp_sukv=301195487965.17377&dvp_tukv=23331618787.397335&ee_dp_tukv=23331618787.397335&dvp_tuid=626635169517&jurtd=2812833387
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements7285.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.101.243 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 243.101.201.35.bc.googleusercontent.com
Software: /
Resource Hash: f7655b4d008c9f75c13db012c2720f2c99d58168ca54d1431604f4fa8fd2312e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Transfer-Encoding: chunked
Cache-Control: max-age=0
Timing-Allow-Origin: *
Content-Encoding: br
Pragma: no-cache
Connection: keep-alive
Expires: 02/17/2025 01:31:43
Date: Tue, 18 Feb 2025 01:31:43 GMT
Content-Type: text/javascript
Vary: Accept-Encoding

GET
H2 200 sync
eb2.3lift.com/ Frame CC22 0
0 30ms
29ms Document
text/html 52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 1644
content-type: text/html; charset=utf-8
date: Tue, 18 Feb 2025 01:31:43 GMT
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H/1.1 200
OK / Show response
mpp.mxptint.net/2/24992/ Frame 1629 43 B
266 B 350ms
91ms Fetch
image/gif 38.99.107.13
COGENT-174

General

Check archive.org

Download Go to

Full URL

https://mpp.mxptint.net/2/24992/?impid=D33647_123E72347_BEB1F9

Requested by

Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements7285.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

38.99.107.13 Santa Clara, United States, ASN174 (COGENT-174, US),

Reverse DNS

Software

Resource Hash

98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Security Headers

Name	Value
Strict-Transport-Security	max-age=-422847103; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Strict-Transport-Security: max-age=-422847103; includeSubDomains
Expires: -1
Cache-Control: no-cache
Content-Length: 43
Pragma: no-cache
Date: Tue, 18 Feb 2025 01:31:42 GMT
Content-Type: image/gif

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 7809 42 B
65 B 48ms
48ms Fetch
image/gif 2607:f8b0:4004:c06::9b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsu3EQXqkg78jQuss2o9iDOUCuexZ97lmL2c-C2_WBnDSy60OfmexBOFzoXPmGe6wIfvX3Kq_wHwtdChpsTHKOTlgri_CSUlOeaw8I1Ngbye8xknolWd47nPDmYUDubTT1QCikQRGL6imuLd7BVVpNi9wvhyXCOE9JVVBK2P4kuKe8vc&sig=Cg0ArKJSzImeQV064fmNEAE&id=lidar2&mcvt=1000&p=313,20,917,180&tm=1050&tu=50.40000009536743&mtos=0,1000,1000,1000,1000&tos=0,1000,0,0,0&v=20250212&bin=7&avms=nio&bs=1600,1200&mc=0.99&vu=1&app=0&itpl=19&adk=2747221344&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=3577510200&rst=1739842302089&rpt=563&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&fle=0&vae=0&spb=0&sfl=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Tue, 18 Feb 2025 01:31:43 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 266ms
264ms Fetch
text/plain 2607:f8b0:4004:c17::65
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-VJBRK9986D&gtm=45je52d0v9101576445za200&_p=1739842299417&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101732279~101732281~102067808~102482433~102539968~102558064~102587591~102605417~102640600&cid=1751889487.1739842300&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=AEA&_s=2&sid=1739842299&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Fdqxws.tombert.com%2F&dt=Paint%20with%20Oils&en=scroll&epn.percent_scrolled=90&_et=7&tfd=6186
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c17::65 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to: {"group":"ascnsrsggc:86:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:86:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 18 Feb 2025 01:31:44 GMT
content-type: text/plain
server: Golfe2

POST
H2 200 aggregate Show response
bis5.vidazoo.com/ Frame 7809 0
183 B 221ms
48ms XHR
text/plain 2604:a880:400:d1::3b3c:b001
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://bis5.vidazoo.com/aggregate
Requested by: Host: static.vidazoo.com
URL: https://static.vidazoo.com/basev/wgt/odin/1.0.17/widget.serverless.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2604:a880:400:d1::3b3c:b001 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: https://paint.toys/

Response headers

access-control-allow-origin: *
p3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Tue, 18 Feb 2025 01:31:45 GMT
content-type: text/plain
access-control-allow-headers: *

GET
H/1.1 200
OK / Show response
mpp.mxptint.net/2/24993/ Frame 1629 43 B
266 B 92ms
91ms Fetch
image/gif 38.99.107.13
COGENT-174

General

Check archive.org

Download Go to

Full URL

https://mpp.mxptint.net/2/24993/?impid=D33647_123E72347_BEB1F9

Requested by

Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements7285.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

38.99.107.13 Santa Clara, United States, ASN174 (COGENT-174, US),

Reverse DNS

Software

Resource Hash

98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Security Headers

Name	Value
Strict-Transport-Security	max-age=-422847105; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Strict-Transport-Security: max-age=-422847105; includeSubDomains
Expires: -1
Cache-Control: no-cache
Content-Length: 43
Pragma: no-cache
Date: Tue, 18 Feb 2025 01:31:44 GMT
Content-Type: image/gif

GET
H/1.1 200
OK / Show response
mpp.mxptint.net/2/24994/ Frame 1629 43 B
266 B 161ms
95ms Fetch
image/gif 38.99.107.13
COGENT-174

General

Check archive.org

Download Go to

Full URL

https://mpp.mxptint.net/2/24994/?impid=D33647_123E72347_BEB1F9

Requested by

Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements7285.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

38.99.107.13 Santa Clara, United States, ASN174 (COGENT-174, US),

Reverse DNS

Software

Resource Hash

98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Security Headers

Name	Value
Strict-Transport-Security	max-age=-422847105; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Strict-Transport-Security: max-age=-422847105; includeSubDomains
Expires: -1
Cache-Control: no-cache
Content-Length: 43
Pragma: no-cache
Date: Tue, 18 Feb 2025 01:31:44 GMT
Content-Type: image/gif

POST
H2 200 fb87a4ea41 Show response
cd836371f1d.cdn.intergient.com/ 0
95 B 39ms
37ms XHR
application/octet-stream 54.81.166.120
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://cd836371f1d.cdn.intergient.com/fb87a4ea41
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/2.2.9/main.884d984457b5c04043a0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.81.166.120 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-81-166-120.compute-1.amazonaws.com
Software: nginx/1.24.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

access-control-allow-origin: *
date: Tue, 18 Feb 2025 01:31:45 GMT
content-type: application/octet-stream
server: nginx/1.24.0

POST
H/1.1 204
No Content event.png
tpsc-uw1.doubleverify.com/ Frame 1629 0
291 B 190ms
87ms Ping
text/plain 35.201.101.243
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://tpsc-uw1.doubleverify.com/event.png?impid=551279046f6e4af487cfc0e50725be23&flavor=0&gdpr=&gdpr_consent=&ee_dp_omvk=doubleverify.com-omid&ee_dp_isom=1&ee_dp_btreg=D33647_123E72347_BEB1F9&ee_dp_btadsrv=D33647_123E72347_BEB1F9&dvp_gdv2_Func=1&dvp_gdv2_Applies=0&dvp_gdv2_Succ=1&dvp_gdv2_Dur=0&dvp_gdv2_Doms=0&dvp_gdv2_Dome=0&ee_dp_alm=auto&pltm=1&iskpm=1&ismmm=1&isocm=1&dvp_atali=1&ee_dp_csc=1&ee_dp_cspf=1&ee_dp_asmm=1&vdur=397&eoid=41&te_strt=1&rtn_exec=IABViewableImpression&te_init=15&te_sup=1&te_exec=1&msrjs=7285&ee_dp_rtnevis=1&sdf=67108868&vit=2&ee_dp_mrci=1&rmi=16&tltms=230&tetms=12&msltms=62&vltms=397&sei=289&vetms=12&tuviims=217&tuviems=626&dvp_dtcov=4&sim=3&msrcanlm=456&msrcannum=4&ee_dp_tmads=2548&ee_dp_msrcanlt=8%3A1%3A(0)%2C32%3A3%3A(0%3B0%3B0)%2C64%3A1%3A(0)%2C128%3A1%3A(0)%2C256%3A1%3A(0)%2C65536%3A3%3A(0%3B0%3B0)&ee_dp_btros=32%3A3%3A(0%3B0%3B0)%2C64%3A1%3A(3)&ee_dp_btsc=32%3A3%3A(a-7-0-n%2Fimg-20-0-n%2Fiframe-26-0-n%2Fdiv-24-0-n%2Fcanvas-1-0-n%3Ba-7-0-n%2Fimg-20-0-n%2Fiframe-27-0-n%2Fdiv-24-0-n%2Fcanvas-1-0-n%3Ba-7-0-n%2Fimg-20-0-n%2Fiframe-27-0-n%2Fdiv-24-0-n%2Fcanvas-1-0-n)&ismms=80&isumms=79&nvr=6&isgmmims=80&isgmv4mims=80&elmtp=3&isbxdms=2480&b10=2501&adhgt=600&adwdth=160&norwdth=160&norhgt=600&vsos=5&ivsos=5&dvp_vsosnmr=16&ivsosm=1&dvp_mvpw=device-width&dvp_mvpis=1.0&lftb=2501&sftb=2501&msrdp=1&naral=64&vct=1&vphgt=1200&vpwdth=1600&chgt=600&cwdth=160&scrhgt=1200&scrwdth=1600&strp=99&advisonl=true&isiabvms=980&isuiabvms=980&isgmpims=79&isgmv4dpims=980&ispmxpms=980&ishvm=1&istchm=1&isascm=1&isaclkm=1&isscrlm=1&engalms=78&dvp_hdnAd=0&dvp_dpr=1&vstsz=968&ee_dp_rtneviabmi=1&ee_dp_rtneviabvi=1&ee_dp_cvcmeeid=1&metp=1&meeid=1&ee_dp_saw=160&ee_dp_sah=600&ee_dp_ald=%5B%5D&ee_dp_didchd=5&ee_dp_didchc=2&ttfurm=3437
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements7285.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.101.243 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 243.101.201.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Expires: 2025-02-17T01:31:46
Access-Control-Allow-Origin: https://paint.toys
Cache-Control: max-age=0
Date: Tue, 18 Feb 2025 01:31:46 GMT
Pragma: no-cache
Connection: keep-alive
Access-Control-Allow-Credentials: true, true

GET
H/1.1 200
OK pixel Show response
ps.eyeota.net/ 1 KB
1 KB 35ms
34ms Script
application/javascript 18.214.54.215
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://ps.eyeota.net/pixel?e_rc=1&pid=m51mh00&t=ajs&uid=user_53984582-6467-459e-adad-e77a796c8a3f_1739842300386
Requested by: Host: ps.eyeota.net
URL: https://ps.eyeota.net/pixel?pid=m51mh00&t=ajs&uid=user_53984582-6467-459e-adad-e77a796c8a3f_1739842300386
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 18.214.54.215 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-214-54-215.compute-1.amazonaws.com
Software: /
Resource Hash: 1ebc9f778aea7fab3b2bc851154c3d5f2b199687cde2e36e8ab1303274c05baf

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 1029
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Tue, 18 Feb 2025 01:31:46 GMT
Content-Type: application/javascript

GET
H3

200

362588.gif
idsync.rlcdn.com/
Redirect Chain

https://idsync.rlcdn.com/423476.gif?partner_uid=2lkvSs7sEJjvz7CSN6i1ibGFEQAtVe1Hd7-32VK9xKDk
https://match.adsrvr.org/track/cmf/generic?ttd_pid=liveramp&ttd_tpi=1
https://idsync.rlcdn.com/362588.gif?partner_uid=06684dbc-6eee-434b-bb51-fed7d7e7a7f1

42 B
60 B

68ms
68ms

Image
image/gif

35.244.154.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://idsync.rlcdn.com/362588.gif?partner_uid=06684dbc-6eee-434b-bb51-fed7d7e7a7f1
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H3
Server: 35.244.154.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.154.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store
timing-allow-origin: *
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 42
date: Tue, 18 Feb 2025 01:31:46 GMT
content-type: image/gif

Redirect headers

location: https://idsync.rlcdn.com/362588.gif?partner_uid=06684dbc-6eee-434b-bb51-fed7d7e7a7f1
content-length: 199
date: Tue, 18 Feb 2025 01:31:46 GMT
server: Kestrel

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=eyeota
https://ps.eyeota.net/match?bid=tpm4omv&uid=jrUasrLxV4pzKDWTKNLbBtD8UA8&gdpr=&gdpr_consent=

70 B
440 B

63ms
34ms

Image
image/gif

18.214.54.215
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?bid=tpm4omv&uid=jrUasrLxV4pzKDWTKNLbBtD8UA8&gdpr=&gdpr_consent=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 18.214.54.215 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-214-54-215.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Tue, 18 Feb 2025 01:31:46 GMT
Content-Type: image/gif

Redirect headers

Location: https://ps.eyeota.net/match?bid=tpm4omv&uid=jrUasrLxV4pzKDWTKNLbBtD8UA8&gdpr=&gdpr_consent=
Content-Length: 126
Date: Tue, 18 Feb 2025 01:31:46 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H2 200 qmap
sync.crwdcntrl.net/ 49 B
239 B 38ms
34ms Image
image/gif 34.236.2.33
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://sync.crwdcntrl.net/qmap?c=6387&gdpr=0&gdpr_consent=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.236.2.33 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-236-2-33.compute-1.amazonaws.com
Software: /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache
pragma: no-cache
expires: 0
access-control-allow-origin: *
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 49
date: Tue, 18 Feb 2025 01:31:46 GMT
content-type: image/gif
x-server: 10.40.60.225

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?gdpr=0&gdpr_consent=&rd=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fbid%3D7ri0rgu%26uid%3D%23PM_USER_ID
https://ps.eyeota.net/match?bid=7ri0rgu&uid=E78389D5-C023-4ACE-AEF9-5710FA70BA5B

70 B
440 B

34ms
33ms

Image
image/gif

18.214.54.215
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?bid=7ri0rgu&uid=E78389D5-C023-4ACE-AEF9-5710FA70BA5B
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 18.214.54.215 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-214-54-215.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Tue, 18 Feb 2025 01:31:46 GMT
Content-Type: image/gif

Redirect headers

location: https://ps.eyeota.net/match?bid=7ri0rgu&uid=E78389D5-C023-4ACE-AEF9-5710FA70BA5B
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
date: Tue, 18 Feb 2025 01:31:46 GMT
content-type: text/html; charset=UTF-8

GET
H/1.1

200
OK

59742
i6.liadm.com/s/
Redirect Chain

https://i.liadm.com/s/59742?bidder_id=220889&bidder_uuid=2sXVQqm7_ndxvH_jYoGh8arKS9o0n40urjbhR2hDG2no
https://i6.liadm.com/s/59742?bidder_id=220889&bidder_uuid=2sXVQqm7_ndxvH_jYoGh8arKS9o0n40urjbhR2hDG2no

43 B
576 B

221ms
39ms

Image
image/gif

2600:1f18:ed:550f:8c1c:b801:1f96:8e26
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://i6.liadm.com/s/59742?bidder_id=220889&bidder_uuid=2sXVQqm7_ndxvH_jYoGh8arKS9o0n40urjbhR2hDG2no

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

HTTP/1.1

Server

2600:1f18:ed:550f:8c1c:b801:1f96:8e26 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Cache-Control: no-store
trace-id: 61ddc8d01ff3db33
Request-Time: 0
Connection: keep-alive
Content-Length: 43
Date: Tue, 18 Feb 2025 01:31:46 GMT
Content-Type: image/gif

Redirect headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Location: https://i6.liadm.com/s/59742?bidder_id=220889&bidder_uuid=2sXVQqm7_ndxvH_jYoGh8arKS9o0n40urjbhR2hDG2no
Content-Length: 0
Date: Tue, 18 Feb 2025 01:31:46 GMT
trace-id: 51bceec964111430
Request-Time: 1
Connection: keep-alive

GET
H/1.1 200
OK /
mpp.mxptint.net/2/25001/ Frame 1629 43 B
0 91ms
90ms Fetch
image/gif 38.99.107.13
COGENT-174

General

Check archive.org

Download Go to

Full URL

https://mpp.mxptint.net/2/25001/?impid=D33647_123E72347_BEB1F9

Requested by

Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements7285.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

38.99.107.13 Santa Clara, United States, ASN174 (COGENT-174, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=-422847107; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Strict-Transport-Security: max-age=-422847107; includeSubDomains
Expires: -1
Cache-Control: no-cache
Content-Length: 43
Pragma: no-cache
Date: Tue, 18 Feb 2025 01:31:47 GMT
Content-Type: image/gif

GET
H2 200 country Show response
api.btloader.com/ 37 B
153 B 179ms
82ms Fetch
application/json 130.211.23.194

General

Check archive.org

Download Go to

Full URL: https://api.btloader.com/country?o=5150306120761344
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.23.194 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b8f0ca68362cf245f891fc09ddfa50806d195e78e196cf96ac5d9cf72be2577a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private, max-age=300, stale-while-revalidate=600, stale-if-error=600
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37
date: Tue, 18 Feb 2025 01:31:47 GMT
content-type: application/json
vary: Origin

GET
H2 200 rlink.js Show response
cdn.btmessage.com/script/ 51 KB
52 KB 166ms
65ms Script
application/javascript 2606:4700:20::681a:68d

General

Check archive.org

Download Go to

Full URL: https://cdn.btmessage.com/script/rlink.js?o=5150306120761344&bt_env=prod
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:68d -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash: 68466efadf870c8c7f0e04746a89f9cbfacc4eb7466db18a7aacf55c495ad3ac

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Origin: https://paint.toys
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 1
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=j8DM3g==, md5=GbK6sbvZuTTQPC3Raq7yZw==
cf-cache-status: HIT
etag: "19b2bab1bbd9b934d03c2dd16aaef267"
age: 291
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mftURLFKljpdVxrYLMhXOqePQSX2EZSFtMh3pryfctrrNFQ4sCMOIaSgTqjHYy1%2B1OpTP31HL5cb%2BoyJTcAHT%2FGuZIN17oZnu9sz7HIDgoq1VNfZEeSriVCUKuhKykq0P0FYqFO4KftpmmXeW%2BXw"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-encoding: identity
expires: Tue, 18 Feb 2025 01:27:08 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=9366&min_rtt=9251&rtt_var=3551&sent=5&recv=6&lost=0&retrans=0&sent_bytes=4337&recv_bytes=2288&delivery_rate=441033&cwnd=253&unsent_bytes=0&cid=ae0cb6b6428f9675&ts=77&x=0"
x-goog-stored-content-length: 52324
date: Tue, 18 Feb 2025 01:31:47 GMT
content-type: application/javascript
last-modified: Thu, 13 Feb 2025 15:51:19 GMT
vary: Accept-Encoding
x-guploader-uploadid: AHMx-iEBhw7_84Ykbr6WcFvHw5927B0JXFQD3tOzu72YN0CKvTJ8b8IYr0P156kLb_jYBhsmtdKUpGI
cache-control: public, max-age=300, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 913a4278d87743c2-EWR
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1739461879805950
content-length: 52324
server: cloudflare

GET
H2 204 pv Show response
api.btloader.com/ 0
128 B 174ms
82ms XHR
text/plain 130.211.23.194

General

Check archive.org

Download Go to

Full URL: https://api.btloader.com/pv?tid=1aHTwNfLcx-cMYahnXbR-9516aea9eb&w=5096819819806720&o=5150306120761344&cv=2.1.75-1-gb0a1279&widget=false&r=false&vr=1600x1200&pageURL=https%3A%2F%2Fpaint.toys%2Foil%2F&sid=RutmZcjDM-eBtrR6Qu-9516aea9eb&pm=false&upapi=true
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.23.194 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

via: 1.1 google
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 18 Feb 2025 01:31:47 GMT
vary: Origin

GET
H2 200 websiteconfig Show response
api.btmessage.com/ 1 KB
1 KB 108ms
106ms Fetch
application/json 2606:4700:20::681a:68d

General

Check archive.org

Download Go to

Full URL: https://api.btmessage.com/websiteconfig?bt_env=prod&o=5150306120761344&w=paint.toys&l=EN
Requested by: Host: cdn.btmessage.com
URL: https://cdn.btmessage.com/script/rlink.js?o=5150306120761344&bt_env=prod
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:68d -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash: 79bdf85a57fafefdb48d8facc2b8e042bb2cd3b3f6b3f0425f846f59bbc13673

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
etag: "86fe4722700c6db740b1af51959e1233"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3MgBbZrIlcHZVT8iuAPfeHspnbd6ErPBX4%2FhJxv%2FJx0imM33eXFbvdZtJU%2Bb%2BSR%2FuEPGgYIiqaqeCe0PH7XKSP%2Fx%2F1TD8FgWqvG54bS4qhSYFjICuQCNg4IVrObvq9pIk07RcIyvEHqXvIGvKNYW"}],"group":"cf-nel","max_age":604800}
server-timing: cfL4;desc="?proto=TCP&rtt=10292&min_rtt=9251&rtt_var=1995&sent=53&recv=15&lost=0&retrans=0&sent_bytes=58671&recv_bytes=2443&delivery_rate=2024578&cwnd=254&unsent_bytes=0&cid=ae0cb6b6428f9675&ts=212&x=0"
date: Tue, 18 Feb 2025 01:31:48 GMT
content-type: application/json
last-modified: Tue, 18 Feb 2025 01:31:48 GMT
vary: Origin, accept-encoding
cache-control: public, max-age=300, must-revalidate, stale-if-error=3600, stale-while-revalidate=300
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
via: 1.1 google
cf-ray: 913a4279591443c2-EWR
access-control-allow-origin: *
content-length: 494
server: cloudflare

GET
H2 200 favicon.ico
paint.toys/ 615 B
747 B 32ms
30ms Image
image/vnd.microsoft.icon 15.197.167.90
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/favicon.ico

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.197.167.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS