paint.toys Open in urlscan Pro
3.33.186.135 Public Scan

Software

Netlify /

Resource Hash

70883a9270d54ca9914810ee600c39f62c1147243374c8b93b7095f9c78b4b66

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://dfry.theunpackingitpodcast.com/gvnljqsquRSnpkMnRnWHg1NjQwTVFqYmIxQWYtMTIxNy0yNjcxNjI1NC0wZmFjMDI2ZC0xNzMxLU1vTTdsWjRzNXI3ZjdndERnVHZm/iz72s5fifp6/zeikvpduwpkhpolpbvovls
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 89923
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-encoding: br
content-length: 1669
content-type: text/html; charset=UTF-8
date: Mon, 20 Jan 2025 12:28:06 GMT
etag: "7afa2eee23cef4ed7f87aab76b5bc74d-ssl-df"
server: Netlify
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-nf-request-id: 01JJ1TYEN2NWSV36YGPYFGRZXT

Redirect headers

accept-ranges: bytes
age: 148275
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-length: 1663
content-type: text/html; charset=UTF-8
date: Mon, 20 Jan 2025 12:28:06 GMT
etag: "7afa2eee23cef4ed7f87aab76b5bc74d-ssl-df"
location: /oil/
server: Netlify
strict-transport-security: max-age=31536000
x-nf-request-id: 01JJ1TYEM9C29Z63XDEFFJ72EM

GET
H3 200 ramp_config.js Show response
cdn.intergient.com/1024872/74068/ 36 KB
7 KB 96ms
43ms Script
application/javascript 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.intergient.com/1024872/74068/ramp_config.js
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c50fbe361812341b77e6cf348a1ec6801a3511b8499cd68bca9081b62673b7d3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: HIT
age: 50
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: P_KIhVJJL5xII2XxmS5I_R1mgx5zz-i3w39S1GbMxtcaw4K7BwiqIQ==
date: Mon, 20 Jan 2025 12:28:06 GMT
last-modified: Mon, 20 Jan 2025 12:27:16 GMT
content-type: application/javascript
vary: Accept-Encoding
priority: u=3,i=?0
server-timing: cfExtPri
hw-country-code: SE
cache-control: max-age=600, public, must-revalidate
via: 1.1 d4f777a2d5a6d5aeb7eb6201b41775ea.cloudfront.net (CloudFront)
cf-ray: 904f0ffe5906d2f3-FRA
x-amz-cf-pop: FRA60-P2
server: cloudflare

GET
H2 200 apps.css
paint.toys/ 5 KB
1 KB 43ms
42ms Stylesheet
text/css 3.33.186.135
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://paint.toys/apps.css

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

2ff696f311f1afa7aafddb260becd45331aab7ce1741821b0f3e2d9e683382b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
content-encoding: br
etag: "58d01e65c6625681e8891f6fbc8c18f5-ssl-df"
age: 31931
accept-ranges: bytes
content-length: 1397
x-nf-request-id: 01JJ1TYENZ8S3KC4NY4CXCST97
cache-status: "Netlify Edge"; hit
date: Mon, 20 Jan 2025 12:28:06 GMT
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: Netlify

GET
H2 200 index.js Show response
paint.toys/oil/ 4 KB
1 KB 22ms
21ms Script
application/javascript 3.33.186.135
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://paint.toys/oil/index.js

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

c91c09319c4b0a24c72c0036cef74c17b85d3c4e2a4abf8153f5710421fe5b4c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
content-encoding: br
etag: "687211e2ced405124b38663a13c97091-ssl-df"
age: 89923
accept-ranges: bytes
content-length: 1207
x-nf-request-id: 01JJ1TYENZXK9QT0GDK8XW5QH5
cache-status: "Netlify Edge"; hit
date: Mon, 20 Jan 2025 12:28:06 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Netlify

GET
H2 200 art-icon.png
paint.toys/assets/ 33 KB
33 KB 22ms
22ms Image
image/png 3.33.186.135
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://paint.toys/assets/art-icon.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

f4d368e4230539c778afbb020e0ea611b3e1d984179f5b3769b44081d6703f3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "1394f8469f2ca5750397e3d7b6ec70a1-ssl"
age: 138886
accept-ranges: bytes
content-length: 33562
x-nf-request-id: 01JJ1TYENZZ4XHCJAXHNE2JEQC
cache-status: "Netlify Edge"; hit
date: Mon, 20 Jan 2025 12:28:06 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-hand.png
paint.toys/assets/ 27 KB
27 KB 41ms
40ms Image
image/png 3.33.186.135
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://paint.toys/assets/icon-hand.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

32aa05a5648678542ab9044647f0bf5549c0b53a070585edb773f0e92b72b97d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "a0822110a4671ffdf710da1467460fba-ssl"
age: 31931
accept-ranges: bytes
content-length: 27394
x-nf-request-id: 01JJ1TYENZSKGNBH9QR18WWJD5
cache-status: "Netlify Edge"; hit
date: Mon, 20 Jan 2025 12:28:06 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-disk.png
paint.toys/assets/ 13 KB
14 KB 22ms
21ms Image
image/png 3.33.186.135
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://paint.toys/assets/icon-disk.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

436814c2374a6d92a42a02d39969ef7c56b5f225667abecb218e692c5569943c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "26852fa1548a91e004629b01e4abf1dd-ssl"
age: 31931
accept-ranges: bytes
content-length: 13766
x-nf-request-id: 01JJ1TYEQCVF26FXANJYGQTGJ0
cache-status: "Netlify Edge"; hit
date: Mon, 20 Jan 2025 12:28:06 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-trash.png
paint.toys/assets/ 50 KB
51 KB 23ms
22ms Image
image/png 3.33.186.135
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://paint.toys/assets/icon-trash.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

6ceb226c487cb85243545e768944e0e1ae0944be8fde6c1c43c7314a9287e6d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "e91ef5e34b5154d392e8560031eaaa4c-ssl"
age: 103144
accept-ranges: bytes
content-length: 51680
x-nf-request-id: 01JJ1TYEQC80SAVM44EM02WR84
cache-status: "Netlify Edge"; hit
date: Mon, 20 Jan 2025 12:28:06 GMT
content-type: image/png
server: Netlify

GET
H3 200 ramp_core.js Show response
cdn.intergient.com/ 3 KB
2 KB 77ms
69ms Script
application/javascript 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.intergient.com/ramp_core.js
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 392226d460d3d1529e65894e7993818d99129e14152ffea285f3d48370c5d8ef

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-amz-cf-id: ZmjorNOfdtnuDEOAnD8HZpcnVKgtsxtz01taZBp3EKoKdcJkW04ZYQ==
date: Mon, 20 Jan 2025 12:28:06 GMT
x-lambda-function: us-east-1.pageos_production:823
content-type: application/javascript
vary: Accept-Encoding
priority: u=3,i=?0
server-timing: cfExtPri
hw-country-code: SE
cache-control: max-age=600, public, must-revalidate
via: 1.1 1aa52a2a71a599aaf6b3df3a9c53b268.cloudfront.net (CloudFront)
cf-ray: 904f0ffe5907d2f3-FRA
x-amz-cf-pop: FRA60-P2
server: cloudflare

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 324 KB
109 KB 119ms
50ms Script
application/javascript 142.250.185.104
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.104 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

72394da3eae5ac22174bc6c94bcac9713f7d285c9dee9a8e5aee39dc0feddaaa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Mon, 20 Jan 2025 12:28:06 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 20 Jan 2025 12:28:06 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 110855
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 ad8f9_1386ab7bc6243cc92d47a0716379721791fca9d2fee.index.js Show response
faucetfoot.com/assets/ 67 KB
24 KB 137ms
58ms Script
text/javascript 104.18.25.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://faucetfoot.com/assets/ad8f9_1386ab7bc6243cc92d47a0716379721791fca9d2fee.index.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.25.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a6b96d4cfbfebcd74554d574e108ae5b5b038cfaca4a203b3033b2b3d30c0957

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: MISS
etag: W/"79ee8333283ca75f74d19dc4312cd048efd67241987ea59b0e2444ef89f1e73a"
x-buildname: hoothoot
x-hostname: fen-hoothoot-europe-west1-x1l3
alt-svc: h3=":443"; ma=86400
date: Mon, 20 Jan 2025 12:28:06 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding, Accept-Language
strict-transport-security: max-age=15724800; preload
cache-control: private, must-revalidate, max-age=21600
timing-allow-origin: *
x-datacenter: gce-europe-west1
via: 1.1 google
cf-ray: 904f0fff2a4592ba-FRA
x-buildnumber: 1620028337
server: cloudflare

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 107 KB
34 KB 112ms
51ms Script
text/javascript 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

971a9a32ba5dbee916bc1771d631843f2e2ebf2675e129f92e69da228825d2bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 235 / 20108 / m202501140101 / config-hash: 11334144743454316884
x-content-type-options: nosniff
expires: Mon, 20 Jan 2025 12:28:06 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Mon, 20 Jan 2025 12:28:06 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 34281
x-xss-protection: 0
server: cafe

GET
H3 200 prebid.js.br Show response
cdn.intergi.com/prebid/ 537 KB
170 KB 96ms
60ms Script
text/javascript 104.18.24.242
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.intergi.com/prebid/prebid.js.br
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.24.242 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ed22ff09626a8ce9a201ce9b1d40e9abd1b683b369589eb203bd4c72f3211390

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"bec9736f4bb183d89435bde103fcb549"
x-amz-version-id: CisJ1TLaJ1ARWHfrd2TowoZKxH0B1Ivt
age: 1414
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: aJlQj9vsskQKkvnShHU5jDk7e24GvXe9pU0Qjakxr8DVQAwgw0wmEw==
date: Mon, 20 Jan 2025 12:28:06 GMT
content-type: text/javascript
last-modified: Wed, 11 Dec 2024 16:32:17 GMT
vary: accept-encoding
priority: u=3,i=?0
server-timing: cfExtPri
via: 1.1 22542310a4f437ba60fc308d81180ad0.cloudfront.net (CloudFront)
cf-ray: 904f0ffeedd11b36-FRA
x-amz-cf-pop: WAW51-P5
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H3 200 pageos.js Show response
cdn.intergient.com/pageos/2.1.12/ 397 B
638 B 43ms
43ms Script
text/javascript 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.intergient.com/pageos/2.1.12/pageos.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/ramp_core.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5b554d8ae95714b5ae509b73f5b11ae859814bf84a2402a47ba321b9bf3aa7ac

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"9eb70486bc5815f7a138d8adce7a9f40"
age: 329062
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: 0A8mwHHWl263Ij2y-RiWfYZbHqtm6Dz1Oa08p9RxA3JSd4iBZbZyGg==
date: Mon, 20 Jan 2025 12:28:06 GMT
content-type: text/javascript
last-modified: Thu, 16 Jan 2025 16:58:51 GMT
vary: Accept-Encoding
priority: u=3,i=?0
server-timing: cfExtPri
hw-country-code: SE
cache-control: public, max-age=31536000
via: 1.1 2696274921f0df0251827f3f8e0222cc.cloudfront.net (CloudFront)
cf-ray: 904f0ffed9fcd2f3-FRA
x-amz-cf-pop: CPH50-P1
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H3 200 runtime.05e182873598139fd53a.js Show response
cdn.intergient.com/pageos/2.1.12/ 3 KB
2 KB 42ms
42ms Script
text/javascript 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.intergient.com/pageos/2.1.12/runtime.05e182873598139fd53a.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/2.1.12/pageos.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 97596d61f954237aab2f9cd7f64c3faf5b82887db16306417392e391c4a6e6a8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"12bc854ca6fa66522ef903ab856a7eee"
age: 328992
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: FPDK2dRxAdFle5n3k5Ejf7bVHbWF6qE-LPuSHy6BD-w7KkK9J7NMHQ==
date: Mon, 20 Jan 2025 12:28:06 GMT
content-type: text/javascript
last-modified: Thu, 16 Jan 2025 16:58:51 GMT
vary: accept-encoding
priority: u=3,i=?0
server-timing: cfExtPri
hw-country-code: SE
cache-control: public, max-age=31536000
via: 1.1 09214cdb11d6af8d53ef4beca9b33e3c.cloudfront.net (CloudFront)
cf-ray: 904f0fff1adbd2f3-FRA
x-amz-cf-pop: CPH50-P1
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H3 200 main.071f1389f3e64b67af67.js Show response
cdn.intergient.com/pageos/2.1.12/ 1 MB
291 KB 50ms
50ms Script
text/javascript 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.intergient.com/pageos/2.1.12/main.071f1389f3e64b67af67.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/2.1.12/pageos.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cdd21e53795c47ddc6484b60d0fd0414744e54b23a4f7deb9b5598ed9e377b64

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"7ae0b2cdb16d540376123b8bc2420c63"
age: 329061
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: nyXLOJGmlNegkJICqpM-KXKyf0kbghTfs-Ko_j5RUPhDgKrfUeMJmw==
date: Mon, 20 Jan 2025 12:28:06 GMT
content-type: text/javascript
last-modified: Thu, 16 Jan 2025 16:58:51 GMT
vary: accept-encoding
priority: u=3,i=?0
server-timing: cfExtPri
hw-country-code: SE
cache-control: public, max-age=31536000
via: 1.1 0e07d676d3fd3e76057c8adaa3291b8a.cloudfront.net (CloudFront)
cf-ray: 904f0fff1aded2f3-FRA
x-amz-cf-pop: CPH50-P1
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202501140101/ 502 KB
156 KB 32ms
32ms Script
text/javascript 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202501140101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

786b02488bab372487274f7f85a9e21d2c23275104bbfa811f9958208d22858a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 471207979459028366
age: 73112
x-content-type-options: nosniff
expires: Mon, 19 Jan 2026 16:09:34 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Sun, 19 Jan 2025 16:09:34 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 159605
x-xss-protection: 0
server: cafe

GET
H2 200 skeleton.gif
static.adsafeprotected.com/ 43 B
481 B 129ms
40ms Image
image/gif 65.9.95.4
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.adsafeprotected.com/skeleton.gif?service=ad&adid=tdaadh&adnum=4223102
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.95.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-95-4.prg50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: "45cf913e5d9d3c9b2058033056d3dd23"
x-amz-version-id: iiN8XkcmZQdDIQeKkzAiegPwcD.5WPja
age: 222837
x-cache: Hit from cloudfront
x-amz-cf-id: An-t1xoLpNacv80ZdzwaEyDid8icLEjmDoNAzrbXmzPfskl34xYt7w==
date: Fri, 17 Jan 2025 22:34:10 GMT
content-type: image/gif
last-modified: Mon, 17 Aug 2020 23:55:15 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 a1c66294cb416b399374a845b97656d2.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 43
x-amz-cf-pop: PRG50-C1
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 266 KB
95 KB 44ms
44ms Script
application/javascript 142.250.185.104
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-CEFZJ359V8&l=dataLayer&cx=c&gtm=45je51g0v9101576445za200

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.104 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

2000508947df0026d3daf3041ccd6bbc640ea7639a804fcabaa8e76bfa52f022

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Mon, 20 Jan 2025 12:28:06 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 20 Jan 2025 12:28:06 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 96702
x-xss-protection: 0
server: Google Tag Manager

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 117ms
43ms Fetch
text/plain 142.250.186.174
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-VJBRK9986D&gtm=45je51g0v9101576445za200&_p=1737376086719&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=102067555~102067808~102081485~102123607&cid=1428874505.1737376087&ul=se-se&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1737376086&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Fdfry.theunpackingitpodcast.com%2F&dt=Paint%20with%20Oils&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=825
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.186.174 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s08-in-f14.1e100.net
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 20 Jan 2025 12:28:07 GMT
content-type: text/plain
server: Golfe2

GET
H3 200 gpt
securepubads.g.doubleclick.net/pagead/managed/dict/m202501160101/ 63 KB
22 KB 39ms
39ms Other
text/plain 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/dict/m202501160101/gpt

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c5c0a2fc2af2da0bd368ce75fe3640564ef3f1c6e2a70e04bdf4a859c102e9a3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 17983749015435242695
age: 70020
x-content-type-options: nosniff
expires: Mon, 20 Jan 2025 17:01:07 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Sun, 19 Jan 2025 17:01:07 GMT
content-type: text/plain; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=86400, stale-while-revalidate=7200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 22813
x-xss-protection: 0
server: cafe
use-as-dictionary: match="/gampad/ads", id="m202501160101"

GET
H2 200 154013155 Show response
fundingchoicesmessages.google.com/i/ 193 KB
63 KB 164ms
85ms Script
application/javascript 142.250.184.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/154013155?ers=3

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202501140101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.238 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

1ccee98bfbf3367d9645d6e6fd98ac4578b0722d02bfe06db6e7437305b40960

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce--0KaOt5C2aAkHF2MgkVrjQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 20 Jan 2025 12:28:07 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjamDU4pJicNKQYpD4-pJJC4id0mewhgBx681zrNOB2GjteVYXIE76d561BIgNFS6xOgOxY9ElVk8gVu25xGoOxPfXXWJ9DsQf6i-z_gDiGecvsy4A4iKJK6wtQMzw9QorBxBX_7rK2gzEtqzXWF2BWIib43rTzj1sAi8uXypV0kjKL4xPzs8rKcpMKi3JL0pLTkstTi0qSy2KNzIwMjUwNDTTMzCNLzAAAELeTLI"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce--0KaOt5C2aAkHF2MgkVrjQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 38ms
38ms Fetch
text/plain 142.250.186.174
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-CEFZJ359V8&gtm=45je51g0v9102396898za200zb9101576445&_p=1737376086719&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=102067555~102067808~102081485~102123607&cid=1428874505.1737376087&ul=se-se&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1737376087&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Fdfry.theunpackingitpodcast.com%2F&dt=Paint%20with%20Oils&en=ramp_js&_fv=1&_ss=1&_ee=1&ep.pageview_id=1737376086719&tfd=968
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-CEFZJ359V8&l=dataLayer&cx=c&gtm=45je51g0v9101576445za200
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.186.174 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s08-in-f14.1e100.net
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 20 Jan 2025 12:28:07 GMT
content-type: text/plain
server: Golfe2

GET
H3 200 videoCard.5ed8eb34c11835040def.js Show response
cdn.intergient.com/pageos/2.1.12/ 559 B
750 B 46ms
46ms Script
text/javascript 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.intergient.com/pageos/2.1.12/videoCard.5ed8eb34c11835040def.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/2.1.12/runtime.05e182873598139fd53a.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 795041923e6338abe450ff9524ef70fd40432f278f32c9c35cdbb08239574fb1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"6880c1609e3243c11c7b4f1285e14d89"
age: 329062
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: -wc9Slbr0_fuTI-qTcGwoFMuThFlbnilyTUTM58czCVxeRYjqvGGLA==
date: Mon, 20 Jan 2025 12:28:07 GMT
content-type: text/javascript
last-modified: Thu, 16 Jan 2025 16:58:51 GMT
vary: Accept-Encoding
priority: u=3,i=?0
server-timing: cfExtPri
hw-country-code: SE
cache-control: public, max-age=31536000
via: 1.1 d20f19c14113bb86116d01e6cb4e2844.cloudfront.net (CloudFront)
cf-ray: 904f1000be55d2f3-FRA
x-amz-cf-pop: FRA60-P2
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H3 200 iframe.html
cdn.intergient.com/pageos/2.1.12/iframe/ Frame 895C 0
0 69ms
38ms Document
text/html 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.intergient.com/pageos/2.1.12/iframe/iframe.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/2.1.12/main.071f1389f3e64b67af67.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

age: 328987
alt-svc: h3=":443"; ma=86400
cache-control: public, max-age=31536000
cf-cache-status: HIT
cf-ray: 904f1000fb87dcc2-FRA
content-encoding: br
content-type: text/html
date: Mon, 20 Jan 2025 12:28:07 GMT
hw-country-code: SE
last-modified: Thu, 16 Jan 2025 16:58:51 GMT
priority: u=0,i
server: cloudflare
server-timing: cfExtPri
vary: Accept-Encoding
via: 1.1 f61b5f0e7797f894b382e612cda75fee.cloudfront.net (CloudFront)
x-amz-cf-id: 1-2vt3vvMm-yVMTT5y2VOivZr0z2apB5VEPOCu6cADUR0isGHpVcPQ==
x-amz-cf-pop: HEL51-P1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront

GET
H3 200 gdpr.1b960cdd1c148987c402.js Show response
cdn.intergient.com/pageos/2.1.12/ 6 KB
2 KB 41ms
41ms Script
text/javascript 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.intergient.com/pageos/2.1.12/gdpr.1b960cdd1c148987c402.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/2.1.12/runtime.05e182873598139fd53a.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0aa98ee205d0ed7ab5765a57a2652a721657b0afe77539306b4d2c2e582587cf

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"f4fb0f395e7b6363ec6a36d7e3603696"
age: 329062
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: Y0ZHX2gPZrXpZDVX2MCCJGRVN6aoeF8XB3xvEwEog4pCeh1mzlTNmA==
date: Mon, 20 Jan 2025 12:28:07 GMT
content-type: text/javascript
last-modified: Thu, 16 Jan 2025 16:58:51 GMT
vary: accept-encoding
priority: u=3,i=?0
server-timing: cfExtPri
hw-country-code: SE
cache-control: public, max-age=31536000
via: 1.1 4b07e670df891a80bcae1d5be052af3c.cloudfront.net (CloudFront)
cf-ray: 904f1000ce78d2f3-FRA
x-amz-cf-pop: FRA60-P2
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 GDPR Show response
impression-inferences-edge-prod.playwire.com/websites/74068/v1/Mon/7/desktop/Chrome/ 584 B
920 B 104ms
33ms XHR
application/json 18.245.46.16
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://impression-inferences-edge-prod.playwire.com/websites/74068/v1/Mon/7/desktop/Chrome/GDPR
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/2.1.12/main.071f1389f3e64b67af67.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.245.46.16 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-245-46-16.fra56.r.cloudfront.net
Software: CloudFront /
Resource Hash: 848c48e4607b7181b080b5505df90531f6e06cc5eac9d7cff6cdae3a48b921b9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=3600, public, must-revalidate
access-control-expose-headers: *
age: 1625
via: 1.1 e999795aa400a9b7027a66ec4ada5728.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Hit from cloudfront
content-length: 584
x-amz-cf-id: E8YBp7nJq5uktDjFUiZej0BqU8ysmo8tfTrPhKPbF7BkLPGLUAH4ug==
date: Mon, 20 Jan 2025 12:01:02 GMT
content-type: application/json
x-amz-cf-pop: FRA56-P9
server: CloudFront

GET
H2 200 tag Show response
btloader.com/ 117 KB
32 KB 117ms
45ms Script
application/javascript 172.67.41.60
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/2.1.12/main.071f1389f3e64b67af67.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.41.60 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f9d3787a7fca800b948613dd71e3c998063ae024c19958850584434dbe936aa0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-robots-tag: noindex, nofollow
cache-control: public, max-age=300, must-revalidate, stale-if-error=3600, stale-while-revalidate=300
content-encoding: gzip
cf-cache-status: HIT
etag: "81ad7b58dbe741ac9a44747f4339002f"
age: 1892
via: 1.1 google
cf-ray: 904f10014e256939-FRA
accept-ranges: bytes
content-length: 32926
date: Mon, 20 Jan 2025 12:28:07 GMT
content-type: application/javascript
last-modified: Mon, 20 Jan 2025 11:53:02 GMT
vary: Origin, Accept-Encoding
server: cloudflare

GET pixel.gif
px.moatads.com/ 0
0

GET
H3 200 px.gif Show response
bt.dns-finder.com/ 43 B
940 B 81ms
47ms Fetch
image/gif 104.21.96.1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://bt.dns-finder.com/px.gif
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.96.1 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 4
access-control-expose-headers: Cache-Control, Content-Length, Content-Type, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 746
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=v%2BzPwN9YjFRU4VwndTc4Zuh3urbGK%2FhEvX4QXNgBYiW%2FTU5o%2FB9Gab7vxv3xdiXstcTrg3DxWguq5ywDF2A4ih0I%2FE52s7sSWpiBxCuZc2w8VRM6eImfaKQxdvw%2FMv3q3cFhKA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-encoding: identity
expires: Mon, 20 Jan 2025 13:15:41 GMT
alt-svc: h3=":443"; ma=86400
x-goog-stored-content-length: 43
date: Mon, 20 Jan 2025 12:28:07 GMT
content-type: image/gif
last-modified: Fri, 19 Jul 2024 16:36:17 GMT
vary: Accept-Encoding
x-guploader-uploadid: AFiumC5HHXJLSempD-7gvML_fZKwHUjM99Hwbkac7khtYKP-fydO6m0xFWBN3hz1VYy_hFbUUNvCVW4
cache-control: public, max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-goog-storage-class: STANDARD
cf-ray: 904f1001da31372f-FRA
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1721406977485562
content-length: 43
server: cloudflare

GET
H2 200 px.gif
ad-delivery.net/ 43 B
476 B 105ms
38ms Image
image/gif 104.26.2.70
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=2
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.70 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 13
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rURJ4sfQKMwP1MAb2iFVsnmuMWBEaWEfTNfniuCA97aR1GEKE21DwgLmsWWi7WnbLZw91ylgq0m%2FQ2bjgFeXKrP1nChdiij6w6u7F9BSySaBCsnMfmOKE%2FRAWFQ%2BKUWiUA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-encoding: identity
expires: Tue, 21 Jan 2025 12:28:07 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=31056&min_rtt=30879&rtt_var=6628&sent=10&recv=11&lost=0&retrans=0&sent_bytes=5395&recv_bytes=2328&delivery_rate=133856&cwnd=239&unsent_bytes=0&cid=1ce341883f6cf78b&ts=40&x=0"
x-goog-stored-content-length: 43
date: Mon, 20 Jan 2025 12:28:07 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
vary: Accept-Encoding
x-guploader-uploadid: AFiumC4b5OwI8qXQYfQcU8AoCFwU31hO45bTzkvm2BytG1cY4ifjJGKF4vdu5N4MLuw8rJS_u9B9FSU
cache-control: public, max-age=86400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 904f10020bbed3bc-FRA
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico
ad.doubleclick.net/ 1 KB
130 B 69ms
30ms Image
image/x-icon 142.250.185.70
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
age: 16403
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Tue, 21 Jan 2025 07:54:44 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 20 Jan 2025 07:54:44 GMT
last-modified: Tue, 08 May 2012 13:08:06 GMT
content-type: image/x-icon
vary: Accept-Encoding
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 px.gif
ad-delivery.net/ 43 B
997 B 104ms
38ms Image
image/gif 104.26.2.70
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.6199666158968864
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.70 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 13
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DRoKOYB8t4MX0A33mbUByoUmXhWGOfZ60WzPRmaSdrPJjYll1pYuVs7OH%2BjvBo%2BDWIDVZElcWCSaq7l1bC9lCS8PdA02MMiMf%2FiYzeBHJcc4%2FdblrIJgxwrnAN67NuyJrw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-encoding: identity
expires: Tue, 21 Jan 2025 12:28:07 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=31056&min_rtt=30879&rtt_var=6628&sent=7&recv=11&lost=0&retrans=0&sent_bytes=4332&recv_bytes=2328&delivery_rate=133856&cwnd=239&unsent_bytes=0&cid=1ce341883f6cf78b&ts=40&x=0"
x-goog-stored-content-length: 43
date: Mon, 20 Jan 2025 12:28:07 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
vary: Accept-Encoding
x-guploader-uploadid: AFiumC4b5OwI8qXQYfQcU8AoCFwU31hO45bTzkvm2BytG1cY4ifjJGKF4vdu5N4MLuw8rJS_u9B9FSU
cache-control: public, max-age=86400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 904f10020bbbd3bc-FRA
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

POST
H3 200 4659a5285392de7252e78257d53a7a53f820a9ea0aaa61283ddb8cdcb Show response
faucetfoot.com/send/3fdd00d6a/ 303 B
743 B 118ms
79ms Fetch
application/json 104.18.25.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://faucetfoot.com/send/3fdd00d6a/4659a5285392de7252e78257d53a7a53f820a9ea0aaa61283ddb8cdcb

Requested by

Host: faucetfoot.com
URL: https://faucetfoot.com/assets/ad8f9_1386ab7bc6243cc92d47a0716379721791fca9d2fee.index.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.25.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dba450d416a81342ef683c4ac42ad45276ced08190920d7f14396fabbe01544a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
x-buildname: hoothoot
access-control-allow-methods: POST, OPTIONS
x-hostname: fen-hoothoot-europe-west1-x1l3
expires: Mon, 20 Jan 2025 12:28:06 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Mon, 20 Jan 2025 12:28:07 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding, Origin
priority: u=1,i
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Cookie
strict-transport-security: max-age=15724800; preload
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
access-control-allow-credentials: true
x-datacenter: gce-europe-west1
via: 1.1 google
cf-ray: 904f1001e85e9bac-FRA
access-control-allow-origin: https://paint.toys
x-buildnumber: 1620028337
server: cloudflare

GET
H2 200 AGSKWxXnmvmQ6UdsrFZ9kLiAFI7bIbe8KgXvmrRPK1dFPWKEjAxHxjCV_LhJcz815Kby2bUJ8jgXFSvw3Bt_TILxTBTGgriY00-VM2NGdte-T4Xii6XpcH1WcBFPxvym6Uqo0JiNeRwuYA== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 62ms
61ms Script
application/javascript 142.250.184.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxXnmvmQ6UdsrFZ9kLiAFI7bIbe8KgXvmrRPK1dFPWKEjAxHxjCV_LhJcz815Kby2bUJ8jgXFSvw3Bt_TILxTBTGgriY00-VM2NGdte-T4Xii6XpcH1WcBFPxvym6Uqo0JiNeRwuYA==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzM3Mzc2MDg3LDMzNjAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzddXSwiaHR0cHM6Ly9wYWludC50b3lzL29pbC8iLG51bGwsW1s4LCIyVlAwa1FhcXd0cyJdLFs5LCJlbi1VUyJdLFsxOSwiMiJdLFsxNywiWzBdIl1dXQ

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.2VP0kQaqwts.es5.O/d=1/rs=AJlcJMx-uDKfz5RVguZ8g7PfzzTocKGHcw/m=kernel_loader,loader_js_executable

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.238 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

bf62f0f66cdb44939f3c7741ebda74ba902cbeddd0f2ba3c40d15fc4490f9875

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-A-HzSGoKzSWPGVC8GCn6YQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 20 Jan 2025 12:28:07 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjamDU4pJiCNCQYpD4-pJJC4id0mewhgBx681zrNOB2GjteVYXIE76d561BIgNFS6xOgOxY9ElVk8gVu25xGoOxPfXXWJ9DsQf6i-z_gDiGecvsy4A4iKJK6wtQMzw9QorBxBX_brK2gTEtqzXWF2BWIiH43rTzj1sAhs2HdrMqKSRlF8Yn5yfV1KUmVRakl-UlpyWWpxaVJZaFG9kYGRqYGhopmdgGl9gAACCjUyV"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-A-HzSGoKzSWPGVC8GCn6YQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 topics_frame.html
securepubads.g.doubleclick.net/static/topics/ Frame D074 0
0 88ms
30ms Document
text/html 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/static/topics/topics_frame.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202501140101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 631
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000, stale-while-revalidate=3600
content-encoding: br
content-length: 29206
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 20 Jan 2025 12:17:36 GMT
expires: Mon, 20 Jan 2025 13:07:36 GMT
last-modified: Mon, 13 Jan 2025 20:43:06 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 publishertag.ids.js Show response
static.criteo.net/js/ld/ 42 KB
13 KB 88ms
32ms Script
text/javascript 178.250.1.3
ASN-CRITEO-EUROPE...

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.ids.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202501140101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.3 , France, ASN44788 (ASN-CRITEO-EUROPE Criteo Technology SAS, FR),

Reverse DNS

Software

nginx /

Resource Hash

1635d2075d3343c86490d2229c1fb868ad59d92958ef65e04cb65767c703e9f6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: max-age=86400, public
timing-allow-origin: *
content-encoding: gzip
etag: W/"670e3454-a69c"
cross-origin-resource-policy: cross-origin
expires: Tue, 21 Jan 2025 12:28:07 GMT
access-control-allow-origin: *
date: Mon, 20 Jan 2025 12:28:07 GMT
content-type: text/javascript
last-modified: Tue, 15 Oct 2024 09:22:28 GMT
server: nginx

GET
H2 200 ob.js Show response
cdn-ima.33across.com/ 17 KB
7 KB 113ms
45ms Script
application/javascript 104.18.28.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-ima.33across.com/ob.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202501140101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.28.101 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9ffa45453324362cbc5cc78288e04513100c2d61baf3a969717ea5df3d0dbb39

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: public, max-age=259200
content-encoding: gzip
cf-cache-status: HIT
etag: W/"671a7174-43df"
age: 457690
cf-ray: 904f100268ed922c-FRA
expires: Thu, 23 Jan 2025 12:28:07 GMT
date: Mon, 20 Jan 2025 12:28:07 GMT
content-type: application/javascript
last-modified: Thu, 24 Oct 2024 16:10:28 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 encrypted-tag-g.js Show response
invstatic101.creativecdn.com/encrypted-signals/ 2 KB
2 KB 86ms
40ms Script
text/javascript 34.96.70.87
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202501140101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.70.87 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 87.70.96.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 5d8dac2d4ae43a0b541c160f30e8238951b42b13bb5f01ca2697271b3a804ad2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: e8fb4c5e5648d4012fd13b4c454df319
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1558
date: Mon, 20 Jan 2025 12:28:07 GMT
content-type: text/javascript; charset=utf-8
last-modified: Wed, 11 Dec 2024 20:03:09 GMT
server: Google Frontend
x-cloud-trace-context: 8c09f8c76155919138a9b4f2e0d38f13

GET
H2 200 esp.js Show response
oa.openxcdn.net/ 24 KB
8 KB 67ms
20ms Script
application/javascript 34.102.146.192
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://oa.openxcdn.net/esp.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202501140101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.146.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 192.146.102.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 1
content-encoding: gzip
x-goog-hash: crc32c=f21hYg==, md5=31VCuIvA42jGmZdUpbniug==
etag: "df5542b88bc0e368c6999754a5b9e2ba"
age: 361223
x-goog-stored-content-encoding: gzip
expires: Fri, 16 Jan 2026 08:07:44 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 7927
date: Thu, 16 Jan 2025 08:07:44 GMT
last-modified: Thu, 27 May 2021 18:30:51 GMT
content-type: application/javascript
x-guploader-uploadid: AFIdbgRZDeljsT7COeYqFPYlNgOwj1V9IlFP-HcTFe0SbU4mId26NOXeI9fHIIHId2JmZpGD7MJmw-0
cache-control: no-transform
x-goog-storage-class: MULTI_REGIONAL
accept-ranges: bytes
x-goog-generation: 1622140251693895
content-length: 7927
server: UploadServer

GET
H2 200 country Show response
api.btloader.com/ 37 B
215 B 167ms
116ms Fetch
application/json 130.211.23.194
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://api.btloader.com/country?o=5150306120761344
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.23.194 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 194.23.211.130.bc.googleusercontent.com
Software: /
Resource Hash: ff0723fc3ffaba65ae40e48023b013da6df4aed73949487e8c4a5fd9b000946e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private, max-age=300, stale-while-revalidate=600, stale-if-error=600
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37
date: Mon, 20 Jan 2025 12:28:07 GMT
content-type: application/json
vary: Origin

GET
H2 200 rlink.js Show response
cdn.btmessage.com/script/ 48 KB
50 KB 108ms
42ms Script
application/javascript 104.26.7.141
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.btmessage.com/script/rlink.js?o=5150306120761344&bt_env=prod
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.7.141 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 88d6624cced4fc50d398d759513b1475da2c29dca62572afa65859bea2950dbd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://paint.toys
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 1
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=k8UKcw==, md5=c6RT6l1KL7KRZHNzf/pyJA==
cf-cache-status: HIT
etag: "73a453ea5d4a2fb2916473737ffa7224"
age: 584
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zfwDsoVoESdlxtzXB%2F2n7gMa6rrBWVc0aixRkYgGnsRigUTUQAXC3NZiGGr7rr19NrPPdEUpDp56Yhc%2FsmRxw8kl6W3VjHKHAeUkZoIvnygHM2Z%2BnVmmKpKLd5JSQPGokhnJ"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-encoding: identity
expires: Mon, 20 Jan 2025 12:19:13 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=31085&min_rtt=31043&rtt_var=6620&sent=6&recv=10&lost=0&retrans=0&sent_bytes=3976&recv_bytes=2192&delivery_rate=133384&cwnd=204&unsent_bytes=0&cid=94f36a927415de27&ts=45&x=0"
x-goog-stored-content-length: 49655
date: Mon, 20 Jan 2025 12:28:07 GMT
content-type: application/javascript
last-modified: Wed, 15 Jan 2025 20:23:54 GMT
vary: Accept-Encoding
x-guploader-uploadid: AFIdbgT41nNQzV58L6LcVr6mc3p9J48A2ATkNxwS67Q5rnKbrj-knQwuR6ftC0dCnXBsELqzzmpyTTs
cache-control: public, max-age=300, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 904f1002bbdb363c-FRA
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1736972634540171
content-length: 49655
server: cloudflare

GET
H2 204 pv Show response
api.btloader.com/ 0
66 B 167ms
117ms XHR
text/plain 130.211.23.194
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://api.btloader.com/pv?tid=E7K4YsjRx8-Vx14cCyeXi-9483af3cf4&w=5096819819806720&o=5150306120761344&cv=2.1.71&widget=false&r=false&vr=1600x1200&pageURL=https%3A%2F%2Fpaint.toys%2Foil%2F&sid=GUye2oKuq-Cgh9dyBcT-9483af3cf4&pm=false&upapi=true
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.23.194 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 194.23.211.130.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

via: 1.1 google
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 20 Jan 2025 12:28:07 GMT
vary: Origin

GET
H3 200 AGSKWxXAUKjksKrxswukcngNQ0dNa6YI26Shdhe1Z39OhABflv3P-PJ_xSqtrOcqmL9kpSmKTZaUSCxxfG07SCCKtomj4hdv2M8n-Qz_OOjDrM6476oDDZwLQsgm8GOSAe0Z2I3DjVILdQ== Show response
fundingchoicesmessages.google.com/f/ 10 KB
4 KB 53ms
53ms Script
application/javascript 142.250.184.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxXAUKjksKrxswukcngNQ0dNa6YI26Shdhe1Z39OhABflv3P-PJ_xSqtrOcqmL9kpSmKTZaUSCxxfG07SCCKtomj4hdv2M8n-Qz_OOjDrM6476oDDZwLQsgm8GOSAe0Z2I3DjVILdQ==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzM3Mzc2MDg3LDQwMTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOV0sbnVsbCwyLG51bGwsImVuIl0sImh0dHBzOi8vcGFpbnQudG95cy9vaWwvIixudWxsLFtbOCwiMlZQMGtRYXF3dHMiXSxbOSwiZW4tVVMiXSxbMTksIjIiXSxbMTcsIlswXSJdXV0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.238 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

d0e09cee9e9b5ffcef2643602a9b4dcffa8d8880e1e970d62b81f9bfd05170e0

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-o78XNwVoB37ncXRVizbdTA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 20 Jan 2025 12:28:07 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjamDU4pJi8NGQYpD4-pJJC4id0mewhgBx681zrNOB2GjteVYXIE76d561BIgNFS6xOgOxY9ElVk8gVu25xGoOxPfXXWJ9DsQf6i-z_gDiGecvsy4A4iKJK6wtQMzw9QorBxBX_brK2gTEtqzXWF2BWIiH43rTzj1sAhPmvzrHqKSRlF8Yn5yfV1KUmVRakl-UlpyWWpxaVJZaFG9kYGRqYGhopmdgGl9gAACCH0yh"
content-security-policy: script-src 'report-sample' 'nonce-o78XNwVoB37ncXRVizbdTA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H2 200 syncframe
gum.criteo.com/ Frame C824 0
0 78ms
27ms Document
text/html 178.250.1.11
ASN-CRITEO-EUROPE...

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=paint.toys&gdpr=0&gdpr_consent=

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.ids.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.11 , France, ASN44788 (ASN-CRITEO-EUROPE Criteo Technology SAS, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Mon, 20 Jan 2025 12:28:06 GMT
server: Kestrel
server-processing-duration-in-ticks: 328184
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding
x-robots-tag: noindex

GET
H2 200 websiteconfig Show response
api.btmessage.com/ 960 B
1 KB 158ms
157ms Fetch
application/json 104.26.7.141
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.btmessage.com/websiteconfig?bt_env=prod&o=5150306120761344&w=paint.toys&l=EN
Requested by: Host: cdn.btmessage.com
URL: https://cdn.btmessage.com/script/rlink.js?o=5150306120761344&bt_env=prod
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.7.141 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e526ecf9218dedd7308132e57e04b1baded12dad1cdb0c8fb7bb34e92ff8d544

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
etag: "39a56c09c4dc2f16daf005c98d823b89"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mae0rL7CNAmBqnaq%2B0AJaIrZaw5SvV%2FFGDb%2Bva6CgkZacr22frt%2Fj4PpUKHrIaisrb522Qq2cw3dYy7%2BhjT1Hb56848pPJq4aBVDBcmtCbzgEthh5aml0ID6cC67MTHwy9ug"}],"group":"cf-nel","max_age":604800}
server-timing: cfL4;desc="?proto=TCP&rtt=31450&min_rtt=31043&rtt_var=268&sent=54&recv=30&lost=0&retrans=0&sent_bytes=55585&recv_bytes=2347&delivery_rate=1521721&cwnd=209&unsent_bytes=0&cid=94f36a927415de27&ts=210&x=0"
date: Mon, 20 Jan 2025 12:28:07 GMT
content-type: application/json
last-modified: Mon, 20 Jan 2025 12:26:24 GMT
vary: Origin, accept-encoding
cache-control: public, max-age=300, must-revalidate, stale-if-error=3600, stale-while-revalidate=300
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
via: 1.1 google
cf-ray: 904f10030c10363c-FRA
access-control-allow-origin: *
content-length: 461
server: cloudflare

GET
H2 200 favicon.ico
paint.toys/ 615 B
748 B 22ms
22ms Other
image/vnd.microsoft.icon 3.33.186.135
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://paint.toys/favicon.ico

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

30a007a99e491d9e1b2b72c02e4a8454334c6ea2b3a03316d50135b20464fccc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "6c77abc0123fbfdebbf702a90fb50938-ssl"
age: 156761
accept-ranges: bytes
content-length: 615
x-nf-request-id: 01JJ1TYFFCFD0WF416R7CP6A3E
cache-status: "Netlify Edge"; hit
date: Mon, 20 Jan 2025 12:28:07 GMT
content-type: image/vnd.microsoft.icon
server: Netlify

GET
H2 200 favicon.ico
paint.toys/ 615 B
41 B 22ms
22ms Image
image/vnd.microsoft.icon 3.33.186.135
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://paint.toys/favicon.ico

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

fra24s07-in-f10.1e100.net

Software

Netlify /

Resource Hash

30a007a99e491d9e1b2b72c02e4a8454334c6ea2b3a03316d50135b20464fccc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "6c77abc0123fbfdebbf702a90fb50938-ssl"
age: 156761
accept-ranges: bytes
content-length: 615
x-nf-request-id: 01JJ1TYFKX1CCCRC6XY22ZEZ8G
cache-status: "Netlify Edge"; hit
date: Mon, 20 Jan 2025 12:28:07 GMT
content-type: image/vnd.microsoft.icon
server: Netlify

GET
H2 204 state Show response
api.btmessage.com/mw/ 0
403 B 152ms
152ms Fetch 104.26.7.141
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.btmessage.com/mw/state?bt_env=prod
Requested by: Host: cdn.btmessage.com
URL: https://cdn.btmessage.com/script/rlink.js?o=5150306120761344&bt_env=prod
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.7.141 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hzsKRUlU99Pu2AZ5FZhFGtjOPXEwOj%2BM5xVIVJ6r9EoT%2Fi%2BD3qQ28C%2F4Jz05xZFJB5E0J195pJP2pP3Rr0fSP9MMyOqfP9x%2BbvNp6lLnXE2Va113P5Q%2FTn1JbiPz4q9pUXtG"}],"group":"cf-nel","max_age":604800}
via: 1.1 google
cf-ray: 904f10042cec363c-FRA
access-control-allow-origin: *
server-timing: cfL4;desc="?proto=TCP&rtt=31467&min_rtt=31043&rtt_var=235&sent=58&recv=32&lost=0&retrans=0&sent_bytes=56700&recv_bytes=2414&delivery_rate=1521721&cwnd=209&unsent_bytes=0&cid=94f36a927415de27&ts=387&x=0"
date: Mon, 20 Jan 2025 12:28:07 GMT
vary: Origin
server: cloudflare

GET
H3 200 iframe.html
cdn.intergient.com/pageos/2.1.12/iframe/ Frame E0A1 0
0 0ms
0ms Document
text/html 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.intergient.com/pageos/2.1.12/iframe/iframe.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/2.1.12/main.071f1389f3e64b67af67.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

age: 328987
alt-svc: h3=":443"; ma=86400
cache-control: public, max-age=31536000
cf-cache-status: HIT
cf-ray: 904f1000fb87dcc2-FRA
content-encoding: br
content-type: text/html
date: Mon, 20 Jan 2025 12:28:07 GMT
hw-country-code: SE
last-modified: Thu, 16 Jan 2025 16:58:51 GMT
priority: u=0,i
server: cloudflare
server-timing: cfExtPri
vary: Accept-Encoding
via: 1.1 f61b5f0e7797f894b382e612cda75fee.cloudfront.net (CloudFront)
x-amz-cf-id: 1-2vt3vvMm-yVMTT5y2VOivZr0z2apB5VEPOCu6cADUR0isGHpVcPQ==
x-amz-cf-pop: HEL51-P1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 353 KB
87 KB 112ms
38ms Script
application/javascript 108.138.3.93
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/2.1.12/main.071f1389f3e64b67af67.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.3.93 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-3-93.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 1d7bee37720c8ed30628179268961854a5f4fac76f69f981700daa92a6943f11

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: max-age=3600
content-encoding: gzip
etag: W/"dae31ca47fdabfd58069725f0be2f620"
age: 1504
via: 1.1 857b0dca772798c338c78a1be69c955c.cloudfront.net (CloudFront), 1.1 149b1af6ad8d2c0fedea82bfb1c29c66.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: 6Ug5HalDU55a2H2NFLGxvt1Lu8SudX39eoowMJw1-CmKZP3TDO016g==
date: Mon, 20 Jan 2025 12:03:04 GMT
content-type: application/javascript
last-modified: Thu, 16 Jan 2025 18:49:29 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P1, FRA56-P6
x-amz-server-side-encryption: AES256

GET 30a6b061-9e42-4986-9e8e-5d49c159fb2c
https://paint.toys/ Frame 0
0

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 76ms
26ms Preflight
application/json 178.250.1.11
ASN-CRITEO-EUROPE...

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&bundle=eUo90F9hTUJvcmxJREw0OXhCd2w1aVlKbzJ3U0hjcVZIQ01oblo5aEljM005Mkg5amFIVkZBc3gzeTlTcjRwJTJCdGhwQnRTT2FBck96M2NCJTJGejJNZEU0bU5xOTF1TDFsJTJCNzMlMkJsSEdTYzhFUXc3TFR4ZzAycGlEUWp0cmpNY29DcUs2ZFJaJTJCS3RxV2hWSVdsZmIyYUl0U25OR0dRJTNEJTNE&cw=1&pbt=1&lsw=1&gdpr=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.11 , France, ASN44788 (ASN-CRITEO-EUROPE Criteo Technology SAS, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://paint.toys
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Mon, 20 Jan 2025 12:28:07 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 263114
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 474.9e5e7d94b0ad365e11fa.js Show response
cdn.intergient.com/pageos/2.1.12/ 3 KB
2 KB 42ms
42ms Script
text/javascript 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.intergient.com/pageos/2.1.12/474.9e5e7d94b0ad365e11fa.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/2.1.12/runtime.05e182873598139fd53a.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1f0769b6ec00799d55c116b89a5b71d923e5ea0d9f0d7e1fac3fe1914599e658

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"f32f7966b1a24d5db4c7e8891271dc87"
age: 328977
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-amz-cf-id: J-wBPfD9NjFXUkjlkV9Y0Rh0BkYaEnn1HuBt7fEeAkZD5_AyuTsvbw==
date: Mon, 20 Jan 2025 12:28:07 GMT
content-type: text/javascript
last-modified: Thu, 16 Jan 2025 16:58:51 GMT
vary: accept-encoding
priority: u=3,i=?0
server-timing: cfExtPri
hw-country-code: SE
cache-control: public, max-age=31536000
via: 1.1 0da7cfa358ecabdb5a62c5418865202c.cloudfront.net (CloudFront)
cf-ray: 904f10044e49d2f3-FRA
x-amz-cf-pop: CPH50-P1
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 ima3.js Show response
imasdk.googleapis.com/js/sdkloader/ 424 KB
135 KB 140ms
64ms Script
text/javascript 142.250.186.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/ima3.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/2.1.12/main.071f1389f3e64b67af67.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

15c1d2c57f6b12e9dfd82ef1b9d2b10e227a9f274d3df68eccf2b056cd6fcd7d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 7716534421233278964
x-content-type-options: nosniff
expires: Mon, 20 Jan 2025 12:28:07 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Mon, 20 Jan 2025 12:28:07 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 137585
x-xss-protection: 0
server: cafe

POST
H2 200 prebid Show response
id5-sync.com/api/config/ 194 B
659 B 100ms
32ms Fetch
application/json 141.95.98.65
OVH OVH SAS

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.65 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ec2-3-222-250-81.compute-1.amazonaws.com

Software

Resource Hash

1526f7f540b829baf0e6d1b491aa7b26b5e49fa160abca67c11695ccfa2cee82

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Mon, 20 Jan 2025 12:28:06 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
access-control-allow-credentials: true

GET
H2 200 id Show response
id.crwdcntrl.net/ 43 B
287 B 101ms
34ms Fetch
application/json 54.228.182.39
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://id.crwdcntrl.net/id?gdpr_applies=false&c=17262
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.228.182.39 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-228-182-39.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: a96e1e97d62ab9747678b947bdf0a0ea5f81790b1e3a1df2d4607a86bf802596

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 43
date: Mon, 20 Jan 2025 12:28:07 GMT
content-type: application/json;charset=utf-8
x-server: 10.45.13.84

GET f
fid.agkn.com/ 0
0

GET
H2 200 envelope Show response
lexicon.33across.com/v1/ 49 B
246 B 144ms
97ms Fetch
application/json 35.244.193.51
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0014000001YrMoYAAV&gdpr=0&src=pbjs&ver=9.11.0&coppa=0
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.193.51 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 51.193.244.35.bc.googleusercontent.com
Software: /
Resource Hash: d0d2e098cd489ef7bc528c86de8ab5c51b5d6cdf9b76a8b08766036992f0d2f4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, must-revalidate, max-age=28800
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49
date: Mon, 20 Jan 2025 12:28:07 GMT
content-type: application/json
vary: origin

GET
H2 204 any Show response
idx.liadm.com/idex/did-0046/ 0
367 B 301ms
100ms Fetch 3.222.250.81
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://idx.liadm.com/idex/did-0046/any?duid=8e413bd09c43--01jj1tyfn4g8tynrc0cwaprmzy&gdpr=0&did=did-0046&cd=.paint.toys&pu=https%3A%2F%2Fpaint.toys&resolve=nonId&resolve=uid2&resolve=index&resolve=bidswitch&resolve=pubmatic&resolve=magnite&resolve=openx&resolve=sorvrn&resolve=thetradedesk&resolve=medianet

Requested by

Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.222.250.81 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: max-age=3599, private
trace-id: 81082eb2b3509839
request-time: 1
access-control-allow-credentials: true
expires: Mon, 20 Jan 2025 13:28:07 GMT
access-control-allow-origin: https://paint.toys
date: Mon, 20 Jan 2025 12:28:07 GMT
vary: Origin

GET
H2 200 json Show response
gum.criteo.com/sid/ 421 B
1 KB 79ms
28ms Fetch
application/json 178.250.1.11
ASN-CRITEO-EUROPE...

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.11 , France, ASN44788 (ASN-CRITEO-EUROPE Criteo Technology SAS, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

33cf3c6e508eaf24dfa1a024391aa95435744cf1881ce19b873eb6da4954a605

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
content-type: application/json
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 748762
expires: 0
access-control-allow-origin: https://paint.toys
date: Mon, 20 Jan 2025 12:28:07 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

POST
H2 200 fb87a4ea41 Show response
cd836371f1d.cdn.intergient.com/ 0
96 B 106ms
33ms XHR
application/octet-stream 3.73.242.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cd836371f1d.cdn.intergient.com/fb87a4ea41
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/2.1.12/main.071f1389f3e64b67af67.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.73.242.72 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-73-242-72.eu-central-1.compute.amazonaws.com
Software: nginx/1.24.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

access-control-allow-origin: *
date: Mon, 20 Jan 2025 12:28:07 GMT
content-type: application/octet-stream
server: nginx/1.24.0

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
282 B 105ms
33ms Fetch
application/json 141.95.33.120
OVH OVH SAS

General

Check archive.org

Show headers Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.33.120 , Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ns3203256.ip-141-95-33.eu

Software

Resource Hash

463df601ccb80071ff35e0dbb024bbdfef6019617aa46c1fcc68fd5eae110741

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Mon, 20 Jan 2025 12:28:07 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET /
invalid/ 0
0

GET
H2 200 webfonts43j533.js Show response
cdn.btmessage.com/ 9 B
686 B 51ms
51ms Fetch
text/javascript 104.26.7.141
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.btmessage.com/webfonts43j533.js
Requested by: Host: cdn.btmessage.com
URL: https://cdn.btmessage.com/script/rlink.js?o=5150306120761344&bt_env=prod
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.7.141 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d35afa9efa47ecc126d99ecb0d56b8100fc7c7e986269a057e6affc1cdfeee7e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 1
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=xM8wXg==, md5=ZFYTTmNc32kMQ/0FYsbamg==
cf-cache-status: HIT
etag: "6456134e635cdf690c43fd0562c6da9a"
age: 336947
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PEU%2F5kSGKj4IZq3El8aQq4LoXFCWxz2cNS2zVMs5Fgx2%2Bdoc%2F9uRgWZErAxK3p2sQOZmT8qYGdr9Cq%2BSEMDa9QSCrVEtSdFbAXBdddIKt6VDxlaAvyhQKqVSjNYWJPk9RSaP"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-encoding: identity
expires: Thu, 16 Jan 2025 15:22:14 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=31583&min_rtt=31043&rtt_var=408&sent=60&recv=33&lost=0&retrans=0&sent_bytes=57125&recv_bytes=2479&delivery_rate=1521721&cwnd=209&unsent_bytes=0&cid=94f36a927415de27&ts=439&x=0"
x-goog-stored-content-length: 9
date: Mon, 20 Jan 2025 12:28:07 GMT
content-type: text/javascript
last-modified: Tue, 06 Aug 2024 16:00:19 GMT
vary: Accept-Encoding
x-guploader-uploadid: AFiumC4ioTQD9oPnWeV8TaLirV6xt3fo02662wrfaJvECAbCdFfO9K9rzmpeLqENkpGgKiAgasL2tzk
cache-control: public, max-age=3600
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 904f10051da9363c-FRA
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1722960019169879
content-length: 9
server: cloudflare

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
0 0ms
0ms Fetch
image/gif 104.26.2.70
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=2
Requested by: Host: cdn.btmessage.com
URL: https://cdn.btmessage.com/script/rlink.js?o=5150306120761344&bt_env=prod
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.70 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 13
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rURJ4sfQKMwP1MAb2iFVsnmuMWBEaWEfTNfniuCA97aR1GEKE21DwgLmsWWi7WnbLZw91ylgq0m%2FQ2bjgFeXKrP1nChdiij6w6u7F9BSySaBCsnMfmOKE%2FRAWFQ%2BKUWiUA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-encoding: identity
expires: Tue, 21 Jan 2025 12:28:07 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=31056&min_rtt=30879&rtt_var=6628&sent=10&recv=11&lost=0&retrans=0&sent_bytes=5395&recv_bytes=2328&delivery_rate=133856&cwnd=239&unsent_bytes=0&cid=1ce341883f6cf78b&ts=40&x=0"
x-goog-stored-content-length: 43
date: Mon, 20 Jan 2025 12:28:07 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
vary: Accept-Encoding
x-guploader-uploadid: AFiumC4b5OwI8qXQYfQcU8AoCFwU31hO45bTzkvm2BytG1cY4ifjJGKF4vdu5N4MLuw8rJS_u9B9FSU
cache-control: public, max-age=86400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 904f10020bbed3bc-FRA
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico Show response
ad.doubleclick.net/ 1 KB
0 0ms
0ms Fetch
image/x-icon 142.250.185.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250

Requested by

Host: cdn.btmessage.com
URL: https://cdn.btmessage.com/script/rlink.js?o=5150306120761344&bt_env=prod

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-3-72-106-219.eu-central-1.compute.amazonaws.com

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
age: 16403
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Tue, 21 Jan 2025 07:54:44 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 20 Jan 2025 07:54:44 GMT
last-modified: Tue, 08 May 2012 13:08:06 GMT
content-type: image/x-icon
vary: Accept-Encoding
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
1 KB 104ms
40ms Fetch
image/gif 104.26.2.70
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.7311510204314413
Requested by: Host: cdn.btmessage.com
URL: https://cdn.btmessage.com/script/rlink.js?o=5150306120761344&bt_env=prod
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.70 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 941856
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EcW%2FKarHWj1Lsw8TAeWLriIs83%2BX%2FHj43mP6yvR0C5iFdeMdG09a8bWpu%2FaY4bUD2ZMqHfWzYBKx2m9V2f8dElQ55vpDBgxjWuk%2BaQf0QDzEwYNF49F%2B6GJQz51YM1XyfA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-encoding: identity
expires: Tue, 21 Jan 2025 12:28:07 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=31232&min_rtt=31128&rtt_var=6721&sent=7&recv=10&lost=0&retrans=0&sent_bytes=4330&recv_bytes=2244&delivery_rate=132140&cwnd=252&unsent_bytes=0&cid=63b00780f1362657&ts=42&x=0"
x-goog-stored-content-length: 43
date: Mon, 20 Jan 2025 12:28:07 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
vary: Accept-Encoding
x-guploader-uploadid: AFiumC6ceVes7AlGSlMLYwnGYZbxfPdM7L1-tsz58iO9zJ1tg4gClA6HQnvP6K_Q2lbMYOj7YMmPewM
cache-control: public, max-age=86400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 904f10058b54d26c-FRA
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 104ms
36ms XHR
application/javascript 108.138.3.93
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.3.93 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-3-93.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-max-age: 3000
content-encoding: gzip
x-amz-version-id: r5.lR.LJ66XEXzxUUVo7iMemjL_F_GoE
etag: W/"a4d296427fc806b21335359e398c025c"
age: 18065
access-control-allow-methods: GET
x-cache: Hit from cloudfront
x-amz-cf-id: mXsdTurBajOkiXA__RnitV24R9Qci_ai17dxl4XcXgdLj2Gr0RG3mQ==
date: Mon, 20 Jan 2025 07:34:54 GMT
content-type: application/javascript
vary: Origin,accept-encoding
last-modified: Thu, 29 Feb 2024 02:13:08 GMT
cache-control: public, max-age=86400
via: 1.1 f61953901038b0c4b4c82c311140f1b8.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: FRA56-P6
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 bd056b42-51db-43ce-9a8e-3b11319b5d1f Show response
config.aps.amazon-adsystem.com/configs/ 563 B
829 B 106ms
33ms Script
application/javascript 99.86.4.39
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://config.aps.amazon-adsystem.com/configs/bd056b42-51db-43ce-9a8e-3b11319b5d1f
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.39 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-39.fra6.r.cloudfront.net
Software: CloudFront /
Resource Hash: e91c87de4de6d6ac01cf83cc344603d7f3e7a4c07a21628997bbfbdc4506dad4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=3600
age: 2290
via: 1.1 d07eabeb1ed60c06da1457f35fb5c8c4.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
content-length: 563
x-amz-cf-id: wt3pP91JVRsd4uN8KHdYRVGmHW33u5GgJnwDowTbJXluErxcphYN0g==
date: Mon, 20 Jan 2025 11:49:57 GMT
content-type: application/javascript
x-amz-cf-pop: FRA6-C1
server: CloudFront

GET
H2 200 config Show response
c.amazon-adsystem.com/cdn/prod/ 3 KB
4 KB 34ms
34ms XHR
application/json 108.138.3.93
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fpaint.toys&pubid=bd056b42-51db-43ce-9a8e-3b11319b5d1f
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.3.93 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-3-93.fra56.r.cloudfront.net
Software: Server /
Resource Hash: 57234c0361bef55cff0569a18aa6d5be13af21f714f8eea3d56e4a35badf0ff0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=21550, s-maxage=21600
age: 2006
access-control-allow-credentials: true
via: 1.1 149b1af6ad8d2c0fedea82bfb1c29c66.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Hit from cloudfront
content-length: 3516
x-amz-cf-id: 8j7r4TxxjxINz5xDGKSqxr8orqInbW08Oa2Yg-bbYAdKQhpOooiipw==
date: Mon, 20 Jan 2025 11:54:41 GMT
content-type: application/json;charset=UTF-8
x-amz-cf-pop: FRA56-P6
server: Server

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 23 B
371 B 179ms
92ms XHR
text/javascript 18.244.21.227
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fpaint.toys%2Foil%2F&pr=https%3A%2F%2Fdfry.theunpackingitpodcast.com%2F&pid=lnCMYuXPHGDZI&cb=0&ws=1600x1200&v=25.114.1705&t=2500&slots=%5B%7B%22sd%22%3A%22pw-160x600_atf%22%2C%22s%22%3A%5B%22160x600%22%2C%22120x600%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600%22%7D%2C%7B%22sd%22%3A%22pw-160x600_btf%22%2C%22s%22%3A%5B%22160x600%22%2C%22120x600%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600%22%7D%2C%7B%22sd%22%3A%22leaderboard_atf%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%2C%22970x90%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-desktop_leaderboard%22%7D%2C%7B%22sd%22%3A%22leaderboard_btf%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%2C%22970x90%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-desktop_leaderboard%22%7D%5D&sg=%7B%22ortb2%22%3A%7B%22site%22%3A%7B%22cattax%22%3A6%2C%22cat%22%3A%5B%22693%22%5D%2C%22sectioncat%22%3A%5B%22693%22%5D%2C%22pagecat%22%3A%5B%22693%22%5D%7D%7D%7D&schain=1.0%2C1%21playwire.com%2C1024872%2C1%2C%2C%2C&pubid=bd056b42-51db-43ce-9a8e-3b11319b5d1f&gdpre=0&gdprl=%7B%22status%22%3A%22tcfv2-success%22%7D
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.244.21.227 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-244-21-227.fra56.r.cloudfront.net
Software: Server /
Resource Hash: 745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
access-control-allow-credentials: true
via: 1.1 92818640c38efb006e1c39f31234144c.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Miss from cloudfront
content-length: 43
x-amz-cf-id: 9y-bCKA0KDo0HvrnBi84StXtLaP1FvsnAjcC-rdEBo1lKGV2P2VF8A==
date: Mon, 20 Jan 2025 12:28:07 GMT
content-type: text/javascript;charset=UTF-8
x-amz-cf-pop: FRA56-P11
server: Server

GET
H2 200 pubcid.min.js Show response
secure.cdn.fastclick.net/js/pubcid/latest/ 54 KB
17 KB 117ms
38ms Script
application/javascript 23.215.23.172
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.cdn.fastclick.net/js/pubcid/latest/pubcid.min.js
Requested by: Host: dfry.theunpackingitpodcast.com
URL: https://dfry.theunpackingitpodcast.com/gvnljqsquRSnpkMnRnWHg1NjQwTVFqYmIxQWYtMTIxNy0yNjcxNjI1NC0wZmFjMDI2ZC0xNzMxLU1vTTdsWjRzNXI3ZjdndERnVHZm/iz72s5fifp6/zeikvpduwpkhpolpbvovls
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.215.23.172 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-215-23-172.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 43f804d38a294c6df1ce8ee64fb95ad0ff5a8d6d5685d9537df02212668a1dff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "d734-5f2f3919e751f-gzip"
expires: Mon, 20 Jan 2025 12:43:07 GMT
accept-ranges: bytes
content-length: 17407
date: Mon, 20 Jan 2025 12:28:07 GMT
last-modified: Mon, 23 Jan 2023 19:40:17 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16576/ 43 KB
13 KB 108ms
34ms Script
text/javascript 65.9.66.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Requested by: Host: dfry.theunpackingitpodcast.com
URL: https://dfry.theunpackingitpodcast.com/gvnljqsquRSnpkMnRnWHg1NjQwTVFqYmIxQWYtMTIxNy0yNjcxNjI1NC0wZmFjMDI2ZC0xNzMxLU1vTTdsWjRzNXI3ZjdndERnVHZm/iz72s5fifp6/zeikvpduwpkhpolpbvovls
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.66.104 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-66-104.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c5fdea6bcb7b7dc4aabe9e409df609b922dde30401ccf5c25f0f384f7e8c43b5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"6016bf24a16f4d1d8384c5f7f11c49fb"
age: 37652
via: 1.1 4f114016fe4d6c05531b0486ec2868be.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: 92rc-WRI1qHVm9VC00hamktj-cSm28jQ1Sbw20q82R-RExVIqTSpuA==
date: Mon, 20 Jan 2025 02:00:36 GMT
content-type: text/javascript
last-modified: Tue, 20 Aug 2024 18:47:26 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-C1
x-amz-server-side-encryption: AES256

GET
H2 200 hadron.js Show response
cdn.hadronid.net/ 11 B
325 B 124ms
49ms Script
application/javascript 104.22.53.173
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fdfry.theunpackingitpodcast.com%2F&_it=amazon&partner_id=403
Requested by: Host: dfry.theunpackingitpodcast.com
URL: https://dfry.theunpackingitpodcast.com/gvnljqsquRSnpkMnRnWHg1NjQwTVFqYmIxQWYtMTIxNy0yNjcxNjI1NC0wZmFjMDI2ZC0xNzMxLU1vTTdsWjRzNXI3ZjdndERnVHZm/iz72s5fifp6/zeikvpduwpkhpolpbvovls
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.22.53.173 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a73f5986eb985871284e6e216372de3505634a97229de643216728d0fbfd6227

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=432000
cf-cache-status: HIT
etag: "ba4f7a703ea78ac1b72b5fe1be4fb407"
age: 6153
x-amz-request-id: FNSGRM2T2X0F3SP6
cf-ray: 904f1005e87b37f5-FRA
accept-ranges: bytes
content-length: 11
date: Mon, 20 Jan 2025 12:28:08 GMT
content-type: application/javascript
last-modified: Thu, 05 Dec 2024 20:48:49 GMT
vary: Accept-Encoding
server: cloudflare
x-amz-id-2: mbaMHu2ugRuAWUTez/9CDUHmCcsdQSTzdB/ybJIe4z6r4sn+n/8rdvXYTZ8sZvLgeGqzwd30XWY=

GET
H2 200 id5-api.js Show response
cdn.id5-sync.com/api/1.0/ 100 KB
29 KB 110ms
38ms Script
text/javascript 172.67.38.106
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/id5-api.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.38.106 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

04c7f536471e1a16bb37c13fb4959de30d7e897ba4f6d66335b3c25d26289616

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"4d852428cba0ba1a5108520745060d6e"
age: 20
expires: Mon, 20 Jan 2025 13:28:07 GMT
date: Mon, 20 Jan 2025 12:28:07 GMT
content-type: text/javascript;charset=utf-8
last-modified: Wed, 04 Dec 2024 13:37:28 GMT
vary: Accept-Encoding
x-amz-id-2: qcl8qkMr2asDo+u2986p5XIzzxFMk9heSSn+iebFxNJt8iiHRycdo0shbxkz7/qnFwvCO5JGeMkKr5yV/ufLLw==
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: public, max-age=3600
x-amz-request-id: ZKBD3CPQ6P271SX3
cf-ray: 904f1005efe8daff-FRA
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 launcher-stub.min.js Show response
secure.cdn.fastclick.net/js/cnvr-launcher/latest/ 14 KB
5 KB 116ms
37ms Script
application/javascript 23.215.23.172
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher-stub.min.js
Requested by: Host: dfry.theunpackingitpodcast.com
URL: https://dfry.theunpackingitpodcast.com/gvnljqsquRSnpkMnRnWHg1NjQwTVFqYmIxQWYtMTIxNy0yNjcxNjI1NC0wZmFjMDI2ZC0xNzMxLU1vTTdsWjRzNXI3ZjdndERnVHZm/iz72s5fifp6/zeikvpduwpkhpolpbvovls
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.215.23.172 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-215-23-172.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: d3c286558922ca8c2c69167698cd61a8280cb03b81bb41d9bd633f80f18c274f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "38c0-5e92054540ea5-gzip"
expires: Mon, 20 Jan 2025 12:43:07 GMT
accept-ranges: bytes
content-length: 5252
date: Mon, 20 Jan 2025 12:28:07 GMT
last-modified: Tue, 20 Sep 2022 18:52:26 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H2 200 topics_frame.html
pa.openx.net/ Frame 4DF1 0
0 69ms
20ms Document
text/html 34.36.214.49
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://pa.openx.net/topics_frame.html?bidder=openx
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.36.214.49 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 49.214.36.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 998
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public,max-age=3600
content-length: 1036
content-type: text/html; charset=utf-8
date: Mon, 20 Jan 2025 12:11:29 GMT
etag: "c5379e35e267deacc52e06ed0f5fa81f"
last-modified: Mon, 22 Jan 2024 14:38:43 GMT
server: UploadServer
supports-loading-mode: fenced-frame
vary: Origin
x-allow-fledge: true
x-goog-generation: 1705934323795552
x-goog-hash: crc32c=eLLIGA== md5=xTeeNeJn3qzFLgbtD1+oHw==
x-goog-metageneration: 1
x-goog-storage-class: STANDARD
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 1036
x-guploader-uploadid: AFIdbgSfkBHwRWTnGgMZfyyRx2spMa0RnMdVtioXQkWMZdvBXaImwSzPjHrsVlmKcgRkLopo6kVVARw

GET
H2 200 topics_frame.html
ads.pubmatic.com/AdServer/js/topics/ Frame 3E43 0
0 114ms
31ms Document
text/html 2.23.241.43
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/topics/topics_frame.html?bidder=pubmatic
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.23.241.43 Doha, Qatar, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-23-241-43.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=151509
content-encoding: gzip
content-length: 859
content-type: text/html
date: Mon, 20 Jan 2025 12:28:08 GMT
expires: Wed, 22 Jan 2025 06:33:17 GMT
last-modified: Tue, 21 Mar 2023 05:02:13 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

POST
H3 200 cookie_sync Show response
prebid.intergient.com/ 2 KB
1 KB 188ms
145ms Fetch
application/json 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.intergient.com/cookie_sync
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7e4d8f0dd57a077dc2d1d9a341cb8d97ec025c0ce6350fd2315b3bf0bdbfcbda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1737376088&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=q15z5j4RuzkP3vyF9fj5wMzbdikyedpmBSxIGPq91F0%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Mon, 20 Jan 2025 12:28:08 GMT
content-type: application/json; charset=utf-8
vary: Origin
priority: u=1,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1737376088&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=q15z5j4RuzkP3vyF9fj5wMzbdikyedpmBSxIGPq91F0%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 vegur
cf-ray: 904f1005f8ae35df-FRA
access-control-allow-origin: https://paint.toys
server: cloudflare

POST
H3 200 auction Show response
prebid.intergient.com/openrtb2/ 13 KB
6 KB 327ms
284ms Fetch
application/json 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.intergient.com/openrtb2/auction
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4a272d2e687fd21300a9e7f7fe36004faadd5458c729bad9c06c21eeb4f046f1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1737376088&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=q15z5j4RuzkP3vyF9fj5wMzbdikyedpmBSxIGPq91F0%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Mon, 20 Jan 2025 12:28:08 GMT
content-type: application/json
vary: Origin
priority: u=1,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1737376088&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=q15z5j4RuzkP3vyF9fj5wMzbdikyedpmBSxIGPq91F0%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 vegur
cf-ray: 904f1005f8b335df-FRA
access-control-allow-origin: https://paint.toys
x-prebid: pbs-go/unknown
server: cloudflare

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
243 B 96ms
29ms Fetch
application/json 54.228.25.110
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.11.0&lt=1737376087934&to=-60&aun=pw-160x600_atf&pubcid=c44d06aa-1e55-400b-8490-9c5e904f5646&criteoId=m0dYIV8lMkZVRnkzVGRycktKem83djVHemRVY3BDVmlSU3pZbEhjUGRDMjVWSlluNWhkTFdWdE9lb2h3Tm5iUnhhNWNIdlZLc0d3M0QwYlNvd2NsZXllc1dYVG05bSUyQjZtRFRpRUYxMUpKOHZUWHI4ZUElM0Q&gpid=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600&t=8ylgv2wd&pi=3&maxw=160&maxh=600&si=1111716&bf=160x600%2C120x600&ae=true&gdprApplies=0&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.11.0%22%7D&ogu=null&ns=10240
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.228.25.110 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-228-25-110.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Mon, 20 Jan 2025 12:28:08 GMT
content-type: application/json;charset=UTF-8
server: nginx

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
242 B 98ms
31ms Fetch
application/json 54.228.25.110
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.11.0&lt=1737376087934&to=-60&aun=pw-160x600_btf&pubcid=c44d06aa-1e55-400b-8490-9c5e904f5646&criteoId=m0dYIV8lMkZVRnkzVGRycktKem83djVHemRVY3BDVmlSU3pZbEhjUGRDMjVWSlluNWhkTFdWdE9lb2h3Tm5iUnhhNWNIdlZLc0d3M0QwYlNvd2NsZXllc1dYVG05bSUyQjZtRFRpRUYxMUpKOHZUWHI4ZUElM0Q&gpid=pw-160x600_btf&t=8ylgv2wd&pi=3&maxw=160&maxh=600&si=1111716&bf=160x600%2C120x600&ae=true&gdprApplies=0&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.11.0%22%7D&ogu=null&ns=10240
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.228.25.110 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-228-25-110.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Mon, 20 Jan 2025 12:28:08 GMT
content-type: application/json;charset=UTF-8
server: nginx

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
242 B 97ms
30ms Fetch
application/json 54.228.25.110
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.11.0&lt=1737376087935&to=-60&aun=leaderboard_atf&pubcid=c44d06aa-1e55-400b-8490-9c5e904f5646&criteoId=m0dYIV8lMkZVRnkzVGRycktKem83djVHemRVY3BDVmlSU3pZbEhjUGRDMjVWSlluNWhkTFdWdE9lb2h3Tm5iUnhhNWNIdlZLc0d3M0QwYlNvd2NsZXllc1dYVG05bSUyQjZtRFRpRUYxMUpKOHZUWHI4ZUElM0Q&gpid=leaderboard_atf&t=8ylgv2wd&pi=3&maxw=970&maxh=250&si=1111709&bf=728x90%2C970x250%2C970x90&ae=true&gdprApplies=0&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.11.0%22%7D&ogu=null&ns=10240
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.228.25.110 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-228-25-110.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Mon, 20 Jan 2025 12:28:08 GMT
content-type: application/json;charset=UTF-8
server: nginx

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
242 B 98ms
32ms Fetch
application/json 54.228.25.110
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.11.0&lt=1737376087935&to=-60&aun=leaderboard_btf&pubcid=c44d06aa-1e55-400b-8490-9c5e904f5646&criteoId=m0dYIV8lMkZVRnkzVGRycktKem83djVHemRVY3BDVmlSU3pZbEhjUGRDMjVWSlluNWhkTFdWdE9lb2h3Tm5iUnhhNWNIdlZLc0d3M0QwYlNvd2NsZXllc1dYVG05bSUyQjZtRFRpRUYxMUpKOHZUWHI4ZUElM0Q&gpid=leaderboard_btf&t=8ylgv2wd&pi=3&maxw=970&maxh=250&si=1111709&bf=728x90%2C970x250%2C970x90&ae=true&gdprApplies=0&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.11.0%22%7D&ogu=null&ns=10240
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.228.25.110 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-228-25-110.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Mon, 20 Jan 2025 12:28:08 GMT
content-type: application/json;charset=UTF-8
server: nginx

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
116 B 169ms
86ms Fetch 3.72.106.219
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.72.106.219 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
access-control-allow-credentials: true

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
116 B 163ms
81ms Fetch 3.72.106.219
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.72.106.219 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-72-106-219.eu-central-1.compute.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
access-control-allow-credentials: true

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
117 B 136ms
54ms Fetch 3.72.106.219
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.72.106.219 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-72-106-219.eu-central-1.compute.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
access-control-allow-credentials: true

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
116 B 137ms
55ms Fetch 3.72.106.219
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.72.106.219 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-72-106-219.eu-central-1.compute.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
access-control-allow-credentials: true

POST
H2 200 hbjson Show response
grid.bidswitch.net/ 24 B
311 B 100ms
41ms Fetch
application/json 178.250.1.56
ASN-CRITEO-EUROPE...

General

Check archive.org

Show headers Download Go to

Full URL

https://grid.bidswitch.net/hbjson

Requested by

Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.56 , France, ASN44788 (ASN-CRITEO-EUROPE Criteo Technology SAS, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

89034996f4a3b983c35d0dd887a440f3b5df1ef4149cc7a547a5f36cc70f84e3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-store, must-revalidate, no-cache
content-encoding: br
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
date: Mon, 20 Jan 2025 12:28:08 GMT
content-type: application/json
vary: Accept-Encoding, Origin
server: Kestrel

POST
H3 200 pbjs Show response
htlb.casalemedia.com/openrtb/ 6 KB
2 KB 298ms
260ms Fetch
application/json 104.18.27.193
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/openrtb/pbjs?s=1031634
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f828af5e4b72e6b917be7528520478187ff1e6cb21645af8da00c2f2ecf2a507

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MGbqx0g2WyAhmwgd63pB9QMQ01wTxsY0%2BG%2FAo1ORMejbAjcinAdQCx5Vuwnuiz8IxNuC%2FoOl1BeprZpwJHzjAaWbkdefvLoQXt0ptp%2FDOPPb8Zn9afklwTmwvw5GS8ux036nAGuI"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Mon, 20 Jan 2025 12:28:08 GMT
content-type: application/json
vary: Accept-Encoding
priority: u=1,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
access-control-allow-credentials: true
cf-ray: 904f1005f9d7db03-FRA
access-control-allow-origin: https://paint.toys
server: cloudflare

POST
H2 204 request Show response
grid-bidder.criteo.com/openrtb_2_5/pbjs/auction/ 0
524 B 101ms
42ms Fetch 178.250.1.38
ASN-CRITEO-EUROPE...

General

Check archive.org

Show headers Download Go to

Full URL

https://grid-bidder.criteo.com/openrtb_2_5/pbjs/auction/request?profileId=207&av=37&wv=9.11.0&cb=68570726460&lsavail=1&bundle=aReJGl9hTUJvcmxJREw0OXhCd2w1aVlKbzIwU3M3ZTUxcTNSeWFWcG95Q1FNczhDc0Z0bXpETjhlVm5yRXJ3MWN2NWhYRGJyczVGRXBKV0p1aFhRQWZVRFRzOGZkNk8lMkIxajlWaWIwenRiYnl2NmlGWk1KTmtYRVAlMkZZeTY3Q213R0hjQWklMkZnYU8lMkZYRmN4cmhaemg1UzFUZ0VKdyUzRCUzRA&networkId=6163

Requested by

Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.38 , France, ASN44788 (ASN-CRITEO-EUROPE Criteo Technology SAS, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
access-control-allow-origin: https://paint.toys
date: Mon, 20 Jan 2025 12:28:07 GMT
vary: Origin
server: Kestrel
access-control-allow-credentials: true

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 12 KB
6 KB 206ms
137ms Fetch
application/json 69.173.156.139
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=9&alt_size_ids=8&p_pos=atf&gdpr=0&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=c44d06aa-1e55-400b-8490-9c5e904f5646%5E1&eid_criteo.com=m0dYIV8lMkZVRnkzVGRycktKem83djVHemRVY3BDVmlSU3pZbEhjUGRDMjVWSlluNWhkTFdWdE9lb2h3Tm5iUnhhNWNIdlZLc0d3M0QwYlNvd2NsZXllc1dYVG05bSUyQjZtRFRpRUYxMUpKOHZUWHI4ZUElM0Q%5E1&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fdfry.theunpackingitpodcast.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.pos=atf&tg_i.sitecont_cat=games_casual&tg_i.adunit=pw-160x600_atf&tg_i.pbadslot=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600&tk_flint=pbjs_lite_v9.11.0&x_source.tid=65f91c41-ca26-4726-9577-f57ed57fafcf&l_pb_bid_id=83b02bdbdceb6c&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=78991682-ab5e-4f9c-ae6b-a90e77b8c4b5&rp_maxbids=1&p_gpid=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600&m_ch_mobile=%3F0&slots=1&rand=0.6711966011571897
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.156.139 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: 239e847a5223e4d58c913b4a032f6a8f0a8c1a503ff9a0d0b7ffe5aad7189f01

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
date: Mon, 20 Jan 2025 12:28:08 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 12 KB
6 KB 332ms
262ms Fetch
application/json 69.173.156.139
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=9&alt_size_ids=8&gdpr=0&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=c44d06aa-1e55-400b-8490-9c5e904f5646%5E1&eid_criteo.com=m0dYIV8lMkZVRnkzVGRycktKem83djVHemRVY3BDVmlSU3pZbEhjUGRDMjVWSlluNWhkTFdWdE9lb2h3Tm5iUnhhNWNIdlZLc0d3M0QwYlNvd2NsZXllc1dYVG05bSUyQjZtRFRpRUYxMUpKOHZUWHI4ZUElM0Q%5E1&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fdfry.theunpackingitpodcast.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.pos=btf&tg_i.sitecont_cat=games_casual&tg_i.adunit=pw-160x600_btf&tg_i.pbadslot=pw-160x600_btf&tk_flint=pbjs_lite_v9.11.0&x_source.tid=65f91c41-ca26-4726-9577-f57ed57fafcf&l_pb_bid_id=84ce85ef4108fc2&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=653ff40d-5810-404d-8b9d-6aca1020567f&rp_maxbids=1&p_gpid=pw-160x600_btf&m_ch_mobile=%3F0&slots=1&rand=0.7205751818520962
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.156.139 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: 54db6300cdbafe00edf2fdc385600fc0f6ec5451e024e4fde33be8b6dd6bd27d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
date: Mon, 20 Jan 2025 12:28:08 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 12 KB
6 KB 237ms
167ms Fetch
application/json 69.173.156.139
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=2&alt_size_ids=55%2C57&p_pos=atf&gdpr=0&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=c44d06aa-1e55-400b-8490-9c5e904f5646%5E1&eid_criteo.com=m0dYIV8lMkZVRnkzVGRycktKem83djVHemRVY3BDVmlSU3pZbEhjUGRDMjVWSlluNWhkTFdWdE9lb2h3Tm5iUnhhNWNIdlZLc0d3M0QwYlNvd2NsZXllc1dYVG05bSUyQjZtRFRpRUYxMUpKOHZUWHI4ZUElM0Q%5E1&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fdfry.theunpackingitpodcast.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.pos=atf&tg_i.sitecont_cat=games_casual&tg_i.adunit=leaderboard_atf&tg_i.pbadslot=leaderboard_atf&tk_flint=pbjs_lite_v9.11.0&x_source.tid=65f91c41-ca26-4726-9577-f57ed57fafcf&l_pb_bid_id=8557418053df175&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=450784f8-364f-482b-8c15-440ae7353ec4&rp_maxbids=1&p_gpid=leaderboard_atf&m_ch_mobile=%3F0&slots=1&rand=0.4706465508067199
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.156.139 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: 78e7a07d8c877ac787a22617c3c3cc2b7a37c7dffa708973eefcbe0825d9c6dd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
date: Mon, 20 Jan 2025 12:28:08 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 12 KB
6 KB 223ms
154ms Fetch
application/json 69.173.156.139
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=2&alt_size_ids=55%2C57&gdpr=0&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=c44d06aa-1e55-400b-8490-9c5e904f5646%5E1&eid_criteo.com=m0dYIV8lMkZVRnkzVGRycktKem83djVHemRVY3BDVmlSU3pZbEhjUGRDMjVWSlluNWhkTFdWdE9lb2h3Tm5iUnhhNWNIdlZLc0d3M0QwYlNvd2NsZXllc1dYVG05bSUyQjZtRFRpRUYxMUpKOHZUWHI4ZUElM0Q%5E1&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fdfry.theunpackingitpodcast.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.pos=btf&tg_i.sitecont_cat=games_casual&tg_i.adunit=leaderboard_btf&tg_i.pbadslot=leaderboard_btf&tk_flint=pbjs_lite_v9.11.0&x_source.tid=65f91c41-ca26-4726-9577-f57ed57fafcf&l_pb_bid_id=8610e69f124579e&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=fdcff294-55d2-4df6-911f-fa0f775fac29&rp_maxbids=1&p_gpid=leaderboard_btf&m_ch_mobile=%3F0&slots=1&rand=0.8387422667518052
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.156.139 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: 71ed77b0785ad767ff2d671db2c6732aaacd102e1b3b67fbe16282875178d4f9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
date: Mon, 20 Jan 2025 12:28:08 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

POST
H2 200 prebidjs Show response
rtb.openx.net/openrtbb/ 53 B
268 B 97ms
22ms Fetch
text/plain 35.186.253.211
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.openx.net/openrtbb/prebidjs
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: /
Resource Hash: 00e7b3d8bdcb2a5fc66578fb75e967b517fc54198797b468080e4252ee02b05f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-forwarded-for: 45.74.44.74
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 77
date: Mon, 20 Jan 2025 12:28:07 GMT
content-type: text/plain
vary: Origin

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
347 B 358ms
158ms Fetch 152.42.153.237
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 152.42.153.237 New York, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Mon, 20 Jan 2025 12:28:08 GMT
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
347 B 367ms
168ms Fetch 152.42.153.237
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 152.42.153.237 New York, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Mon, 20 Jan 2025 12:28:08 GMT
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
347 B 357ms
172ms Fetch 152.42.153.237
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 152.42.153.237 New York, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Mon, 20 Jan 2025 12:28:08 GMT
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
347 B 382ms
187ms Fetch 152.42.153.237
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 152.42.153.237 New York, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Mon, 20 Jan 2025 12:28:08 GMT
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control

POST
H2 200 hb-multi Show response
hb.yellowblue.io/ 83 B
621 B 149ms
66ms Fetch
application/json 52.222.236.9
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://hb.yellowblue.io/hb-multi
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.236.9 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-236-9.fra56.r.cloudfront.net
Software: istio-envoy /
Resource Hash: 47c1cfd6abb52168c159a4fbc087accebba5536d79e0d564be96e8a33c32056a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: GET, OPTIONS
via: 1.1 c9499008aa7e1acd11e9fbc171281d82.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Miss from cloudfront
content-length: 108
x-amz-cf-id: tKf3wFnTHseZavx9wci4Q-7Ag3f7TdsY7gneiAeC4xjaEUlbr0_qFg==
date: Mon, 20 Jan 2025 12:28:08 GMT
content-type: application/json
x-amz-cf-pop: FRA56-P4
server: istio-envoy
x-reason: maxmind hosting provider
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

POST
H/1.1 200
OK playwire Show response
direct.adsrvr.org/bid/bidder/ 0
394 B 106ms
37ms Fetch
application/json 35.71.170.66
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://direct.adsrvr.org/bid/bidder/playwire
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 35.71.170.66 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a8c33d2b6751b365d.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-openrtb-version: 2.3
cache-control: private
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
content-length: 0
date: Mon, 20 Jan 2025 12:28:07 GMT
content-type: application/json
server: Kestrel
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 470 B
1 KB 112ms
44ms Fetch
application/json 37.252.172.123
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.123 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

9dbea5f2db01c4d8a1d28be9c522824700f8a0b863efdb422aaf431da5ba48ec

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 45.74.44.74; 45.74.44.74; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: https://paint.toys
an-x-request-uuid: 31a16eb0-2df1-48b6-9867-83aaf6d1a61a
content-length: 470
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Mon, 20 Jan 2025 12:28:08 GMT
x-xss-protection: 0
content-type: application/json; charset=utf-8
server: nginx/1.23.4

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
109 B 136ms
73ms Fetch 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
access-control-allow-origin: https://paint.toys
date: Mon, 20 Jan 2025 12:28:06 GMT
access-control-allow-credentials: true

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
649 B 196ms
119ms Fetch
application/json 3.124.64.248
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=9.11.0&referrer=https%3A%2F%2Fpaint.toys%2Foil%2F&tmax=2500&gdpr=false&fledge=true

Requested by

Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.124.64.248 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-124-64-248.eu-central-1.compute.amazonaws.com

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
accept-ch: sec-ch-downlink,sec-ch-ua-full-version-list,sec-ch-prefers-color-scheme,sec-ch-ua-platform,sec-ch-dpr,user-agent,sec-ch-width,sec-ch-viewport-height,sec-ch-save-data,sec-ch-ect,sec-ch-ua-model,sec-ch-ua-platform-version,sec-ch-device-memory,sec-ch-ua-bitness,sec-ch-ua,sec-ch-ua-full-version,sec-ch-ua-arch,sec-ch-rtt,sec-ch-ua-mobile,sec-ch-viewport-width
access-control-allow-credentials: true
expires: Thu, 15 Oct 1992 20:10:00 GMT
access-control-allow-origin: https://paint.toys
x-xss-protection: 0
content-type: application/json; charset=utf-8
vary: Accept-Encoding

GET
H3 200 ima_ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 67 B
59 B 40ms
39ms XHR
application/json 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ima_ppub_config?ippd=https%3A%2F%2Fpaint.toys%2Foil%2F

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

641768f2d1d19839fc3cecfa5158382fa0d332d5e49e31bcaafbedc4af91995a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
content-encoding: br
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Mon, 20 Jan 2025 12:28:07 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 35
date: Mon, 20 Jan 2025 12:28:07 GMT
x-xss-protection: 0
content-type: application/json; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

POST
H2 200 483.json Show response
id5-sync.com/g/v2/ 385 B
575 B 32ms
31ms Fetch
application/json 141.95.98.65
OVH OVH SAS

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/483.json

Requested by

Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.65 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

99ab41085d5b8ac7e2d3fc2f19d785e31f381d8ff7541bbc27e6e2cd3838500b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Mon, 20 Jan 2025 12:28:07 GMT
content-type: application/json
vary: Origin
access-control-allow-credentials: true

GET
H2 200 launcher.min.js Show response
secure.cdn.fastclick.net/js/cnvr-launcher/latest/ 49 KB
17 KB 30ms
30ms Script
application/javascript 23.215.23.172
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher-stub.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.215.23.172 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-215-23-172.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 938c64115ce60b98ee8151d7eb28208567753f3d4ebbe0aa0f56618c555a18fb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "c4b6-5e920545406d3-gzip"
expires: Mon, 20 Jan 2025 12:43:08 GMT
accept-ranges: bytes
content-length: 17042
date: Mon, 20 Jan 2025 12:28:08 GMT
last-modified: Tue, 20 Sep 2022 18:52:26 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H2 200 launcher Show response
proc.ad.cpe.dotomi.com/cvx/client/direct/ 190 B
459 B 107ms
33ms XHR
application/json 63.215.202.146
VCLK-EU-SE Conver...

General

Check archive.org

Show headers Download Go to

Full URL: https://proc.ad.cpe.dotomi.com/cvx/client/direct/launcher?version=1.1.1&lid=681
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 63.215.202.146 Amsterdam, Netherlands, ASN41041 (VCLK-EU-SE Conversant LLC, US),
Reverse DNS: ams01-convex-float1.dotomi.com
Software: nginx /
Resource Hash: 71f0c958e33905cb028dfd76ff7fcffa9d57a260845594e84d116530e3f80a36

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=1800
accept-ch: Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness
access-control-allow-credentials: true
expires: Mon, 20 Jan 2025 12:58:08 GMT
access-control-allow-origin: https://paint.toys
content-length: 190
date: Mon, 20 Jan 2025 12:28:08 GMT
content-type: application/json
vary: Origin
server: nginx

GET
H3 200 ads_global. Show response
fundingchoicesmessages.google.com/f/AGSKWxXn9CJIbiQBfhvaM7cq59b5Qd_kxGBtnxNCBm8LvFoCG6px-0qBJInQNeOE3NNfq4plBqtcGVESsSia1JksnbBhcQSxecA-Lhd6bbgmaOVzgOsZJWizowOXSrFmE05Jv2qto9HrdVtrX34f2142dO5qMyUH6... 54 B
109 B 47ms
46ms Script
application/javascript 142.250.184.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxXn9CJIbiQBfhvaM7cq59b5Qd_kxGBtnxNCBm8LvFoCG6px-0qBJInQNeOE3NNfq4plBqtcGVESsSia1JksnbBhcQSxecA-Lhd6bbgmaOVzgOsZJWizowOXSrFmE05Jv2qto9HrdVtrX34f2142dO5qMyUH6WfVGuL9w4IVDxqoU32MwIb9QuwVUEUa/__ad_number=/gadv-right./downads./msn-exo-/ads_global.

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.2VP0kQaqwts.es5.O/d=1/exm=kernel_loader,loader_js_executable,web_iab_tcf_v2_signal_executable/ed=1/rs=AJlcJMx-uDKfz5RVguZ8g7PfzzTocKGHcw/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.238 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

26944298dc6fef0310bc979bbbd514313ef2c63fb18b2c9c69f073305b1cd8c6

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-iuMHpkoonDUz72meqIE3Yw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 20 Jan 2025 12:28:08 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjamDU4pJicNCQYpD4-pJJC4id0mewhgBx681zrNOB2GjteVYXIE76d561BIgNFS6xOgOxY9ElVk8gVu25xGoOxPfXXWJ9DsQf6i-z_gDiGecvsy4A4iKJK6wtQMzw9QorBxBX_7rK2gzEtqzXWF2BWIib40bTzj1sAi-2XDVS0kjKL4xPzs8rKcpMKi3JL0pLTkstTi0qSy2KNzIwMjUwNDTTMzCNLzAAADF8TFI"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-iuMHpkoonDUz72meqIE3Yw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 google_top_exp.js Show response
pagead2.googlesyndication.com/pagead/js/ 47 B
67 B 93ms
32ms Script
text/javascript 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/google_top_exp.js?fcd=true

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.2VP0kQaqwts.es5.O/d=1/exm=kernel_loader,loader_js_executable,web_iab_tcf_v2_signal_executable/ed=1/rs=AJlcJMx-uDKfz5RVguZ8g7PfzzTocKGHcw/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ccecd185ac16ba0a538840f37701053fbb861f7fbbdd86039c7415fcd924d1f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 13036835877489095579
age: 84148
x-content-type-options: nosniff
expires: Sun, 02 Feb 2025 13:05:40 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sun, 19 Jan 2025 13:05:40 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 42
x-xss-protection: 0
server: cafe

POST
H3 204 AGSKWxWSODV9180JfxTLk7hJfIQdG-vPfDttPudYk-AqaOYxgozyWoZgYx-4Io5GVGNKG8GIVL8oFmp-OcrgQmJtFnRkV2tBOygm208Roe89zedWNwKw0zGx5ZAU1nDDhurdQoKYw0lfLw== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 84ms
42ms XHR
text/html 142.250.184.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWSODV9180JfxTLk7hJfIQdG-vPfDttPudYk-AqaOYxgozyWoZgYx-4Io5GVGNKG8GIVL8oFmp-OcrgQmJtFnRkV2tBOygm208Roe89zedWNwKw0zGx5ZAU1nDDhurdQoKYw0lfLw==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.238 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-CZ1iMv2Tsf5yBiytnE2CpQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 20 Jan 2025 12:28:08 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjUtDikmLw1ZBicEqfwRoAxB_qL7P-AGKGr1dYOYBYiJvjRtPOPWwCE95dcFZyScovjE_OzytJzSvRTUwp1gWxizKTSkvyi1DYqWUgFTn56emZeenxRgZGpgaGhmZ6BubxBQYA09IqlQ"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-CZ1iMv2Tsf5yBiytnE2CpQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H2 200 prbds2s
rtb.gumgum.com/usync/ Frame 0D4C 0
0 101ms
31ms Document
text/plain 54.229.43.142
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.gumgum.com/usync/prbds2s?gdpr=0&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dgumgum%26gdpr%3D0%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.229.43.142 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-229-43-142.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

content-length: 0
date: Mon, 20 Jan 2025 12:28:08 GMT
etag: "0d41d8cd98f00b204e9800998ecf8427e"
server: nginx
timing-allow-origin: *

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWSODV9180JfxTLk7hJfIQdG-vPfDttPudYk-AqaOYxgozyWoZgYx-4Io5GVGNKG8GIVL8oFmp-OcrgQmJtFnRkV2tBOygm208Roe89zedWNwKw0zGx5ZAU1nDDhurdQoKYw0lfLw==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.238 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-TelBc_8I1cRHqSf9X7mnVw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 20 Jan 2025 12:28:08 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjUtDikmJw0ZBicEqfwRoAxB_qL7P-AGKGr1dYOYBYiJvjRtPOPWwCDx53BCi5JOUXxifn55Wk5pXoJqYU64LYRZlJpSX5RSjs1DKQipz89PTMvPR4IwMjUwNDQzM9A_P4AgMA00Mqlg"
content-security-policy: script-src 'report-sample' 'nonce-TelBc_8I1cRHqSf9X7mnVw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H2 200 coreid.min.js Show response
secure.cdn.fastclick.net/js/cnvr-coreid/latest/ 229 KB
66 KB 31ms
30ms Script
application/javascript 23.215.23.172
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-coreid/latest/coreid.min.js
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.215.23.172 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-215-23-172.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: eb87c0447bd19366919bdb8913f775caca732ac31cbc5e5d42e4db5df39437ce

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "394d0-60864a57eaadc-gzip"
expires: Mon, 20 Jan 2025 12:43:08 GMT
accept-ranges: bytes
content-length: 67550
date: Mon, 20 Jan 2025 12:28:08 GMT
last-modified: Mon, 23 Oct 2023 16:23:46 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWSODV9180JfxTLk7hJfIQdG-vPfDttPudYk-AqaOYxgozyWoZgYx-4Io5GVGNKG8GIVL8oFmp-OcrgQmJtFnRkV2tBOygm208Roe89zedWNwKw0zGx5ZAU1nDDhurdQoKYw0lfLw==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.238 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-vsu7FQALEcx9nEukViUdfQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 20 Jan 2025 12:28:08 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjUtDikmJw1pBicEqfwRoAxB_qL7P-AGKGr1dYOYBYiJvjRtPOPWwCP_ZPiVVyScovjE_OzytJzSvRTUwp1gWxizKTSkvyi1DYqWUgFTn56emZeenxRgZGpgaGhmZ6BubxBQYA1nsqog"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-vsu7FQALEcx9nEukViUdfQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWSODV9180JfxTLk7hJfIQdG-vPfDttPudYk-AqaOYxgozyWoZgYx-4Io5GVGNKG8GIVL8oFmp-OcrgQmJtFnRkV2tBOygm208Roe89zedWNwKw0zGx5ZAU1nDDhurdQoKYw0lfLw==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.238 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-mEieUX7ZQ5EHc2ttCICaQQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 20 Jan 2025 12:28:08 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjUtDikmII1JBicEqfwRoAxB_qL7P-AGKGr1dYOYBYiJvjRtPOPWwCN862xiq5JOUXxifn55Wk5pXoJqYU64LYRZlJpSX5RSjs1DKQipz89PTMvPR4IwMjUwNDQzM9A_P4AgMA0xMqjw"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-mEieUX7ZQ5EHc2ttCICaQQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H3 200 AGSKWxVE_HdithBZzOGpG4fveiMP2_GAHaokVfsgTiYNi9_dFtY_sri5MAJkNZJfTm0uSt4-z3zz2YlOZY2VCb47vEHm8Ihstmqt84nmLZdo9UteICAV780_cWA9z9_52VePpIca5FTFWA== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 56ms
56ms Script
application/javascript 142.250.184.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxVE_HdithBZzOGpG4fveiMP2_GAHaokVfsgTiYNi9_dFtY_sri5MAJkNZJfTm0uSt4-z3zz2YlOZY2VCb47vEHm8Ihstmqt84nmLZdo9UteICAV780_cWA9z9_52VePpIca5FTFWA==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzM3Mzc2MDg4LDE3NDAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOSw2XSxudWxsLDIsbnVsbCwiZW4iLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCwxXSwiaHR0cHM6Ly9wYWludC50b3lzL29pbC8iLG51bGwsW1s4LCIyVlAwa1FhcXd0cyJdLFs5LCJlbi1VUyJdLFsxOSwiMiJdLFsxNywiWzBdIl1dXQ

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.238 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

b033c42310cd32907c005dee766fe7fe4d9207082cfc75326f7f098f146210a0

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-KQaLyM159aoWObTpy5ks8A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 20 Jan 2025 12:28:08 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjamDU4pJi8NCQYpD4-pJJC4id0mewhgBx681zrNOB2GjteVYXIE76d561BIgNFS6xOgOxY9ElVk8gVu25xGoOxPfXXWJ9DsQf6i-z_gDiGecvsy4A4iKJK6wtQMzw9QorBxBX_brK2gTEtqzXWF2BWIib40bTzj1sAi_mH05R0kjKL4xPzs8rKcpMKi3JL0pLTkstTi0qSy2KNzIwMjUwNDTTMzCNLzAAADgnTGM"
content-security-policy: script-src 'report-sample' 'nonce-KQaLyM159aoWObTpy5ks8A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H2 200 j Show response
rp.liadm.com/ 13 B
380 B 302ms
100ms Fetch
application/json 3.229.10.181
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://rp.liadm.com/j?dtstmp=1737376088217&did=did-0046&se=e30&duid=8e413bd09c43--01jj1tyfn4g8tynrc0cwaprmzy&tv=9.11.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&gdpr=0&refr=https%3A%2F%2Fdfry.theunpackingitpodcast.com%2F&cd=.paint.toys
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.229.10.181 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-229-10-181.compute-1.amazonaws.com
Software: /
Resource Hash: efabba3678b85fcab831b778ea2ddaad1e2a1e952584d3566bc39b7ccb3429d9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-pixel-event-id: 0782274f-b740-42fc-8868-3934d6f18a54
access-control-max-age: 86400
access-control-expose-headers: *
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-origin: https://paint.toys
content-length: 13
date: Mon, 20 Jan 2025 12:28:08 GMT
content-type: application/json

GET
H2

200

cm
u.openx.net/w/1.0/ Frame 7376
Redirect Chain

https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=0&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26g...
https://u.openx.net/w/1.0/cm?cc=1&id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=0&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopen...

0
0

32ms
32ms

Document
text/html

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://u.openx.net/w/1.0/cm?cc=1&id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=0&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D0%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 494
content-type: text/html
date: Mon, 20 Jan 2025 12:28:07 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
via: 1.1 google

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Mon, 20 Jan 2025 12:28:07 GMT
location: https://u.openx.net/w/1.0/cm?cc=1&id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=0&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D0%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
p3p: CP="CUR ADM OUR NOR STA NID"
server: OXGW/0.0.0
via: 1.1 google

POST
H3 204 AGSKWxUe6tcbd3GoJt6fh68VB82wK0kmP0rFxhU45eeKRPi8O1ILU9opSH_mE5HLNsDSatb4BQ0RBfupkfaXFwbsPLsO4m00ZiMufq-EZSCTvf3IiQfaZzF0-iFT8UaW2KqV88cuPSXn4g== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 46ms
46ms XHR
text/html 142.250.184.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUe6tcbd3GoJt6fh68VB82wK0kmP0rFxhU45eeKRPi8O1ILU9opSH_mE5HLNsDSatb4BQ0RBfupkfaXFwbsPLsO4m00ZiMufq-EZSCTvf3IiQfaZzF0-iFT8UaW2KqV88cuPSXn4g==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.238 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-lF7STOpt9MpC-OXTU-7jVA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 20 Jan 2025 12:28:08 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjUtDikmLw1pBicEqfwRoAxB_qL7P-AGKGr1dYOYBYiJvjRtPOPWwCG5acq1RyScovjE_OzytJzSvRTUwp1gWxizKTSkvyi1DYqWUgFTn56emZeenxRgZGpgaGhmZ6BubxBQYA1YQqnQ"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-lF7STOpt9MpC-OXTU-7jVA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H3 200 sodar Show response
ep1.adtrafficquality.google/getconfig/ 17 KB
13 KB 89ms
49ms XHR
application/json 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ep1.adtrafficquality.google/getconfig/sodar?sv=200&tid=gpt&tv=m202501140101&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202501140101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

7b71cd76f9fc9f0558646e59225de744a611f8c20f24783085bb442ccd7b5867

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

timing-allow-origin: *
content-encoding: br
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 13253
date: Mon, 20 Jan 2025 12:28:08 GMT
x-xss-protection: 0
content-type: application/json; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 31 KB
3 KB 501ms
501ms Fetch
text/plain 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2560302069360572&correlator=2407077860373454&eid=31088846%2C83321072&output=ldjh&gdfp_req=1&vrg=202501140101&ptt=17&impl=fifs&gdpr=0&npa=1&iu_parts=154013155%2C1024872%2C74068%2Cpublisher%3A1024872-website%3A74068-160x600%2Cpublisher%3A1024872-website%3A74068-160x600-CP%2Cpublisher%3A1024872-website%3A74068-160x600-CP-160x600&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4%2F5&prev_iu_szs=160x600%7C120x600&ifi=1&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1737376088362&lmt=1737376088&adxs=20&adys=614&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fdfry.theunpackingitpodcast.com%2F&vis=1&psz=180x1097&msz=160x-1&fws=4&ohw=180&topics=5&tps=5&htps=5&a3p=EhMKDGlkNS1zeW5jLmNvbRIBMFgBEjQKCnB1YmNpZC5vcmcSJGM0NGQwNmFhLTFlNTUtNDAwYi04NDkwLTljNWU5MDRmNTY0NlgBEh0KDmVzcC5jcml0ZW8uY29tGKr6vJ3IMkgAUgIIZBIUCgVvcGVueBjz-rydyDJIAFICCG8SGwoMMzNhY3Jvc3MuY29tGKv6vJ3IMkgAUgIIZBIXCghydGJob3VzZRiE-7ydyDJIAFICCGo.&nt=1&psd=WzE1LFtdLG51bGwsM10.&dlt=1737376086708&idt=384&prev_scp=pos%3Datf%26slot_id%3Dpw-160x600_atf%26refresh%3Dfalse%26amazonBid%3Dfalse%26custom_path%3D160x600%26lld_id%3Dbc531c74bbf74decacfac3a6dc1ba8a176087865%26price_floor%3Dna%26amznbid%3D2%26amznp%3D2%26hb_cache_host_s2s_ix%3Dprebid.adnxs.com%26hb_format_s2s_ix%3Dbanner%26hb_size_s2s_ix%3D160x600%26hb_pb_s2s_ix%3D0.55%26hb_adid_s2s_ix%3D1301ef51d840ad45%26hb_bidder_s2s_ix%3Ds2s_ix%26hb_format_rubicon%3Dbanner%26hb_size_rubicon%3D160x600%26hb_pb_rubicon%3D0.59%26hb_adid_rubicon%3D1250107a4419d137%26hb_bidder_rubicon%3Drubicon%26hb_cache_path%3D%252Fpbc%252Fv1%252Fcache%26hb_format%3Dbanner%26hb_size%3D160x600%26hb_pb%3D0.59%26hb_adid%3D1250107a4419d137%26hb_bidder%3Drubicon%26bid_type%3Dclient&cust_params=pf_src%3Dml%26li-module-enabled%3Dt1-e0%26salad%3Dchef%26dd%3Draspberry%26di%3Dpineapple%26vd%3Draspberry%26vi%3Dpineapple%26sitecont_cat%3Dgames_casual%26referrer%3Dhttps%253A%252F%252Fdfry.theunpackingitpodcast.com%252F%26tyche_code%3D2.1.12%26pageos_code%3D2.1.12%26hour%3D13%26day%3DMonday%26referrer_domain%3Ddfry.theunpackingitpodcast.com%26OS%3DLinux%2520null%26browser%3DChrome%2520131%26pagecount%3D1%26window_width%3D1600%26window_height%3D1200%26screen_orientation%3Dlandscape%26website_id%3D74068%26refresh_count%3D0%26tyche_version%3D2.1.12%26ab_test%3Dna_A%26page_focus%3Dtrue&adks=2747221344&frm=20&eoidce=1&td=1&egid=33938&tan=7694250d-1cee-4b7e-9270-458a4dc99b8b&tdf=2

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202501140101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

37f72ebe1214b3c0288d2fa676200a613a14d070762756703e78f57b4e64dcdb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: dcb
google-lineitem-id: 5978692050
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Mon, 20 Jan 2025 12:28:08 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: 138446081992
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
content-length: 2982
x-xss-protection: 0
server: cafe

GET
H2 200 container.html
c8522671acd552874fe059617dd6561e.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 52EB 0
0 124ms
38ms Document
text/html 142.250.186.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://c8522671acd552874fe059617dd6561e.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202501140101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f1.1e100.net

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 20 Jan 2025 12:28:08 GMT
expires: Mon, 20 Jan 2025 12:28:08 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
ep2.adtrafficquality.google/sodar/ 18 KB
7 KB 109ms
37ms Script
text/javascript 142.250.74.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ep2.adtrafficquality.google/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202501140101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.74.193 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f1.1e100.net

Software

sffe /

Resource Hash

ff3de130872fe0fb5b770dfa2bc9f0daf8ab320403a34a60d089436f08d24f99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
etag: "1727224258380615"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
x-content-type-options: nosniff
expires: Mon, 20 Jan 2025 12:28:08 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 20 Jan 2025 12:28:08 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: private, max-age=3000
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 6445
x-xss-protection: 0
server: sffe

GET
H2 200 bounce Show response
id5-sync.com/ 30 B
228 B 32ms
31ms Fetch
text/plain 141.95.98.65
OVH OVH SAS

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/bounce

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.65 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ns3203256.ip-141-95-33.eu

Software

Resource Hash

b04cd869cfd41a48c006458f71969a0eb26f33fec12f3cfe00408f8b73bf3ff8

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Mon, 20 Jan 2025 12:28:08 GMT
content-type: text/plain;charset=utf-8
vary: Origin
access-control-allow-credentials: true

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
281 B 34ms
34ms Fetch
application/json 141.95.33.120
OVH OVH SAS

General

Check archive.org

Show headers Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.33.120 , Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

940377cb1276b89202627c9aa8c884421a4352cee584f6f8591e614ae6302ff4

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Mon, 20 Jan 2025 12:28:08 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

POST
H2 200 v3 Show response
id5-sync.com/gm/ 453 B
643 B 33ms
32ms XHR
application/json 141.95.98.65
OVH OVH SAS

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/gm/v3

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.65 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ams15s21-in-f129.1e100.net

Software

Resource Hash

630cac9beb604ae718330774376dc771d18d6cddf5742d7f3bd4b09c2e4fc03d

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Mon, 20 Jan 2025 12:28:08 GMT
content-type: application/json
vary: Origin
access-control-allow-credentials: true

GET
H2 200 runner.html
ep2.adtrafficquality.google/sodar/sodar2/232/ Frame 75EF 0
0 102ms
32ms Document
text/html 216.58.212.129
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ep2.adtrafficquality.google/sodar/sodar2/232/runner.html

Requested by

Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.129 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 833
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000
content-encoding: gzip
content-length: 5005
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 20 Jan 2025 12:14:15 GMT
expires: Mon, 20 Jan 2025 13:04:15 GMT
last-modified: Mon, 23 Sep 2024 18:12:21 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe
www.google.com/recaptcha/api2/ Frame 4F67 0
0 104ms
44ms Document
text/html 216.58.206.36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.36 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lcfraa-aa-in-f4.1e100.net

Software

ESF /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-IsXq4BEKwUJ7V3eijbxITg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-IsXq4BEKwUJ7V3eijbxITg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy-report-only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
cross-origin-resource-policy: cross-origin
date: Mon, 20 Jan 2025 12:28:08 GMT
expires: Mon, 20 Jan 2025 12:28:08 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
server: ESF
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

setuid
prebid.intergient.com/
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dappnexus%26gdpr%3D0%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%24UID
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fprebid.intergient.com%252Fsetuid%253Fbidder%253Dappnexus%2526gdpr%253D0%2526gdpr_consent%253D%2526gpp%253D%2526gpp_sid%253D%2526f%253Di%2...
https://prebid.intergient.com/setuid?bidder=appnexus&gdpr=0&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=3745704257559007735

86 B
1 KB

141ms
140ms

Image
image/png

104.18.20.56
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.intergient.com/setuid?bidder=appnexus&gdpr=0&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=3745704257559007735
Protocol: H3
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1737376088&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=q15z5j4RuzkP3vyF9fj5wMzbdikyedpmBSxIGPq91F0%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Mon, 20 Jan 2025 12:28:08 GMT
content-type: image/png
vary: Origin
priority: u=3,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1737376088&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=q15z5j4RuzkP3vyF9fj5wMzbdikyedpmBSxIGPq91F0%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 vegur
cf-ray: 904f100b7e9035df-FRA
server: cloudflare

Redirect headers

cache-control: no-store, no-cache, private
location: https://prebid.intergient.com/setuid?bidder=appnexus&gdpr=0&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=3745704257559007735
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 45.74.44.74; 45.74.44.74; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 1e03b32f-3977-404a-b408-e9c0c3e3f63c
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Mon, 20 Jan 2025 12:28:08 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 6526 0
0 66ms
66ms Fetch
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvPYQOvBekbFRvyR70Jn-0E6IY4RiEBmUHOZ3IqdaKNCc2HzBEa62WOcyNDGeSuKT59I_KTVgOH1tvMF-lngCXoV7QgfZI6iNsXC0x2UJKuPnHAtIIyYHptW-BfUImhpLwJIewlZ96gGZzw1nrWQXLeaHm7NeeJPuq9QPap73pYsZY0Te2HqtIw4dAEQNI4ENRrIcGZEzsOWw33mWG0kYDOY_iHULcOoL0wXD7Vrfnp3n3St_6ILr0pGf89A6iAMAoErN9mYtMf6njGiEquFXY0rZXBWfTSXnzjeSYnBG6SeCELjVg1_bsr1wrpAQkrm7GAVqPjJaoPW2UExyLTDp4KBHq0Vcf0R2DFU7ZbB6k2fkM4Y8N0a0Nhr13wipy6zomLRr5WMHaREfQrhWbMDDSr9nvO18L93Z2caj0wxIEzZPQIbdEaEvhqxr79KQI3Ir-8P9zELVmWUiiBx5thSURudM_0uEiBqdtbwo9l26XxnELPu2N4zcmo63HfP9kYntKLzEPLMN7_v7M4nI0TYwlHI3sMIPwL9dDI8I4Wd-c20ZjddHifUuXDheGDlDdsJWaCmYo4aIDOOOUQgdI4NJ336SxLRNI&sai=AMfl-YTo96jhMofJF-juOOsBHOH51giLcPdtjkiLbMUaUSGKUpjA-0ozh0HQnu5ImYnHnKzQ637xqsltU8mNiWT0BbGeCy-8H2WYauHST7TUJm23K-6b8Oqza8v-RryN55QqPuac198JLptgf_noHEdB3A&sig=Cg0ArKJSzLY6JsBX8eYaEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Mon, 20 Jan 2025 12:28:08 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 pixel
googleads.g.doubleclick.net/xbbe/ Frame 1183 0
0 45ms
45ms Document
text/html 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJaQJxC867ABGJmdhK4CMAE&v=APEucNVup-YQC8xLXhmu8sGR33iLPGurcKmTc5guc2BOIkV2SRv6fKJja8SdDX6Gm0B8zkT3TyakJH_BJG8ilMShovDK0wizesOdCeDKiV0ciOC2JG_LNTg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 20 Jan 2025 12:28:08 GMT
expires: Mon, 20 Jan 2025 12:28:08 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 6526 105 KB
36 KB 52ms
51ms Script
text/javascript 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d22438a908fb754c1bd6e2f368e8f43bcc5092c126b5688d0cc14b0804727585

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 8686496304925888373
x-content-type-options: nosniff
expires: Mon, 20 Jan 2025 12:28:08 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Mon, 20 Jan 2025 12:28:08 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 36916
x-xss-protection: 0
server: cafe

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6526 42 B
63 B 87ms
86ms Image
image/gif 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BePQjPdxnk-a8DCDY6VIbHvbDI2DZMqfRf9mAh0DRIXtACX3yNjaSYlr4uAuBn1EPmmG1gyn611NK35m2q9NNVsvrwTKwOdGDTHD_KdTTYcYsTYLs

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Mon, 20 Jan 2025 12:28:08 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 2d05af92-2548-48da-91b6-ab6b16f599d3
beacon-ams3.rubiconproject.com/beacon/d/ Frame 6526 43 B
227 B 90ms
28ms Image
image/avif 69.173.156.130
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://beacon-ams3.rubiconproject.com/beacon/d/2d05af92-2548-48da-91b6-ab6b16f599d3?oo=0&accountId=12556&siteId=110932&zoneId=523774&sizeId=9&e=6A1E40E384DA563BF9198E0360CA1CEA98F715DA8BBC4DA1200C6D1B9A353292977718179EB54357364196FA95EDC25D06ED6754DDB432152546DF75CA63E104C2D52B40F95AF58E9DC4E5E7510F723E8881943F9281468B53E1422D47C487CF303496171A09D3CA1E47E9796228E64C94E609D3BE29E19970FBDBD4C927984E69A8906358651F33FCC3A27E7EA6C6B40D452FCF5E1BE92AE0606BEFF670047D73EF6E9FFD1AF02930681D0E3EE38EBCF17E2903A5DE47F7

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

69.173.156.130 , United States, ASN26667 (RUBICONPROJECT, US),

Reverse DNS

Software

Resource Hash

b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-content-type-options: nosniff
expires: 01 Jan 1970 10:00:00 GMT
content-length: 43
x-xss-protection: 1; mode=block
date: Mon, 20 Jan 2025 12:28:08 GMT
content-type: image/avif
x-frame-options: DENY

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 6526 216 KB
67 KB 31ms
31ms Script
text/javascript 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202501140101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e85f321211dd46eaf7f889826ecb61273dd5b452178e5ff80cfc6ac09538b7fc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 16822743467033048381
age: 1096
x-content-type-options: nosniff
expires: Mon, 20 Jan 2025 13:09:52 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Mon, 20 Jan 2025 12:09:52 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=ISO-8859-1
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 68585
x-xss-protection: 0
server: cafe

GET
H2 200 user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 39F5 0
0 32ms
32ms Document
text/html 2.23.241.43
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&gdpr=0&gdpr_consent=
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.23.241.43 Doha, Qatar, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-23-241-43.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=56389
content-encoding: gzip
content-length: 6694
content-type: text/html
date: Mon, 20 Jan 2025 12:28:08 GMT
expires: Tue, 21 Jan 2025 04:07:57 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 usync.html
eus.rubiconproject.com/ Frame E0E8 0
0 100ms
31ms Document
text/html 184.30.22.30
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?gdpr=0
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.30.22.30 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-22-30.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) /
Resource Hash

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Mon, 20 Jan 2025 12:28:08 GMT
etag: "10d-629840acea280-gzip"
last-modified: Wed, 18 Dec 2024 04:42:34 GMT
server: Apache/2.4.62 (Debian)
vary: Accept-Encoding

GET
H2 200 pd
playwire-d.openx.net/w/1.0/ Frame 2159 0
0 27ms
21ms Document
text/html 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://playwire-d.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 199
content-type: text/html
date: Mon, 20 Jan 2025 12:28:08 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 45.74.44.74

GET
H2 200 syncframe
gum.criteo.com/ Frame DEE4 0
0 30ms
30ms Document
text/html 178.250.1.11
ASN-CRITEO-EUROPE...

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=criteoPrebidAdapter&topUrl=paint.toys&gpp=

Requested by

Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.11 , France, ASN44788 (ASN-CRITEO-EUROPE Criteo Technology SAS, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Mon, 20 Jan 2025 12:28:08 GMT
server: Kestrel
server-processing-duration-in-ticks: 1277039
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding
x-robots-tag: noindex

GET
H2 200 ixmatch.html
js-sec.indexww.com/um/ Frame 0F78 0
0 111ms
41ms Document
text/html 104.18.25.18
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.25.18 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

age: 986
cache-control: public, max-age=14400
cf-cache-status: HIT
cf-ray: 904f100c2b8265d1-FRA
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Mon, 20 Jan 2025 12:28:08 GMT
expires: Mon, 20 Jan 2025 16:28:08 GMT
last-modified: Mon, 25 Jul 2022 19:18:19 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
server: cloudflare
vary: Accept-Encoding

GET
H/1.1 200
OK async_usersync.html
acdn.adnxs.com/dmp/ Frame 717F 0
0 81ms
25ms Document
text/html 151.101.65.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.65.108 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 528
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Mon, 20 Jan 2025 12:28:08 GMT
ETag: W/"623de86a-cf34"
Expires: Wed, 01 Jan 2025 12:18:41 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish, 1.1 varnish
X-Cache: HIT, HIT
X-Cache-Hits: 2456555, 822
X-Served-By: cache-lga21982-LGA, cache-man4120-MAN
X-Timer: S1737376089.964830,VS0,VE0

GET
H2 200 /
sync.cootlogix.com/api/sync/iframe/ Frame F931 0
0 263ms
86ms Document
text/html 198.199.89.209
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.cootlogix.com/api/sync/iframe/?cid=&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 198.199.89.209 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
content-length: 109
content-type: text/html
date: Mon, 20 Jan 2025 12:28:09 GMT
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"

GET
H2 200 sync
eb2.3lift.com/ Frame E5C7 0
0 94ms
33ms Document
image/gif 13.248.245.213
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eb2.3lift.com/sync?
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.248.245.213 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a0f671730127a0812.awsglobalaccelerator.com
Software: /
Resource Hash

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
content-type: image/gif
date: Mon, 20 Jan 2025 12:28:08 GMT

POST
H2 200 prebid Show response
id5-sync.com/api/config/ 195 B
470 B 32ms
32ms Fetch
application/json 141.95.98.65
OVH OVH SAS

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.65 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ns3203256.ip-141-95-33.eu

Software

Resource Hash

7e4d2c9111e1ca31b5e2e4bfd5a66925f07c0c232672f31481c6b66a89b26f16

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Mon, 20 Jan 2025 12:28:08 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
access-control-allow-credentials: true

GET
H2 200 id Show response
id.crwdcntrl.net/ 43 B
286 B 33ms
33ms Fetch
application/json 54.228.182.39
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://id.crwdcntrl.net/id?gdpr_applies=false&c=17262
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.228.182.39 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-228-182-39.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: a96e1e97d62ab9747678b947bdf0a0ea5f81790b1e3a1df2d4607a86bf802596

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 43
date: Mon, 20 Jan 2025 12:28:08 GMT
content-type: application/json;charset=utf-8
x-server: 10.45.9.157

GET f
fid.agkn.com/ 0
0

GET
H2 200 envelope Show response
lexicon.33across.com/v1/ 49 B
0 1ms
1ms Fetch
application/json 35.244.193.51
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0014000001YrMoYAAV&gdpr=0&src=pbjs&ver=9.11.0&coppa=0
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.193.51 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 51.193.244.35.bc.googleusercontent.com
Software: /
Resource Hash: d0d2e098cd489ef7bc528c86de8ab5c51b5d6cdf9b76a8b08766036992f0d2f4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, must-revalidate, max-age=28800
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49
date: Mon, 20 Jan 2025 12:28:07 GMT
content-type: application/json
vary: origin

GET
H2 204 any Show response
idx.liadm.com/idex/did-0046/ 0
0 2ms
2ms Fetch 3.222.250.81
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://idx.liadm.com/idex/did-0046/any?duid=8e413bd09c43--01jj1tyfn4g8tynrc0cwaprmzy&gdpr=0&did=did-0046&cd=.paint.toys&pu=https%3A%2F%2Fpaint.toys&resolve=nonId&resolve=uid2&resolve=index&resolve=bidswitch&resolve=pubmatic&resolve=magnite&resolve=openx&resolve=sorvrn&resolve=thetradedesk&resolve=medianet
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.222.250.81 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-222-250-81.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: max-age=3599, private
trace-id: 81082eb2b3509839
request-time: 1
access-control-allow-credentials: true
expires: Mon, 20 Jan 2025 13:28:07 GMT
access-control-allow-origin: https://paint.toys
date: Mon, 20 Jan 2025 12:28:07 GMT
vary: Origin

GET
H2 200 json Show response
gum.criteo.com/sid/ 415 B
1 KB 100ms
97ms Fetch
application/json 178.250.1.11
ASN-CRITEO-EUROPE...

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&bundle=aReJGl9hTUJvcmxJREw0OXhCd2w1aVlKbzIwU3M3ZTUxcTNSeWFWcG95Q1FNczhDc0Z0bXpETjhlVm5yRXJ3MWN2NWhYRGJyczVGRXBKV0p1aFhRQWZVRFRzOGZkNk8lMkIxajlWaWIwenRiYnl2NmlGWk1KTmtYRVAlMkZZeTY3Q213R0hjQWklMkZnYU8lMkZYRmN4cmhaemg1UzFUZ0VKdyUzRCUzRA&cw=1&pbt=1&lsw=1&gdpr=0

Requested by

Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.11 , France, ASN44788 (ASN-CRITEO-EUROPE Criteo Technology SAS, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

39845402a5dc2df19d45aa424c1c0286c850d362c87e95917ec713eb4687745e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
content-type: application/json
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 55765175
expires: 0
access-control-allow-origin: https://paint.toys
date: Mon, 20 Jan 2025 12:28:08 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

GET
H2

200

sync
x.bidswitch.net/
Redirect Chain

https://x.bidswitch.net/sync?ssp=themediagrid&gdpr=0
https://x.bidswitch.net/ul_cb/sync?ssp=themediagrid&gdpr=0
https://gw-iad-bid.ymmobi.com/adx/user/sync?pubid=eWg=&gdpr=0&gdpr_consent=&us_privacy=&bidswitch_ssp_id=themediagrid&bsw_custom_parameter=7ca1a81f-61c9-43bc-9732-35427b6b4856&callback=https%3A%2F%...
https://x.bidswitch.net/sync?dsp_id=257&ssp=themediagrid&user_id=ym_user_7896bf29-3546-4fdd-9492-e22b97adfebe&bsw_param=7ca1a81f-61c9-43bc-9732-35427b6b4856

43 B
103 B

31ms
31ms

Image
image/gif

35.214.136.108
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?dsp_id=257&ssp=themediagrid&user_id=ym_user_7896bf29-3546-4fdd-9492-e22b97adfebe&bsw_param=7ca1a81f-61c9-43bc-9732-35427b6b4856
Protocol: H2
Server: 35.214.136.108 Groningen, Netherlands, ASN15169 (GOOGLE, US),
Reverse DNS: 108.136.214.35.bc.googleusercontent.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
date: Mon, 20 Jan 2025 12:28:09 GMT
content-type: image/gif

Redirect headers

access-control-allow-headers: Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token
access-control-allow-origin: *
location: https://x.bidswitch.net/sync?dsp_id=257&ssp=themediagrid&user_id=ym_user_7896bf29-3546-4fdd-9492-e22b97adfebe&bsw_param=7ca1a81f-61c9-43bc-9732-35427b6b4856
content-length: 0
date: Mon, 20 Jan 2025 12:28:09 GMT
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

GET
H2 200 usersync
match.adsrvr.org/track/ 70 B
149 B 95ms
31ms Image
image/gif 52.223.40.198
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/usersync?us_privacy=&gdpr=0&gdpr_consent=undefined&ust=image
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.223.40.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-length: 70
date: Mon, 20 Jan 2025 12:28:08 GMT
content-type: image/gif
server: Kestrel

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 29ms
26ms Preflight
application/json 178.250.1.11
ASN-CRITEO-EUROPE...

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.11 , France, ASN44788 (ASN-CRITEO-EUROPE Criteo Technology SAS, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://paint.toys
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Mon, 20 Jan 2025 12:28:08 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 249578
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
281 B 35ms
34ms Fetch
application/json 141.95.33.120
OVH OVH SAS

General

Check archive.org

Show headers Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.33.120 , Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

c1e221730254f2aca846c19d8e42421c86b4bd7089668578f7f80ebdc70b929f

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Mon, 20 Jan 2025 12:28:08 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6526 0
20 B 62ms
62ms Ping
image/gif 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=9722482943117&version=m202411180101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Mon, 20 Jan 2025 12:28:08 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6526 0
20 B 62ms
61ms Ping
image/gif 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=9722482943117&version=m202411180101&ct=76&x=8&cor=16246115628109052000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Mon, 20 Jan 2025 12:28:08 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 6526 130 KB
47 KB 74ms
73ms Script
text/javascript 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-B223V2WACyTiw9Ax_DtiYYrAVVET71Xe9DH4_d0E1iDTObnhi-s0BGh-FJa0N6rIjMfM9TJ7T0XpM8OYDkXn5Z6jVdpid8pUhHRYs3NZ4e8QHI3gLIXrX0tmli3bnC6sEg3YRgABwTn_jV-2lFFFpliNYpZYLWuKiyv-w-jN-oLw3vGZ_uwariDM8fQgywPkwFhk-5bXipmuSecuLaVN-TRAzdIMtm6jJ-8aZHtC_xAXDKmmc&dbm_d=AKAmf-Dcj0_oguBa67GV67WlDp9GNGggVpO8U-Z5NMr-OV9ZpZqM7wsVFKby34ZLl8NgxJQupYdh7MtzHuyxnaienDhzoBVM1h3ZUHPlKkT6yRvS5xAfU5Ww2tXQa6BCAyVksyGN5lLYRAjoDevLUJYp3d4ZAEh6nKeIRkfpAchdGvop0e0nngxLp90moXCDoB_Z0e7I69rTs_fOmxFbSPL5AtfzRxqWwclZqLrVegnWI_qzH8WhuVpgav6s11D3vDWZIrMBr6JN8lZ58ECtzDEeKHbt_gI7BDYsmkWrPtOeLDhSroVT0Rl0uTY4U3M0LkC6nKtt4HhlwUZ_qe7UAqlx74P16EZKLcN6KJQzZZg2HUdDn5h-zUCg7CXyunBY_V53grhQIxksnIFLaAgCNsyUth3HiJiBwG2-xZB5rzMKd8nbYLaiJvhTRxRJurMiRh7JjVPsHLhOHmfNSHLaQ_P88A75AzuU3eNVwO2rA82pC-1XrasA6bPElUIKQM2OcDzyvyZ7NxaGQ6oml0D9_A8fAIUhVUG7K48K3qCwx941i3Nw0jIHixejtKiFRO-C2c0rbiTcpuK0scsfLDOWys6y5OKLF4JpP2H-qxJZZCeeOBynARX7UXIXmxQdfs3MIf3kFT2eAnfwvWrB3kk8igVMiA6kTwMfoCje4sQP1OmiNTHV-qJCQYa8xMrajo_r43_n9YDw-VTz0TpxqtCTBT-ojn-sJ2VV0jRJvtUZnTCZzE-1kKrv4ubVJFzWUT7ZLixj9_zSGRYJ9S9HUZq0pzUoT_WzrATKmJ8V8qLblEzjJmro4Z-3Q3tcwk9BS8aYsN6OJA4f0wYqpHpqRQKutbNsOZS54eas_TPboArt9ebsXTHo3jw7eqY4Q_E13tZR2qsJjfV67eFov3Wm6mOftqpklc9ie7pWVhMlbFwt7B91uQyGHGdQ71OQ6I8e0FuYzxMoozzPbXEN2V6flYJg14mp6TZw7z0h8DBjswFmpU-L_7DHfJZnkOYTWe543QHCc1EeArRjyJZczAcv95wpO3O_n_7xdcMn17Q9xszbQx2QJKwXWupMVio0-XAOCHmJy2Bhbtpw7LYp4WbWP8KcuTkTPoQ4A5wKkvRIifB1Nl9ne7gFJRi_g9EyWpJTheBU0TKTRvsAK2wQ0AeyQkWH2t2upSmm38TOQoCeUpT2zXAn46WDQEAoAIEZpOdW-g3G4UdudziupzNVwVlROc0ClIFchVtNZtt-5YP1QqO-NPygnrANHTefItodRFt2eBJg9DhoF8BJjJebxVgmoD94Z_DyFjcOKcrYHYHTRNMra878shcn8PqK_flFsUUdHbH41qpZjC_KrHbqfglIO0QlapwazL63vr1V6zsvp8ikOvTA-epgdWzcraNu92kKdi4i7DRpDg63Gkx9NujRmsTTSlmI9bUJNc8np25nIFr1rtZXanYoCsxwSqErfYPYWogppZCYxZGcmkd2_07jPRWpHcC-W8EkhJnTkrLH2b6IgVe9pouBoYpdmJsu1aR47n-1Diq1aEropgYMxf0p7ujW_sdffUvPMk0i9LYuDfNNm_oVE5h2u5NP04tESB-MXQdE4czbBQ9qoVFQ_jdPIWEmHFrXVJFoMVGradejDeX8m1U7tGb-vxmTTbYxDiJ2kK8UZnxW2SfGN_WdGC3MicWYmnTfWWeEo1uM-HLwQd4pVUTyDNII3nvWBc2ipE4Lwgia_qWjisQHLBZW5jAaLN9XoHj7-yhKEMEWp1ZL_7rEJpP9fJFkxqrB9Cjfun12XCRG-z3ZpogLqBqbX7lNXxBuzDF-yn8vJEWF9UrIea0kuYantc7RfvDzUjejtrEDTMSm7DvEqDqmWpaR-a8ShzlPDCO2dKhL4CRwTIj9DQV4h-GVuJUPXT0k2T8zf898HSFMrH7Qw3vTaKb38RBXeDqodAnE2bZdPUYPnl-dLGlYGTHAmW2WGGQKUzxg30MWpXZjbJQI65hPS5HEcjzeBYkugToAxl4XPnNG8dnpbn_SS-ZyK9MlHqLbsDSdARSXQSGBKIsBh6kmd8HS8DBtwFuRDLUSaObiyxshk4vyXefsHM1iwcuhUyrCKkHQXBZV5BMkO-szp-54Imyw-3_HaLQLSg4HgnPG0EQkrSxa9f9obqJW0A7sfQ8qsgx4k9KYG7TyXNA4RXF6tyJaXMGnG8Ig18-9YtOzyxWbCA8HvS_6gMH29m0kyiMDeO11dM0Q8u_-NoV9MopAFdW0D55P0f_qpr0XfSDWexw9KSE8se40uuld7EtzyzKpJU-mPCNcweSTjs4nNQs4aO9bhYFpvUVJ2O9lZAx5Ld_avM3qf2w_5OcG9Md5MqxGWnbBbLOj2EX5iCVaOetP4hvztnqwBiMx2LtUr1AJ5rp42mF-PH3Rf3x8emfvc74n-Cx3I9gh9c2Ci93neaB0jqGO59J6jP3HmiWT9BFSSZISnzU7OowddQ4_ZuUjXbgElWFrP3yMfL_pRMERp9BOrKUiszHuZdcS86Blfped88_b18niwZ4WgZztDCkmrlojoy4t72z5ME6JhfA3kynYDuyXmJWgK460IQ-ZpCU6DSYCzZ3xB1RFMvUzBUEhup6CW39WtPoo3qj-UXAvJK_nSXSRUn7wAlWxWOjnZJ2JxViJraJ_reb54o7rVC_gs7SDvhQ-2imQLhbVUCVwuiZn9ZzAN__w1k_NIVZF6JbzS9S6VwALpTiQ7jGRYRY4TDXe6K-YJXlbS09A4Ad199qqejkxcUQz3m4-yu5MuMWQCc8gq37-5aSpzbJXW4949QF-0utm_ETEBhxnJQuaNDFqrxwGbvqVx0fmmoVwkGboMjHpgbEvrlXZKEQlogBEY5x8w5V4IT4VwWSRTGLaBV1x7aI7kSoUITMsqoD8kUA88jfUeMzWywfyOLr0Phikl1XpWz0U7tYkskPCQgvDG4wEr6vc2k_dBzGH9GBwkg_-IdoxOxo6ghJHmiiWERCNP2jyc_K1VDxYNcyDqa7gx50QvpCEj8W28__YYVeRs6NTRrMn83zvbWcAfns6vjAi_nfz9ghcxJKDhMmkAr-w4LzGxY2mvnh5IJXTmVz4Jdi1qVhnjoLGAdk4su2GZBQf9D2s1PHTj4BG7S5vaSv6IVWfFAN_KBSnPQFtyvMIEfsPykONocvql8uQT7ucdUtMQ5irC0oxWXuWY-b2kK2ruoCE1FpCckDK0EXIW-52ogRU3VYYCLdJoDwN45QMcI5MVOxKsTL6BsSF1pSHn2XJJ_Tw4HBocvD7nI0pgoPooQnpcXV0SD1foKtO_9WderKV2bDW2U-qy8qcP1Wx5YeVMMKjntI3YPTNwatgVGD5j-xG5BDu7S-j4hghaZQ_hbSgBFXsbVq8TVy3-8sFqyvHuoo2WBt2avyu17f3TMzBEP6BS87mVuPpu_XKwA9KM8CgEd4l5qM8PLBlfRGQC0itYxoRlv9nkyOZNzPLCvUCfvz9jJRZNeMk3XJannC4scyZqIyBI51Rm4dUS4NN-0XVGoIhbISVFKrSwf_uW364J0Gof9mWw_ArurjTLEsPkIP4e3vCzLdnVn989oGrrg3_kU8iHdRziX0pDrSUa5gFww_sXncsAEoCyVk_srWi19Kj_B1EEnVycoTtVQJxm-xOquch1sT3s_QkHsv3VB-2I6-G6PArmkOFF-WvFMgGhdxNBdYKutUrXarspRrx2DnjErctXXar&pr=8%3A952733BB369EEB75&cid=CAQSSQCa7L7dpL2JTFPOEtMif0aBvMJJWPcu_e68hzL1h8vZ_EsW__Bfp0yEKWep5gENUYYKB2tPUNLWdt8x0qqv6duAlypo8BMf0HoYAQ&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&dv3_ver=m202411180101&nel=1&rfl=https%3A%2F%2Fpaint.toys%2Foil%2F&ds=l&xdt=0&iif=1&cor=16246115628109052000&adk=1061202331&idt=75&cac=0&dtd=28

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

aa8c10b08eaadb5a39d25353f0784fa302ebf27ce2b4f06cf07d1d272072b6e3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 48144
date: Mon, 20 Jan 2025 12:28:09 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

POST
H2 200 483.json Show response
id5-sync.com/g/v2/ 385 B
575 B 32ms
31ms Fetch
application/json 141.95.98.65
OVH OVH SAS

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/483.json

Requested by

Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.65 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

6a6ee9acd88801cc9027cf16badb567b934a9606adb38cbc50b71b80451fef3e

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Mon, 20 Jan 2025 12:28:09 GMT
content-type: application/json
vary: Origin
access-control-allow-credentials: true

GET
H2

200

sync
eb2.3lift.com/ Frame 1434
Redirect Chain

https://eb2.3lift.com/sync?gdpr=0&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D0%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3...
https://eb2.3lift.com/sync?gdpr=0&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D0%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3...

0
0

34ms
34ms

Document
text/html

13.248.245.213
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eb2.3lift.com/sync?gdpr=0&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D0%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID&ld=1
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.248.245.213 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a0f671730127a0812.awsglobalaccelerator.com
Software: /
Resource Hash

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 1093
content-type: text/html; charset=utf-8
date: Mon, 20 Jan 2025 12:28:09 GMT
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

cache-control: no-cache, no-store, must-revalidate
content-length: 0
date: Mon, 20 Jan 2025 12:28:09 GMT
location: /sync?gdpr=0&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D0%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID&ld=1
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H/1.1 200
OK dvbm.js Show response
cdn.doubleverify.com/ Frame 6526 446 KB
91 KB 129ms
35ms Script
text/javascript 184.24.77.44
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvbm.js
Requested by: Host: dfry.theunpackingitpodcast.com
URL: https://dfry.theunpackingitpodcast.com/gvnljqsquRSnpkMnRnWHg1NjQwTVFqYmIxQWYtMTIxNy0yNjcxNjI1NC0wZmFjMDI2ZC0xNzMxLU1vTTdsWjRzNXI3ZjdndERnVHZm/iz72s5fifp6/zeikvpduwpkhpolpbvovls
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 184.24.77.44 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS: a184-24-77-44.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 6629385f886b04e88574151ac1f29edfa2d2b2f545976e3fb9434cb77f92df4a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Access-Control-Expose-Headers: *
Cache-Control: max-age=900
Content-Encoding: br
ETag: "4af32ee9e957e8e2a10e2e80ae6a549a"
Connection: keep-alive
Expires: Mon, 20 Jan 2025 12:43:09 GMT
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Length: 92643
Date: Mon, 20 Jan 2025 12:28:09 GMT
Last-Modified: Wed, 15 Jan 2025 13:53:17 GMT
Content-Type: text/javascript

GET
H2 200 express_html_inpage_rendering_lib_200_281.js Show response
s0.2mdn.net/879366/ Frame 6526 117 KB
41 KB 107ms
31ms Script
text/javascript 142.250.185.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_281.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d0d116b21c9ac496c162f9074c75ce227719d025422a1794a57f497718f87cee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://paint.toys
Referer: https://paint.toys/

Response headers

content-encoding: gzip
age: 85499
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Mon, 20 Jan 2025 12:43:10 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 19 Jan 2025 12:43:10 GMT
last-modified: Tue, 29 Oct 2024 21:00:00 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=86400
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 41319
x-xss-protection: 0
server: sffe

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20250114/r20110914/elements/html/ Frame 6526 12 KB
4 KB 31ms
31ms Script
text/javascript 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20250114/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-B223V2WACyTiw9Ax_DtiYYrAVVET71Xe9DH4_d0E1iDTObnhi-s0BGh-FJa0N6rIjMfM9TJ7T0XpM8OYDkXn5Z6jVdpid8pUhHRYs3NZ4e8QHI3gLIXrX0tmli3bnC6sEg3YRgABwTn_jV-2lFFFpliNYpZYLWuKiyv-w-jN-oLw3vGZ_uwariDM8fQgywPkwFhk-5bXipmuSecuLaVN-TRAzdIMtm6jJ-8aZHtC_xAXDKmmc&dbm_d=AKAmf-Dcj0_oguBa67GV67WlDp9GNGggVpO8U-Z5NMr-OV9ZpZqM7wsVFKby34ZLl8NgxJQupYdh7MtzHuyxnaienDhzoBVM1h3ZUHPlKkT6yRvS5xAfU5Ww2tXQa6BCAyVksyGN5lLYRAjoDevLUJYp3d4ZAEh6nKeIRkfpAchdGvop0e0nngxLp90moXCDoB_Z0e7I69rTs_fOmxFbSPL5AtfzRxqWwclZqLrVegnWI_qzH8WhuVpgav6s11D3vDWZIrMBr6JN8lZ58ECtzDEeKHbt_gI7BDYsmkWrPtOeLDhSroVT0Rl0uTY4U3M0LkC6nKtt4HhlwUZ_qe7UAqlx74P16EZKLcN6KJQzZZg2HUdDn5h-zUCg7CXyunBY_V53grhQIxksnIFLaAgCNsyUth3HiJiBwG2-xZB5rzMKd8nbYLaiJvhTRxRJurMiRh7JjVPsHLhOHmfNSHLaQ_P88A75AzuU3eNVwO2rA82pC-1XrasA6bPElUIKQM2OcDzyvyZ7NxaGQ6oml0D9_A8fAIUhVUG7K48K3qCwx941i3Nw0jIHixejtKiFRO-C2c0rbiTcpuK0scsfLDOWys6y5OKLF4JpP2H-qxJZZCeeOBynARX7UXIXmxQdfs3MIf3kFT2eAnfwvWrB3kk8igVMiA6kTwMfoCje4sQP1OmiNTHV-qJCQYa8xMrajo_r43_n9YDw-VTz0TpxqtCTBT-ojn-sJ2VV0jRJvtUZnTCZzE-1kKrv4ubVJFzWUT7ZLixj9_zSGRYJ9S9HUZq0pzUoT_WzrATKmJ8V8qLblEzjJmro4Z-3Q3tcwk9BS8aYsN6OJA4f0wYqpHpqRQKutbNsOZS54eas_TPboArt9ebsXTHo3jw7eqY4Q_E13tZR2qsJjfV67eFov3Wm6mOftqpklc9ie7pWVhMlbFwt7B91uQyGHGdQ71OQ6I8e0FuYzxMoozzPbXEN2V6flYJg14mp6TZw7z0h8DBjswFmpU-L_7DHfJZnkOYTWe543QHCc1EeArRjyJZczAcv95wpO3O_n_7xdcMn17Q9xszbQx2QJKwXWupMVio0-XAOCHmJy2Bhbtpw7LYp4WbWP8KcuTkTPoQ4A5wKkvRIifB1Nl9ne7gFJRi_g9EyWpJTheBU0TKTRvsAK2wQ0AeyQkWH2t2upSmm38TOQoCeUpT2zXAn46WDQEAoAIEZpOdW-g3G4UdudziupzNVwVlROc0ClIFchVtNZtt-5YP1QqO-NPygnrANHTefItodRFt2eBJg9DhoF8BJjJebxVgmoD94Z_DyFjcOKcrYHYHTRNMra878shcn8PqK_flFsUUdHbH41qpZjC_KrHbqfglIO0QlapwazL63vr1V6zsvp8ikOvTA-epgdWzcraNu92kKdi4i7DRpDg63Gkx9NujRmsTTSlmI9bUJNc8np25nIFr1rtZXanYoCsxwSqErfYPYWogppZCYxZGcmkd2_07jPRWpHcC-W8EkhJnTkrLH2b6IgVe9pouBoYpdmJsu1aR47n-1Diq1aEropgYMxf0p7ujW_sdffUvPMk0i9LYuDfNNm_oVE5h2u5NP04tESB-MXQdE4czbBQ9qoVFQ_jdPIWEmHFrXVJFoMVGradejDeX8m1U7tGb-vxmTTbYxDiJ2kK8UZnxW2SfGN_WdGC3MicWYmnTfWWeEo1uM-HLwQd4pVUTyDNII3nvWBc2ipE4Lwgia_qWjisQHLBZW5jAaLN9XoHj7-yhKEMEWp1ZL_7rEJpP9fJFkxqrB9Cjfun12XCRG-z3ZpogLqBqbX7lNXxBuzDF-yn8vJEWF9UrIea0kuYantc7RfvDzUjejtrEDTMSm7DvEqDqmWpaR-a8ShzlPDCO2dKhL4CRwTIj9DQV4h-GVuJUPXT0k2T8zf898HSFMrH7Qw3vTaKb38RBXeDqodAnE2bZdPUYPnl-dLGlYGTHAmW2WGGQKUzxg30MWpXZjbJQI65hPS5HEcjzeBYkugToAxl4XPnNG8dnpbn_SS-ZyK9MlHqLbsDSdARSXQSGBKIsBh6kmd8HS8DBtwFuRDLUSaObiyxshk4vyXefsHM1iwcuhUyrCKkHQXBZV5BMkO-szp-54Imyw-3_HaLQLSg4HgnPG0EQkrSxa9f9obqJW0A7sfQ8qsgx4k9KYG7TyXNA4RXF6tyJaXMGnG8Ig18-9YtOzyxWbCA8HvS_6gMH29m0kyiMDeO11dM0Q8u_-NoV9MopAFdW0D55P0f_qpr0XfSDWexw9KSE8se40uuld7EtzyzKpJU-mPCNcweSTjs4nNQs4aO9bhYFpvUVJ2O9lZAx5Ld_avM3qf2w_5OcG9Md5MqxGWnbBbLOj2EX5iCVaOetP4hvztnqwBiMx2LtUr1AJ5rp42mF-PH3Rf3x8emfvc74n-Cx3I9gh9c2Ci93neaB0jqGO59J6jP3HmiWT9BFSSZISnzU7OowddQ4_ZuUjXbgElWFrP3yMfL_pRMERp9BOrKUiszHuZdcS86Blfped88_b18niwZ4WgZztDCkmrlojoy4t72z5ME6JhfA3kynYDuyXmJWgK460IQ-ZpCU6DSYCzZ3xB1RFMvUzBUEhup6CW39WtPoo3qj-UXAvJK_nSXSRUn7wAlWxWOjnZJ2JxViJraJ_reb54o7rVC_gs7SDvhQ-2imQLhbVUCVwuiZn9ZzAN__w1k_NIVZF6JbzS9S6VwALpTiQ7jGRYRY4TDXe6K-YJXlbS09A4Ad199qqejkxcUQz3m4-yu5MuMWQCc8gq37-5aSpzbJXW4949QF-0utm_ETEBhxnJQuaNDFqrxwGbvqVx0fmmoVwkGboMjHpgbEvrlXZKEQlogBEY5x8w5V4IT4VwWSRTGLaBV1x7aI7kSoUITMsqoD8kUA88jfUeMzWywfyOLr0Phikl1XpWz0U7tYkskPCQgvDG4wEr6vc2k_dBzGH9GBwkg_-IdoxOxo6ghJHmiiWERCNP2jyc_K1VDxYNcyDqa7gx50QvpCEj8W28__YYVeRs6NTRrMn83zvbWcAfns6vjAi_nfz9ghcxJKDhMmkAr-w4LzGxY2mvnh5IJXTmVz4Jdi1qVhnjoLGAdk4su2GZBQf9D2s1PHTj4BG7S5vaSv6IVWfFAN_KBSnPQFtyvMIEfsPykONocvql8uQT7ucdUtMQ5irC0oxWXuWY-b2kK2ruoCE1FpCckDK0EXIW-52ogRU3VYYCLdJoDwN45QMcI5MVOxKsTL6BsSF1pSHn2XJJ_Tw4HBocvD7nI0pgoPooQnpcXV0SD1foKtO_9WderKV2bDW2U-qy8qcP1Wx5YeVMMKjntI3YPTNwatgVGD5j-xG5BDu7S-j4hghaZQ_hbSgBFXsbVq8TVy3-8sFqyvHuoo2WBt2avyu17f3TMzBEP6BS87mVuPpu_XKwA9KM8CgEd4l5qM8PLBlfRGQC0itYxoRlv9nkyOZNzPLCvUCfvz9jJRZNeMk3XJannC4scyZqIyBI51Rm4dUS4NN-0XVGoIhbISVFKrSwf_uW364J0Gof9mWw_ArurjTLEsPkIP4e3vCzLdnVn989oGrrg3_kU8iHdRziX0pDrSUa5gFww_sXncsAEoCyVk_srWi19Kj_B1EEnVycoTtVQJxm-xOquch1sT3s_QkHsv3VB-2I6-G6PArmkOFF-WvFMgGhdxNBdYKutUrXarspRrx2DnjErctXXar&pr=8%3A952733BB369EEB75&cid=CAQSSQCa7L7dpL2JTFPOEtMif0aBvMJJWPcu_e68hzL1h8vZ_EsW__Bfp0yEKWep5gENUYYKB2tPUNLWdt8x0qqv6duAlypo8BMf0HoYAQ&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&dv3_ver=m202411180101&nel=1&rfl=https%3A%2F%2Fpaint.toys%2Foil%2F&ds=l&xdt=0&iif=1&cor=16246115628109052000&adk=1061202331&idt=75&cac=0&dtd=28

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

39761e2a7cb0e42a8b09fbbf0d2c4cd9fb0c1568c045b1c5e387177dda8ff064

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 5098607549323971572
age: 75159
x-content-type-options: nosniff
expires: Sun, 02 Feb 2025 15:35:30 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sun, 19 Jan 2025 15:35:30 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 4393
x-xss-protection: 0
server: cafe

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20250114/r20110914/ Frame 6526 36 KB
13 KB 32ms
32ms Script
text/javascript 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20250114/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

75d0aaf0bb822b8a61076485a150b975a4d3f49a7422580233c529d7e83155c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 13517638169788690
age: 75351
x-content-type-options: nosniff
expires: Sun, 02 Feb 2025 15:32:18 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sun, 19 Jan 2025 15:32:18 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 13410
x-xss-protection: 0
server: cafe

GET
H2 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 6526 41 KB
14 KB 114ms
33ms Script
text/javascript 142.250.186.65
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.65 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f1.1e100.net

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
age: 511
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
x-content-type-options: nosniff
expires: Mon, 20 Jan 2025 13:09:38 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 20 Jan 2025 12:19:38 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=3000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 13937
x-xss-protection: 0
server: sffe

GET
H2 200 usync.html
eus.rubiconproject.com/ Frame 80AD 0
0 30ms
30ms Document
text/html 184.30.22.30
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?&gdpr=0&geo=eu&co=se
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.30.22.30 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-22-30.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) /
Resource Hash

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Mon, 20 Jan 2025 12:28:09 GMT
etag: "10d-629840acea280-gzip"
last-modified: Wed, 18 Dec 2024 04:42:34 GMT
server: Apache/2.4.62 (Debian)
vary: Accept-Encoding

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6526 0
0 72ms
72ms Fetch
image/gif 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Mon, 20 Jan 2025 12:28:09 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 6526 0
0 68ms
68ms Fetch
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsv2juhgSK2S-opWKey07lZBDKEQeuGhXwTRZ7E4UVM3Fbs2_xtGS28fe4gQ7iPoscQ_Tucir7VznZCru6Xvx3eQxwseLvc1Kmwik5acqDeyBuVr8s0r0vP09NBfKWGbB-7QeyLjyt8KSa4U9ysyR9uSdDRnNl7Og5WLtZpkeInU4JvfCan6Cu49T7G6UOnF9uMBc_APr9McPf0_anNEg2EDVtZcZHvulCWagSSw7qcA3-dfBGp_l_QD96O_KPRx_9dUKcjjwD6HS-HClxEZDFsKczk4DDday9cbSHslysFJEFijw3Ahe9vGn6s-5MZ4RG6pHxKhn62xh1fP5EM_J4K8zokn4WYfZV9tkxnfEzR_x600IBIlbfmoL6g-mxQ-CJJv2gc4RAsj4jvFb5yEZXYoSWM1Q6jV9DeSI3XG4BqBssKcCDUENnaGvYmgk4yQj9FyWZ8DtHD3oytYR5075_so6sIn3svsgcsJ2mQtkG_fnKwEAFm9x83eBaLjDIlBk9sAYerBl7wg36akFvr8S8IGQea3-VFDlFwqlIXgGKe4fy0P3AnFrBVRCKZtYG5-ijskAzTEC45eMzuMXWWlMAqvpxsbwc4-dQ&sai=AMfl-YTNwfwWokIUrMwPonc7krzFRH3GCmKCnR06q74d4dqlsB-gUIZ96W6Wrfj8SHnJLAMqk1YHWgFoxfuiGlNWKpdmMcOW5W2_fkaJ93GHv_0ZBg6B3gHZZ2EI8oELYzonF4lKybsqv0AR994wHNcbCA&sig=Cg0ArKJSzDLwQuIVGcchEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Mon, 20 Jan 2025 12:28:09 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Mon, 20 Jan 2025 12:28:09 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
DATA 200
OK truncated
/ Frame 6526 218 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b8c93b3fdd9854a2d4b92e91a1c6d96bf3a4b32cf1686b3d4f1bf034ebcf817b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6526 0
0 65ms
65ms Fetch
image/gif 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Mon, 20 Jan 2025 12:28:09 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 62bHydCX.html
tpc.googlesyndication.com/sodar/ Frame 5038 0
0 97ms
31ms Document
text/html 142.250.186.65
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.65 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f1.1e100.net

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 2036
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 20 Jan 2025 11:54:13 GMT
expires: Mon, 20 Jan 2025 12:44:13 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 FY25TVTCLSUPEBOWL575053_160x600_01192025-012525.html
s0.2mdn.net/sadbundle/7962624318047919655/ Frame A39D 0
0 99ms
33ms Document
text/html 142.250.185.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7962624318047919655/FY25TVTCLSUPEBOWL575053_160x600_01192025-012525.html?ev=01_253

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_281.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 103706
allow-fenced-frame-automatic-beacons: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 3024
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Sun, 19 Jan 2025 07:39:43 GMT
expires: Mon, 19 Jan 2026 07:39:43 GMT
last-modified: Wed, 15 Jan 2025 14:36:38 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 view
ad.doubleclick.net/pcs/ Frame 6526 0
0 76ms
76ms Fetch
image/png 142.250.185.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjssW8ChLk30ASDffdjEVA8uCmVQoryc7Ts-DFRjow361kBSt5x_kyeLz9C7JeXmnubBt1j8JeTKY8rgYE4mJqjXBrh_tf-EdXVaiZc0od0WSHy7bDEvsA113NJPnyiKZGvb652Bt29npIK0ti-9GcxR6x1yyXr7-LBAmt1_dwtXmwoL7DZLirvXmVKOzNvYLG1qj5u5uhYa9qZHoGreirQsTsMfSM24H2r-unkewj7-Qa0aS1BdiymV1hygOHiMNeLd6RD3mEAhW8MKP6F5OhNVjeOoXq_P1gMepGIqfOMogFFBWlYvVu-_zNqWHnSBY0a4QdIvC6Fsn_5eWp8IFcIp0tPa22wkUALUt2EQzWxMfMkmgScQoP-etcXH9TUQHIC9xn4Tw9ShdaNnRxKWvWmf1bsOXu-IcWylQxD7anlQ_w02PXE5S_r6nPjOTGTJp9ILlPmpLp7QODAQ1qBx8P3MRowFew6tgGXvM1JjjbZqBa0HFZDpd5Ff_PQBc3eoAs8I5pN4bmY-U3piLbq-ZMmu_-AW6Py7Mbw9laCviieE32EXYlBnuxWo5b5M7FNkbkzEwOdIgjoBcLsHTNbXG1RS7Cw9SM9zdhrevuFq5EYudBf4xW33fzrahgNmax2-ManEqO6dhF_nEspLVwbEMU2g6JYfHxA1SJ8UMrUn5M4lYCX_sCZfEGsvf2quE-CET-rlERHK2tlX7seXobvFnGULKjPF2WRVjdTIzzFyt4DoYpANjAuJQDJb_SPEXngKx-MgCcb_BMabNWCBgORHpkzDrK_KUpYokooLLHioqmo05aWZjPk2siHCo4M6VXwGE2C8pNed35N0FZmA_2VSfpJ5A7zDdLpDg1d5GXOMluGQmZ_yTiOHp9NQF0fRGEleWFLniKXBYbw89pKi33jq2MDNWujY0zU7MqTVQlpFDM0tzyxjLWRhSSc87Ub90S3zwWSNQ37SXsKxyLsSwDwXmQHz1dPmg9sg_I9Cef2_gFrM4iq4ViW1U233VIRHCWbNnPVSiNNcbOhiku7ylK9pp9Tv51wkcpe1lYgbGM69uyQMrWx9dRAVd5b-1oisfC5FjKlGd1SD3kxXh9W7W64_-p6oSkAqCKBbbJS3i6C58lX2RG0an_s11et9lNl1TThkCwVPWdLjH5hgVqWQz32eO5yqo0qDzi7kHkUtg0UUH0qrROqStORrE7kCsFDdLQKp9nJakGgrKWdp-Dp0Y-bn8BAgr4HwH3oCVDGWmCCh8VB_1lk-SvVX2njP_AjFMXQ1lPfV2ClCiJn95ti2_vFWFwgKLeCuRreGe29RVutkq9cIIldZDYqHXcxJjGzPaXg24BoVroqD-cfCs6zqGJNsBy17QQTCR-UC0DYvN5uUp1oFnMQ2dpWgyMciRaATWfMnUizKxhrKqnRo4wbDXxYo4XrZPM4lSQuw&sai=AMfl-YRaO4yJBBmz3hJWnBgwFAyx5pJFminerRYKVz9Xf4KMp7zoNAUWlo_bO9RAxlp2rLY7Kdf1m93LKCpmKjATHs3zOJQ1dxUuO-MIiyFNzd7MEHCXi4ugzhK7_opsj0DoUYP3T8dKAJzwAxejidMBavahm-OreDFBK-dBG47e-4o2V6yI0rqYY3IniKCqRCiCBsGcEGx9HdQhB-hbuaD6t5aeOqU6wB3aLgaoxWkLKOamCVaFv1R3i0Y1eTteM11L2h_Sf2tfv-7VUfzrjNk6kQ-Buhvy1JceCj4BDmEY1P37YspgaG1h0n1FhdldNXHj2-cQSRJje65YGx4&sig=Cg0ArKJSzKQ3bhpfPHK2EAE&uach_m=%5BUACH%5D&crd=aHR0cHM6Ly9iZXN0YnV5LmNvbQ&pr=8:952733BB369EEB75&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=150&cbvp=1&cstd=147&cisv=r20250114.73464&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=1&ftch=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

a2-23-241-96.deploy.static.akamaitechnologies.com

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-content-type-options: nosniff
expires: Mon, 20 Jan 2025 12:28:09 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Mon, 20 Jan 2025 12:28:09 GMT
content-type: image/png
content-security-policy: script-src 'none'; object-src 'none'
cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
x-xss-protection: 0
attribution-reporting-register-source: {"aggregation_keys":{"628632924":"0xefa7ffb40ec80c100000000000000000","628632925":"0x11b832f36cd848c70000000000000000","628632926":"0x477b04368383efdc0000000000000000","628632927":"0xd6dbf41758225ec00000000000000000"},"debug_key":"13843416186353690080","debug_reporting":true,"destination":["https://bestbuy.com","https://debugconversiondomain1.com","https://debugconversiondomain2.com"],"event_report_windows":{"end_times":[86400,345600]},"expiry":"1296000","filter_data":{"14":["8628416","1799868","9672931","8637828","1797534","16157378"],"21":[],"23":[],"24":[],"25":[],"26":[],"27":[],"28":[],"29":[],"8":["4448269"]},"max_event_level_reports":2,"priority":"0","source_event_id":"1566552973110314031"}
server: cafe

GET
H/1.1 200
OK adServerESI.aspx
secure.insightexpressai.com/adServer/ Frame 6526 35 B
2 KB 218ms
136ms Image
image/gif 2.23.241.96
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.insightexpressai.com/adServer/adServerESI.aspx?script=false&bannerID=12253500&siteID=N51901.2403912GOOGLEDBM116&creativeID=229392534&placementID=412600468&rnd=1526251894&gdpr=0&gdpr_consent=&redir=https://secure.insightexpressai.com/adserver/1pixel.gif

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2.23.241.96 Doha, Qatar, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

22816a00dfe9fcdc30063d22717ab9cbab3aeb2a8e9844e9d774d256dc48b7c8

Security Headers

Name	Value
Content-Security-Policy	default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src ; style-src 'unsafe-inline';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOWALL
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Access-Control-Expose-Headers: Request-Context
X-Content-Type-Options: nosniff
Expires: Mon, 20 Jan 2025 12:28:09 GMT
P3P: CP="NOI DSP COR NID CUR ADMa OUR STP STA"
Date: Mon, 20 Jan 2025 12:28:09 GMT
Content-Type: image/gif
Vary: Accept-Encoding
Feature-Policy: accelerometer 'none'; camera 'none'; geolocation 'none'; gyroscope 'none'; magnetometer 'none'; microphone 'none'; payment 'none'; usb 'none'
X-Frame-Options: ALLOWALL
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; style-src * 'unsafe-inline';
Cache-Control: max-age=0, no-cache
Pragma: no-cache
Connection: keep-alive
Referrer-Policy: unsafe-url
Request-Context: appId=cid-v1:47139b8a-696d-4ae8-b194-53d8c1af57ca
Access-Control-Allow-Origin: *
Content-Length: 35
X-XSS-Protection: 1; mode=block

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6526 0
0 65ms
65ms Fetch
image/gif 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Mon, 20 Jan 2025 12:28:09 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6526 0
0 65ms
65ms Fetch
image/gif 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Mon, 20 Jan 2025 12:28:09 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H/1.1 200
OK verify.js Show response
rtb0.doubleverify.com/ Frame 6526 7 KB
4 KB 100ms
36ms Script
text/javascript 130.211.44.5
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb0.doubleverify.com/verify.js?ctx=21072637&cmp=32959091&sid=7190176&plc=412600468&crt=229392534&advid=4468395&adsrv=1&mon=1&blk=1&dvp_cawf=crtwrp&cm360cw=1&unit=160x600&prr=1&turl=https%3A%2F%2Fpaint.toys%2Foil%2F&aucmp=22132207419&auevent=ABAjH0iWgr7rtt7RkzAhDnVq-hcT&autt=1&ppid=103&aucrtv=633409177&auorder=1019616503&pltfrm=8&ausite=1995081996404&auxch=8&aufilter1=641046&c1=641046&adid=&app=&dup=&gmnpo=&isdvvid=&supplySource=&tagtype=&aUrlD=0&brid=96&bridua=3&brver=&fcl=1542&fec=123&flt=0&brh=1&vavbkt=&lvvn=28&fcifrms=25&winh=1200&winw=1600&chro=1&noc=32&wouh=1200&wouw=1600&htmlmsging=1&refD=1&scah=1200&scaw=1600&jsver=7085&uid=1737376089285810&fwc=0&srcurlD=0&ttfrms=26&num=6&dvp_isOnHead=0&flvr=1&ver=7085&jsCallback=__verify_callback_1737376089285810&jsTagObjCallback=__tagObject_callback_1737376089285810&ssl=1&m1=96&blkmode=2&dvp_rcp=2&dvp_seem=2&dvp_tuk=1&dvp_sukv=54285113.90443822&ee_dp_sukv=54285113.90443822&dvp_tukv=468053570481.6962&ee_dp_tukv=468053570481.6962&eparams=DC4FC%3Dl9EEADTbpTauTauA2%3A%3FE%5DE%40JDTau%40%3A%3DTauU2%3F4r92%3A%3Fl9EEADTbpTauTauA2%3A%3FE%5DE%40JDTar9EEADTbpTauTauA2%3A%3FE%5DE%40JD&referrer=https%3A%2F%2Fpaint.toys%2Foil%2F&dvp_rdyst=interactive&dvp_excm=2
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbm.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.44.5 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 5.44.211.130.bc.googleusercontent.com
Software: /
Resource Hash: 7117c3addd493ce42dfbeb08ff26d3132bec1cbcc2d5e637ce8b5c7f8fce0d08

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Transfer-Encoding: chunked
Cache-Control: max-age=0
Timing-Allow-Origin: *
Content-Encoding: br
Pragma: no-cache
Connection: keep-alive
X-DV-Response: 1
Expires: 01/19/2025 12:28:09
Date: Mon, 20 Jan 2025 12:28:09 GMT
Content-Type: text/javascript
Vary: Accept-Encoding

GET sodar
ep1.adtrafficquality.google/pagead/ 0
0

GET
DATA 200
OK truncated Show response
/ Frame 7DB2 690 B
690 B Document
text/html

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e048f9d1328aed41422ed3f1703a3bc7e772b9a99c89f5c11a15a8993051ff30

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

Content-Type: text/html

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 6526 0
482 B 139ms
65ms Ping
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvQDpwLSjDBX4BOgGeKXVdbkh90yvMruSiTM-7yDysKzAUb_Y7kriPT5ynDOLRrwBY71nb887ChMJXjiAcXNOwL6_xkBMAmFV-U_8Ka1L5ytIJgCU6b9KhDPoeqN80TZrp0cZTTxrjR8K-QAUyzIfAU0AmP9QN-P0l_A01MEdTyE-DsZzd9IjH_Akp8NS5mVK9-AEnGvT-4Zcc8tPBsMj5xv0QUkQ&sai=AMfl-YTTM_UruxmlWoduyUUhulvWgRnPw9LS5V_UAhePrB2oQRz8UbSGHdpSaVRgM24UUIu0QXXKayBY8u6eve_5QJx_r40xytLZk1nLD3Vm9KS49UTAvLvmnpV0CjgC2b4kFi0sXdaK0E5TvJ9fYmPZhFoYiBvL_V7ZT3CfobkKHABc70P92g&sig=Cg0ArKJSzC0nmxTi_nwUEAE&uach_m=%5BUACH%5D&urlfix=1&vt=13&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-3-72-38-170.eu-central-1.compute.amazonaws.com

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Mon, 20 Jan 2025 12:28:09 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 dcmads.js Show response
www.googletagservices.com/dcm/ Frame 7DB2 22 KB
10 KB 105ms
32ms Script
text/javascript 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/dcmads.js

Requested by

Host: text
URL: data:text/html,%0A%20%20%20%20%20%20%3Chtml%20style%3D%22margin%3A0%3B%20padding%3A0%3B%20overflow%3Ahidden%3B%22%3E%0A%20%20%20%20%20%20%20%20%3Chead%3E%3C%2Fhead%3E%0A%20%20%20%20%20%20%20%20%3Cbody%20style%3D%22margin%3A0%3B%20padding%3A0%3B%20overflow%3Ahidden%3B%22%3E%0A%20%20%20%20%20%20%20%20%20%20%3Cins%20class%3D'dcmads'%20style%3D'display%3Ainline-block%3Bwidth%3A160px%3Bheight%3A600px'%0A%20%20%20%20data-dcm-placement%3D'N1395.150740DOUBLEVERIFY%2FB9689862.280626343'%0A%20%20%20%20data-dcm-rendering-mode%3D'iframe'%0A%20%20%20%20data-dcm-https-only%0A%20%20%20%20data-dcm-gdpr-applies%3D'gdpr%3D%24%7BGDPR%7D'%0A%20%20%20%20data-dcm-gdpr-consent%3D'gdpr_consent%3D%24%7BGDPR_CONSENT_755%7D'%0A%20%20%20%20data-dcm-addtl-consent%3D'addtl_consent%3D%24%7BADDTL_CONSENT%7D'%0A%20%20%20%20data-dcm-resettable-device-id%3D''%0A%20%20%20%20data-dcm-app-id%3D''%3E%0A%20%20%3Cscript%20src%3D'https%3A%2F%2Fwww.googletagservices.com%2Fdcm%2Fdcmads.js'%3E%3C%2Fscript%3E%0A%3C%2Fins%3E%0A%20%20%20%20%20%20%20%20%3C%2Fbody%3E%0A%20%20%20%20%20%20%3C%2Fhtml%3E

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

sffe /

Resource Hash

42cdaa245981ea0fd12e477a46b06da3573306e3ec48f28d8691792fe285ff6d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
age: 2520
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
x-content-type-options: nosniff
expires: Mon, 20 Jan 2025 12:46:09 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 20 Jan 2025 11:46:09 GMT
last-modified: Wed, 15 Jan 2025 20:13:53 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=3600
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
accept-ranges: bytes
content-length: 9348
x-xss-protection: 0
server: sffe

GET
H2 204 v1
match.sharethrough.com/FGMrCMMc/ 0
58 B 106ms
34ms Image
text/plain 3.72.38.170
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://match.sharethrough.com/FGMrCMMc/v1?redirectUri=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dsharethrough%26gdpr%3D0%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%24UID

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.72.38.170 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;

GET
H2 200 impl_v104.js Show response
www.googletagservices.com/dcm/ Frame 7DB2 71 KB
27 KB 31ms
31ms Script
text/javascript 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/impl_v104.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/dcmads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

sffe /

Resource Hash

a8eda1bf7f3b78a01b79865c34d7741d3237cf2d1acb90da3ab5b189b29df2a8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
age: 518502
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
x-content-type-options: nosniff
expires: Wed, 14 Jan 2026 12:26:27 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 14 Jan 2025 12:26:27 GMT
last-modified: Mon, 13 Jan 2025 15:03:03 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=31536000
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
accept-ranges: bytes
content-length: 27364
x-xss-protection: 0
server: sffe

GET
H3 200 view
ad.doubleclick.net/pcs/ Frame 6526 0
0 77ms
77ms Fetch
image/png 142.250.185.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjssW8ChLk30ASDffdjEVA8uCmVQoryc7Ts-DFRjow361kBSt5x_kyeLz9C7JeXmnubBt1j8JeTKY8rgYE4mJqjXBrh_tf-EdXVaiZc0od0WSHy7bDEvsA113NJPnyiKZGvb652Bt29npIK0ti-9GcxR6x1yyXr7-LBAmt1_dwtXmwoL7DZLirvXmVKOzNvYLG1qj5u5uhYa9qZHoGreirQsTsMfSM24H2r-unkewj7-Qa0aS1BdiymV1hygOHiMNeLd6RD3mEAhW8MKP6F5OhNVjeOoXq_P1gMepGIqfOMogFFBWlYvVu-_zNqWHnSBY0a4QdIvC6Fsn_5eWp8IFcIp0tPa22wkUALUt2EQzWxMfMkmgScQoP-etcXH9TUQHIC9xn4Tw9ShdaNnRxKWvWmf1bsOXu-IcWylQxD7anlQ_w02PXE5S_r6nPjOTGTJp9ILlPmpLp7QODAQ1qBx8P3MRowFew6tgGXvM1JjjbZqBa0HFZDpd5Ff_PQBc3eoAs8I5pN4bmY-U3piLbq-ZMmu_-AW6Py7Mbw9laCviieE32EXYlBnuxWo5b5M7FNkbkzEwOdIgjoBcLsHTNbXG1RS7Cw9SM9zdhrevuFq5EYudBf4xW33fzrahgNmax2-ManEqO6dhF_nEspLVwbEMU2g6JYfHxA1SJ8UMrUn5M4lYCX_sCZfEGsvf2quE-CET-rlERHK2tlX7seXobvFnGULKjPF2WRVjdTIzzFyt4DoYpANjAuJQDJb_SPEXngKx-MgCcb_BMabNWCBgORHpkzDrK_KUpYokooLLHioqmo05aWZjPk2siHCo4M6VXwGE2C8pNed35N0FZmA_2VSfpJ5A7zDdLpDg1d5GXOMluGQmZ_yTiOHp9NQF0fRGEleWFLniKXBYbw89pKi33jq2MDNWujY0zU7MqTVQlpFDM0tzyxjLWRhSSc87Ub90S3zwWSNQ37SXsKxyLsSwDwXmQHz1dPmg9sg_I9Cef2_gFrM4iq4ViW1U233VIRHCWbNnPVSiNNcbOhiku7ylK9pp9Tv51wkcpe1lYgbGM69uyQMrWx9dRAVd5b-1oisfC5FjKlGd1SD3kxXh9W7W64_-p6oSkAqCKBbbJS3i6C58lX2RG0an_s11et9lNl1TThkCwVPWdLjH5hgVqWQz32eO5yqo0qDzi7kHkUtg0UUH0qrROqStORrE7kCsFDdLQKp9nJakGgrKWdp-Dp0Y-bn8BAgr4HwH3oCVDGWmCCh8VB_1lk-SvVX2njP_AjFMXQ1lPfV2ClCiJn95ti2_vFWFwgKLeCuRreGe29RVutkq9cIIldZDYqHXcxJjGzPaXg24BoVroqD-cfCs6zqGJNsBy17QQTCR-UC0DYvN5uUp1oFnMQ2dpWgyMciRaATWfMnUizKxhrKqnRo4wbDXxYo4XrZPM4lSQuw&sai=AMfl-YRaO4yJBBmz3hJWnBgwFAyx5pJFminerRYKVz9Xf4KMp7zoNAUWlo_bO9RAxlp2rLY7Kdf1m93LKCpmKjATHs3zOJQ1dxUuO-MIiyFNzd7MEHCXi4ugzhK7_opsj0DoUYP3T8dKAJzwAxejidMBavahm-OreDFBK-dBG47e-4o2V6yI0rqYY3IniKCqRCiCBsGcEGx9HdQhB-hbuaD6t5aeOqU6wB3aLgaoxWkLKOamCVaFv1R3i0Y1eTteM11L2h_Sf2tfv-7VUfzrjNk6kQ-Buhvy1JceCj4BDmEY1P37YspgaG1h0n1FhdldNXHj2-cQSRJje65YGx4&sig=Cg0ArKJSzKQ3bhpfPHK2EAE&uach_m=%5BUACH%5D&crd=aHR0cHM6Ly9iZXN0YnV5LmNvbQ&pr=8:952733BB369EEB75&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=483&vt=11&dtpt=333&dett=4&cstd=147&cisv=r20250114.73464&vwbs=2&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=1&ftch=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Mon, 20 Jan 2025 12:28:09 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Mon, 20 Jan 2025 12:28:09 GMT
x-xss-protection: 0
content-type: image/png
attribution-reporting-register-source: {"aggregation_keys":{"628632924":"0xefa7ffb40ec80c100000000000000000","628632925":"0x11b832f36cd848c70000000000000000","628632926":"0x477b04368383efdc0000000000000000","628632927":"0xd6dbf41758225ec00000000000000000"},"debug_key":"16843435145682731719","debug_reporting":true,"destination":["https://bestbuy.com","https://debugconversiondomain1.com","https://debugconversiondomain2.com"],"event_report_windows":{"end_times":[86400,345600]},"expiry":"1296000","filter_data":{"14":["8628416","1799868","9672931","8637828","1797534","16157378"],"21":[],"23":[],"24":[],"25":[],"26":[],"27":[],"28":[],"29":[],"8":["4448269"]},"max_event_level_reports":2,"priority":"0","source_event_id":"509378756203098536"}
server: cafe

GET
H2 200 user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 2836 0
0 31ms
31ms Document
text/html 2.23.241.43
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=0&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D0%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.23.241.43 Doha, Qatar, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-23-241-43.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=56388
content-encoding: gzip
content-length: 6694
content-type: text/html
date: Mon, 20 Jan 2025 12:28:09 GMT
expires: Tue, 21 Jan 2025 04:07:57 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H3 200 usermatch
ssum-sec.casalemedia.com/ Frame F2A9 0
0 112ms
73ms Document
text/html 104.18.26.193
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?s=184674&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gppsid=&cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dix%26gdpr%3D0%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 904f1010b8cb5c32-FRA
content-encoding: br
content-type: text/html
date: Mon, 20 Jan 2025 12:28:09 GMT
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
priority: u=0,i
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SJcdpWpSwPgCunBS8jl%2BzxQVHPidR2RVgFoqRoiYzrqkDqGhOm3zN6RfZwjVIjGn7tIF3VOJw0%2Bpdz6YBNU8N2A%2BZsgkCXjePRnVNQrwCCO%2Fh2wxryA8cSamPIX64jNnLKsoOVW0xj%2FAQA%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfExtPri
vary: Accept-Encoding

GET
H3 200 B9689862.280626343;dc_ver=104.305;sz=160x600;u_sd=1;gdpr_consent=tcunavailable;nel=1;dc_adk=3454886507;ord=4akonu;dc_rfl=2,https%3A%2F%2Fpaint.toys$2,,data%3Atext%2Fhtml%2C%250A%2520%2520%2520%2520...
ad.doubleclick.net/ddm/adi/N1395.150740DOUBLEVERIFY/ Frame 5E05 0
0 106ms
66ms Document
text/html 142.250.185.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/ddm/adi/N1395.150740DOUBLEVERIFY/B9689862.280626343;dc_ver=104.305;sz=160x600;u_sd=1;gdpr_consent=tcunavailable;nel=1;dc_adk=3454886507;ord=4akonu;dc_rfl=2,https%3A%2F%2Fpaint.toys$2,,data%3Atext%2Fhtml%2C%250A%2520%2520%2520%2520%2520%2520%253Chtml%2520style%253D%2522margin%253A0%253B%2520padding%253A0%253B%2520overflow%253Ahidden%253B%2522%253E%250A%2520%2520%2520%2520%2520%2520%2520%2520%253Chead%253E%253C%252Fhead%253E%250A%2520%2520%2520%2520%2520%2520%2520%2520%253Cbody%2520style%253D%2522margin%253A0%253B%2520padding%253A0%253B%2520overflow%253Ahidden%253B%2522%253E%250A%2520%2520%2520%2520%2520%2520%2520%2520%2520%2520%253Cins%2520class%253D'dcmads'%2520style%253D'display%253Ainline-block%253Bwidth%253A160px%253Bheight%253A600px'%250A%2520%2520%2520%2520data-dcm-placement%253D'N1395.150740DOUBLEVERIFY%252FB9689862.280626343'%250A%2520%2520%2520%2520data-dcm-rendering-mode%253D'iframe'%250A%2520%2520%2520%2520data-dcm-https-only%250A%2520%2520%2520%2520data-dcm-gdpr-applies%253D'gdpr%253D%2524%257BGDPR%257D'%250A%2520%2520%2520%2520data-dcm-gdpr-consent%253D'gdpr_consent%253D%2524%257BGDPR_CONSENT_755%257D'%250A%2520%2520%2520%2520data-dcm-addtl-consent%253D'addtl_consent%253D%2524%257BADDTL_CONSENT%257D'%250A%2520%2520%2520%2520data-dcm-resettable-device-id%253D''%250A%2520%2520%2520%2520data-dcm-app-id%253D''%253E%250A%2520%2520%253Cscript%2520src%253D'https%253A%252F%252Fwww.googletagservices.com%252Fdcm%252Fdcmads.js'%253E%253C%252Fscript%253E%250A%253C%252Fins%253E%250A%2520%2520%2520%2520%2520%2520%2520%2520%253C%252Fbody%253E%250A%2520%2520%2520%2520%2520%2520%253C%252Fhtml%253E$0;xdt=1;crlt=ToLM4n'bdP;cmpl=8;gcsr=a;stc=1;sttr=552;prcl=s

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/impl_v104.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

allow-fenced-frame-automatic-beacons: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 33994
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 20 Jan 2025 12:28:10 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 pbs-iframe
pbs-cs.yellowblue.io/ Frame 5260 0
0 107ms
35ms Document
text/html 3.248.65.188
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=0&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D0%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/prebid/prebid.js.br
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 3.248.65.188 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-248-65-188.eu-west-1.compute.amazonaws.com
Software: istio-envoy /
Resource Hash

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://paint.toys/
content-length: 0
content-type: text/html
date: Mon, 20 Jan 2025 12:28:10 GMT
server: istio-envoy
x-envoy-upstream-service-time: 1
x-reason: could not perform CS due to compliance policy: gdpr is not applied

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6526 0
20 B 63ms
62ms Ping
image/gif 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=9722482943117&version=m202411180101&ct=76&x=8&cor=16246115628109052000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS