www.mediafire.com Open in urlscan Pro
104.17.150.117 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Submission: On April 26 via manual (April 26th 2025, 10:48:25 am UTC) from TR — Scanned from TR

Summary HTTP 220 Redirects Links 9 Behaviour Indicators

Summary

This website contacted 59 IPs in 9 countries across 45 domains to perform 220 HTTP transactions. The main IP is 104.17.150.117, located in and belongs to CLOUDFLARENET, US. The main domain is www.mediafire.com. The Cisco Umbrella rank of the primary domain is 33690.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on July 30th 2024. Valid for: a year.

This is the only time www.mediafire.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 26	104.17.150.117 104.17.150.117	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	172.67.199.186 172.67.199.186	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	216.58.206.40 216.58.206.40	15169 (GOOGLE) (GOOGLE)
1	104.22.74.216 104.22.74.216	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	172.67.170.144 172.67.170.144	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.21.42.32 104.21.42.32	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	18.245.86.4 18.245.86.4	16509 (AMAZON-02) (AMAZON-02)
12	142.250.184.206 142.250.184.206	15169 (GOOGLE) (GOOGLE)
2	104.26.8.66 104.26.8.66	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.16.79.73 104.16.79.73	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	157.240.0.35 157.240.0.35	32934 (FACEBOOK) (FACEBOOK)
2	104.22.5.65 104.22.5.65	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	142.250.184.198 142.250.184.198	15169 (GOOGLE) (GOOGLE)
23	52.57.221.121 52.57.221.121	16509 (AMAZON-02) (AMAZON-02)
19	188.114.96.3 188.114.96.3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	157.240.0.6 157.240.0.6	32934 (FACEBOOK) (FACEBOOK)
1	35.82.174.89 35.82.174.89	16509 (AMAZON-02) (AMAZON-02)
3	142.250.181.227 142.250.181.227	15169 (GOOGLE) (GOOGLE)
1	142.250.186.138 142.250.186.138	15169 (GOOGLE) (GOOGLE)
2	172.217.16.142 172.217.16.142	15169 (GOOGLE) (GOOGLE)
2	172.67.38.106 172.67.38.106	13335 (CLOUDFLAR...) (CLOUDFLARENET)
19	142.250.186.34 142.250.186.34	15169 (GOOGLE) (GOOGLE)
1	184.30.26.29 184.30.26.29	16625 (AKAMAI-AS) (AKAMAI-AS)
2	216.58.212.174 216.58.212.174	15169 (GOOGLE) (GOOGLE)
1	173.194.76.156 173.194.76.156	15169 (GOOGLE) (GOOGLE)
1	172.217.18.3 172.217.18.3	15169 (GOOGLE) (GOOGLE)
2	188.114.97.3 188.114.97.3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	178.250.1.11 178.250.1.11	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE Criteo Technology SAS)
1	35.244.193.51 35.244.193.51	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 2	79.127.216.47 79.127.216.47	60068 (CDN77 Dat...) (CDN77 Datacamp Limited)
1 1	79.127.227.46 79.127.227.46	60068 (CDN77 Dat...) (CDN77 Datacamp Limited)
1	87.248.119.251 87.248.119.251	203220 (YAHOO-DEB...) (YAHOO-DEB Yahoo-UK Limited)
1	104.22.4.69 104.22.4.69	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2 7	141.95.98.65 141.95.98.65	16276 (OVH OVH SAS) (OVH OVH SAS)
1	34.120.133.55 34.120.133.55	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	54.194.27.185 54.194.27.185	16509 (AMAZON-02) (AMAZON-02)
2	35.71.131.137 35.71.131.137	16509 (AMAZON-02) (AMAZON-02)
8	3.237.175.195 3.237.175.195	14618 (AMAZON-AES) (AMAZON-AES)
1	142.250.185.163 142.250.185.163	15169 (GOOGLE) (GOOGLE)
2	141.95.98.64 141.95.98.64	16276 (OVH OVH SAS) (OVH OVH SAS)
1	18.66.102.31 18.66.102.31	16509 (AMAZON-02) (AMAZON-02)
1	18.173.204.202 18.173.204.202	16509 (AMAZON-02) (AMAZON-02)
1	104.16.174.226 104.16.174.226	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	65.9.66.104 65.9.66.104	16509 (AMAZON-02) (AMAZON-02)
1	34.96.70.87 34.96.70.87	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	178.250.1.39 178.250.1.39	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE Criteo Technology SAS)
1	34.102.146.192 34.102.146.192	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
3	142.250.185.97 142.250.185.97	15169 (GOOGLE) (GOOGLE)
2 2	77.243.51.121 77.243.51.121	42697 (NETIC-AS ...) (NETIC-AS Netic A/S)
1	35.190.39.111 35.190.39.111	15169 (GOOGLE) (GOOGLE)
3	142.250.186.130 142.250.186.130	15169 (GOOGLE) (GOOGLE)
8	87.250.254.222 87.250.254.222	13238 (YANDEX YA...) (YANDEX YANDEX LLC)
4	18.245.46.90 18.245.46.90	16509 (AMAZON-02) (AMAZON-02)
6	142.250.185.225 142.250.185.225	15169 (GOOGLE) (GOOGLE)
13	142.250.185.130 142.250.185.130	15169 (GOOGLE) (GOOGLE)
4	37.9.64.225 37.9.64.225	13238 (YANDEX YA...) (YANDEX YANDEX LLC)
2	13.248.176.26 13.248.176.26	16509 (AMAZON-02) (AMAZON-02)
4	3.167.227.120 3.167.227.120	16509 (AMAZON-02) (AMAZON-02)
2	130.211.23.194 130.211.23.194	() ()
220	59

26 104.17.150.117 (None, ) 1 redirects

ASN13335 (CLOUDFLARENET, US)

www.mediafire.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
static.mediafire.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.67.199.186 (United States)

ASN13335 (CLOUDFLARENET, US)

the.gatekeeperconsent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 216.58.206.40 (United States)

ASN15169 (GOOGLE, US)
PTR: mil07s07-in-f8.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.22.74.216 (None, )

ASN13335 (CLOUDFLARENET, US)

btloader.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.67.170.144 (United States)

ASN13335 (CLOUDFLARENET, US)

www.ezojs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.21.42.32 (None, )

ASN13335 (CLOUDFLARENET, US)

privacy.gatekeeperconsent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.245.86.4 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-245-86-4.fra60.r.cloudfront.net

cdn.amplitude.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 142.250.184.206 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s11-in-f14.1e100.net

translate.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
fundingchoicesmessages.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.26.8.66 (None, )

ASN13335 (CLOUDFLARENET, US)

cdn.econventa.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
econventa.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.16.79.73 (None, )

ASN13335 (CLOUDFLARENET, US)

static.cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 157.240.0.35 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
PTR: edge-star-mini-shv-02-fra3.facebook.com

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.22.5.65 (None, )

ASN13335 (CLOUDFLARENET, US)

ad-delivery.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.184.198 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s11-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

23 52.57.221.121 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-57-221-121.eu-central-1.compute.amazonaws.com

g.ezoic.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

19 188.114.96.3 (Amsterdam, Netherlands)

ASN13335 (CLOUDFLARENET, US)

go.ezodn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 157.240.0.6 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-02-fra3.fbcdn.net

static.xx.fbcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.82.174.89 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-82-174-89.us-west-2.compute.amazonaws.com

api.amplitude.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.181.227 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s56-in-f3.1e100.net

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.138 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s07-in-f10.1e100.net

translate.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.16.142 (United States)

ASN15169 (GOOGLE, US)
PTR: fra15s46-in-f14.1e100.net

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.67.38.106 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

19 142.250.186.34 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 184.30.26.29 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a184-30-26-29.deploy.static.akamaitechnologies.com

link.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 216.58.212.174 (United States)

ASN15169 (GOOGLE, US)
PTR: ams15s22-in-f174.1e100.net

analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 173.194.76.156 (United States)

ASN15169 (GOOGLE, US)
PTR: ws-in-f156.1e100.net

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.18.3 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s22-in-f3.1e100.net

www.google.com.tr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 188.114.97.3 (Amsterdam, Netherlands)

ASN13335 (CLOUDFLARENET, US)

bshr.ezodn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 178.250.1.11 (France)

ASN44788 (ASN-CRITEO-EUROPE Criteo Technology SAS, FR)

gum.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.193.51 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 51.193.244.35.bc.googleusercontent.com

lexicon.33across.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 79.127.216.47 (Frankfurt am Main, Germany) 1 redirects

ASN60068 (CDN77 Datacamp Limited, GB)
PTR: unn-79-127-216-47.datapacket.com

id.a-mx.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 79.127.227.46 (Amsterdam, Netherlands) 1 redirects

ASN60068 (CDN77 Datacamp Limited, GB)
PTR: unn-79-127-227-46.datapacket.com

c3.a-mo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 87.248.119.251 (United Kingdom)

ASN203220 (YAHOO-DEB Yahoo-UK Limited, GB)
PTR: e1-bmr.ycpi.vip.deb.yahoo.com

ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.22.4.69 (None, )

ASN13335 (CLOUDFLARENET, US)

id.hadron.ad.gt	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 141.95.98.65 (France) 2 redirects

ASN16276 (OVH OVH SAS, FR)
PTR: ns3216659.ip-141-95-98.eu

id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.120.133.55 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 55.133.120.34.bc.googleusercontent.com

api.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.194.27.185 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-194-27-185.eu-west-1.compute.amazonaws.com

id.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.71.131.137 (United States)

ASN16509 (AMAZON-02, US)
PTR: a6370ebea231e0c9a.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 3.237.175.195 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-237-175-195.compute-1.amazonaws.com

carbon-cdn.ccgateway.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
script-api.ccgateway.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ingestion-router-api.ccgateway.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.163 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s51-in-f3.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 141.95.98.64 (France)

ASN16276 (OVH OVH SAS, FR)
PTR: ns3216658.ip-141-95-98.eu

lb.eu-1-id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.102.31 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-102-31.fra56.r.cloudfront.net

connectid.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.173.204.202 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-173-204-202.fra56.r.cloudfront.net

cdn.prod.uidapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.16.174.226 (None, )

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 65.9.66.104 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-65-9-66-104.fra56.r.cloudfront.net

tags.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.96.70.87 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 87.70.96.34.bc.googleusercontent.com

invstatic101.creativecdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 178.250.1.39 (France)

ASN44788 (ASN-CRITEO-EUROPE Criteo Technology SAS, FR)

static.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.102.146.192 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 192.146.102.34.bc.googleusercontent.com

oa.openxcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.185.97 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s49-in-f1.1e100.net

e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 77.243.51.121 (Aalborg, Denmark) 2 redirects

ASN42697 (NETIC-AS Netic A/S, DK)

uipglob.semasio.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.190.39.111 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 111.39.190.35.bc.googleusercontent.com

esp.rtbhouse.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.186.130 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s07-in-f2.1e100.net

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 87.250.254.222 (Russian Federation)

ASN13238 (YANDEX YANDEX LLC, RU)
PTR: air.yandex.ru

abs.yandex.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 18.245.46.90 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-245-46-90.fra56.r.cloudfront.net

pcode.yads.tech	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 142.250.185.225 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s53-in-f1.1e100.net

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 142.250.185.130 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s50-in-f2.1e100.net

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 37.9.64.225 (Russian Federation)

ASN13238 (YANDEX YANDEX LLC, RU)
PTR: cloud.cdn.yandex.net

yastatic.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.248.176.26 (United States)

ASN16509 (AMAZON-02, US)
PTR: a20e0f9587322a99e.awsglobalaccelerator.com

display.yads.tech	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 3.167.227.120 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-3-167-227-120.fra60.r.cloudfront.net

avatars.yads.tech	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 130.211.23.194 (None, )

ASN- ()

api.btloader.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
26	mediafire.com 1 redirects www.mediafire.com — Cisco Umbrella Rank: 33690 static.mediafire.com — Cisco Umbrella Rank: 45623	190 KB
24	doubleclick.net ad.doubleclick.net — Cisco Umbrella Rank: 190 securepubads.g.doubleclick.net — Cisco Umbrella Rank: 281 stats.g.doubleclick.net — Cisco Umbrella Rank: 227 googleads.g.doubleclick.net — Cisco Umbrella Rank: 63	338 KB
23	ezoic.net g.ezoic.net — Cisco Umbrella Rank: 13484	64 KB
22	googlesyndication.com e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com tpc.googlesyndication.com — Cisco Umbrella Rank: 217 pagead2.googlesyndication.com — Cisco Umbrella Rank: 141	139 KB
21	ezodn.com go.ezodn.com — Cisco Umbrella Rank: 15324 bshr.ezodn.com — Cisco Umbrella Rank: 22786	422 KB
14	google.com translate.google.com — Cisco Umbrella Rank: 1411 analytics.google.com — Cisco Umbrella Rank: 215 fundingchoicesmessages.google.com — Cisco Umbrella Rank: 780	103 KB
10	yads.tech pcode.yads.tech — Cisco Umbrella Rank: 138927 display.yads.tech — Cisco Umbrella Rank: 99647 avatars.yads.tech — Cisco Umbrella Rank: 110914	305 KB
9	id5-sync.com 2 redirects cdn.id5-sync.com — Cisco Umbrella Rank: 1002 id5-sync.com — Cisco Umbrella Rank: 637	68 KB
8	yandex.ru abs.yandex.ru — Cisco Umbrella Rank: 76211	857 B
8	ccgateway.net carbon-cdn.ccgateway.net — Cisco Umbrella Rank: 13584 script-api.ccgateway.net — Cisco Umbrella Rank: 15131 ingestion-router-api.ccgateway.net — Cisco Umbrella Rank: 14788	16 KB
4	yastatic.net yastatic.net — Cisco Umbrella Rank: 3581	35 KB
4	criteo.com gum.criteo.com — Cisco Umbrella Rank: 574	8 KB
4	gstatic.com www.gstatic.com fonts.gstatic.com	11 KB
3	btloader.com btloader.com — Cisco Umbrella Rank: 1276 api.btloader.com	22 KB
3	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 79	335 KB
2	semasio.net 2 redirects uipglob.semasio.net — Cisco Umbrella Rank: 2051	1 KB
2	eu-1-id5-sync.com lb.eu-1-id5-sync.com — Cisco Umbrella Rank: 1126	577 B
2	adsrvr.org match.adsrvr.org — Cisco Umbrella Rank: 486	586 B
2	crwdcntrl.net id.crwdcntrl.net — Cisco Umbrella Rank: 3478 tags.crwdcntrl.net — Cisco Umbrella Rank: 1250	14 KB
2	yahoo.com ups.analytics.yahoo.com — Cisco Umbrella Rank: 744 connectid.analytics.yahoo.com — Cisco Umbrella Rank: 3898	9 KB
2	a-mx.com 1 redirects id.a-mx.com — Cisco Umbrella Rank: 2139	2 KB
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 80	22 KB
2	fbcdn.net static.xx.fbcdn.net — Cisco Umbrella Rank: 708	141 KB
2	ad-delivery.net ad-delivery.net — Cisco Umbrella Rank: 1338	673 B
2	econventa.com cdn.econventa.com — Cisco Umbrella Rank: 52414 econventa.com — Cisco Umbrella Rank: 44443	58 KB
2	amplitude.com cdn.amplitude.com — Cisco Umbrella Rank: 3886 api.amplitude.com — Cisco Umbrella Rank: 3374	22 KB
2	ezojs.com www.ezojs.com — Cisco Umbrella Rank: 20594	89 KB
2	gatekeeperconsent.com the.gatekeeperconsent.com — Cisco Umbrella Rank: 28830 privacy.gatekeeperconsent.com — Cisco Umbrella Rank: 46632	4 KB
1	rtbhouse.com esp.rtbhouse.com — Cisco Umbrella Rank: 2927	550 B
1	openxcdn.net oa.openxcdn.net — Cisco Umbrella Rank: 2876	8 KB
1	criteo.net static.criteo.net — Cisco Umbrella Rank: 1067	13 KB
1	creativecdn.com invstatic101.creativecdn.com — Cisco Umbrella Rank: 2770	3 KB
1	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 377	1 KB
1	uidapi.com cdn.prod.uidapi.com — Cisco Umbrella Rank: 3604	4 KB
1	rlcdn.com api.rlcdn.com — Cisco Umbrella Rank: 1174	254 B
1	ad.gt id.hadron.ad.gt — Cisco Umbrella Rank: 2273	271 B
1	a-mo.net 1 redirects c3.a-mo.net — Cisco Umbrella Rank: 23863	947 B
1	33across.com lexicon.33across.com — Cisco Umbrella Rank: 1981 cdn-ima.33across.com Failed	251 B
1	google.com.tr www.google.com.tr — Cisco Umbrella Rank: 15379	408 B
1	rubiconproject.com link.rubiconproject.com — Cisco Umbrella Rank: 180897	821 B
1	googleapis.com translate.googleapis.com — Cisco Umbrella Rank: 1145	74 KB
1	facebook.com www.facebook.com — Cisco Umbrella Rank: 132	14 KB
1	cloudflareinsights.com static.cloudflareinsights.com — Cisco Umbrella Rank: 717	7 KB
0	mediafiredls.com Failed www.mediafiredls.com Failed
0	dns-finder.com Failed ag.dns-finder.com Failed
220	45

	Domain	Requested by
23	g.ezoic.net	www.ezojs.com go.ezodn.com www.mediafire.com g.ezoic.net
20	static.mediafire.com	www.mediafire.com
19	securepubads.g.doubleclick.net	www.mediafire.com securepubads.g.doubleclick.net
19	go.ezodn.com	www.mediafire.com go.ezodn.com
13	pagead2.googlesyndication.com	e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com securepubads.g.doubleclick.net pagead2.googlesyndication.com
11	fundingchoicesmessages.google.com	securepubads.g.doubleclick.net
8	abs.yandex.ru	www.mediafire.com e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com
7	id5-sync.com	2 redirects go.ezodn.com cdn.id5-sync.com
6	tpc.googlesyndication.com	e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com
6	script-api.ccgateway.net	carbon-cdn.ccgateway.net
6	www.mediafire.com	1 redirects www.mediafire.com
4	avatars.yads.tech	e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com pcode.yads.tech
4	yastatic.net	pcode.yads.tech
4	pcode.yads.tech	www.mediafire.com pcode.yads.tech
4	gum.criteo.com	go.ezodn.com static.criteo.net gum.criteo.com
3	googleads.g.doubleclick.net	securepubads.g.doubleclick.net
3	e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
3	www.gstatic.com	www.mediafire.com www.gstatic.com
3	www.googletagmanager.com	www.mediafire.com www.googletagmanager.com
2	api.btloader.com	btloader.com
2	display.yads.tech	pcode.yads.tech
2	uipglob.semasio.net	2 redirects
2	lb.eu-1-id5-sync.com	go.ezodn.com cdn.id5-sync.com
2	match.adsrvr.org	go.ezodn.com www.mediafire.com
2	id.a-mx.com	1 redirects www.mediafire.com
2	bshr.ezodn.com	go.ezodn.com
2	analytics.google.com	www.googletagmanager.com
2	cdn.id5-sync.com	www.ezojs.com securepubads.g.doubleclick.net
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	static.xx.fbcdn.net	www.facebook.com
2	ad-delivery.net	www.mediafire.com
2	www.ezojs.com	www.mediafire.com www.ezojs.com
1	ingestion-router-api.ccgateway.net	www.mediafire.com
1	esp.rtbhouse.com	invstatic101.creativecdn.com
1	oa.openxcdn.net	securepubads.g.doubleclick.net
1	static.criteo.net	securepubads.g.doubleclick.net
1	invstatic101.creativecdn.com	securepubads.g.doubleclick.net
1	tags.crwdcntrl.net	securepubads.g.doubleclick.net
1	cdn.jsdelivr.net	securepubads.g.doubleclick.net
1	cdn.prod.uidapi.com	securepubads.g.doubleclick.net
1	connectid.analytics.yahoo.com	securepubads.g.doubleclick.net
1	fonts.gstatic.com	www.mediafire.com
1	carbon-cdn.ccgateway.net	link.rubiconproject.com
1	id.crwdcntrl.net	go.ezodn.com
1	api.rlcdn.com	go.ezodn.com
1	id.hadron.ad.gt	go.ezodn.com
1	ups.analytics.yahoo.com	go.ezodn.com
1	c3.a-mo.net	1 redirects
1	lexicon.33across.com	go.ezodn.com
1	www.google.com.tr	www.mediafire.com
1	stats.g.doubleclick.net	www.googletagmanager.com
1	link.rubiconproject.com	www.mediafire.com
1	translate.googleapis.com
1	econventa.com	cdn.econventa.com
1	api.amplitude.com	cdn.amplitude.com
1	ad.doubleclick.net	www.mediafire.com
1	www.facebook.com	www.mediafire.com
1	static.cloudflareinsights.com	www.mediafire.com
1	cdn.econventa.com	www.mediafire.com
1	translate.google.com	www.mediafire.com
1	cdn.amplitude.com	www.mediafire.com
1	privacy.gatekeeperconsent.com	the.gatekeeperconsent.com
1	btloader.com	www.mediafire.com
1	the.gatekeeperconsent.com	www.mediafire.com
0	cdn-ima.33across.com Failed	securepubads.g.doubleclick.net
0	www.mediafiredls.com Failed	www.mediafire.com
0	ag.dns-finder.com Failed	btloader.com
220	67

This site contains links to these domains. Also see Links.

Domain
download2273.mediafire.com
blog.mediafire.com
fast.io
mediafire.zendesk.com
translate.google.com
twitter.com
www.facebook.com

Subject Issuer	Validity	Valid
*.mediafire.com Sectigo RSA Domain Validation Secure Server CA	`2024-07-30` - `2025-08-30`	a year	crt.sh
gatekeeperconsent.com WE1	`2025-04-14` - `2025-07-13`	3 months	crt.sh
*.google-analytics.com WE2	`2025-03-31` - `2025-06-23`	3 months	crt.sh
btloader.com WE1	`2025-04-03` - `2025-07-02`	3 months	crt.sh
www.ezojs.com WE1	`2025-04-22` - `2025-07-21`	3 months	crt.sh
cdn.amplitude.com Amazon RSA 2048 M03	`2024-11-14` - `2025-12-13`	a year	crt.sh
*.google.com WE2	`2025-03-31` - `2025-06-23`	3 months	crt.sh
econventa.com WE1	`2025-03-20` - `2025-06-18`	3 months	crt.sh
cloudflareinsights.com WE1	`2025-02-27` - `2025-05-28`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2025-02-02` - `2025-05-03`	3 months	crt.sh
ad-delivery.net WE1	`2025-03-08` - `2025-06-06`	3 months	crt.sh
*.doubleclick.net WE2	`2025-03-31` - `2025-06-23`	3 months	crt.sh
ezoic.net E6	`2025-03-13` - `2025-06-11`	3 months	crt.sh
ezodn.com WE1	`2025-04-12` - `2025-07-11`	3 months	crt.sh
*.amplitude.com COMODO RSA Domain Validation Secure Server CA	`2025-02-07` - `2026-02-14`	a year	crt.sh
*.gstatic.com WE2	`2025-03-31` - `2025-06-23`	3 months	crt.sh
upload.video.google.com WE2	`2025-03-31` - `2025-06-23`	3 months	crt.sh
id5-sync.com WE1	`2025-03-26` - `2025-06-24`	3 months	crt.sh
*.g.doubleclick.net WE2	`2025-03-31` - `2025-06-23`	3 months	crt.sh
*.rubiconproject.com DigiCert TLS RSA SHA256 2020 CA1	`2025-03-06` - `2026-04-03`	a year	crt.sh
*.google.com.tr WE2	`2025-03-31` - `2025-06-23`	3 months	crt.sh
*.criteo.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2025-04-18` - `2025-07-17`	3 months	crt.sh
lexicon.33across.com WR3	`2025-04-21` - `2025-07-20`	3 months	crt.sh
sp.analytics.yahoo.com DigiCert SHA2 High Assurance Server CA	`2025-02-24` - `2025-08-20`	6 months	crt.sh
id.hadron.ad.gt WE1	`2025-03-16` - `2025-06-14`	3 months	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2025-02-06` - `2026-03-05`	a year	crt.sh
*.crwdcntrl.net Amazon RSA 2048 M03	`2024-09-08` - `2025-10-08`	a year	crt.sh
*.adsrvr.org GlobalSign GCC R3 DV TLS CA 2020	`2025-03-19` - `2026-04-02`	a year	crt.sh
ccgateway.net E5	`2025-04-02` - `2025-07-01`	3 months	crt.sh
eu-1-id5-sync.com R10	`2025-03-01` - `2025-05-30`	3 months	crt.sh
connectid.analytics.yahoo.com GlobalSign ECC OV SSL CA 2018	`2025-03-25` - `2025-09-18`	6 months	crt.sh
cdn.prod.uidapi.com Amazon RSA 2048 M03	`2024-11-20` - `2025-12-20`	a year	crt.sh
*.jsdelivr.net Sectigo RSA Domain Validation Secure Server CA	`2025-04-25` - `2026-05-04`	a year	crt.sh
invstatic101.creativecdn.com WR3	`2025-04-12` - `2025-07-11`	3 months	crt.sh
*.criteo.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2025-04-11` - `2025-07-04`	3 months	crt.sh
oa.openxcdn.net WR3	`2025-03-12` - `2025-06-10`	3 months	crt.sh
esp.rtbhouse.com WR3	`2025-04-14` - `2025-07-13`	3 months	crt.sh
abs.yandex.ru GlobalSign ECC OV SSL CA 2018	`2025-03-09` - `2025-10-09`	7 months	crt.sh
pcode.yads.tech Amazon ECDSA 256 M02	`2024-11-05` - `2025-12-05`	a year	crt.sh
tpc.googlesyndication.com WE2	`2025-03-31` - `2025-06-23`	3 months	crt.sh
*.yastatic-net.ru GlobalSign RSA OV SSL CA 2018	`2024-11-06` - `2025-06-08`	7 months	crt.sh
*.yads.tech Amazon ECDSA 256 M03	`2025-04-07` - `2026-05-07`	a year	crt.sh
avatars.yads.tech Amazon ECDSA 256 M02	`2024-11-05` - `2025-12-05`	a year	crt.sh
api.btloader.com WR3	`2025-03-28` - `2025-06-26`	3 months	crt.sh

This page contains 9 frames:

Primary Page: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Frame ID: 160B4B27E3803AF05D7D7466F7287D7C
Requests: 165 HTTP requests in this frame

Frame: https://www.facebook.com/plugins/like.php?href=http://www.facebook.com/MediaFire&width=193&layout=button_count&action=like&show_faces=false&share=true&height=30&appId=124578887583575
Frame ID: 0107C02AD357024B6625BE7C32679288
Requests: 3 HTTP requests in this frame

Frame: https://www.mediafire.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/44e6f86df4dc/main.js
Frame ID: 29641F46E5D7B379938F4D1B0DCD5E83
Requests: 2 HTTP requests in this frame

Frame: data://truncated
Frame ID: EB1C2335ED342463289CD58CE86CEEA7
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/static/topics/topics_frame.html
Frame ID: 8C649B29E633E9AF450F6C28644AB08F
Requests: 1 HTTP requests in this frame

Frame: https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html
Frame ID: D0BE8FBA28276A96F1103945950DD544
Requests: 1 HTTP requests in this frame

Frame: https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html
Frame ID: 3DDE3594F826A91388CDA4A44B6BF9B7
Requests: 22 HTTP requests in this frame

Frame: https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html
Frame ID: AD50EC36934BA79D4667F6AAF063EBB6
Requests: 22 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=www.mediafire.com&gdpr=0&gdpr_consent=&gpp=&gpp_sid=-1
Frame ID: 52B41E40D5E2504EEB86B8B395EF7CD5
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

EX13_RP8-FP

Detected technologies

Amplitude (Analytics) Expand

Overall confidence: 100%
Detected patterns

cdn\.amplitude\.com

Cloudflare Browser Insights (Analytics) Expand

Overall confidence: 100%
Detected patterns

static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

DoubleClick Ad Exchange (AdX) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

tpc\.googlesyndication\.com/safeframe

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

220
Requests

97 %
HTTPS

0 %
IPv6

45
Domains

67
Subdomains

59
IPs

9
Countries

2543 kB
Transfer

9442 kB
Size

90
Cookies

9 Outgoing links

These are links going to different origins than the main page.

URL: https://download2273.mediafire.com/enogjkfqy8egi1EyZBNnyeSEhG9QEp_HujXo-SLig3b4BXMrPETB25obYUw4N_wjnTZfUOLCGMJ_sz69xh4mSrWgTRabcK7xbsLbNnxPwh5R5-Elp875RtA_AIGTofq3As55EMxHwSRUdWJ884viEi2TUAm74buvZsdkcaVH_-0WK3o/0z4njtfe7z5sca3/EX13_RP8-FP.rar
Title: Download (8.61GB)

Search URL Search Domain Scan URL

URL: http://blog.mediafire.com/
Title: Company Blog

Search URL Search Domain Scan URL

URL: https://fast.io/
Title: AI Cloud Storage for Teams

Search URL Search Domain Scan URL

URL: https://mediafire.zendesk.com/hc/en-us
Title: Support

Search URL Search Domain Scan URL

URL: https://translate.google.com/
Title: Çeviri

Search URL Search Domain Scan URL

URL: https://twitter.com/#!/mediafire

Search URL Search Domain Scan URL

URL: https://www.facebook.com/mediafire

Search URL Search Domain Scan URL

URL: https://twitter.com/mediafire
Title: Twitter Page

Search URL Search Domain Scan URL

URL: https://blog.mediafire.com/
Title: MediaFire Blog

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 42

https://www.mediafire.com/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
https://www.mediafire.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/44e6f86df4dc/main.js

Request Chain 84

https://id.a-mx.com/sync/?tagId=&ref=null&u=https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file&tl=https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file&nf=0&rt=true&v=9.37.0&av=2.0&vg=epbjs&us_privacy=null&am=null&gdpr=0&gdpr_consent= HTTP 302
https://c3.a-mo.net/b?uid=d7dd4e2b-7034-4838-9ffb-9b09dcd4709a&sh=id.a-mx.com& HTTP 302
https://id.a-mx.com/set?oid=d7dd4e2b-7034-4838-9ffb-9b09dcd4709a&uid=d7dd4e2b-7034-4838-9ffb-9b09dcd4709a&

Request Chain 146

https://id5-sync.com/i/457/8.gif?o=api&id5id=ID5*PQvzisAzwH2a_XVHJ5yfKsIl-YH7xvPDt4Nb4vJwY_8Sj6momD6YOz0bCK8dejNC&gdpr_consent=undefined&gdpr=false HTTP 302
https://uipglob.semasio.net/id5/1/get?gdpr=0&gdpr_consent=&_url=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F112%2F7%2F2.gif%3Fpuid%3D%24%7BUIPID%7D%26gdpr%3D0%26gdpr_consent%3D HTTP 302
https://uipglob.semasio.net/id5/1/get2?gdpr=0&gdpr_consent=&_url=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F112%2F7%2F2.gif%3Fpuid%3D%24%7BUIPID%7D%26gdpr%3D0%26gdpr_consent%3D HTTP 302
https://id5-sync.com/c/457/112/7/2.gif?puid=478191D71E4A1F02&gdpr=0&gdpr_consent= HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=8h9u11h&ttd_tpi=1&gdpr=0&gdpr_consent=

220 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3 200 Primary Request file Show response
www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/ 347 KB
89 KB 629ms
572ms Document
text/html 104.17.150.117
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.150.117 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bab561008f03f1dcbcf178605ebb782ca271615ca813a969799bef6b5a9b5fc7

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-methods: OPTIONS, POST, GET
access-control-allow-origin: https://www.mediafire.com
alt-svc: h3=":443"; ma=86400
cache-control: no-cache, no-store, must-revalidate, max-age=0, post-check=0, pre-check=0
cf-cache-status: DYNAMIC
cf-ray: 936581c26ea5bd5c-IST
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Sat, 26 Apr 2025 10:48:17 GMT
expires: 0
pragma: no-cache
priority: u=0,i
server: cloudflare
server-timing: cfCacheStatus;desc="DYNAMIC" cfExtPri
strict-transport-security: max-age=0
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
x-mf-env: liveApi
x-mf-fe: mf2
x-robots-tag: noindex, nofollow

GET
H3 200 cmp.min.js Show response
the.gatekeeperconsent.com/ 8 KB
3 KB 113ms
55ms Script
application/javascript 172.67.199.186
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://the.gatekeeperconsent.com/cmp.min.js
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.199.186 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e0ff1aa498c3e7899a1ba72cea996bea56b397a6e93864cff709ce8d1776e5ea

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex
content-encoding: gzip
cf-cache-status: HIT
age: 40
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QGGGoUCBXBdHb%2BtHvkL8VdLaekVZU4ihDXD%2B6jLinTStscJIOW8njZEHg9geLONJm%2BnO30GVC0dIPBkQsQtsbaN9UkBdLAaZiSN8vvi3lNV04UICo%2BY%2BnBUd5J0UZqQYfWngICFLfLZnCXeT"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=44869&min_rtt=44869&rtt_var=16826&sent=8&recv=7&lost=0&retrans=0&sent_bytes=3594&recv_bytes=3090&delivery_rate=64959&cwnd=12000&unsent_bytes=0&cid=66160e0847ebe9cd&ts=57&x=16"
date: Sat, 26 Apr 2025 10:48:18 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding
last-modified: Sat, 26 Apr 2025 10:45:22 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cache-control: max-age=300, public
cf-ray: 936581c88ae4c8cd-IST
server: cloudflare

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 243 KB
87 KB 326ms
130ms Script
application/javascript 216.58.206.40
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-829541-1

Requested by

Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.206.40 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

mil07s07-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

7f8c2e0e993d935444e4c330556184bedd195ed9bfc3b1c62ed655dc7c8221e3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1068:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1068:0"}],}
expires: Sat, 26 Apr 2025 10:48:18 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 26 Apr 2025 10:48:18 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Sat, 26 Apr 2025 09:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1068:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1068:0
content-length: 88711
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 tag Show response
btloader.com/ 65 KB
21 KB 165ms
59ms Script
application/javascript 104.22.74.216
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.22.74.216 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a8b0878903af377a12fe490acb0df77cf52d1f84c1b9497cca6af6c0b86297f7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex, nofollow
cache-control: public, max-age=300, stale-if-error=3600, stale-while-revalidate=300
content-encoding: gzip
cf-cache-status: HIT
etag: "395723ae0e18f6e9fd32791f6e7b51b2"
via: 1.1 google
cf-ray: 936581c99898b737-IST
accept-ranges: bytes
access-control-allow-origin: *
content-length: 21704
date: Sat, 26 Apr 2025 10:48:18 GMT
content-type: application/javascript
last-modified: Sat, 26 Apr 2025 10:46:07 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 sa.min.js Show response
www.ezojs.com/ezoic/ 144 KB
47 KB 122ms
56ms Script
application/javascript 172.67.170.144
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://www.ezojs.com/ezoic/sa.min.js
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.170.144 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 41da135a5039e2aad02bd25c14cf5105752de0ccbd088374499b08559d4378c4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex, nofollow
content-encoding: gzip
cf-cache-status: HIT
etag: W/"a55ed91d3f257a3cb5709ba30b200036"
age: 67
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DKKwouTOEtrjfdNd8wg26ipwAyUnuHPVHKE60crczoZ%2BKMXUqMIN0XzcnQodtBnH5z9C9QlIgqw%2BN%2BuRwn%2BHctNvcCqkEHcHKvv6LVhhaGByTUwIyZIqqyCxr3e%2B3hiq"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=45184&min_rtt=45166&rtt_var=16973&sent=8&recv=7&lost=0&retrans=0&sent_bytes=3630&recv_bytes=3062&delivery_rate=65150&cwnd=12000&unsent_bytes=0&cid=4adf8b587f9aefdb&ts=57&x=16"
date: Sat, 26 Apr 2025 10:48:18 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cache-control: public, max-age=600, stale-while-revalidate=3600
cf-ray: 936581c95f9f333e-IST
server: cloudflare

GET
H3 200 upgrade_widget.js Show response
static.mediafire.com/js/ 13 KB
3 KB 115ms
106ms Script
application/x-javascript 104.17.150.117
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://static.mediafire.com/js/upgrade_widget.js
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.150.117 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 47878b1adcd923dcfcf5d29ade971275259a236199ca23114deaaa409b138c18

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"67f6eaca-351b"
age: 3811
access-control-allow-methods: OPTIONS, POST, GET
expires: Mon, 26 May 2025 08:20:07 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Sat, 26 Apr 2025 10:48:18 GMT
content-type: application/x-javascript
last-modified: Wed, 09 Apr 2025 21:46:50 GMT
vary: Accept-Encoding
priority: u=3,i=?0
cache-control: max-age=2592000
x-mf-fe: mf1
cf-ray: 936581c8bcecbd5c-IST
access-control-allow-origin: *
server: cloudflare

GET
H3 200 zap_circle.svg
static.mediafire.com/images/download/subscription_upsell/ 770 B
666 B 114ms
105ms Image
image/svg+xml 104.17.150.117
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://static.mediafire.com/images/download/subscription_upsell/zap_circle.svg
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.150.117 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ed2fac09523ed9ca4b23fd845302db29d2c2b405457cfaa9601e9c35959e8dd8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"67f6eaca-302"
age: 7233
access-control-allow-methods: OPTIONS, POST, GET
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Sat, 26 Apr 2025 10:48:18 GMT
content-type: image/svg+xml
last-modified: Wed, 09 Apr 2025 21:46:50 GMT
vary: Accept-Encoding
priority: u=2,i
x-mf-fe: mf1
cf-ray: 936581c8bcedbd5c-IST
access-control-allow-origin: *
server: cloudflare

GET
H3 200 timer.svg
static.mediafire.com/images/download/subscription_upsell/ 877 B
708 B 113ms
105ms Image
image/svg+xml 104.17.150.117
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://static.mediafire.com/images/download/subscription_upsell/timer.svg
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.150.117 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 136a2a86b537e7fe909a0479f565714e476c88055ca3fe81209e1e17c6f43bd4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"67f6eaca-36d"
age: 12180
access-control-allow-methods: OPTIONS, POST, GET
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Sat, 26 Apr 2025 10:48:18 GMT
content-type: image/svg+xml
last-modified: Wed, 09 Apr 2025 21:46:50 GMT
vary: Accept-Encoding
priority: u=2,i
x-mf-fe: mf1
cf-ray: 936581c8bcf0bd5c-IST
access-control-allow-origin: *
server: cloudflare

GET
H3 200 zap.svg
static.mediafire.com/images/download/subscription_upsell/ 747 B
667 B 70ms
69ms Image
image/svg+xml 104.17.150.117
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://static.mediafire.com/images/download/subscription_upsell/zap.svg
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.150.117 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 81b49dbd181c58edb92ec92edaa0f0e982d841ab735978cfe98e7ec2eb503f7c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"67f6eaca-2eb"
age: 14130
access-control-allow-methods: OPTIONS, POST, GET
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Sat, 26 Apr 2025 10:48:18 GMT
content-type: image/svg+xml
last-modified: Wed, 09 Apr 2025 21:46:50 GMT
vary: Accept-Encoding
priority: u=2,i
x-mf-fe: mf1
cf-ray: 936581c8ed5ebd5c-IST
access-control-allow-origin: *
server: cloudflare

GET
H3 200 megaphone.svg
static.mediafire.com/images/download/subscription_upsell/ 759 B
691 B 140ms
139ms Image
image/svg+xml 104.17.150.117
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://static.mediafire.com/images/download/subscription_upsell/megaphone.svg
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.150.117 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 482a94c1ba7976b2b97757f9004facd785bee598b9678fb64e2a07542f86e5b9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"67f6eaca-2f7"
age: 10646
access-control-allow-methods: OPTIONS, POST, GET
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Sat, 26 Apr 2025 10:48:18 GMT
content-type: image/svg+xml
last-modified: Wed, 09 Apr 2025 21:46:50 GMT
vary: Accept-Encoding
priority: u=2,i
x-mf-fe: mf1
cf-ray: 936581c8ed60bd5c-IST
access-control-allow-origin: *
server: cloudflare

GET
H3 200 crown.svg
static.mediafire.com/images/download/subscription_upsell/ 712 B
645 B 72ms
71ms Image
image/svg+xml 104.17.150.117
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://static.mediafire.com/images/download/subscription_upsell/crown.svg
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.150.117 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e7c0df5d23898ea8e195222a6386aba911e9f282df4c0941d8baacbe35a18eea

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"67f6eaca-2c8"
age: 12559
access-control-allow-methods: OPTIONS, POST, GET
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Sat, 26 Apr 2025 10:48:18 GMT
content-type: image/svg+xml
last-modified: Wed, 09 Apr 2025 21:46:50 GMT
vary: Accept-Encoding
priority: u=2,i
x-mf-fe: mf1
cf-ray: 936581c8ed62bd5c-IST
access-control-allow-origin: *
server: cloudflare

GET
H3 200 zap_white.svg
static.mediafire.com/images/download/subscription_upsell/ 770 B
687 B 67ms
65ms Image
image/svg+xml 104.17.150.117
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://static.mediafire.com/images/download/subscription_upsell/zap_white.svg
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.150.117 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 91f2fceb37be6396e8f5b416d15a007ddb33034dd8496aa4a681d5bf7360761b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"67f6eaca-302"
age: 13673
access-control-allow-methods: OPTIONS, POST, GET
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Sat, 26 Apr 2025 10:48:18 GMT
content-type: image/svg+xml
last-modified: Wed, 09 Apr 2025 21:46:50 GMT
vary: Accept-Encoding
priority: u=3,i
x-mf-fe: mf2
cf-ray: 936581c96e74bd5c-IST
access-control-allow-origin: *
server: cloudflare

GET
H3 200 download.svg
static.mediafire.com/images/download/subscription_upsell/ 149 B
400 B 68ms
66ms Image
image/svg+xml 104.17.150.117
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://static.mediafire.com/images/download/subscription_upsell/download.svg
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.150.117 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6ff39e2e085828036c40efa08d69febb971361f0c11eb21f7c382e7443c08015

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"67f6eaca-95"
age: 10143
access-control-allow-methods: OPTIONS, POST, GET
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Sat, 26 Apr 2025 10:48:18 GMT
content-type: image/svg+xml
last-modified: Wed, 09 Apr 2025 21:46:50 GMT
vary: Accept-Encoding
priority: u=3,i
x-mf-fe: mf2
cf-ray: 936581c96e77bd5c-IST
access-control-allow-origin: *
server: cloudflare

GET
H3 200 consent_modules.json Show response
privacy.gatekeeperconsent.com/ 2 B
641 B 113ms
54ms XHR
application/json 104.21.42.32
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://privacy.gatekeeperconsent.com/consent_modules.json
Requested by: Host: the.gatekeeperconsent.com
URL: https://the.gatekeeperconsent.com/cmp.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.42.32 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cache-control: max-age=15780000, public
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=A1LH180D7Lm2cOU2YjgRRNQiOwN7s0VQiC6rC0jAn09QzHu8ovaysF2xFE%2B596h8BPzCoeRz%2FPIGPrIhR0B%2FZJC3hWOQ3bK1RfCtmWqd8KNsBoA40ekfleDKZrDNpUf2Wa1JfQywZv6wyFb4w%2FOncA%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 936581c94f6d7b12-IST
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
content-length: 2
server-timing: cfL4;desc="?proto=QUIC&rtt=44850&min_rtt=44849&rtt_var=16818&sent=9&recv=7&lost=0&retrans=0&sent_bytes=3645&recv_bytes=3102&delivery_rate=64925&cwnd=12000&unsent_bytes=0&cid=465bdc7b1778e6ab&ts=57&x=16"
date: Sat, 26 Apr 2025 10:48:18 GMT
content-type: application/json;charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 amplitude-8.5.0-min.gz.js Show response
cdn.amplitude.com/libs/ 68 KB
22 KB 261ms
95ms Script
application/javascript 18.245.86.4
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.amplitude.com/libs/amplitude-8.5.0-min.gz.js
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.245.86.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-245-86-4.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2450e5580136f94bda7ccf95e3167b57e15b05b513a430967943a50036fa47a4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Origin: https://www.mediafire.com
Referer: https://www.mediafire.com/

Response headers

access-control-max-age: 3000
content-encoding: gzip
etag: "660c3b546f2a131de50b69b91f26c636"
x-amz-version-id: NY8_7uBz3xoXYJBVsMSBAGHOz8ixMBS3
age: 412892
access-control-allow-methods: GET, HEAD
x-cache: Hit from cloudfront
x-amz-cf-id: rkgXXJrGWJfS2YceiXc_gR17puRxskhpboQNd873J-rGJR2f9SqBCA==
date: Mon, 21 Apr 2025 16:06:47 GMT
content-type: application/javascript
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method
last-modified: Fri, 13 Aug 2021 22:37:42 GMT
cache-control: max-age=31536000
via: 1.1 997d50190609a53c76124b45ad43b3ec.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 22154
x-amz-cf-pop: FRA60-P6
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 335 KB
103 KB 279ms
202ms Script
application/javascript 216.58.206.40
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-53LP4T

Requested by

Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.206.40 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

mil07s07-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

596dfdf90e479a2d9c42b36372b5e3cc1be3439e3294119ed7d15920a22f8f5f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1310:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1310:0"}],}
expires: Sat, 26 Apr 2025 10:48:18 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 26 Apr 2025 10:48:18 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Sat, 26 Apr 2025 09:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1310:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1310:0
content-length: 104853
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 mf_logo_full_color.svg
static.mediafire.com/images/backgrounds/header/ 3 KB
2 KB 64ms
64ms Image
image/svg+xml 104.17.150.117
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://static.mediafire.com/images/backgrounds/header/mf_logo_full_color.svg
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.150.117 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8539c91ae0a82f8cab27d481ea38ac4e66d1e5b36701fe295bcba4399b9255bd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"5813cfb2-d1d"
age: 1523
access-control-allow-methods: OPTIONS, POST, GET
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Sat, 26 Apr 2025 10:48:18 GMT
content-type: image/svg+xml
last-modified: Fri, 28 Oct 2016 22:22:42 GMT
vary: Accept-Encoding
priority: u=1,i
x-mf-fe: mf2
cf-ray: 936581c8fd6fbd5c-IST
access-control-allow-origin: *
server: cloudflare

GET
H2 200 element.js Show response
translate.google.com/translate_a/ 78 KB
28 KB 292ms
96ms Script
text/javascript 142.250.184.206
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://translate.google.com/translate_a/element.js?cb=googFooterTranslate

Requested by

Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.206 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f14.1e100.net

Software

ESF /

Resource Hash

b05079bcb0c79db2e26f5a249c9c389ca2c44bbc575afebbd2415cbd1396dbf8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 26 Apr 2025 10:48:18 GMT
x-xss-protection: 0
content-type: text/javascript; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
server: ESF
x-frame-options: SAMEORIGIN

GET
H3 200 file-zip-v3.png
static.mediafire.com/images/filetype/ 2 KB
2 KB 60ms
60ms Image
image/png 104.17.150.117
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://static.mediafire.com/images/filetype/file-zip-v3.png
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.150.117 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4448e430d3c53bad548a5d135e1c7e2f9593e806ba47892640d430ea752e979e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cf-cache-status: HIT
etag: "62deda56-750"
age: 12815
access-control-allow-methods: OPTIONS, POST, GET
expires: Mon, 26 May 2025 04:42:26 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Sat, 26 Apr 2025 10:48:18 GMT
content-type: image/png
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
vary: Accept-Encoding
priority: u=3,i
cache-control: max-age=2592000
x-mf-fe: mf1
cf-ray: 936581c98eacbd5c-IST
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1872
server: cloudflare

GET
H3 200 icons_sprite.svg
www.mediafire.com/images/icons/svg_light/ 36 KB
8 KB 64ms
64ms Image
image/svg+xml 104.17.150.117
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://www.mediafire.com/images/icons/svg_light/icons_sprite.svg
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.150.117 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7ba1bc2084def769e77a7dbf97cd91d68fe6c6d55b5d183a7d36630da8da2b02

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"62deda56-90ab"
age: 4170
access-control-allow-methods: OPTIONS, POST, GET
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Sat, 26 Apr 2025 10:48:18 GMT
content-type: image/svg+xml
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
vary: Accept-Encoding
priority: u=3,i
cf-ray: 936581c98eadbd5c-IST
x-mf-fe: mf2
access-control-allow-origin: *
server: cloudflare

GET
H3 200 apps_list_sprite-v6.png
static.mediafire.com/images/backgrounds/download/ 8 KB
8 KB 63ms
62ms Image
image/png 104.17.150.117
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://static.mediafire.com/images/backgrounds/download/apps_list_sprite-v6.png
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.150.117 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dc54b817820f14ce6395ba2a037f37d4bb0af75d5b017336140793fbe2f7f738

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cf-cache-status: HIT
etag: "62deda56-1fd1"
age: 11253
access-control-allow-methods: OPTIONS, POST, GET
expires: Mon, 26 May 2025 06:59:41 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Sat, 26 Apr 2025 10:48:18 GMT
content-type: image/png
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
vary: Accept-Encoding
priority: u=3,i
cache-control: max-age=2592000
x-mf-fe: mf2
cf-ray: 936581c98eb3bd5c-IST
accept-ranges: bytes
access-control-allow-origin: *
content-length: 8145
server: cloudflare

GET
H3 200 arrow_dropdown.svg
www.mediafire.com/images/icons/svg_dark/ 315 B
505 B 77ms
76ms Image
image/svg+xml 104.17.150.117
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://www.mediafire.com/images/icons/svg_dark/arrow_dropdown.svg
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.150.117 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 82b94716473aa225e715e117802145c5d2d725aa1ba9d476d61a5d3da16a8c26

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"62deda56-13b"
age: 12197
access-control-allow-methods: OPTIONS, POST, GET
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Sat, 26 Apr 2025 10:48:18 GMT
content-type: image/svg+xml
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
vary: Accept-Encoding
priority: u=3,i
cf-ray: 936581c98eb7bd5c-IST
x-mf-fe: mf1
access-control-allow-origin: *
server: cloudflare

GET
H3 200 check_circle_green.svg
static.mediafire.com/images/icons/svg_dark/ 444 B
553 B 57ms
56ms Image
image/svg+xml 104.17.150.117
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://static.mediafire.com/images/icons/svg_dark/check_circle_green.svg
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.150.117 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 03c8d2dc7d985c3004ff2cd6d8148dd03560f37ed15efdf6c2d7f4d771d0e599

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"62deda56-1bc"
age: 12935
access-control-allow-methods: OPTIONS, POST, GET
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Sat, 26 Apr 2025 10:48:18 GMT
content-type: image/svg+xml
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
vary: Accept-Encoding
priority: u=3,i
x-mf-fe: mf2
cf-ray: 936581c98eb8bd5c-IST
access-control-allow-origin: *
server: cloudflare

GET
H3 200 fb_16x16.png
static.mediafire.com/images/backgrounds/download/social/ 181 B
452 B 60ms
59ms Image
image/png 104.17.150.117
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://static.mediafire.com/images/backgrounds/download/social/fb_16x16.png
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.150.117 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 720671166ac43aba99e3952b0b9341ab4e0fee1fd891db54e2a07f05db653142

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cf-cache-status: HIT
etag: "62deda56-b5"
age: 381
access-control-allow-methods: OPTIONS, POST, GET
expires: Mon, 26 May 2025 08:24:17 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Sat, 26 Apr 2025 10:48:18 GMT
content-type: image/png
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
vary: Accept-Encoding
priority: u=3,i
cache-control: max-age=2592000
x-mf-fe: mf2
cf-ray: 936581c98ebabd5c-IST
accept-ranges: bytes
access-control-allow-origin: *
content-length: 181
server: cloudflare

GET
H3 200 footerIcons.png
static.mediafire.com/images/backgrounds/footer/social/ 583 B
856 B 63ms
63ms Image
image/png 104.17.150.117
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://static.mediafire.com/images/backgrounds/footer/social/footerIcons.png
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.150.117 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f917a9105c311331b1d40f4d2bdbf11233c1c465616c1a9c46232f451463b061

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cf-cache-status: HIT
etag: "62deda56-247"
age: 14027
access-control-allow-methods: OPTIONS, POST, GET
expires: Mon, 26 May 2025 03:28:32 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Sat, 26 Apr 2025 10:48:18 GMT
content-type: image/png
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
vary: Accept-Encoding
priority: u=3,i
cache-control: max-age=2592000
x-mf-fe: mf1
cf-ray: 936581c99ef5bd5c-IST
accept-ranges: bytes
access-control-allow-origin: *
content-length: 583
server: cloudflare

GET
H3 200 infinity.js.aspx Show response
cdn.econventa.com/Scripts/ 179 KB
55 KB 138ms
78ms Script
application/x-javascript 104.26.8.66
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.econventa.com/Scripts/infinity.js.aspx?guid=5ff0fb62-0643-4ff1-aaee-c737f9ffc0e0
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.26.8.66 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 368499ba3f7e2b4ea9bb3187d0d7be2928b59f12bb76a9d327d9d8006d593a26

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
age: 506
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=45262&min_rtt=45152&rtt_var=17010&sent=10&recv=7&lost=0&retrans=0&sent_bytes=4239&recv_bytes=4293&delivery_rate=71888&cwnd=12000&unsent_bytes=0&cid=f65c1ac8eea2766c&ts=83&x=1", cfExtPri, cfHdrFlush;dur=0
p3p: CP="CAO PSA OUR IND"
date: Sat, 26 Apr 2025 10:48:18 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Sat, 26 Apr 2025 10:27:44 GMT
priority: u=3,i=?0
cache-control: public, max-age=1200, no-transform
accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version
cf-ray: 936581ca0d2b720d-IST
access-control-allow-origin: *
server: cloudflare

GET
H2 200 vcd15cbe7772f49c399c6a5babf22c1241717689176015 Show response
static.cloudflareinsights.com/beacon.min.js/ 19 KB
7 KB 147ms
53ms Script
text/javascript 104.16.79.73
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.79.73 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Origin: https://www.mediafire.com
Referer: https://www.mediafire.com/

Response headers

cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"2024.6.1"
cross-origin-resource-policy: cross-origin
cf-ray: 936581ca6c98f2ed-IST
access-control-allow-origin: *
date: Sat, 26 Apr 2025 10:48:18 GMT
content-type: text/javascript;charset=UTF-8
last-modified: Thu, 06 Jun 2024 15:52:56 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 like.php Show response
www.facebook.com/plugins/ Frame 0107 49 KB
14 KB 328ms
232ms Document
text/html 157.240.0.35
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://www.facebook.com/plugins/like.php?href=http://www.facebook.com/MediaFire&width=193&layout=button_count&action=like&show_faces=false&share=true&height=30&appId=124578887583575

Requested by

Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.0.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-02-fra3.facebook.com

Software

Resource Hash

7efe760d93c9b9e43e76decf6cb39f9cad9ef5ee106f090fbfa38326906e583c

Security Headers

Name	Value
Content-Security-Policy	default-src blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'nonce-YxvbQ6ya' blob: data: 'self' connect.facebook.net 'wasm-unsafe-eval' https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com https://.google-analytics.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com https://fonts.gstatic.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net .carriersignal.info blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com .tenor.co .tenor.com .giphy.com https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co .tenor.com https://.giphy.com;child-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net accounts.meta.com https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net .google.com .doubleclick.net;manifest-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;object-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.mediafire.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: private, no-cache, no-store, must-revalidate
content-encoding: zstd
content-security-policy: default-src blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'nonce-YxvbQ6ya' blob: data: 'self' connect.facebook.net 'wasm-unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;child-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net accounts.meta.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;manifest-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;object-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
content-type: text/html; charset="utf-8"
cross-origin-opener-policy: unsafe-none
cross-origin-opener-policy-report-only: restrict-properties;report-to="coop_report"
cross-origin-resource-policy: cross-origin
date: Sat, 26 Apr 2025 10:48:18 GMT
document-policy: force-load-at-top
expires: Sat, 01 Jan 2000 00:00:00 GMT
origin-agent-cluster: ?1
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
pragma: no-cache
priority: u=0,i
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7497571928699148398&cpp=C3&cv=1022271664&st=1745664498415"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7497571928699148398&cpp=C3&cv=1022271664&st=1745664498415", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
strict-transport-security: max-age=15552000; preload
vary: Accept-Encoding
x-content-type-options: nosniff
x-fb-connection-quality: GOOD; q=0.7, rtt=86, rtx=0, c=23, mss=1232, tbw=4815, tp=9, tpl=0, uplat=144, ullat=0
x-fb-debug: SNl9/jXsroCKnRLyGm/jQZcmy0MAi8DKE6xqRAjQvC+akVPHWMu6fsajWusmrNfjvkznZLthTDS90NlThSxa0w==
x-xss-protection: 0

GET
H3 200 world.svg
static.mediafire.com/images/backgrounds/download/additional_content/ 143 KB
53 KB 72ms
71ms Image
image/svg+xml 104.17.150.117
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://static.mediafire.com/images/backgrounds/download/additional_content/world.svg
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.150.117 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4342feac38021c4fe3069eba0edf1c2e1b4345e2b548b0afb7ab21b7369b3bc8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"62deda56-23ce2"
age: 12633
access-control-allow-methods: OPTIONS, POST, GET
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Sat, 26 Apr 2025 10:48:18 GMT
content-type: image/svg+xml
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
vary: Accept-Encoding
priority: u=3,i
x-mf-fe: mf2
cf-ray: 936581ca080cbd5c-IST
access-control-allow-origin: *
server: cloudflare

GET
H3 200 continent-eu.svg
static.mediafire.com/images/backgrounds/download/additional_content/ 23 KB
9 KB 67ms
67ms Image
image/svg+xml 104.17.150.117
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://static.mediafire.com/images/backgrounds/download/additional_content/continent-eu.svg
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.150.117 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cbb99c4149249b280f1d3d924d9bdd29a4a14cba1e71775fb3bdbdf13ebd5a48

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"62deda56-5ca3"
age: 5671
access-control-allow-methods: OPTIONS, POST, GET
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Sat, 26 Apr 2025 10:48:18 GMT
content-type: image/svg+xml
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
vary: Accept-Encoding
priority: u=3,i
x-mf-fe: mf2
cf-ray: 936581ca0812bd5c-IST
access-control-allow-origin: *
server: cloudflare

GET
H3 200 fra.svg
static.mediafire.com/images/flags_svg/ 249 B
411 B 61ms
60ms Image
image/svg+xml 104.17.150.117
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://static.mediafire.com/images/flags_svg/fra.svg
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.150.117 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 241dac7da9d2782f58c2ffdc05090ac486b49cde149c879675d189dee66aedf6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"62deda56-f9"
age: 1294
access-control-allow-methods: OPTIONS, POST, GET
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Sat, 26 Apr 2025 10:48:18 GMT
content-type: image/svg+xml
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
vary: Accept-Encoding
priority: u=3,i
x-mf-fe: mf1
cf-ray: 936581ca0814bd5c-IST
access-control-allow-origin: *
server: cloudflare

GET
H3 200 flag.svg
static.mediafire.com/images/backgrounds/download/additional_content/ 234 B
456 B 63ms
63ms Image
image/svg+xml 104.17.150.117
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://static.mediafire.com/images/backgrounds/download/additional_content/flag.svg
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.150.117 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f52a0c7d9fa7ae8e45916c491ae7193f9a1e289f128f05264122c53d8da970db

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"62deda56-ea"
age: 13394
access-control-allow-methods: OPTIONS, POST, GET
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Sat, 26 Apr 2025 10:48:18 GMT
content-type: image/svg+xml
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
vary: Accept-Encoding
priority: u=3,i
x-mf-fe: mf2
cf-ray: 936581ca0816bd5c-IST
access-control-allow-origin: *
server: cloudflare

GET
H3 200 mf_round.svg
static.mediafire.com/images/backgrounds/download/additional_content/ 1 KB
1 KB 63ms
62ms Image
image/svg+xml 104.17.150.117
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://static.mediafire.com/images/backgrounds/download/additional_content/mf_round.svg
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.150.117 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f1a67642fc97b508ce07cf6df329022bf5184a1c573044dc021e0d6e64688c64

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"62deda56-5b1"
age: 11005
access-control-allow-methods: OPTIONS, POST, GET
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Sat, 26 Apr 2025 10:48:18 GMT
content-type: image/svg+xml
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
vary: Accept-Encoding
priority: u=3,i
x-mf-fe: mf1
cf-ray: 936581ca0818bd5c-IST
access-control-allow-origin: *
server: cloudflare

GET
H3 200 browser_chrome.svg
static.mediafire.com/images/backgrounds/download/additional_content/ 8 KB
2 KB 66ms
65ms Image
image/svg+xml 104.17.150.117
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://static.mediafire.com/images/backgrounds/download/additional_content/browser_chrome.svg
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.150.117 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1c6ba1010c2cc88c59de9e9584728da124770fa399643ffc1beffcec54b84be7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"62deda56-1e24"
age: 6765
access-control-allow-methods: OPTIONS, POST, GET
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Sat, 26 Apr 2025 10:48:18 GMT
content-type: image/svg+xml
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
vary: Accept-Encoding
priority: u=3,i
x-mf-fe: mf1
cf-ray: 936581ca081bbd5c-IST
access-control-allow-origin: *
server: cloudflare

GET px.gif
ag.dns-finder.com/ 0
0

GET
H2 200 px.gif
ad-delivery.net/ 43 B
563 B 161ms
57ms Image
image/gif 104.22.5.65
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=2
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.22.5.65 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 624060
x-goog-stored-content-encoding: identity
expires: Sat, 19 Apr 2025 06:01:07 GMT
x-goog-stored-content-length: 43
date: Sat, 26 Apr 2025 10:48:18 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
vary: Accept-Encoding
x-guploader-uploadid: AKDAyIssYxu17Ldc9byYFb48cALCJKTAoyoftBjtfRUWZh_RBYSLq5U353cZJS-FDGe5RrUJwHKhehU
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 936581cae971c5fd-IST
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico
ad.doubleclick.net/ 1 KB
130 B 189ms
94ms Image
image/x-icon 142.250.184.198
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250

Requested by

Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f6.1e100.net

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
age: 18123
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Sun, 27 Apr 2025 05:46:15 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 26 Apr 2025 05:46:15 GMT
last-modified: Tue, 08 May 2012 13:08:06 GMT
content-type: image/x-icon
vary: Accept-Encoding
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 px.gif
ad-delivery.net/ 43 B
110 B 162ms
59ms Image
image/gif 104.22.5.65
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.11268168838211257
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.22.5.65 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 624060
x-goog-stored-content-encoding: identity
expires: Sat, 19 Apr 2025 06:01:07 GMT
x-goog-stored-content-length: 43
date: Sat, 26 Apr 2025 10:48:18 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
vary: Accept-Encoding
x-guploader-uploadid: AKDAyIssYxu17Ldc9byYFb48cALCJKTAoyoftBjtfRUWZh_RBYSLq5U353cZJS-FDGe5RrUJwHKhehU
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 936581cae972c5fd-IST
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

POST
H2 200 saa.go Show response
g.ezoic.net/ 10 KB
4 KB 257ms
85ms XHR
text/javascript 52.57.221.121
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/saa.go
Requested by: Host: www.ezojs.com
URL: https://www.ezojs.com/ezoic/sa.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.57.221.121 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-57-221-121.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 8ebf53e90b302dd92548c42edc336eb170d3c6ada29dcac4d70cea8137913b8f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex
access-control-max-age: 1728000
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
content-encoding: br
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, PUT, OPTIONS
expires: Fri, 25 Apr 2025 10:48:18 GMT
access-control-allow-origin: https://www.mediafire.com
date: Sat, 26 Apr 2025 10:48:18 GMT
content-type: text/javascript
vary: Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
access-control-allow-headers: Content-Type

GET
H3 200 boise.js Show response
go.ezodn.com/detroitchicago/ 824 B
1 KB 126ms
65ms Script
application/javascript 188.114.96.3
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://go.ezodn.com/detroitchicago/boise.js?gcb=195-13&cb=5
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a4fafcd389d58bbd82e49d9a68e81e9dc8384330ff14ec3283a4d0d11812047b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex
content-encoding: zstd
cf-cache-status: HIT
age: 545834
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Jl2Ddc4NJtczioLYMSAZeTNV59Z0YS7SD9ySOXo%2BaiAxphaoufB0aIpCd02X01roktfAte%2FuB97NQ9zbWav2P4K1BzgIoLUgjxmc0nt%2FCWK4sEZ2JDfJW84WmRl%2FHN8%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=45028&min_rtt=44963&rtt_var=16907&sent=16&recv=8&lost=0&retrans=0&sent_bytes=9196&recv_bytes=4586&delivery_rate=73306&cwnd=12000&unsent_bytes=0&cid=b8cb5485a5b7503b&ts=68&x=1", cfExtPri, cfHdrFlush;dur=0
date: Sat, 26 Apr 2025 10:48:18 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding
last-modified: Fri, 18 Apr 2025 01:54:54 GMT
priority: u=3,i=?0
cache-control: public, max-age=31536000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 936581cc5e93db8d-IST
server: cloudflare

GET
H3 200 abilene.js Show response
go.ezodn.com/parsonsmaize/ 11 KB
5 KB 125ms
64ms Script
application/javascript 188.114.96.3
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://go.ezodn.com/parsonsmaize/abilene.js?gcb=195-13&cb=dc112bb7ea
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f1c02e9ba02a159b34fc2d7d2be0a743b497a6cd0a422a0c3acc88b871b2af96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex
content-encoding: zstd
cf-cache-status: HIT
age: 618531
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=S7FAVYrM0pqNHcYh%2FBrwwWfjs8wJfscjJGu7m1O1Z0dhVzrek%2BHRofvPF8mWJkCXSkyGGXFkKjYHBeoKp7muHp7wxuyIEC0V%2FSRVSO5rL5axiyfeWf7UJ%2FIi9A%2BgDas%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=45028&min_rtt=44963&rtt_var=16907&sent=11&recv=8&lost=0&retrans=0&sent_bytes=4113&recv_bytes=4586&delivery_rate=73306&cwnd=12000&unsent_bytes=0&cid=b8cb5485a5b7503b&ts=67&x=1", cfExtPri, cfHdrFlush;dur=0
date: Sat, 26 Apr 2025 10:48:18 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding
last-modified: Sat, 19 Apr 2025 02:06:15 GMT
priority: u=3,i=?0
cache-control: public, max-age=31536000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 936581cc5e94db8d-IST
server: cloudflare

POST
H2 200 sa.go Show response
g.ezoic.net/ 109 KB
27 KB 115ms
113ms XHR
text/javascript 52.57.221.121
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/sa.go
Requested by: Host: www.ezojs.com
URL: https://www.ezojs.com/ezoic/sa.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.57.221.121 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-57-221-121.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: eeda1175e4830a49aba285a77241ec5fdcf5640becff18d137f5777b032f7fec

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex
access-control-max-age: 1728000
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
content-encoding: br
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, PUT, OPTIONS
expires: Fri, 25 Apr 2025 10:48:18 GMT
access-control-allow-origin: https://www.mediafire.com
date: Sat, 26 Apr 2025 10:48:18 GMT
content-type: text/javascript
vary: Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
access-control-allow-headers: Content-Type

GET
H3 200 identity.js Show response
www.ezojs.com/ 168 KB
42 KB 53ms
52ms Script
application/javascript 172.67.170.144
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://www.ezojs.com/identity.js
Requested by: Host: www.ezojs.com
URL: https://www.ezojs.com/ezoic/sa.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.170.144 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8787abba1a566d5492523a12b1a7f8927db9296e83ad14efe3acd1a07037cf19

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex, nofollow
content-encoding: gzip
cf-cache-status: HIT
etag: W/"718d535e4044841c3640732abbe38887"
age: 254
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=92KXu%2FsrAY%2FydgYo4%2Ft5cWVHun45JBNTXc884y2OZZkPrbNOchX%2Fp6CKbp%2B2uxhEhu6en7DikzbgIUoIdGNC0NEJEng5GJojcsC%2BMpYNln%2FXxqaEgzDoj%2BuoLDbRltWj"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=48774&min_rtt=45166&rtt_var=4593&sent=55&recv=33&lost=0&retrans=0&sent_bytes=52739&recv_bytes=4432&delivery_rate=411348&cwnd=24900&unsent_bytes=0&cid=4adf8b587f9aefdb&ts=483&x=16"
date: Sat, 26 Apr 2025 10:48:18 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cache-control: public, max-age=900, stale-while-revalidate=3600
cf-ray: 936581cc081d333e-IST
server: cloudflare

GET
H3

200

main.js Show response
www.mediafire.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/44e6f86df4dc/ Frame 2964
Redirect Chain

https://www.mediafire.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
https://www.mediafire.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/44e6f86df4dc/main.js?

8 KB
4 KB

53ms
53ms

Script
application/javascript

104.17.150.117
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://www.mediafire.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/44e6f86df4dc/main.js?

Requested by

Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file

Protocol

Server

104.17.150.117 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8f2706997957ef1c1004e3ade43f1805894a4f4b2846d1a8801c8ab151fee421

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

cache-control: max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public
content-encoding: gzip
x-content-type-options: nosniff
cf-ray: 936581ccadd4bd5c-IST
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Sat, 26 Apr 2025 10:48:18 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare
priority: u=3,i=?0

Redirect headers

cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public
location: /cdn-cgi/challenge-platform/h/g/scripts/jsd/44e6f86df4dc/main.js?
cf-ray: 936581cc2cbdbd5c-IST
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
content-length: 0
server-timing: cfExtPri
date: Sat, 26 Apr 2025 10:48:18 GMT
vary: Accept-Encoding
server: cloudflare
priority: u=3,i=?0

GET
H3 200 FEppCFCt76d.png
static.xx.fbcdn.net/rsrc.php/v4/yD/r/ Frame 0107 299 B
438 B 192ms
92ms Image
image/png 157.240.0.6
FACEBOOK

General

Check archive.org

Download Go to Show image

Full URL

https://static.xx.fbcdn.net/rsrc.php/v4/yD/r/FEppCFCt76d.png

Requested by

Host: www.facebook.com
URL: https://www.facebook.com/plugins/like.php?href=http://www.facebook.com/MediaFire&width=193&layout=button_count&action=like&show_faces=false&share=true&height=30&appId=124578887583575

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.0.6 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-fra3.fbcdn.net

Software

Resource Hash

d65f4b2e8eee94ddc7f762d098de19558d879a3b597c8913b4d075532e3ed4b4

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.facebook.com/

Response headers

content-md5: OIlAxCmR79nrM/Ez4ygGlg==
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Fri, 17 Apr 2026 11:23:24 GMT
alt-svc: h3=":443"; ma=86400
date: Sat, 26 Apr 2025 10:48:18 GMT
content-type: image/png
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
x-fb-debug: SL4f4nAej3RMi17YZ9rjNvf9bfBT29CpdwXasodAV0UY8ML+T8dItHr/R9LHkcaKa3WhLTVmmBVHWV0Dqx1t8A==
priority: u=1,i
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
x-fb-connection-quality: GOOD; q=0.7, rtt=90, rtx=0, c=23, mss=1232, tbw=4816, tp=9, tpl=0, uplat=0, ullat=-1
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
access-control-allow-origin: *
content-length: 299
origin-agent-cluster: ?1

POST
H2 200 / Show response
api.amplitude.com/ 7 B
137 B 745ms
255ms XHR
text/html 35.82.174.89
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://api.amplitude.com/

Requested by

Host: cdn.amplitude.com
URL: https://cdn.amplitude.com/libs/amplitude-8.5.0-min.gz.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.82.174.89 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-82-174-89.us-west-2.compute.amazonaws.com

Software

Resource Hash

aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Referer: https://www.mediafire.com/

Response headers

strict-transport-security: max-age=15768000
access-control-allow-origin: *
content-length: 7
date: Sat, 26 Apr 2025 10:48:19 GMT
content-type: text/html;charset=utf-8

GET
H3 200 Tag.engine Show response
econventa.com/ 2 KB
3 KB 432ms
423ms Script
application/json 104.26.8.66
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://econventa.com/Tag.engine?time=-180&id=5ff0fb62-0643-4ff1-aaee-c737f9ffc0e0&rand=20676&ver=async&referrerUrl=&fingerPrint=123&abr=false&stdTime=180&fpe=1&bw=1600&bh=1200&res=1600x1200&curl=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F0z4njtfe7z5sca3%2FEX13_RP8-FP.rar%2Ffile&kw=online%20storage%2Cfree%20storage%2Ccloud%20storage%2Ccollaboration%2Cbackup%20file%20sharing%2Cshare%20files%2Cphoto%20backup%2Cphoto%20sharing%2Cftp%20replacement%2Ccross%20platform%2Cremote%20access%2Cmobile%20access%2Csend%20large%20files%2Crecover%20files%2Cfile%20versioning%2Cundelete%2Cwindows%2Cpc%2Cmac%2Cos%20x%2Clinux%2Ciphone
Requested by: Host: cdn.econventa.com
URL: https://cdn.econventa.com/Scripts/infinity.js.aspx?guid=5ff0fb62-0643-4ff1-aaee-c737f9ffc0e0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.26.8.66 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 334b1b036b22a598fbc80da1d7edae26bfefc739b7b41d3f47649cf197bab2fc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cache-control: private, no-transform
content-encoding: gzip
cf-cache-status: DYNAMIC
accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version
cf-ray: 936581cc7a0d720d-IST
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
p3p: CP="CAO PSA OUR IND"
server-timing: cfL4;desc="?proto=QUIC&rtt=46424&min_rtt=44666&rtt_var=2263&sent=64&recv=37&lost=0&retrans=0&sent_bytes=62059&recv_bytes=6255&delivery_rate=698837&cwnd=38400&unsent_bytes=0&cid=f65c1ac8eea2766c&ts=818&x=1", cfExtPri, cfHdrFlush;dur=0
date: Sat, 26 Apr 2025 10:48:19 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: cloudflare
priority: u=3,i=?0

GET
H2 200 m=el_main_css
www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.NJgGN_yGIWM.L.W.O/am=AAY/d=0/rs=AN8SPfrTSMIvWAFISYN4u74dPJrX0HgUsw/ 22 KB
5 KB 250ms
79ms Stylesheet
text/css 142.250.181.227
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.NJgGN_yGIWM.L.W.O/am=AAY/d=0/rs=AN8SPfrTSMIvWAFISYN4u74dPJrX0HgUsw/m=el_main_css

Requested by

Host:
URL: /_/translate_http/_/js/k=translate_http.tr.tr.FzixK1GLCJw.O/am=AAY/d=1/rs=AN8SPfoiW0mAaICUJ7TIgQWLMuVltJWvig/m=el_conf

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.227 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f3.1e100.net

Software

sffe /

Resource Hash

71ca2652e2b3ffd3c0ec966958604714ce6c7af01d961b44adc438518eb58cb3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
age: 355988
report-to: {"group":"rosetta","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/rosetta"}]}
x-content-type-options: nosniff
expires: Wed, 22 Apr 2026 07:55:10 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 22 Apr 2025 07:55:10 GMT
last-modified: Tue, 25 Feb 2025 22:10:27 GMT
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=31536000
cross-origin-opener-policy: same-origin; report-to="rosetta"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/rosetta
accept-ranges: bytes
access-control-allow-origin: *
content-length: 4144
x-xss-protection: 0
server: sffe

GET
H2 200 m=el_main Show response
translate.googleapis.com/_/translate_http/_/js/k=translate_http.tr.tr.FzixK1GLCJw.O/am=ACA/d=1/exm=el_conf/ed=1/rs=AN8SPfoB5y7tOg2Uo0d8k1xknJyJtDl5WA/ 213 KB
74 KB 296ms
92ms Script
text/javascript 142.250.186.138
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://translate.googleapis.com/_/translate_http/_/js/k=translate_http.tr.tr.FzixK1GLCJw.O/am=ACA/d=1/exm=el_conf/ed=1/rs=AN8SPfoB5y7tOg2Uo0d8k1xknJyJtDl5WA/m=el_main

Requested by

Host:
URL: /_/translate_http/_/js/k=translate_http.tr.tr.FzixK1GLCJw.O/am=AAY/d=1/rs=AN8SPfoiW0mAaICUJ7TIgQWLMuVltJWvig/m=el_conf

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f10.1e100.net

Software

sffe /

Resource Hash

eadb2140c433b64ca74a8e25665b4f80a54a4183c3cb01da578e7426fbae95c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
age: 84252
report-to: {"group":"rosetta","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/rosetta"}]}
x-content-type-options: nosniff
expires: Sat, 25 Apr 2026 11:24:06 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 25 Apr 2025 11:24:06 GMT
last-modified: Fri, 21 Mar 2025 23:10:30 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=31536000
cross-origin-opener-policy: same-origin; report-to="rosetta"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/rosetta
accept-ranges: bytes
access-control-allow-origin: *
content-length: 75224
x-xss-protection: 0
server: sffe

GET
H3 200 XPzlbDA_tOt.js Show response
static.xx.fbcdn.net/rsrc.php/v4iR5z4/y8/l/tr_TR/ Frame 0107 543 KB
141 KB 183ms
92ms XHR
application/x-javascript 157.240.0.6
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v4iR5z4/y8/l/tr_TR/XPzlbDA_tOt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.0.6 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-fra3.fbcdn.net

Software

Resource Hash

68d8dfa93b4e38c1b0c7149805dad2a10785abfd56d10aac2822537d195e4c3b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.facebook.com/

Response headers

content-md5: M8QaJQIj7jbxE/4NdbocCQ==
content-encoding: zstd
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sun, 26 Apr 2026 00:49:06 GMT
alt-svc: h3=":443"; ma=86400
date: Sat, 26 Apr 2025 10:48:18 GMT
content-type: application/x-javascript; charset=utf-8
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
x-fb-debug: Gf4QsXLoHPZ0TsmQeVNFkXSq/IKiUX8GbJSO6tDbX0n80FVqbu9n1suTTgFEr7nqkfujo48PmzzNjdH07pJyjQ==
priority: u=1,i
vary: Origin
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
x-fb-connection-quality: GOOD; q=0.7, rtt=87, rtx=0, c=23, mss=1232, tbw=4819, tp=9, tpl=0, uplat=3, ullat=-1
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
access-control-allow-origin: https://www.facebook.com
content-length: 143973
origin-agent-cluster: ?1

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 250ms
79ms Script
text/javascript 172.217.16.142
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-829541-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.142 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
age: 7119
report-to: {"group":"ascnsrsgac:225:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:225:0"}],}
x-content-type-options: nosniff
expires: Sat, 26 Apr 2025 10:49:39 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 26 Apr 2025 08:49:39 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
content-type: text/javascript
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:225:0
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsgac:225:0
content-length: 20994
server: Golfe2

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 452 KB
145 KB 128ms
127ms Script
application/javascript 216.58.206.40
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-K68XP6D85D&l=dataLayer&cx=c&gtm=45He54n0v6304663za200&tag_exp=102887800~103051953~103077950~103106314~103106316~103116025~103130360~103130362~103200001

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-53LP4T

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.206.40 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

mil07s07-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

1c11dc2ad05325563e9fd3a8201b49acdc45798ffc3fc8b6e5df513ea8a64569

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1068:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1068:0"}],}
expires: Sat, 26 Apr 2025 10:48:18 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 26 Apr 2025 10:48:18 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1068:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1068:0
content-length: 147907
x-xss-protection: 0
server: Google Tag Manager

OPTIONS
H2 200 ezconfig
g.ezoic.net/detroitchicago/ Frame 0
0 259ms
86ms Preflight 52.57.221.121
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/detroitchicago/ezconfig
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.57.221.121 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-57-221-121.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.mediafire.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET, POST, PUT, OPTIONS
access-control-allow-origin: https://www.mediafire.com
access-control-max-age: 1728000
content-length: 0
date: Sat, 26 Apr 2025 10:48:18 GMT
vary: Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers

OPTIONS
H2 200 ezconfig
g.ezoic.net/detroitchicago/ Frame 0
0 258ms
86ms Preflight 52.57.221.121
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/detroitchicago/ezconfig
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.57.221.121 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-57-221-121.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.mediafire.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET, POST, PUT, OPTIONS
access-control-allow-origin: https://www.mediafire.com
access-control-max-age: 1728000
content-length: 0
date: Sat, 26 Apr 2025 10:48:18 GMT
vary: Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers

GET
H2 200 id5-api.js Show response
cdn.id5-sync.com/api/1.0/ 105 KB
30 KB 162ms
54ms Script
text/javascript 172.67.38.106
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/id5-api.js

Requested by

Host: www.ezojs.com
URL: https://www.ezojs.com/identity.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.38.106 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

007036d465b81110214bfc2593974dfd94e31304794dd2e2f0a85adf880cf472

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-amz-id-2: F9+6LDEd7TMZniR8tqVnGbze8HS5GW/kiFnr/ZkHbW9vgkaBoCwkFlfUZOchH+kwaPVTHNMCNbXz8mzcowkhkhu0dk14+W30KARr0b7d0j8=
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: public, max-age=3600
content-encoding: br
cf-cache-status: HIT
etag: W/"e080505431750bcc4447c43d487f9da4"
age: 3421
x-amz-request-id: Q43HQGWSHF9ER9HC
cf-ray: 936581cd6f631628-IST
date: Sat, 26 Apr 2025 10:48:18 GMT
content-type: text/javascript;charset=utf-8
last-modified: Fri, 18 Apr 2025 14:04:56 GMT
vary: Accept-Encoding
server: cloudflare
x-amz-server-side-encryption: AES256

POST
H2 200 ezconfig Show response
g.ezoic.net/detroitchicago/ 49 B
109 B 92ms
91ms Fetch
application/json 52.57.221.121
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/detroitchicago/ezconfig
Requested by: Host: www.ezojs.com
URL: https://www.ezojs.com/identity.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.57.221.121 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-57-221-121.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 50a63bf06dcdc62ce03de6a07d10770dc80cfa47ef2b63db1e9f6a5fbd786a7d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: application/json
Referer: https://www.mediafire.com/

Response headers

access-control-max-age: 1728000
content-encoding: gzip
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, PUT, OPTIONS
access-control-allow-origin: https://www.mediafire.com
content-length: 73
date: Sat, 26 Apr 2025 10:48:18 GMT
content-type: application/json
vary: Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
access-control-allow-headers: Content-Type

POST
H2 200 ezconfig Show response
g.ezoic.net/detroitchicago/ 29 B
72 B 88ms
87ms Fetch
application/json 52.57.221.121
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/detroitchicago/ezconfig
Requested by: Host: www.ezojs.com
URL: https://www.ezojs.com/identity.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.57.221.121 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-57-221-121.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 893719087a8bc6dcdfabc4e1d54fd6d724953d40da2ad369f8b4fb5f689394d7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: application/json
Referer: https://www.mediafire.com/

Response headers

access-control-max-age: 1728000
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, PUT, OPTIONS
access-control-allow-origin: https://www.mediafire.com
content-length: 29
date: Sat, 26 Apr 2025 10:48:18 GMT
content-type: application/json
vary: Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
access-control-allow-headers: Content-Type

GET
H3 200 mulvane.js Show response
go.ezodn.com/parsonsmaize/ 1 KB
1 KB 56ms
56ms Script
application/javascript 188.114.96.3
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://go.ezodn.com/parsonsmaize/mulvane.js?gcb=195-13&cb=e75e48eec0
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9b41253384e2818bd0f76171d6ffd723d4c85c5e1a69da74f174489cb52a40ce

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex
content-encoding: zstd
cf-cache-status: HIT
age: 977860
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QFsTxh0P7SJsRBQdOzAA4HFTYspztsDtSrhtnBQfbT8CeBVEiv9W7skSSkhC7b4TBxDuIZpi5Vj1Bw%2Bmx2sld9yqn8C2qCIBuzh0ENHwLEavpaLWcBfg85o5X3BvMtg%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=52963&min_rtt=44963&rtt_var=13382&sent=24&recv=17&lost=0&retrans=0&sent_bytes=12386&recv_bytes=5782&delivery_rate=153635&cwnd=12000&unsent_bytes=0&cid=b8cb5485a5b7503b&ts=129&x=1", cfExtPri, cfHdrFlush;dur=0
date: Sat, 26 Apr 2025 10:48:18 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding
last-modified: Thu, 20 Mar 2025 04:44:38 GMT
priority: u=3,i=?0
cache-control: public, max-age=31536000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 936581cccfb2db8d-IST
server: cloudflare

GET
H3 200 birmingham.js Show response
go.ezodn.com/detroitchicago/ 752 B
1 KB 54ms
53ms Script
application/javascript 188.114.96.3
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://go.ezodn.com/detroitchicago/birmingham.js?gcb=195-13&cb=539c47377c
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 30be558393bd8b0585c806a6eaed6d6f5b51d1ca63c0113061dfe35eaa128ce3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex
content-encoding: zstd
cf-cache-status: HIT
age: 299946
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dv%2F8NVGbGzninqiyonR%2FMcmVAIaDpnMn8G%2B4yJp7vf7jdl0bvIPAJG7NYVrOn%2B5B9mN6FE3G5naIWNYxVgGns%2BjzgzHVtULVB4bYRHTHDciZYAIGGYaQYfH7XPxn9yE%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=52963&min_rtt=44963&rtt_var=13382&sent=21&recv=17&lost=0&retrans=0&sent_bytes=10493&recv_bytes=5782&delivery_rate=153635&cwnd=12000&unsent_bytes=0&cid=b8cb5485a5b7503b&ts=126&x=1", cfExtPri, cfHdrFlush;dur=0
date: Sat, 26 Apr 2025 10:48:18 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding
last-modified: Fri, 18 Apr 2025 02:02:26 GMT
priority: u=3,i=?0
cache-control: public, max-age=31536000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 936581cccfb3db8d-IST
server: cloudflare

GET
H3 200 ezoicanalytics.js Show response
go.ezodn.com/ 2 KB
2 KB 55ms
55ms Script
application/javascript 188.114.96.3
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://go.ezodn.com/ezoicanalytics.js?cb=1&dcb=195-13&shcb=34
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e814d50a228f54aecf40d8a58e41d48ce1dfc4376fd5fbedc28078fe0a8c5526

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex
content-encoding: zstd
cf-cache-status: HIT
age: 11999
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CVrTmZrxvLaPsdpgOXTo1QbHVqo3UfSlYJD%2B%2BqFAxFrK0wPFa%2FNqRd6bjtGlhtR0eIiytqEzKHLKblIodicbLzV6vnkNVFhME5IJZiwiXAiROdNpMkimrxzqhSce1bE%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=52963&min_rtt=44963&rtt_var=13382&sent=23&recv=17&lost=0&retrans=0&sent_bytes=11662&recv_bytes=5782&delivery_rate=153635&cwnd=12000&unsent_bytes=0&cid=b8cb5485a5b7503b&ts=129&x=1", cfExtPri, cfHdrFlush;dur=0
date: Sat, 26 Apr 2025 10:48:18 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding
last-modified: Sat, 26 Apr 2025 05:45:44 GMT
priority: u=3,i=?0
cache-control: public, max-age=86400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 936581cccfb4db8d-IST
server: cloudflare

GET
H3 200 jellyfish.js Show response
go.ezodn.com/porpoiseant/ 37 KB
11 KB 56ms
56ms Script
application/javascript 188.114.96.3
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://go.ezodn.com/porpoiseant/jellyfish.js?a=a&cb=17&dcb=195-13&shcb=34
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c710cdd34e668d4b076117de6e491db51bfdb199410738766ebc187cf6bd625c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex
content-encoding: zstd
cf-cache-status: HIT
age: 545474
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=L7i20njft4yba%2FN%2FhFuGOO11XNcVbLDEEELIXTbZ0M%2ByvUcCV9xh5Q%2Biq6m1Nmnb7XD%2Ff6jYJ6Oa%2BL08rboiK%2F%2BdNIRmrvMOnTOt4EEMHq%2B2ULxRVLcIbHgHuwYLzGc%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=54246&min_rtt=44963&rtt_var=12603&sent=32&recv=27&lost=0&retrans=0&sent_bytes=15010&recv_bytes=8867&delivery_rate=100517&cwnd=12000&unsent_bytes=0&cid=b8cb5485a5b7503b&ts=167&x=1", cfExtPri, cfHdrFlush;dur=0
date: Sat, 26 Apr 2025 10:48:18 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding
last-modified: Fri, 28 Mar 2025 04:02:38 GMT
priority: u=3,i=?0
cache-control: public, max-age=31536000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 936581cd0841db8d-IST
server: cloudflare

GET
H3 200 sidebarwall.js Show response
go.ezodn.com/detroitchicago/ 9 KB
3 KB 57ms
57ms Script
application/javascript 188.114.96.3
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://go.ezodn.com/detroitchicago/sidebarwall.js?gcb=13&cb=22
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c46112b521d8782f9ace52b74a86041d1378ad4ce71b94a8e6870f2823cadf94

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex
content-encoding: zstd
cf-cache-status: HIT
age: 616972
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=i0faDJq3qMcAln%2FVgmwpc4PgIsDJ987%2Ftn690lqUh3plPNIsnza84ChsYswgGFcWzy%2BA75P8zRA9q6KA%2FHTNnUAIsqzcQJr2lJvIeGRujbGz4t39vZLD%2FRS%2BS5qS3Do%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=54246&min_rtt=44963&rtt_var=12603&sent=33&recv=27&lost=0&retrans=0&sent_bytes=15726&recv_bytes=8867&delivery_rate=100517&cwnd=12000&unsent_bytes=0&cid=b8cb5485a5b7503b&ts=167&x=1", cfExtPri, cfHdrFlush;dur=0
date: Sat, 26 Apr 2025 10:48:18 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding
last-modified: Sat, 19 Apr 2025 01:02:33 GMT
priority: u=3,i=?0
cache-control: public, max-age=31536000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 936581cd0842db8d-IST
server: cloudflare

GET
H3 200 ezadcreator.js Show response
go.ezodn.com/porpoiseant/ 11 KB
4 KB 59ms
59ms Script
application/javascript 188.114.96.3
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://go.ezodn.com/porpoiseant/ezadcreator.js?gcb=195-13&cb=612
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f211169b2ebf63cf303b0a0164586df2715b16e3adbd75fc2ea4615b459f1d80

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex
content-encoding: zstd
cf-cache-status: HIT
age: 133000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pdz54HCbkbUt3FcpYrKyrwLkMTn5CNCWVYPmyVxOCOg%2F6VpUHKqvUpRE%2BN8BadBJ9PJ94f6wys6%2BWUdVdpOC6D12MOh7Fqh3VIHoy7yfGTIToK5mqGa5TuANKz8K2uA%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=54246&min_rtt=44963&rtt_var=12603&sent=40&recv=27&lost=0&retrans=0&sent_bytes=22585&recv_bytes=8867&delivery_rate=100517&cwnd=12000&unsent_bytes=0&cid=b8cb5485a5b7503b&ts=169&x=1", cfExtPri, cfHdrFlush;dur=2
date: Sat, 26 Apr 2025 10:48:18 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding
last-modified: Thu, 24 Apr 2025 21:51:38 GMT
priority: u=3,i=?0
cache-control: public, max-age=31536000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 936581cd0847db8d-IST
server: cloudflare

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 110 KB
33 KB 205ms
111ms Script
text/javascript 142.250.186.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

e203523351f7a084281207ad35ed6eb81374d000f35b935d63040cff94a75d71

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: br
etag: 44 / 20204 / m202504220101 / config-hash: 18116493962408344416
x-content-type-options: nosniff
expires: Sat, 26 Apr 2025 10:48:18 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Sat, 26 Apr 2025 10:48:18 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 34252
x-xss-protection: 0
server: cafe

GET
H3 200 tuscon.js Show response
go.ezodn.com/detroitchicago/ 7 KB
3 KB 63ms
62ms Script
application/javascript 188.114.96.3
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://go.ezodn.com/detroitchicago/tuscon.js?gcb=13&cb=14
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 50fbbe164918e6fb86e26b49d99c193d1c36ec6bbf9a51b9967ca74f2282ccde

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex
content-encoding: zstd
cf-cache-status: HIT
age: 299910
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ExLiDnCYZ4brMSIorFMK4CoJ%2F4V3M5a6cTNhH3ZNx4gGLAoQbcFFI51cy6rFPeue5Sz7b76oK1M1mqqPFk7apaxw0RMGQL%2Bh3rO3FC%2FfSOuS48Ycfl7SEWKwCw%2BBXfA%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=54246&min_rtt=44963&rtt_var=12603&sent=40&recv=27&lost=0&retrans=0&sent_bytes=22585&recv_bytes=8867&delivery_rate=100517&cwnd=12000&unsent_bytes=0&cid=b8cb5485a5b7503b&ts=168&x=1", cfExtPri, cfHdrFlush;dur=6
date: Sat, 26 Apr 2025 10:48:18 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding
last-modified: Tue, 22 Apr 2025 23:29:13 GMT
priority: u=3,i=?0
cache-control: public, max-age=31536000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 936581cd1849db8d-IST
server: cloudflare

GET
H3 200 kenai.js Show response
go.ezodn.com/detroitchicago/ 8 KB
3 KB 63ms
63ms Script
application/javascript 188.114.96.3
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://go.ezodn.com/detroitchicago/kenai.js?gcb=13&cb=cb9f11341a
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b866d909afc582d7c400417d7bb441cb74d6d297f33a2ad07052a07255f7aa4e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex
content-encoding: zstd
cf-cache-status: HIT
age: 308290
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1ZXLsBbwOFyylLt1zh62%2BdoCKND6g0Wbk8Izl8qb84ewOYkm1hR1lDJrGnY7coSLn4fHdtVxbD6giViaEnqH407qKp1s8mAHFm61gwlb00Jb91tX8%2BOY0v5e0AcDfgU%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=54246&min_rtt=44963&rtt_var=12603&sent=40&recv=27&lost=0&retrans=0&sent_bytes=22585&recv_bytes=8867&delivery_rate=100517&cwnd=12000&unsent_bytes=0&cid=b8cb5485a5b7503b&ts=168&x=1", cfExtPri, cfHdrFlush;dur=6
date: Sat, 26 Apr 2025 10:48:18 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding
last-modified: Tue, 22 Apr 2025 21:09:12 GMT
priority: u=3,i=?0
cache-control: public, max-age=31536000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 936581cd184bdb8d-IST
server: cloudflare

GET
H3 200 portland.js Show response
go.ezodn.com/detroitchicago/ 128 KB
35 KB 99ms
98ms Script
application/javascript 188.114.96.3
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=13&cb=f939edbc27
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 20b06cd91ae1eb1b7a30afb2d6d6255de0cf46aa2d6458401e55819d7aad88b0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex
cache-control: public, max-age=31536000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: zstd
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0O5CBoxmW9i1wQCma2RL89y7TKax3QHb519fXY0IcFZVjxvh6IqS8lpc0UvV3Y7BvQXOBEZBEWE3WeyJ6AFQku2U1OyDBvXFsuqPMyaD0DHbCna%2F%2FrzOLvyLkhCY9sc%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 936581cd184edb8d-IST
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=65113&min_rtt=44963&rtt_var=18428&sent=52&recv=31&lost=0&retrans=0&sent_bytes=30610&recv_bytes=9040&delivery_rate=75916&cwnd=15600&unsent_bytes=0&cid=b8cb5485a5b7503b&ts=209&x=1", cfExtPri, cfHdrFlush;dur=3
date: Sat, 26 Apr 2025 10:48:18 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare
priority: u=3,i=?0

GET
H3 200 dall.js Show response
go.ezodn.com/hb/ 764 KB
251 KB 86ms
85ms Script
application/javascript 188.114.96.3
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://go.ezodn.com/hb/dall.js?cb=195-13-120
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0852600515cbe8f4f936e0344eeace63836dc0fd79c8e1d553fd921e05430128

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cache-control: public, max-age=31536000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: zstd
cf-cache-status: HIT
age: 307755
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FlYNauif6OQf%2FhPFO8kKTopvSg9zzHwUUT0v3rev5k0gzFvTz4pYmy3bjKS3zA3cIungHX3eYGkDuJ9M4PaCWfSr8bbDpYV6RHNwczZVOot3OFznEjzKYcqi15xX%2FMQ%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 936581cd184fdb8d-IST
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=57205&min_rtt=44963&rtt_var=15370&sent=42&recv=28&lost=0&retrans=0&sent_bytes=23754&recv_bytes=8910&delivery_rate=20407&cwnd=12000&unsent_bytes=0&cid=b8cb5485a5b7503b&ts=172&x=1", cfExtPri, cfHdrFlush;dur=28
date: Sat, 26 Apr 2025 10:48:18 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare
last-modified: Tue, 22 Apr 2025 21:16:53 GMT
priority: u=3,i=?0

GET
H3 200 augusta.js Show response
go.ezodn.com/detroitchicago/ 3 KB
2 KB 240ms
239ms Script
application/javascript 188.114.96.3
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://go.ezodn.com/detroitchicago/augusta.js?gcb=195-13&cb=49
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bccb4111eb4c8b10e4cd76ec113f0d8786d91869f5913620ab4d8b7fe4408c44

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex
content-encoding: zstd
cf-cache-status: HIT
age: 545795
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PZ9a1n7fxdtN6N3e2GqHTDOkOYZqXkDLyJPFC%2BGDZSLMr%2FMGM9%2B8SBQiLuuco%2Ft6nYqbZoi%2BvlhHP%2F6MIb0%2Bgrpj0d%2FsorAvgyb0dP2HIh6SCzQaLwF2lfrkGQgCHhU%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=57205&min_rtt=44963&rtt_var=15370&sent=42&recv=28&lost=0&retrans=0&sent_bytes=23754&recv_bytes=8910&delivery_rate=20407&cwnd=12000&unsent_bytes=0&cid=b8cb5485a5b7503b&ts=174&x=1", cfExtPri, cfHdrFlush;dur=38
date: Sat, 26 Apr 2025 10:48:18 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding
last-modified: Wed, 16 Apr 2025 10:56:12 GMT
priority: u=3,i=?0
cache-control: public, max-age=31536000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 936581cd1851db8d-IST
server: cloudflare

GET
H3 200 banger.js Show response
go.ezodn.com/porpoiseant/ 56 KB
16 KB 239ms
238ms Script
application/javascript 188.114.96.3
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://go.ezodn.com/porpoiseant/banger.js?cb=195-13&bv=446&PageSpeed=off
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8a16e1f89f566a4d9144c44c480457b9aeb83827402b2baf9b3baf51ebff2f0e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex
content-encoding: zstd
cf-cache-status: HIT
age: 300963
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FrnRvZj8ZbwmyOz73Zh6byy6%2BFE2%2BnKuHcrymq2Lk8IBUAnFXzXvQrZBeWhwMIS1CloxJVcT7HPVqzrVGDVeLIEYWLMP3%2FAOQ7IA2DuKMsGmakjuZrtr53UEU%2FSlvWg%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=57205&min_rtt=44963&rtt_var=15370&sent=42&recv=28&lost=0&retrans=0&sent_bytes=23754&recv_bytes=8910&delivery_rate=20407&cwnd=12000&unsent_bytes=0&cid=b8cb5485a5b7503b&ts=172&x=1", cfExtPri, cfHdrFlush;dur=40
date: Sat, 26 Apr 2025 10:48:18 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding
last-modified: Tue, 22 Apr 2025 23:11:40 GMT
priority: u=3,i=?0
cache-control: public, max-age=31536000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 936581cd1859db8d-IST
server: cloudflare

GET
H2 200 21150.js Show response
link.rubiconproject.com/magnite/ 2 KB
821 B 269ms
80ms Script
text/javascript 184.30.26.29
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://link.rubiconproject.com/magnite/21150.js
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.30.26.29 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-26-29.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) PHP/8.3.19 OpenSSL/3.0.15 / PHP/8.3.19
Resource Hash: 2588095be4106a2ae22605a31874b4da0a3ca9e895d52be5d95ff08ea07685a8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cache-control: max-age=29056
content-encoding: gzip
expires: Sat, 26 Apr 2025 18:52:34 GMT
content-length: 602
date: Sat, 26 Apr 2025 10:48:18 GMT
last-modified: Fri, 25 Apr 2025 17:08:54 GMT
x-powered-by: PHP/8.3.19
server: Apache/2.4.62 (Debian) PHP/8.3.19 OpenSSL/3.0.15
content-type: text/javascript;charset=UTF-8
vary: Accept-Encoding

GET
H3 200 ezadloadhb.js Show response
go.ezodn.com/porpoiseant/ 25 KB
8 KB 238ms
238ms Script
application/javascript 188.114.96.3
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://go.ezodn.com/porpoiseant/ezadloadhb.js?gcb=195-13&cb=612
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6cf6a5393ba05e0dcf96520ea3e10986184c04140346e3962cd20a0a88c150e3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex
content-encoding: zstd
cf-cache-status: HIT
age: 133017
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qFrH%2BJgIL8l19AZHqVlj%2FQgWWeREx7c7kgVye9JWs4VpUPsjE6q2KLhCZw6BacvudaD2i4OvFQZ5gUaxoqGboddLeQBUPMCgzZT%2FXDOa9zgoez%2BpCBvpi8FyWimLrmw%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=54246&min_rtt=44963&rtt_var=12603&sent=40&recv=27&lost=0&retrans=0&sent_bytes=22585&recv_bytes=8867&delivery_rate=100517&cwnd=12000&unsent_bytes=0&cid=b8cb5485a5b7503b&ts=171&x=1", cfExtPri, cfHdrFlush;dur=41
date: Sat, 26 Apr 2025 10:48:18 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding
last-modified: Thu, 24 Apr 2025 21:51:13 GMT
priority: u=3,i=?0
cache-control: public, max-age=31536000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 936581cd185ddb8d-IST
server: cloudflare

POST
H3 200 936581c26ea5bd5c Show response
www.mediafire.com/cdn-cgi/challenge-platform/h/g/jsd/r/0.5463814849181322:1745663017:kcBlA9NAiiU_a5INrBs1Vu_sZUFZW-5Yxl4rqiDGzqE/ Frame 2964 0
574 B 58ms
51ms XHR
text/plain 104.17.150.117
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://www.mediafire.com/cdn-cgi/challenge-platform/h/g/jsd/r/0.5463814849181322:1745663017:kcBlA9NAiiU_a5INrBs1Vu_sZUFZW-5Yxl4rqiDGzqE/936581c26ea5bd5c
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.150.117 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer

Response headers

cf-ray: 936581cd6f60bd5c-IST
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
content-length: 0
date: Sat, 26 Apr 2025 10:48:18 GMT
content-type: text/plain; charset=UTF-8
server: cloudflare
priority: u=1,i

POST
H2 200 analytics Show response
g.ezoic.net/ezais/ 14 KB
4 KB 211ms
144ms Fetch
text/plain 52.57.221.121
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/ezais/analytics?cb=1
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/ezoicanalytics.js?cb=1&dcb=195-13&shcb=34
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.57.221.121 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-57-221-121.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 1ec8d6434ddffa8344c2927b90398dc5e02475eead44b7f9d9902d7acafb1a02

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex
access-control-max-age: 1728000
content-encoding: br
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, PUT, OPTIONS
access-control-allow-origin: https://www.mediafire.com
date: Sat, 26 Apr 2025 10:48:18 GMT
content-type: text/plain; charset=utf-8
vary: Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
access-control-allow-headers: Content-Type

POST
H2 204 collect
analytics.google.com/g/ 0
0 259ms
87ms Fetch
text/plain 216.58.212.174
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-K68XP6D85D&gtm=45je54n0v887485693z86304663za200zb6304663&_p=1745664498043&_gaz=1&gcs=G111&gcd=13n3n3l3l5l1&npa=0&dma=0&tag_exp=102887800~103051953~103077950~103106314~103106316~103116025~103130360~103130362~103200001&ptag_exp=102887800~103051953~103077950~103106314~103106316~103116025~103130360~103130362~103200001&cid=128592636.1745664499&ul=tr-tr&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&pae=1&frm=0&pscdl=noapi&_s=1&sid=1745664498&sct=1&seg=0&dl=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F0z4njtfe7z5sca3%2FEX13_RP8-FP.rar%2Ffile&dt=EX13_RP8-FP&en=page_view&_fv=1&_nsi=1&_ss=1&up.page_url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F0z4njtfe7z5sca3%2FEX13_RP8-FP.rar%2Ffile&tfd=1916
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-K68XP6D85D&l=dataLayer&cx=c&gtm=45He54n0v6304663za200&tag_exp=102887800~103051953~103077950~103106314~103106316~103116025~103130360~103130362~103200001
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 216.58.212.174 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: ams15s22-in-f174.1e100.net
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:153:0
report-to: {"group":"ascnsrsggc:153:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:153:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.mediafire.com
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:153:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 26 Apr 2025 10:48:19 GMT
content-type: text/plain
server: Golfe2

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
549 B 276ms
90ms Ping
text/plain 173.194.76.156
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-K68XP6D85D&cid=128592636.1745664499&gtm=45je54n0v887485693z86304663za200zb6304663&aip=1&dma=0&gcs=G111&gcd=13n3n3l3l5l1&npa=0&frm=0&tag_exp=102887800~103051953~103077950~103106314~103106316~103116025~103130360~103130362~103200001&ptag_exp=102887800~103051953~103077950~103106314~103106316~103116025~103130360~103130362~103200001
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-K68XP6D85D&l=dataLayer&cx=c&gtm=45He54n0v6304663za200&tag_exp=102887800~103051953~103077950~103106314~103106316~103116025~103130360~103130362~103200001
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 173.194.76.156 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: ws-in-f156.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:122:0
report-to: {"group":"ascnsrsggc:122:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:122:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.mediafire.com
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:122:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 26 Apr 2025 10:48:19 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 ga-audiences
www.google.com.tr/ads/ 42 B
408 B 316ms
117ms Image
image/gif 172.217.18.3
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://www.google.com.tr/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-K68XP6D85D&cid=128592636.1745664499&gtm=45je54n0v887485693z86304663za200zb6304663&aip=1&dma=0&gcs=G111&gcd=13n3n3l3l5l1&npa=0&frm=0&tag_exp=102887800~103051953~103077950~103106314~103106316~103116025~103130360~103130362~103200001&ptag_exp=102887800~103051953~103077950~103106314~103106316~103116025~103130360~103130362~103200001&tag_exp=102887800~103051953~103077950~103106314~103106316~103116025~103130360~103130362~103200001&ptag_exp=102887800~103051953~103077950~103106314~103106316~103116025~103130360~103130362~103200001&z=1412069550

Requested by

Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.3 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s22-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Sat, 26 Apr 2025 10:48:19 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 indy.js Show response
go.ezodn.com/detroitchicago/ 168 KB
43 KB 78ms
78ms Script
application/javascript 188.114.96.3
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://go.ezodn.com/detroitchicago/indy.js?cb=36&gcb=0
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8787abba1a566d5492523a12b1a7f8927db9296e83ad14efe3acd1a07037cf19

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex
content-encoding: zstd
cf-cache-status: HIT
age: 315893
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ak9zDQ0pfDhICtgvekb5eY3qFRhJF3lnl3Z%2B0xcnI3sCdd1MBL3lXXiBI6Fg9aPC08pgdm4t7U6FWOh7Z2%2F2bi5Nv0q5q58jyhKkroqEutOr7d338ltqNr1Uv8jVqDA%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=50874&min_rtt=44626&rtt_var=3410&sent=221&recv=72&lost=0&retrans=0&sent_bytes=217846&recv_bytes=11105&delivery_rate=1058266&cwnd=103200&unsent_bytes=0&cid=b8cb5485a5b7503b&ts=331&x=1", cfExtPri, cfHdrFlush;dur=13
date: Sat, 26 Apr 2025 10:48:18 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding
last-modified: Sat, 19 Apr 2025 01:06:10 GMT
priority: u=3,i=?0
cache-control: public, max-age=31536000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 936581ce1ae8db8d-IST
server: cloudflare

GET
H3 200 ezjitpos.js Show response
go.ezodn.com/porpoiseant/ 4 KB
2 KB 56ms
56ms Script
application/javascript 188.114.96.3
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://go.ezodn.com/porpoiseant/ezjitpos.js?gcb=195-13&cb=612
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d34364518d1fdc1b69ba193a0593a933aac3cc1327f6d36f87f5da9052caf62b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex
content-encoding: zstd
cf-cache-status: HIT
age: 133017
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mrfmwRCxk1byGhidOlo3kVOd41bmNDGgt0v7twS392LU5Iu%2BQsszMytCD6ZlIcp2UsCV1c0bGT4fFLiyphyJoJwgDXHiJ07nRkn2J%2BVU3Pt5xS05VyuilQs3%2Bdc9RAw%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=47163&min_rtt=44626&rtt_var=2749&sent=389&recv=82&lost=0&retrans=0&sent_bytes=412881&recv_bytes=11819&delivery_rate=1663103&cwnd=199200&unsent_bytes=0&cid=b8cb5485a5b7503b&ts=372&x=1", cfExtPri, cfHdrFlush;dur=0
date: Sat, 26 Apr 2025 10:48:18 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding
last-modified: Thu, 24 Apr 2025 21:51:21 GMT
priority: u=3,i=?0
cache-control: public, max-age=31536000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 936581ce5bb5db8d-IST
server: cloudflare

POST
H2 200 collect Show response
www.google-analytics.com/j/ 1 B
451 B 87ms
86ms XHR
text/plain 172.217.16.142
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1572878818&t=pageview&_s=1&dl=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F0z4njtfe7z5sca3%2FEX13_RP8-FP.rar%2Ffile&ul=tr-tr&de=UTF-8&dt=EX13_RP8-FP&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAUABAAAAACAAI~&jid=1305131620&gjid=1525299093&cid=128592636.1745664499&tid=UA-829541-1&_gid=683673704.1745664499&_r=1&gtm=457e54n0za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=102887800~103051953~103071290~103077950~103106314~103106316~103116025~103130360~103130362~103200001&cd1=unregistered&cd7=legacy&cd3=archive&cd4=59&cd5=rar&cd8=%2F20%2F50%2F100%2F&jsscut=1&z=163846948

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.142 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://www.mediafire.com/

Response headers

report-to: {"group":"ascnsrsgac:175:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:175:0"}],}
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 26 Apr 2025 10:48:18 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: text/plain
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:175:0
access-control-allow-origin: https://www.mediafire.com
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsgac:175:0
content-length: 1
server: Golfe2

OPTIONS
H3 200 /
bshr.ezodn.com/ Frame 0
0 152ms
91ms Preflight 188.114.97.3
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://bshr.ezodn.com/?bf=30000&dc=1254144
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-pingback
Access-Control-Request-Method: GET
Origin: https://www.mediafire.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type,x-pingback
access-control-allow-methods: GET, POST, PUT, OPTIONS
access-control-allow-origin: https://www.mediafire.com
access-control-max-age: 1728000
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 936581cf0f735b08-IST
content-length: 0
date: Sat, 26 Apr 2025 10:48:19 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
priority: u=1,i
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gIHipUaLHw%2Bi2sOy%2BA5OG3fWXvFc2o%2Bv1k1MuXuUhcf8PZ5745ZHP4sA9wfk2aV5UWlP24vLDRBBSqVIkurhKeFo3WHXoiV5bn%2F%2BSSkpE%2Bygc6qVf68Gy5DPcQgCVui3Aw%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfL4;desc="?proto=QUIC&rtt=45014&min_rtt=44960&rtt_var=9584&sent=11&recv=9&lost=0&retrans=0&sent_bytes=4125&recv_bytes=4404&delivery_rate=13056&cwnd=12000&unsent_bytes=0&cid=e65228bfa7d36dc3&ts=97&x=1" cfExtPri cfHdrFlush;dur=0
vary: Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers

GET
H3 200 nmash.js Show response
go.ezodn.com/porpoiseant/ 65 KB
24 KB 56ms
56ms Script
application/javascript 188.114.96.3
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://go.ezodn.com/porpoiseant/nmash.js?bv=446
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/porpoiseant/banger.js?cb=195-13&bv=446&PageSpeed=off
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 14bca899e1d5bbb4c331967a0772e0071cb7c16f19eb8e0aa350bf79dc2346d6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex
content-encoding: zstd
cf-cache-status: HIT
age: 301009
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2oDo6g%2Bqka4CVophzuHtN042Szc%2BDQEYoE3qYm9EsULxL7IJAFZMKEwT76Jdc0ASy5QOZvOnv9Wo%2FPj5H1jYHHVT4%2Bup4YSikKAZZFaSvnnORsiW6aU6k7Ow5W2BhZs%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=45345&min_rtt=44590&rtt_var=421&sent=394&recv=99&lost=0&retrans=0&sent_bytes=415248&recv_bytes=12844&delivery_rate=4266306&cwnd=199200&unsent_bytes=0&cid=b8cb5485a5b7503b&ts=421&x=1", cfExtPri, cfHdrFlush;dur=0
date: Sat, 26 Apr 2025 10:48:18 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding
last-modified: Tue, 22 Apr 2025 23:11:23 GMT
priority: u=3,i=?0
cache-control: public, max-age=31536000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 936581ceac65db8d-IST
server: cloudflare

GET
H3 200 / Show response
bshr.ezodn.com/ 5 KB
3 KB 55ms
55ms XHR
application/json 188.114.97.3
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://bshr.ezodn.com/?bf=30000&dc=1254144
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/porpoiseant/banger.js?cb=195-13&bv=446&PageSpeed=off
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7a3d8e2d5b065e99d9780a4627cc5922132af4a67de8c2fbafa811e131769846

Request headers

Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: application/json
X-PINGBACK: pingpong

Response headers

access-control-max-age: 1728000
content-encoding: zstd
cf-cache-status: HIT
age: 308249
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AxiBaq7BTd3hI62X8qt%2F8AmeNwI5starejzVfCTFe5oMH%2Bwor3ofntzi%2F9dgKfhBPc6fORCAaJWrg6FFgTDhsEaNYiyHsVdOw5meA5fP2SiBsxNCvdFNwEUQ27nPWCSj5g%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET, POST, PUT, OPTIONS
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=45054&min_rtt=44960&rtt_var=7267&sent=13&recv=11&lost=0&retrans=0&sent_bytes=4964&recv_bytes=4783&delivery_rate=18572&cwnd=12000&unsent_bytes=0&cid=e65228bfa7d36dc3&ts=152&x=1", cfExtPri, cfHdrFlush;dur=0
date: Sat, 26 Apr 2025 10:48:19 GMT
content-type: application/json; charset=utf8
vary: Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
priority: u=1,i
access-control-allow-headers: Content-Type
last-modified: Tue, 22 Apr 2025 21:09:11 GMT
cache-control: public, max-age=1209600
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 936581cf98755b08-IST
access-control-allow-origin: https://www.mediafire.com
server: cloudflare

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 262ms
85ms Preflight
application/json 178.250.1.11
ASN-CRITEO-EUROPE...

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.mediafire.com%2F&domain=www.mediafire.com&cw=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.11 , France, ASN44788 (ASN-CRITEO-EUROPE Criteo Technology SAS, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://www.mediafire.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://www.mediafire.com
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Sat, 26 Apr 2025 10:48:19 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 245542
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 envelope Show response
lexicon.33across.com/v1/ 49 B
251 B 293ms
175ms Fetch
application/json 35.244.193.51
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0010b00002MpnPqAAJ&gdpr=0&src=pbjs&ver=9.37.0&coppa=0
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-13-120
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.193.51 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 51.193.244.35.bc.googleusercontent.com
Software: /
Resource Hash: d0d2e098cd489ef7bc528c86de8ab5c51b5d6cdf9b76a8b08766036992f0d2f4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.mediafire.com/

Response headers

cache-control: private, must-revalidate, max-age=28800
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://www.mediafire.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49
date: Sat, 26 Apr 2025 10:48:19 GMT
content-type: application/json
vary: origin

GET
H/1.1

200
OK

set Show response
id.a-mx.com/
Redirect Chain

https://id.a-mx.com/sync/?tagId=&ref=null&u=https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file&tl=https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file&nf=0&rt=true&v...
https://c3.a-mo.net/b?uid=d7dd4e2b-7034-4838-9ffb-9b09dcd4709a&sh=id.a-mx.com&
https://id.a-mx.com/set?oid=d7dd4e2b-7034-4838-9ffb-9b09dcd4709a&uid=d7dd4e2b-7034-4838-9ffb-9b09dcd4709a&

99 B
960 B

89ms
89ms

Fetch
application/json

79.127.216.47
CDN77 Datacamp Li...

General

Check archive.org

Download Go to

Full URL: https://id.a-mx.com/set?oid=d7dd4e2b-7034-4838-9ffb-9b09dcd4709a&uid=d7dd4e2b-7034-4838-9ffb-9b09dcd4709a&
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: HTTP/1.1
Server: 79.127.216.47 Frankfurt am Main, Germany, ASN60068 (CDN77 Datacamp Limited, GB),
Reverse DNS: unn-79-127-216-47.datapacket.com
Software: /
Resource Hash: d4e7fddec4f3b06b74237a4e12177dd8d5ca5e9e6775de5dbbb830f1fe407398

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

access-control-allow-origin: null
content-length: 99
date: Sat, 26 Apr 2025 12:48:19 +0200
content-type: application/json
access-control-allow-credentials: true

Redirect headers

access-control-allow-origin: null
location: https://id.a-mx.com/set?oid=d7dd4e2b-7034-4838-9ffb-9b09dcd4709a&uid=d7dd4e2b-7034-4838-9ffb-9b09dcd4709a&
content-length: 0
date: Sat, 26 Apr 2025 10:48:18 GMT
access-control-allow-credentials: true

GET
H2 400 fed Show response
ups.analytics.yahoo.com/ups/58713/ 0
391 B 297ms
126ms Fetch
application/json 87.248.119.251
YAHOO-DEB Yahoo-U...

General

Check archive.org

Download Go to

Full URL

https://ups.analytics.yahoo.com/ups/58713/fed?v=1&1p=0&gdpr=0&gdpr_consent=&us_privacy=&url=https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file&pixelId=58713

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-13-120

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

87.248.119.251 , United Kingdom, ASN203220 (YAHOO-DEB Yahoo-UK Limited, GB),

Reverse DNS

e1-bmr.ycpi.vip.deb.yahoo.com

Software

ATS /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.mediafire.com/

Response headers

strict-transport-security: max-age=31536000
age: 0
access-control-allow-credentials: true
referrer-policy: no-referrer-when-downgrade
access-control-allow-origin: https://www.mediafire.com
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Sat, 26 Apr 2025 10:48:19 GMT
content-type: application/json
vary: Origin
server: ATS

GET
H2 200 json Show response
gum.criteo.com/sid/ 364 B
949 B 256ms
87ms Fetch
application/json 178.250.1.11
ASN-CRITEO-EUROPE...

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.mediafire.com%2F&domain=www.mediafire.com&cw=1&lsw=1

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-13-120

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.11 , France, ASN44788 (ASN-CRITEO-EUROPE Criteo Technology SAS, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

30cf1059a83ec858f901696eae5bd84fcf7dbc39123879b45ba4090180b05728

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: application/json
Referer: https://www.mediafire.com/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 487953
expires: 0
access-control-allow-origin: https://www.mediafire.com
date: Sat, 26 Apr 2025 10:48:18 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

GET
H2 200 pbhid Show response
id.hadron.ad.gt/api/v1/ 2 B
271 B 412ms
299ms Fetch
application/json 104.22.4.69
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://id.hadron.ad.gt/api/v1/pbhid?partner_id=524&_it=prebid&t=1&src=id&domain=www.mediafire.com
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-13-120
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.22.4.69 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.mediafire.com/

Response headers

cache-control: max-age=604800
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
access-control-allow-methods: HEAD,GET,POST,PUT,DELETE,OPTIONS
cf-ray: 936581cfde0df26b-IST
access-control-allow-origin: *
content-length: 2
date: Sat, 26 Apr 2025 10:48:19 GMT
content-type: application/json; charset=utf8
server: cloudflare
access-control-allow-headers: authorization,content-type

POST
H2 200 prebid Show response
id5-sync.com/api/config/ 194 B
666 B 251ms
81ms Fetch
application/json 141.95.98.65
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-13-120

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.65 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ns3216659.ip-141-95-98.eu

Software

Resource Hash

446a24acf9272b37cf14bf847684201154b6648113a148f1381b7489db6294f3

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://www.mediafire.com/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://www.mediafire.com
p3p: CP="CAO PSA OUR"
date: Sat, 26 Apr 2025 10:48:18 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
access-control-allow-credentials: true

GET
H2 451 envelope Show response
api.rlcdn.com/api/identity/ 0
254 B 212ms
94ms Fetch 34.120.133.55
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://api.rlcdn.com/api/identity/envelope?pid=14067
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-13-120
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.133.55 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 55.133.120.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.mediafire.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, OPTIONS
via: 1.1 google
access-control-allow-origin: https://www.mediafire.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Sat, 26 Apr 2025 10:48:19 GMT
access-control-allow-headers: Accept, Authorization, Content-Type, Cookie, Origin, X-Requested-With

GET
H2 200 id Show response
id.crwdcntrl.net/ 152 B
859 B 348ms
123ms Fetch
application/json 54.194.27.185
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://id.crwdcntrl.net/id
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-13-120
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.194.27.185 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-194-27-185.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: f7e685306e459b623f2f80ff3672d84ab2d5f5b362c881ea6ce8d8577074a9b9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.mediafire.com/

Response headers

cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://www.mediafire.com
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 152
date: Sat, 26 Apr 2025 10:48:19 GMT
content-type: application/json;charset=utf-8

GET
H2 200 rid Show response
match.adsrvr.org/track/ 63 B
438 B 339ms
111ms Fetch
application/json 35.71.131.137
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://match.adsrvr.org/track/rid?ttd_pid=muno13d&fmt=json
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-13-120
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.71.131.137 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 91fcf8f726654f0d20fa8c4b2b7ce9d14f7dabc3d0ee429f3a3e3c63130ce81f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.mediafire.com/

Response headers

cache-control: private
content-encoding: gzip
access-control-allow-credentials: true
expires: Mon, 26 May 2025 10:48:19 GMT
access-control-allow-origin: https://www.mediafire.com
date: Sat, 26 Apr 2025 10:48:19 GMT
content-type: application/json
vary: Origin, Accept-Encoding
server: Kestrel
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept, x-integration-type

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504220101/ 529 KB
167 KB 91ms
91ms Script
text/javascript 142.250.186.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504220101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

0a18f1d1a038a61a76a04b783020b0f52bcd997b4b83015b566a8f3e9093c2e1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: br
etag: 4745022393092336697
age: 17845
x-content-type-options: nosniff
expires: Sun, 26 Apr 2026 05:50:54 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Sat, 26 Apr 2025 05:50:54 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 170786
x-xss-protection: 0
server: cafe

GET
H2 200 script Show response
carbon-cdn.ccgateway.net/ 31 KB
8 KB 537ms
172ms Script
text/javascript 3.237.175.195
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://carbon-cdn.ccgateway.net/script?id=www.mediafire.com&parentId=0dae949f4b
Requested by: Host: link.rubiconproject.com
URL: https://link.rubiconproject.com/magnite/21150.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.237.175.195 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-237-175-195.compute-1.amazonaws.com
Software: /
Resource Hash: 3aae934f52b6e8e431ea4255052e857321c8dc97241ff0c5ca2ce11ec8204bc0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cache-control: private,max-age=900
content-encoding: gzip
date: Sat, 26 Apr 2025 10:48:19 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
DATA 200
OK truncated Show response
/ Frame EB1C 2 KB
2 KB Document
text/html

General

Check archive.org

Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9c5b591f10c8fb4d85649e71bdc40e72a316fdceb1aab3ce125ac064ffa5f6e3

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

Content-Type: text/html;charset=UTF-8

GET
H3 200 24px.svg
fonts.gstatic.com/s/i/productlogos/translate/v14/ 6 KB
3 KB 193ms
91ms Image
image/svg+xml 142.250.185.163
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://fonts.gstatic.com/s/i/productlogos/translate/v14/24px.svg

Requested by

Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f3.1e100.net

Software

sffe /

Resource Hash

ab5c23a05e39deed14d9d8262b0dce9f024f86105a27196cad37d14a3f516e09

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
age: 268224
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Thu, 23 Apr 2026 08:17:55 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 23 Apr 2025 08:17:55 GMT
last-modified: Wed, 20 Apr 2022 14:24:23 GMT
content-type: image/svg+xml
vary: Accept-Encoding
cache-control: public, max-age=31536000
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 3340
x-xss-protection: 0
server: sffe

GET
H2 200 googlelogo_color_42x16dp.png
www.gstatic.com/images/branding/googlelogo/1x/ 910 B
1 KB 81ms
80ms Image
image/png 142.250.181.227
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://www.gstatic.com/images/branding/googlelogo/1x/googlelogo_color_42x16dp.png

Requested by

Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.227 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f3.1e100.net

Software

sffe /

Resource Hash

6318394f737c66f0e2ccfcd88e3935c6667633a1b95fa29fba2b75431d55eef2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

age: 17207
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
x-content-type-options: nosniff
expires: Sun, 26 Apr 2026 06:01:32 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 26 Apr 2025 06:01:32 GMT
last-modified: Thu, 02 Nov 2023 22:48:00 GMT
content-type: image/png
vary: Origin
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
content-length: 910
x-xss-protection: 0
server: sffe

GET
H2 200 translate_24dp.png
www.gstatic.com/images/branding/product/2x/ 2 KB
2 KB 80ms
79ms Image
image/png 142.250.181.227
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://www.gstatic.com/images/branding/product/2x/translate_24dp.png

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.NJgGN_yGIWM.L.W.O/am=AAY/d=0/rs=AN8SPfrTSMIvWAFISYN4u74dPJrX0HgUsw/m=el_main_css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.227 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f3.1e100.net

Software

sffe /

Resource Hash

4dac0026fbfa2615dce30c0af12830863fe885f84387a0147b9e338f548d5d82

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.NJgGN_yGIWM.L.W.O/am=AAY/d=0/rs=AN8SPfrTSMIvWAFISYN4u74dPJrX0HgUsw/m=el_main_css

Response headers

age: 49244
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
x-content-type-options: nosniff
expires: Sat, 25 Apr 2026 21:07:35 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 25 Apr 2025 21:07:35 GMT
last-modified: Thu, 14 Oct 2021 09:08:00 GMT
content-type: image/png
vary: Origin
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
content-length: 1842
x-xss-protection: 0
server: sffe

GET
H2 200 boise.js Show response
g.ezoic.net/detroitchicago/ 824 B
549 B 81ms
80ms Script
application/javascript 52.57.221.121
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/detroitchicago/boise.js?gcb=195-13&cb=5
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.57.221.121 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-57-221-121.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: a4fafcd389d58bbd82e49d9a68e81e9dc8384330ff14ec3283a4d0d11812047b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex
cache-control: max-age=31536000, public
content-encoding: br
content-length: 426
date: Sat, 26 Apr 2025 10:48:19 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding

GET
H2 200 abilene.js Show response
g.ezoic.net/parsonsmaize/ 11 KB
4 KB 86ms
84ms Script
application/javascript 52.57.221.121
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/parsonsmaize/abilene.js?gcb=195-13&cb=dc112bb7ea
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.57.221.121 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-57-221-121.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: f1c02e9ba02a159b34fc2d7d2be0a743b497a6cd0a422a0c3acc88b871b2af96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex
cache-control: max-age=31536000, public
content-encoding: br
date: Sat, 26 Apr 2025 10:48:19 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding

GET
H2 200 et.js Show response
g.ezoic.net/porpoiseant/ 1 KB
602 B 82ms
81ms Script
application/javascript 52.57.221.121
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/porpoiseant/et.js?gcb=195-13&cb=3
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.57.221.121 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-57-221-121.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 0f67393986c012dbf48aa3149e2874bd84ed5f466362ad1ac31305f697f1da7b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex
cache-control: max-age=31536000, public
content-encoding: br
content-length: 571
date: Sat, 26 Apr 2025 10:48:19 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding

GET
H2 200 drake.js Show response
g.ezoic.net/beardeddragon/ 4 KB
1 KB 84ms
83ms Script
application/javascript 52.57.221.121
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/beardeddragon/drake.js?gcb=13&cb=1b0a0a9dcc
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.57.221.121 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-57-221-121.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: a5e87590d9232e0b0be4c640eeb47cb4f4299af754f195c802d49fe380ea1870

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex
cache-control: max-age=31536000, public
content-encoding: br
date: Sat, 26 Apr 2025 10:48:19 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding

GET
H2 200 jellyfish.js Show response
g.ezoic.net/porpoiseant/ 37 KB
9 KB 118ms
117ms Script
application/javascript 52.57.221.121
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/porpoiseant/jellyfish.js?a=a&cb=17&dcb=195-13&shcb=34
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.57.221.121 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-57-221-121.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: c710cdd34e668d4b076117de6e491db51bfdb199410738766ebc187cf6bd625c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex
cache-control: max-age=31536000, public
content-encoding: br
date: Sat, 26 Apr 2025 10:48:19 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding

GET 0
www.mediafiredls.com/onclick/ 0
0

GET
H3 200 gpt
securepubads.g.doubleclick.net/pagead/managed/dict/m202504240101/ 63 KB
23 KB 100ms
99ms Other
text/plain 142.250.186.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/dict/m202504240101/gpt

Requested by

Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

02b8824bd47ff5abde631d5dad8206e74bf7aea212f3873eda3c9dfb37d1fcea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 17736166072191226177
age: 2350
x-content-type-options: nosniff
expires: Sat, 03 May 2025 10:09:09 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Sat, 26 Apr 2025 10:09:09 GMT
content-type: text/plain; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=604800, stale-while-revalidate=7200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 23361
x-xss-protection: 0
server: cafe
use-as-dictionary: match="/gampad/ads", id="m202504240101"

GET
H2 200 mulvane.js Show response
g.ezoic.net/parsonsmaize/ 1 KB
552 B 82ms
81ms Script
application/javascript 52.57.221.121
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/parsonsmaize/mulvane.js?gcb=195-13&cb=e75e48eec0
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.57.221.121 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-57-221-121.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 9b41253384e2818bd0f76171d6ffd723d4c85c5e1a69da74f174489cb52a40ce

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex
cache-control: max-age=31536000, public
content-encoding: br
content-length: 522
date: Sat, 26 Apr 2025 10:48:19 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding

GET
H2 200 birmingham.js Show response
g.ezoic.net/detroitchicago/ 752 B
411 B 87ms
87ms Script
application/javascript 52.57.221.121
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/detroitchicago/birmingham.js?gcb=195-13&cb=539c47377c
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.57.221.121 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-57-221-121.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 30be558393bd8b0585c806a6eaed6d6f5b51d1ca63c0113061dfe35eaa128ce3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex
cache-control: max-age=31536000, public
content-encoding: br
content-length: 380
date: Sat, 26 Apr 2025 10:48:19 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding

GET
H2 200 reno.js Show response
g.ezoic.net/detroitchicago/ 1 KB
557 B 85ms
84ms Script
application/javascript 52.57.221.121
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/detroitchicago/reno.js?gcb=195-13&cb=3
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.57.221.121 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-57-221-121.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: a285bc82f73dbd55244657449b4d9b2ecae8b2ea622d5558432bc818bb847df2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex
cache-control: max-age=31536000, public
content-encoding: br
content-length: 526
date: Sat, 26 Apr 2025 10:48:19 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding

GET
H2 200 overlandpark.js Show response
g.ezoic.net/detroitchicago/ 1 KB
519 B 83ms
83ms Script
application/javascript 52.57.221.121
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/detroitchicago/overlandpark.js?gcb=195-13&cb=301bbdaf04
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.57.221.121 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-57-221-121.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 8b3a000db28359e0512e1484988806b9cdaeb457e29ef6b82bfe097e6eed3231

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex
cache-control: max-age=31536000, public
content-encoding: br
content-length: 488
date: Sat, 26 Apr 2025 10:48:19 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding

GET
H2 200 wichita.js Show response
g.ezoic.net/detroitchicago/ 2 KB
953 B 84ms
84ms Script
application/javascript 52.57.221.121
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/detroitchicago/wichita.js?gcb=195-13&cb=9f9286e31b
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.57.221.121 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-57-221-121.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 53731718ab10d0a5e783bd3eaef381aa420a233d429903bcde616619e25d330b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex
cache-control: max-age=31536000, public
content-encoding: br
date: Sat, 26 Apr 2025 10:48:19 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding

GET
H2 200 raleigh.js Show response
g.ezoic.net/detroitchicago/ 1 KB
673 B 81ms
81ms Script
application/javascript 52.57.221.121
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/detroitchicago/raleigh.js?gcb=195-13&cb=8
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.57.221.121 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-57-221-121.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: dcfeafb915fb5e0eaf4cce1e3abf6eeace381b5926e07261cbceffc30fa4e699

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex
cache-control: max-age=31536000, public
content-encoding: br
content-length: 642
date: Sat, 26 Apr 2025 10:48:19 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding

GET
H2 200 vista.js Show response
g.ezoic.net/detroitchicago/ 705 B
401 B 83ms
83ms Script
application/javascript 52.57.221.121
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/detroitchicago/vista.js?gcb=195-13&cb=296945a885
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.57.221.121 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-57-221-121.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: bdb45214f548d4da3ec07c07d9f6f92f2fbff7d1ccefee55631d31729cf02a30

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex
cache-control: max-age=31536000, public
content-encoding: br
content-length: 370
date: Sat, 26 Apr 2025 10:48:19 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
289 B 255ms
81ms Fetch
application/json 141.95.98.64
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-13-120

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.64 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ns3216658.ip-141-95-98.eu

Software

Resource Hash

49d11f0270bb45cc7220ec668b5a6fbcda43a50dc207a2eeccd85e28802ebdbd

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://www.mediafire.com
date: Sat, 26 Apr 2025 10:48:18 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H2 200 olathe.js Show response
g.ezoic.net/parsonsmaize/ 2 KB
897 B 84ms
80ms Script
application/javascript 52.57.221.121
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/parsonsmaize/olathe.js?gcb=195-13&cb=26
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.57.221.121 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-57-221-121.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 3cefef7fc952707c97375ef3fa95a8c45a96eda7845d02bc1c28bf3570c0cfba

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex
cache-control: max-age=31536000, public
content-encoding: br
date: Sat, 26 Apr 2025 10:48:19 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding

GET
H2 200 vitals.js Show response
g.ezoic.net/tardisrocinante/ 11 KB
4 KB 85ms
82ms Script
application/javascript 52.57.221.121
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/tardisrocinante/vitals.js?gcb=13&cb=5
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.57.221.121 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-57-221-121.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 6fca1361d81b8d8d05afbe947e257aef026891372b45e0d2de123a907a4ed1af

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex
cache-control: max-age=31536000, public
content-encoding: br
date: Sat, 26 Apr 2025 10:48:19 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding

GET
H2 200 chanute.js Show response
g.ezoic.net/parsonsmaize/ 20 KB
5 KB 86ms
83ms Script
application/javascript 52.57.221.121
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/parsonsmaize/chanute.js?a=a&cb=16&dcb=195-13&shcb=34
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.57.221.121 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-57-221-121.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 45fd2ba3960eed5c593360163563e703c8c333d4be5736119d53b84d666783ef

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex
cache-control: max-age=31536000, public
content-encoding: br
date: Sat, 26 Apr 2025 10:48:19 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding

GET
H2 200 183096492 Show response
fundingchoicesmessages.google.com/i/ 200 KB
65 KB 133ms
113ms Script
application/javascript 142.250.184.206
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/183096492?ers=3

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504220101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.206 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f14.1e100.net

Software

ESF /

Resource Hash

efb586bd61746a6503d4119a609a833c29e1c218076bd50343f27a38adc62919

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-qLLSZQ11hMlkED-TomejGA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 26 Apr 2025 10:48:19 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjStDikmLw1JBiaL15jnUqEButPc_qBMSGCpdYHYH4_rpLrM-B-EP9ZdYfQFwkcYW1CYg_Vd1gFaq-wRqbdpM1FYh7995kvXHkJuuajbdYtwBxk_Zt1i4gFuLh-Px50wE2gYYXZx4zKmkk5RfGJ-fnlRRlJpWW5BelJaelFqcWlaUWxRsZGJkamBiZ6BkYxBcYAADCBkAF"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-qLLSZQ11hMlkED-TomejGA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

POST
H2 200 imp.gif
g.ezoic.net/detroitchicago/ 43 B
216 B 85ms
83ms Ping
image/gif 52.57.221.121
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/detroitchicago/imp.gif
Requested by: Host: g.ezoic.net
URL: https://g.ezoic.net/parsonsmaize/abilene.js?gcb=195-13&cb=dc112bb7ea
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.57.221.121 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-57-221-121.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://www.mediafire.com/

Response headers

access-control-max-age: 1728000, 1728000
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, PUT, OPTIONS, HEAD, PUT, POST, GET, OPTIONS
expires: Fri, 25 Apr 2025 10:48:19 GMT
access-control-allow-origin: https://www.mediafire.com, https://www.mediafire.com
content-length: 43
date: Sat, 26 Apr 2025 10:48:19 GMT
x-middleton-display: imp_sol
content-type: image/gif
vary: Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
access-control-allow-headers: Content-Type, Content-Type

GET
H2 200 bounce Show response
id5-sync.com/ 30 B
235 B 81ms
81ms Fetch
text/plain 141.95.98.65
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/bounce

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.65 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ns3216659.ip-141-95-98.eu

Software

Resource Hash

b04cd869cfd41a48c006458f71969a0eb26f33fec12f3cfe00408f8b73bf3ff8

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://www.mediafire.com
date: Sat, 26 Apr 2025 10:48:19 GMT
content-type: text/plain;charset=utf-8
vary: Origin
access-control-allow-credentials: true

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
288 B 202ms
81ms Fetch
application/json 141.95.98.64
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.64 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ns3216658.ip-141-95-98.eu

Software

Resource Hash

04a0c16b9bf4c97a4f3734845a0f22e0847ae29cd7a8725cc388636cc9da030c

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://www.mediafire.com
date: Sat, 26 Apr 2025 10:48:18 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

POST
H2 200 457.json Show response
id5-sync.com/g/v2/ 853 B
1 KB 82ms
81ms Fetch
application/json 141.95.98.65
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/g/v2/457.json

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-13-120

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.65 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ns3216659.ip-141-95-98.eu

Software

Resource Hash

3b2967f25021d925d140758ccf20d77145e08676196c4c75d7ce576560a4fe7c

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://www.mediafire.com/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://www.mediafire.com
p3p: CP="CAO PSA OUR"
date: Sat, 26 Apr 2025 10:48:19 GMT
content-type: application/json
vary: Origin

GET
H2 200 AGSKWxWDw3OOyj3bOrFl3PD4vtvfU_2zR7ymVsgy7uKSuTTKTWlzMTnEVHADDPzWNNhRRGcdmfRW7IJkqBfHu5iJOGkoPwvv7dUVF9dCJBcVXvYcykA--YUv2qxMxDpKFs44H65zhPS_Jg== Show response
fundingchoicesmessages.google.com/f/ 9 KB
5 KB 102ms
102ms Script
application/javascript 142.250.184.206
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxWDw3OOyj3bOrFl3PD4vtvfU_2zR7ymVsgy7uKSuTTKTWlzMTnEVHADDPzWNNhRRGcdmfRW7IJkqBfHu5iJOGkoPwvv7dUVF9dCJBcVXvYcykA--YUv2qxMxDpKFs44H65zhPS_Jg==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQ1NjY0NDk5LDYwMjAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzddXSwiaHR0cHM6Ly93d3cubWVkaWFmaXJlLmNvbS9maWxlLzB6NG5qdGZlN3o1c2NhMy9FWDEzX1JQOC1GUC5yYXIvZmlsZSIsbnVsbCxbWzgsImlDWExkVXI5bjBVIl0sWzksInRyIl0sWzE5LCIyIl0sWzI0LCIiXSxbMjUsIltbOTUzNDAyNTMsOTUzNDAyNTVdXSJdLFsyOSwiZmFsc2UiXV1d

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.tr.iCXLdUr9n0U.es5.O/d=1/rs=AJlcJMx33TfqXOkz4ovzXLrLmOe_QovRhg/m=kernel_loader,loader_js_executable

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.206 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f14.1e100.net

Software

ESF /

Resource Hash

5220004114d5a7e1eceb622b4606637de3daf733ca0b4e7024dbe5bd4436973e

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-QbdmiAKMpJBwIsfEm_ogKA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 26 Apr 2025 10:48:19 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjStDikmLw0pBiaL15jnUqEButPc_qBMSGCpdYHYH4_rpLrM-B-EP9ZdYfQFwkcYW1CYg_Vd1gFaq-wRqbdpM1FYh7995kvXHkJuuajbdYtwBxk_Zt1i4gFuLh-Px50wE2gRONTXuYlDSS8gvjk_PzSooyk0pL8ovSktNSi1OLylKL4o0MjEwNTIxM9AwM4gsMAKnFP3c"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-QbdmiAKMpJBwIsfEm_ogKA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 topics_frame.html Show response
securepubads.g.doubleclick.net/static/topics/ Frame 8C64 101 KB
28 KB 177ms
91ms Document
text/html 142.250.186.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/static/topics/topics_frame.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504220101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

sffe /

Resource Hash

190f676ee781e35d2d2a8c07e56b2ca05fe36625bbc7a5cfec2f3a060a45c3e2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.mediafire.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 747
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000, stale-while-revalidate=3600
content-encoding: br
content-length: 28980
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 26 Apr 2025 10:35:52 GMT
expires: Sat, 26 Apr 2025 11:25:52 GMT
last-modified: Mon, 21 Apr 2025 19:44:47 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 esp.js Show response
cdn.id5-sync.com/api/1.0/ 106 KB
30 KB 57ms
55ms Script
text/javascript 172.67.38.106
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/esp.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504220101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.38.106 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

77b2f35b2aee5d890fe0b78354bc7a04342ec767906919382dee04f646e005a7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-amz-id-2: ghnFS7lm9OrfbrWX/1f1Lh5e16pwpjBj0Z63z6GlISLZU5f2mEWhN5/gpyW0DdVb1m5upP9PS8I=
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: public, max-age=3600
content-encoding: br
cf-cache-status: HIT
etag: W/"81beb8ae26990a760337f86348546ef4"
age: 2396
x-amz-request-id: E279E5RN1MMT7X45
cf-ray: 936581d2cac61628-IST
date: Sat, 26 Apr 2025 10:48:19 GMT
content-type: text/javascript;charset=utf-8
last-modified: Fri, 18 Apr 2025 14:04:56 GMT
vary: Accept-Encoding
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 connectId-gpt.js Show response
connectid.analytics.yahoo.com/ 9 KB
9 KB 264ms
85ms Script
application/javascript 18.66.102.31
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://connectid.analytics.yahoo.com/connectId-gpt.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504220101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.102.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-102-31.fra56.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

56351c084d8d56437d41f1e58b7eb184b563871e88bab60f6b15486c39f13996

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

etag: "faa388a163b1b6d0377ee77a861591e5"
age: 3172
x-cache: Hit from cloudfront
x-amz-cf-id: Kkcxj-BZv-fJtl3QI4l7ZEDHeJBbtQQOPjmzGPpoFP7vNok6XEwgcw==
date: Sat, 26 Apr 2025 09:55:28 GMT
content-type: application/javascript
last-modified: Mon, 22 Apr 2024 18:18:45 GMT
x-amz-expiration: expiry-date="Mon, 23 Apr 2029 00:00:00 GMT", rule-id="webapp-standard-lifecycle"
content-security-policy: default-src 'self'
cache-control: max-age=3600
via: 1.1 cb4c4a25e4ef534686959996782c8476.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 8729
x-amz-cf-pop: FRA56-P2
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H/1.1 200
OK uid2SecureSignal.js Show response
cdn.prod.uidapi.com/ 3 KB
4 KB 278ms
87ms Script
text/javascript 18.173.204.202
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.prod.uidapi.com/uid2SecureSignal.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504220101/pubads_impl.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.204.202 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-204-202.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f0db2da3ee90dcf1f14054ba3c18ccc331993a4f19fd95c56169f3de5047950e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-amz-version-id: suVMGQsV8z1neCwtnAwOA2e_FhSjpoa6
ETag: "e264379414c85b18fe5fb338ed4823f8"
Age: 33183
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: nTWPtzCoYv2QPoj4DLWgOJ9rZXEx5HbiqzK4d2QGSYw9wwQaJLQeaA==
Date: Sat, 26 Apr 2025 01:35:17 GMT
Content-Type: text/javascript
Last-Modified: Wed, 11 Dec 2024 19:25:11 GMT
x-amz-replication-status: COMPLETED
Connection: keep-alive
Via: 1.1 b44afb2a44376871c20edb8c123ed47c.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 3117
X-Amz-Cf-Pop: FRA56-P12
Server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 pubcid.min.js Show response
cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/ 732 B
1 KB 154ms
54ms Script
application/javascript 104.16.174.226
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/pubcid.min.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504220101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.174.226 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a5230196df9a4e9f6382c504668862efc8e25c1ec093c7dc997fbedb4b3ec54e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

access-control-expose-headers: *
content-encoding: br
cf-cache-status: HIT
etag: W/"2dc-IrZxm/sP4aqtIfs1EfEw6Dg5q1Y"
age: 12186
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eTsl3sznNtmDM7B3CC0PH10L0h92OlW3FTZ0mlbBorN5BhyecqipiRgUiV8SoRaO%2Bmd7mY5m8usgtJqQimlKapncDytuBGjAQ3Opa0Sxm%2FapZpFUv6DjwJiMU%2FeyI%2FvCLd8%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
x-jsd-version-type: branch
alt-svc: h3=":443"; ma=86400
x-cache: HIT, HIT
date: Sat, 26 Apr 2025 10:48:19 GMT
content-type: application/javascript; charset=utf-8
x-served-by: cache-fra-eddf8230168-FRA, cache-lga21940-LGA
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy: cross-origin
cf-ray: 936581d36c1a0ed1-IST
accept-ranges: bytes
access-control-allow-origin: *
content-length: 394
server: cloudflare
x-jsd-version: master

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16589/ 43 KB
13 KB 270ms
90ms Script
text/javascript 65.9.66.104
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504220101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.66.104 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-66-104.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 30b32e97f2e3e06deb742bf2e19daeb4f4657a956e836c2a25a7df2bc72f7500

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

vary: Accept-Encoding
cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"7db46e1255a018ecf02f47b2c19c26c4"
age: 31359
via: 1.1 4874e0c922f34c928345f4c183ea11b4.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: 7Awvb6LqdWCoFSk8NnAbhW45zvnSOcOQHq8eSsEv6ggRLgobPx8oig==
date: Sat, 26 Apr 2025 02:05:41 GMT
content-type: text/javascript
last-modified: Tue, 20 Aug 2024 18:47:40 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-C1
x-amz-server-side-encryption: AES256

GET
H2 200 encrypted-tag-g.js Show response
invstatic101.creativecdn.com/encrypted-signals/ 3 KB
3 KB 235ms
115ms Script
text/javascript 34.96.70.87
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504220101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.70.87 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 87.70.96.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 2e5f5cb912c0619933ea6c3ad8ac1466a005f792e3338d96a8432d144c63520f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

etag: 861bdaf24bda5c0db45c6ebe1c94a9eb
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2729
date: Sat, 26 Apr 2025 10:48:19 GMT
content-type: text/javascript; charset=utf-8
last-modified: Wed, 05 Feb 2025 14:45:21 GMT
server: Google Frontend
x-cloud-trace-context: b51fb26e605a5c6f25bc43734dc15ffd

GET ob.js
cdn-ima.33across.com/ 0
0

GET
H2 200 publishertag.ids.js Show response
static.criteo.net/js/ld/ 42 KB
13 KB 344ms
140ms Script
text/javascript 178.250.1.39
ASN-CRITEO-EUROPE...

General

Check archive.org

Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.ids.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504220101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.39 , France, ASN44788 (ASN-CRITEO-EUROPE Criteo Technology SAS, FR),

Reverse DNS

Software

nginx /

Resource Hash

8b9649ecf99400f7fefce2ec3568d60386481da0991d4cb519b901aa4aca6c3e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: max-age=86400, public
timing-allow-origin: *
content-encoding: gzip
etag: W/"67ece34f-a612"
cross-origin-resource-policy: cross-origin
expires: Sun, 27 Apr 2025 10:48:19 GMT
access-control-allow-origin: *
date: Sat, 26 Apr 2025 10:48:19 GMT
content-type: text/javascript
last-modified: Wed, 02 Apr 2025 07:12:15 GMT
server: nginx

GET
H2 200 esp.js Show response
oa.openxcdn.net/ 24 KB
8 KB 168ms
54ms Script
application/javascript 34.102.146.192
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://oa.openxcdn.net/esp.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504220101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.146.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 192.146.102.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-goog-metageneration: 1
content-encoding: gzip
x-goog-hash: crc32c=f21hYg==, md5=31VCuIvA42jGmZdUpbniug==
etag: "df5542b88bc0e368c6999754a5b9e2ba"
age: 660118
x-goog-stored-content-encoding: gzip
expires: Sat, 18 Apr 2026 19:26:21 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 7927
date: Fri, 18 Apr 2025 19:26:21 GMT
last-modified: Thu, 27 May 2021 18:30:51 GMT
content-type: application/javascript
x-guploader-uploadid: AAO2VwqHXrlY2RC0w3cNKSWOEha74OGJ21Q2wNng9Yys28Zlt44wsMcL0kpiEc5GT9bbwPxB-upj6Tc
cache-control: no-transform
x-goog-storage-class: MULTI_REGIONAL
accept-ranges: bytes
x-goog-generation: 1622140251693895
content-length: 7927
server: UploadServer

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 43 KB
19 KB 360ms
360ms Fetch
text/plain 142.250.186.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=5966717732066796&correlator=2029763363967604&eid=31086815%2C31090592%2C83321072%2C31091673%2C95340253%2C95340255&output=ldjh&gdfp_req=1&vrg=202504220101&ptt=17&impl=fif&gdpr=0&us_privacy=1---&gpp_sid=-1&iu_parts=1254144%3A183096492%2Cmediafire_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=1&didk=1697938527&dids=div-gpt-ad-mediafire_com-box-2&adfs=2211965457&sfv=1-0-41&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1745664499622&lmt=1745664499&adxs=552&adys=10&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=180&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F0z4njtfe7z5sca3%2FEX13_RP8-FP.rar%2Ffile&vis=1&aee=1&psz=728x-1&msz=728x-1&fws=0&ohw=0&topics=9&tps=9&htps=10&a3p=ElMKDWNyd2RjbnRybC5uZXQSQDIwMzNiYjg1ZGI2ODk1MjYzMjY1YThhY2Y0ZmIxODVjYTAyY2U4ZGEyMWExNzFlZDllMTZjODlhNDliMTQ4ODBYARIZCgp1aWRhcGkuY29tGKG_2Y3nMkgAUgIIZBI0CgpwdWJjaWQub3JnEiRlYzNlZmY2OC0wZTFhLTQxMTItOGUyMS1mOGJkMzYxYzQyMGRYARIbCgxpZDUtc3luYy5jb20Yob_ZjecySABSAghkEh0KDmVzcC5jcml0ZW8uY29tGKG_2Y3nMkgAUgIIZBIYCgl5YWhvby5jb20Yob_ZjecySABSAghkEhQKBW9wZW54GKG_2Y3nMkgAUgIIZBIbCgwzM2Fjcm9zcy5jb20Yob_ZjecySABSAghkEhcKCHJ0YmhvdXNlGKG_2Y3nMkgAUgIIZA..&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1745664497579&idt=1785&ppid=e1c37ebfc1a9a27cfae119775cae22e8&prev_scp=a%3D1%26iid1%3D7992908034463469%26eid%3D7992908034463469%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D0%26ap%3D1103%26sap%3D1103%26as%3Drevenue%26plat%3D1%26bra%3Dmod31-c%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dmediafire_com-box-2-7992908034463469%26eb_br%3D60474211daf1dfd4d90000ea01f56c30%26eba%3D0%26bv%3D38%26bvm%3D4%26bvr%3D0%26avc%3D6%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D0%26br2%3D0%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D157%2C131%2C0%2C0%2C0%2C193%2C196%2C20%2C0%2C0%2C192%2C31%2C902%2C903%2C901%2C902%2C903%26deal1%3D17%2C18%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1428%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C2764%2C2765%2C3044%2C3045%2C3052%2C3053%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C3856%2C4184%2C4186%2C4276%2C5747%2C6293%2C6294%2C6295%2C7035%2C7036%2C7330%2C7331%2C7605%2C7606%2C7607%2C7608%2C7609%2C7610%2C7611%2C7612%2C7613%2C7614%2C7615%2C7616%2C7617%2C7618%2C6772%2C5534%2C7661%2C7713&cust_params=carbon_segment%3D&adks=3106951849&frm=20&eoidce=1&pbbce=1&td=1&egid=38815&tan=a9d4574a-b146-43f0-b55d-8d6d45dae5e9&tdf=2

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504220101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

cdc3d73c7155b5769cba0ad4d53f308a7cd053d7612d0028b575019713fdd842

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: dcb
google-lineitem-id: -2
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Sat, 26 Apr 2025 10:48:19 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.mediafire.com
content-length: 19193
x-xss-protection: 0
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 39 KB
5 KB 393ms
392ms Fetch
text/plain 142.250.186.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=5966717732066796&correlator=1579058946854044&eid=31086815%2C31090592%2C83321072%2C31091673%2C95340253%2C95340255&output=ldjh&gdfp_req=1&vrg=202504220101&ptt=17&impl=fif&gdpr=0&us_privacy=1---&gpp_sid=-1&iu_parts=1254144%3A183096492%2Cmediafire_com-medrectangle-3&enc_prev_ius=%2F0%2F1&prev_iu_szs=336x280&ifi=2&didk=46179496&dids=div-gpt-ad-mediafire_com-medre&adfs=2749637499&sfv=1-0-41&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1745664499628&lmt=1745664499&adxs=320&adys=120&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=180&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F0z4njtfe7z5sca3%2FEX13_RP8-FP.rar%2Ffile&vis=1&aee=1&psz=336x-1&msz=336x-1&fws=0&ohw=0&topics=9&tps=9&htps=10&a3p=ElMKDWNyd2RjbnRybC5uZXQSQDIwMzNiYjg1ZGI2ODk1MjYzMjY1YThhY2Y0ZmIxODVjYTAyY2U4ZGEyMWExNzFlZDllMTZjODlhNDliMTQ4ODBYARIZCgp1aWRhcGkuY29tGKG_2Y3nMkgAUgIIZBI0CgpwdWJjaWQub3JnEiRlYzNlZmY2OC0wZTFhLTQxMTItOGUyMS1mOGJkMzYxYzQyMGRYARIbCgxpZDUtc3luYy5jb20Yob_ZjecySABSAghkEh0KDmVzcC5jcml0ZW8uY29tGKG_2Y3nMkgAUgIIZBIYCgl5YWhvby5jb20Yob_ZjecySABSAghkEhQKBW9wZW54GKG_2Y3nMkgAUgIIZBIbCgwzM2Fjcm9zcy5jb20Yob_ZjecySABSAghkEhcKCHJ0YmhvdXNlGKG_2Y3nMkgAUgIIZA..&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1745664497579&idt=1785&ppid=e1c37ebfc1a9a27cfae119775cae22e8&prev_scp=a%3D1%26iid1%3D6798894264446493%26eid%3D6798894264446493%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D0%26ap%3D1104%26sap%3D1104%26as%3Drevenue%26plat%3D1%26bra%3Dmod31-c%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D3%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D21%26al%3D1021%26compid%3D0%26tap%3Dmediafire_com-medrectangle-3-6798894264446493%26eb_br%3D60474211daf1dfd4d90000ea01f56c30%26eba%3D0%26bv%3D38%26bvm%3D4%26bvr%3D0%26avc%3D7%26shp%3D3%26ftsn%3D12%26ftsng%3D12%26br1%3D0%26br2%3D0%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D157%2C168%2C0%2C0%2C0%2C193%2C184%2C20%2C0%2C0%2C192%2C31%2C902%2C903%2C901%2C902%2C903%26deal1%3D17%2C18%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C760%2C761%2C813%2C815%2C816%2C817%2C818%2C819%2C893%2C899%2C917%2C918%2C919%2C1428%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C2764%2C2765%2C3044%2C3045%2C3052%2C3053%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C3856%2C3915%2C3919%2C3933%2C4184%2C4185%2C4186%2C4276%2C4604%2C4605%2C5747%2C6044%2C6045%2C6293%2C6294%2C6295%2C6983%2C7035%2C7036%2C7046%2C7144%2C7327%2C7330%2C7331%2C7605%2C7606%2C7607%2C7608%2C7609%2C7610%2C7611%2C7612%2C7613%2C7614%2C7615%2C7616%2C7617%2C7618%2C6772%2C5534%2C7661%2C7713&cust_params=carbon_segment%3D&adks=4079446691&frm=20&eoidce=1&pbbce=1&td=1&egid=38815&tan=a9d4574a-b146-43f0-b55d-8d6d45dae5ea&tdf=2

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504220101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

608883c72927c2e177f748d474aad3962becb40794b134fa5204f6b0315d8d00

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: dcb
google-lineitem-id: -1
observe-browsing-topics: ?1
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Sat, 26 Apr 2025 10:48:19 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -1
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.mediafire.com
content-length: 5540
x-xss-protection: 0
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 83 KB
24 KB 324ms
323ms Fetch
text/plain 142.250.186.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=5966717732066796&correlator=3245196529282155&eid=31086815%2C31090592%2C83321072%2C31091673%2C95340253%2C95340255&output=ldjh&gdfp_req=1&vrg=202504220101&ptt=17&impl=fif&gdpr=0&us_privacy=1---&gpp_sid=-1&iu_parts=1254144%3A183096492%2Cmediafire_com-medrectangle-4&enc_prev_ius=%2F0%2F1&prev_iu_szs=336x280%7C300x250&ifi=3&didk=46192883&dids=div-gpt-ad-mediafire_com-medre&adfs=3666211919&sfv=1-0-41&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1745664499631&lmt=1745664499&adxs=320&adys=420&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=180&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F0z4njtfe7z5sca3%2FEX13_RP8-FP.rar%2Ffile&vis=1&aee=1&psz=336x250&msz=336x0&fws=0&ohw=0&topics=9&tps=9&htps=10&a3p=ElMKDWNyd2RjbnRybC5uZXQSQDIwMzNiYjg1ZGI2ODk1MjYzMjY1YThhY2Y0ZmIxODVjYTAyY2U4ZGEyMWExNzFlZDllMTZjODlhNDliMTQ4ODBYARIZCgp1aWRhcGkuY29tGKG_2Y3nMkgAUgIIZBI0CgpwdWJjaWQub3JnEiRlYzNlZmY2OC0wZTFhLTQxMTItOGUyMS1mOGJkMzYxYzQyMGRYARIbCgxpZDUtc3luYy5jb20Yob_ZjecySABSAghkEh0KDmVzcC5jcml0ZW8uY29tGKG_2Y3nMkgAUgIIZBIYCgl5YWhvby5jb20Yob_ZjecySABSAghkEhQKBW9wZW54GKG_2Y3nMkgAUgIIZBIbCgwzM2Fjcm9zcy5jb20Yob_ZjecySABSAghkEhcKCHJ0YmhvdXNlGKG_2Y3nMkgAUgIIZA..&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1745664497579&idt=1785&ppid=e1c37ebfc1a9a27cfae119775cae22e8&prev_scp=a%3D1%26iid1%3D9125662540473733%26eid%3D9125662540473733%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D0%26ap%3D1105%26sap%3D1105%26as%3Drevenue%26plat%3D1%26bra%3Dmod31-c%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D4%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D22%26al%3D1022%26compid%3D0%26tap%3Dmediafire_com-medrectangle-4-9125662540473733%26eb_br%3D60474211daf1dfd4d90000ea01f56c30%26eba%3D0%26bv%3D38%26bvm%3D4%26bvr%3D0%26avc%3D6%26shp%3D3%26ftsn%3D12%26ftsng%3D12%26br1%3D0%26br2%3D0%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D34%2C193%2C0%2C0%2C0%2C168%2C142%2C0%2C0%2C0%2C143%2C0%2C901%2C182%2C901%2C902%2C903%26deal1%3D17%2C18%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C760%2C761%2C813%2C815%2C816%2C817%2C818%2C893%2C899%2C919%2C1428%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C2764%2C2765%2C3044%2C3045%2C3052%2C3053%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C3856%2C3919%2C3933%2C4184%2C4185%2C4186%2C4276%2C4604%2C4605%2C5747%2C6044%2C6045%2C6293%2C6294%2C6295%2C6983%2C7035%2C7036%2C7046%2C7144%2C7327%2C7330%2C7331%2C7605%2C7606%2C7607%2C7608%2C7609%2C7610%2C7611%2C7612%2C7613%2C7614%2C7615%2C7616%2C7617%2C7618%2C6772%2C5534%2C7661%2C7713&cust_params=carbon_segment%3D&adks=1277606936&frm=20&eoidce=1&pbbce=1&td=1&egid=38815&tan=a9d4574a-b146-43f0-b55d-8d6d45dae5eb&tdf=2

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504220101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

f24bc4aaf793e5b568771b4c9adf8b02e7ef9e576c28daf02bc28e38a53b8926

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: dcb
google-lineitem-id: -1
observe-browsing-topics: ?1
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Sat, 26 Apr 2025 10:48:19 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -1
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.mediafire.com
content-length: 24403
x-xss-protection: 0
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 761 B
375 B 405ms
404ms Fetch
text/plain 142.250.186.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=5966717732066796&correlator=2334572635238140&eid=31086815%2C31090592%2C83321072%2C31091673%2C95340253%2C95340255&output=ldjh&gdfp_req=1&vrg=202504220101&ptt=17&impl=fif&gdpr=0&us_privacy=1---&gpp_sid=-1&iu_parts=1254144%3A183096492%2Cmediafire_com-edge-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C160x600&fluid=height&ifi=4&didk=2994273263&dids=div-gpt-ad-mediafire_com-edge-&adfs=2968723417&sfv=1-0-41&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1745664499633&lmt=1745664499&adxs=0&adys=300&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=180&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F0z4njtfe7z5sca3%2FEX13_RP8-FP.rar%2Ffile&vis=1&aee=1&psz=160x-1&msz=160x-1&fws=512&ohw=0&topics=9&tps=9&htps=10&a3p=ElMKDWNyd2RjbnRybC5uZXQSQDIwMzNiYjg1ZGI2ODk1MjYzMjY1YThhY2Y0ZmIxODVjYTAyY2U4ZGEyMWExNzFlZDllMTZjODlhNDliMTQ4ODBYARIZCgp1aWRhcGkuY29tGKG_2Y3nMkgAUgIIZBI0CgpwdWJjaWQub3JnEiRlYzNlZmY2OC0wZTFhLTQxMTItOGUyMS1mOGJkMzYxYzQyMGRYARIbCgxpZDUtc3luYy5jb20Yob_ZjecySABSAghkEh0KDmVzcC5jcml0ZW8uY29tGKG_2Y3nMkgAUgIIZBIYCgl5YWhvby5jb20Yob_ZjecySABSAghkEhQKBW9wZW54GKG_2Y3nMkgAUgIIZBIbCgwzM2Fjcm9zcy5jb20Yob_ZjecySABSAghkEhcKCHJ0YmhvdXNlGKG_2Y3nMkgAUgIIZA..&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1745664497579&idt=1785&ppid=e1c37ebfc1a9a27cfae119775cae22e8&prev_scp=a%3D1%26iid1%3D7924875182434044%26eid%3D7924875182434044%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D0%26ap%3D1101%26sap%3D1101%26as%3Drevenue%26plat%3D1%26bra%3Dmod31-c%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D2%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D38%26al%3D1038%26compid%3D0%26tap%3Dmediafire_com-edge-1-7924875182434044%26eb_br%3D291d27313eb66c50243129b23df8a579%26eba%3D0%26bv%3D38%26bvm%3D4%26bvr%3D0%26avc%3D4%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D10%26br2%3D4%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D34%2C193%2C0%2C0%2C0%2C168%2C132%2C0%2C0%2C0%2C143%2C0%2C901%2C182%2C901%2C902%2C903%26deal1%3D17%2C18%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1428%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C2764%2C2765%2C3044%2C3045%2C3052%2C3053%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C3856%2C4184%2C4186%2C4276%2C5747%2C6293%2C6294%2C6295%2C7035%2C7036%2C7330%2C7331%2C7605%2C7606%2C7607%2C7608%2C7609%2C7610%2C7611%2C7612%2C7613%2C7614%2C7615%2C7616%2C7617%2C7618%2C6772%2C5534%2C7661%2C7713&cust_params=carbon_segment%3D&adks=3527628052&frm=20&eoidce=1&pbbce=1&td=1&egid=38815&tan=a9d4574a-b146-43f0-b55d-8d6d45dae5ec&tdf=2

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504220101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

119385575c02b729504d08b6f9608505971197ca65d7d4acfcc6ec266d748765

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: dcb
google-lineitem-id: -2
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Sat, 26 Apr 2025 10:48:19 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.mediafire.com
content-length: 344
x-xss-protection: 0
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 43 KB
19 KB 352ms
351ms Fetch
text/plain 142.250.186.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=5966717732066796&correlator=1638539355493869&eid=31086815%2C31090592%2C83321072%2C31091673%2C95340253%2C95340255&output=ldjh&gdfp_req=1&vrg=202504220101&ptt=17&impl=fif&gdpr=0&us_privacy=1---&gpp_sid=-1&iu_parts=1254144%3A183096492%2Cmediafire_com-edge-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C160x600&fluid=height&ifi=5&didk=2994425013&dids=div-gpt-ad-mediafire_com-edge-&adfs=1145427683&sfv=1-0-41&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1745664499635&lmt=1745664499&adxs=1440&adys=300&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=5&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=180&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F0z4njtfe7z5sca3%2FEX13_RP8-FP.rar%2Ffile&vis=1&aee=1&psz=160x-1&msz=160x-1&fws=512&ohw=0&topics=9&tps=9&htps=10&a3p=ElMKDWNyd2RjbnRybC5uZXQSQDIwMzNiYjg1ZGI2ODk1MjYzMjY1YThhY2Y0ZmIxODVjYTAyY2U4ZGEyMWExNzFlZDllMTZjODlhNDliMTQ4ODBYARIZCgp1aWRhcGkuY29tGKG_2Y3nMkgAUgIIZBI0CgpwdWJjaWQub3JnEiRlYzNlZmY2OC0wZTFhLTQxMTItOGUyMS1mOGJkMzYxYzQyMGRYARIbCgxpZDUtc3luYy5jb20Yob_ZjecySABSAghkEh0KDmVzcC5jcml0ZW8uY29tGKG_2Y3nMkgAUgIIZBIYCgl5YWhvby5jb20Yob_ZjecySABSAghkEhQKBW9wZW54GKG_2Y3nMkgAUgIIZBIbCgwzM2Fjcm9zcy5jb20Yob_ZjecySABSAghkEhcKCHJ0YmhvdXNlGKG_2Y3nMkgAUgIIZA..&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1745664497579&idt=1785&ppid=e1c37ebfc1a9a27cfae119775cae22e8&prev_scp=a%3D1%26iid1%3D4932720536473080%26eid%3D4932720536473080%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D0%26ap%3D1102%26sap%3D1102%26as%3Drevenue%26plat%3D1%26bra%3Dmod31-c%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D1%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D39%26al%3D1039%26compid%3D0%26tap%3Dmediafire_com-edge-2-4932720536473080%26eb_br%3D291d27313eb66c50243129b23df8a579%26eba%3D0%26bv%3D38%26bvm%3D4%26bvr%3D0%26avc%3D7%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D10%26br2%3D4%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D157%2C168%2C0%2C0%2C0%2C193%2C196%2C20%2C0%2C0%2C192%2C31%2C902%2C903%2C901%2C902%2C903%26deal1%3D17%2C18%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1428%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C2764%2C2765%2C3044%2C3045%2C3052%2C3053%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C3856%2C4184%2C4186%2C4276%2C5747%2C6293%2C6294%2C6295%2C7035%2C7036%2C7330%2C7331%2C7605%2C7606%2C7607%2C7608%2C7609%2C7610%2C7611%2C7612%2C7613%2C7614%2C7615%2C7616%2C7617%2C7618%2C6772%2C5534%2C7661%2C7713&cust_params=carbon_segment%3D&adks=3081006461&frm=20&eoidce=1&pbbce=1&td=1&egid=38815&tan=a9d4574a-b146-43f0-b55d-8d6d45dae5ed&tdf=2

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504220101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

a750e9678bd32b1d95865354b09cdd855a4ef5db69bdb1a7831bf921d8bae0a8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: dcb
google-lineitem-id: -2
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Sat, 26 Apr 2025 10:48:19 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.mediafire.com
content-length: 19372
x-xss-protection: 0
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 914 B
453 B 285ms
285ms Fetch
text/plain 142.250.186.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=5966717732066796&correlator=2140018793925170&eid=31086815%2C31090592%2C83321072%2C31091673%2C95340253%2C95340255&output=ldjh&gdfp_req=1&vrg=202504220101&ptt=17&impl=fif&gdpr=0&us_privacy=1---&gpp_sid=-1&iu_parts=1254144%3A183096492%2Cmediafire_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=1x1&ifi=6&didk=674410252&dids=gpt_unit_%2F1254144%2C183096492%2Fme&sfv=1-0-41&fas=1&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1745664499637&lmt=1745664499&adxs=-9&adys=-9&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=6&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=180&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F0z4njtfe7z5sca3%2FEX13_RP8-FP.rar%2Ffile&vis=1&aee=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&topics=9&tps=9&htps=10&a3p=ElMKDWNyd2RjbnRybC5uZXQSQDIwMzNiYjg1ZGI2ODk1MjYzMjY1YThhY2Y0ZmIxODVjYTAyY2U4ZGEyMWExNzFlZDllMTZjODlhNDliMTQ4ODBYARIZCgp1aWRhcGkuY29tGKG_2Y3nMkgAUgIIZBI0CgpwdWJjaWQub3JnEiRlYzNlZmY2OC0wZTFhLTQxMTItOGUyMS1mOGJkMzYxYzQyMGRYARIbCgxpZDUtc3luYy5jb20Yob_ZjecySABSAghkEh0KDmVzcC5jcml0ZW8uY29tGKG_2Y3nMkgAUgIIZBIYCgl5YWhvby5jb20Yob_ZjecySABSAghkEhQKBW9wZW54GKG_2Y3nMkgAUgIIZBIbCgwzM2Fjcm9zcy5jb20Yob_ZjecySABSAghkEhcKCHJ0YmhvdXNlGKG_2Y3nMkgAUgIIZA..&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1745664497579&idt=1785&ppid=e1c37ebfc1a9a27cfae119775cae22e8&prev_scp=a%3D1%26iid1%3D8330223226438365%26eid%3D8330223226438365%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D0%26ap%3D1100%26sap%3D1100%26as%3Drevenue%26plat%3D1%26bra%3Dmod31-c%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D5%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26tap%3Dmediafire_com-medrectangle-2-8330223226438365%26eb_br%3D291d27313eb66c50243129b23df8a579%26eba%3D0%26bv%3D38%26bvm%3D4%26bvr%3D0%26avc%3D8%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D10%26br2%3D4%26ezoic%3D1%26nmau%3D0%26mau%3D0%26ganc%3D1%26cal%3D0%26stl%3D82%2C25%2C133%2C4%2C50%2C131%2C87%2C20%2C71%2C164%2C205%2C0%2C147%2C166%2C901%2C902%2C903%26deal1%3D17%2C18%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C760%2C761%2C813%2C815%2C816%2C817%2C818%2C819%2C893%2C899%2C903%2C917%2C918%2C919%2C1428%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C2764%2C2765%2C3044%2C3045%2C3052%2C3053%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C3856%2C3915%2C3919%2C3933%2C4184%2C4185%2C4186%2C4276%2C4604%2C4605%2C5747%2C6044%2C6045%2C6293%2C6294%2C6295%2C6983%2C7035%2C7036%2C7046%2C7144%2C7327%2C7330%2C7331%2C7605%2C7606%2C7607%2C7608%2C7609%2C7610%2C7611%2C7612%2C7613%2C7614%2C7615%2C7616%2C7617%2C7618%2C6772%2C5534%2C7661%2C7713&cust_params=carbon_segment%3D&adks=318048222&frm=20&eoidce=1&pbbce=1&td=1&egid=38815&tan=a9d4574a-b146-43f0-b55d-8d6d45dae5ee&tdf=2

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504220101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

e7cb12275e5da2a8fdf3a43876f8efb4bd89824cb34e3554f7dd7495872e0a23

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: dcb
google-lineitem-id: -2
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Sat, 26 Apr 2025 10:48:19 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.mediafire.com
content-length: 422
x-xss-protection: 0
server: cafe

GET
H3 200 container.html Show response
e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com/safeframe/1-0-41/html/ Frame D0BE 7 KB
3 KB 209ms
101ms Document
text/html 142.250.185.97
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504220101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f1.1e100.net

Software

sffe /

Resource Hash

c173503f8ae4fdbb42c06c514edf25e62e81503e418ee3a0cdbd884e1a741444

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.mediafire.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 3024
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 26 Apr 2025 10:48:19 GMT
expires: Sat, 26 Apr 2025 10:48:19 GMT
last-modified: Thu, 30 Jan 2025 19:28:58 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pubads_impl_page_level_ads.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504220101/ 53 KB
17 KB 96ms
96ms Script
text/javascript 142.250.186.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504220101/pubads_impl_page_level_ads.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504220101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

35158712d8c8e8fb3a83624967b46e6ac3aa11879123de066042aa0e1d0e8a03

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: br
etag: 992039669773385612
age: 65711
x-content-type-options: nosniff
expires: Sat, 25 Apr 2026 16:33:08 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Fri, 25 Apr 2025 16:33:08 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 17651
x-xss-protection: 0
server: cafe

POST
H2 200 v3 Show response
id5-sync.com/gm/ 1 KB
2 KB 83ms
81ms XHR
application/json 141.95.98.65
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/gm/v3

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.65 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ns3216659.ip-141-95-98.eu

Software

Resource Hash

fb082853fd42a22187c62aeff206e56a46d5344d984892473a8a927b521c9003

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://www.mediafire.com/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://www.mediafire.com
p3p: CP="CAO PSA OUR"
date: Sat, 26 Apr 2025 10:48:19 GMT
content-type: application/json
vary: Origin

GET
H2 204 increment Show response
id5-sync.com/api/esp/ 0
233 B 257ms
86ms XHR
text/plain 141.95.98.65
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/api/esp/increment?counter=no-config

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/esp.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.65 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ns3216659.ip-141-95-98.eu

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://www.mediafire.com/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://www.mediafire.com
date: Sat, 26 Apr 2025 10:48:19 GMT
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
access-control-allow-credentials: true

GET
H2 200 userId Show response
script-api.ccgateway.net/1/ 446 B
705 B 179ms
171ms Script
text/javascript 3.237.175.195
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/1/userId
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=www.mediafire.com&parentId=0dae949f4b
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.237.175.195 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-237-175-195.compute-1.amazonaws.com
Software: /
Resource Hash: 7bc60d3f868be943f071cecb9ed0a3c66cbcf4e7a1e84146d9acdd2cdffa9b3c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cache-control: private,max-age=3156000
content-encoding: gzip
date: Sat, 26 Apr 2025 10:48:19 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 user.js Show response
script-api.ccgateway.net/script/launcher/2/ 2 KB
677 B 178ms
171ms Script
text/javascript 3.237.175.195
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/script/launcher/2/user.js
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=www.mediafire.com&parentId=0dae949f4b
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.237.175.195 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-237-175-195.compute-1.amazonaws.com
Software: /
Resource Hash: a11d3b4b6f2902037c365146ff80b5bf95923f3176f1a827355e45177314d423

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cache-control: private,max-age=604800
content-encoding: gzip
date: Sat, 26 Apr 2025 10:48:19 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 customevents.js Show response
script-api.ccgateway.net/script/launcher/1/ 5 KB
2 KB 172ms
172ms Script
text/javascript 3.237.175.195
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/script/launcher/1/customevents.js
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=www.mediafire.com&parentId=0dae949f4b
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.237.175.195 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-237-175-195.compute-1.amazonaws.com
Software: /
Resource Hash: 04c94ecaae50f713607dd45d40c5756d0e6a9e58c6398433ac098bc9bee89f5d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cache-control: private,max-age=604800
content-encoding: gzip
date: Sat, 26 Apr 2025 10:48:19 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 api.js Show response
script-api.ccgateway.net/script/launcher/5/ 5 KB
2 KB 171ms
171ms Script
text/javascript 3.237.175.195
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/script/launcher/5/api.js
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=www.mediafire.com&parentId=0dae949f4b
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.237.175.195 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-237-175-195.compute-1.amazonaws.com
Software: /
Resource Hash: 67942c522b8f0e187f291d3dde230596fa526a323a9f50a0d667b6956839d98e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cache-control: private,max-age=604800
content-encoding: gzip
date: Sat, 26 Apr 2025 10:48:19 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2

200

generic
match.adsrvr.org/track/cmf/
Redirect Chain

https://id5-sync.com/i/457/8.gif?o=api&id5id=ID5*PQvzisAzwH2a_XVHJ5yfKsIl-YH7xvPDt4Nb4vJwY_8Sj6momD6YOz0bCK8dejNC&gdpr_consent=undefined&gdpr=false
https://uipglob.semasio.net/id5/1/get?gdpr=0&gdpr_consent=&_url=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F112%2F7%2F2.gif%3Fpuid%3D%24%7BUIPID%7D%26gdpr%3D0%26gdpr_consent%3D
https://uipglob.semasio.net/id5/1/get2?gdpr=0&gdpr_consent=&_url=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F112%2F7%2F2.gif%3Fpuid%3D%24%7BUIPID%7D%26gdpr%3D0%26gdpr_consent%3D
https://id5-sync.com/c/457/112/7/2.gif?puid=478191D71E4A1F02&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmf/generic?ttd_pid=8h9u11h&ttd_tpi=1&gdpr=0&gdpr_consent=

70 B
148 B

112ms
112ms

Image
image/gif

35.71.131.137
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=8h9u11h&ttd_tpi=1&gdpr=0&gdpr_consent=
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H2
Server: 35.71.131.137 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-length: 70
date: Sat, 26 Apr 2025 10:48:20 GMT
content-type: image/gif
server: Kestrel

Redirect headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
location: https://match.adsrvr.org/track/cmf/generic?ttd_pid=8h9u11h&ttd_tpi=1&gdpr=0&gdpr_consent=
p3p: CP="CAO PSA OUR"
date: Sat, 26 Apr 2025 10:48:19 GMT
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers

POST
H2 200 encrypt Show response
esp.rtbhouse.com/ 285 B
550 B 211ms
98ms Fetch
application/json 35.190.39.111
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://esp.rtbhouse.com/encrypt
Requested by: Host: invstatic101.creativecdn.com
URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.39.111 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 111.39.190.35.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: b551ad6701bd2ed5a5ade923a62692e3d2d66f833ece86a0989b9158531518b5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://www.mediafire.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: POST
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 285
date: Sat, 26 Apr 2025 10:48:20 GMT
content-type: application/json
x-cloud-trace-context: b56165fa0bdc706eb6b3530a78cf3a7e
server: Google Frontend
access-control-allow-headers: X-Requested-With

GET
H2 200 setUser Show response
script-api.ccgateway.net/ 0
360 B 171ms
171ms Script
text/javascript 3.237.175.195
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/setUser?parent=0dae949f4b&site=www.mediafire.com&ccuid=f0344ebd-6fbe-4bdf-ab54-b54c0d278c3c&ccsid=025f28ab-fc9c-47b5-9f13-e0b0827f7933
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=www.mediafire.com&parentId=0dae949f4b
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.237.175.195 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-237-175-195.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cache-control: private,max-age=300
content-length: 0
date: Sat, 26 Apr 2025 10:48:20 GMT
content-type: text/javascript

GET
H2 200 bundle Show response
script-api.ccgateway.net/script/ 8 KB
3 KB 174ms
174ms Script
text/javascript 3.237.175.195
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/script/bundle?id=www.mediafire.com&parentId=0dae949f4b
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=www.mediafire.com&parentId=0dae949f4b
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.237.175.195 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-237-175-195.compute-1.amazonaws.com
Software: /
Resource Hash: 4f0f55570e972d3bbcb8729daf5ff64bfa16819a7f5cc81147d6772fdd1cbbb2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cache-control: public,max-age=1200
content-encoding: gzip
date: Sat, 26 Apr 2025 10:48:20 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H3 200 auctionwinner
googleads.g.doubleclick.net/td/ 0
0 179ms
91ms Fetch
text/html 142.250.186.130
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://googleads.g.doubleclick.net/td/auctionwinner?status=nowinner&isContextualWinner=1&winner_qid=COSQnYPD9YwDFVSHgwcdUgU2mQ&xfpQid=CL27m4PD9YwDFVSHgwcdUgU2mQ&ecrs=Ae0eij1HR6TEaPOcLEuOEUhfykPu2bJFQ8g9RSnwUsUGhNTWUer211ohh9Igc7xskIx3znr_qtEU9yO419k_1TkCFkmwEPk2014J9rMbw3oBdjoKDmYZ3ERo-epYblRC4H6hZLRXQzKHTb1-1PeSc7gXLgi-5CxY3VryiDI1xtFvFIYgqMI63Jj8x1LotC1ZOBpRtbrUsMlfNGEkEJeMwAktabx4xaQ2P9WdSXbniwvu1HpxrcliT3po3apFZZwQlbw5vpAYsIGNaweTSl81-94gOyuaDuSinU2jtHw8Qd8plL2lTxLPCwaeW5w4LI7K-WrEcxHwgBX5GEPOVw0QrxzvvrNBTn8oEuIKGRlgSueGsCAiuTtYHXMkP3Jcv6czIumln8QSk5ePFdVrnt4xCfedptEj5wQC9FLOWB5zsF1KSakNrv5Hg9TMSuqYMpvILwQXamsulbjQH-KE6kDeBZYGbIJU4onJfENPI5oVEPOiHAfXdHR2pFna0UgZxMydTWiOO9yR57BjPjzTfPIZsebur1EZ85lPF90FtMFc8xT6KHpdZlTqya2iweVJuV3H9OtVuPIIRFYEqhwkFajJPE9qYUvT8jVdz8GSwB9LDiMSXxMLBiac9EhhMRXFB-oDv8TKBDLBiliy8ZF8sXsarYyF4G2uhntiVssd08ub3wejS1z7Ugi5F10zPqT3VxbdgQwgySoI8P6OzThgmY8jsNRWBSsA0lzoeGxhgeC9Nf-dikuer4osE4GkHSTmgipLGbF3iKETRZMzbGQNZ9NxW_zTu1_LDeDrxf7UzCLlfhhhbEYxEPy5l9CoCcVausZYfWn39oQennUXioJB4taCPpxqQRR-6i55WiIhST5ZhfLVGapgmwpG3yvrLGsNcsryD8EIf_Dhyfkp91V-Grvvy0WSF99Xy6SPlaQ3AsPjuGLUC3O0FdA2L6h_bThY1NPfHnSdKIJzmek0Te32b3NO3lfO4c3TIvGqrC_Q9VEmCXo89OfrO9yjyPyrK6SA6rpL0ZDiEC37YAbcF2Hm3V1St_myRkc3FepmafijqPUg0RkM1KRzJWKpuuZ48VULmimzx5byoha0fBsSkFhOmrdRs2Ul2qg12TV98UbNsbaY7HjqrbQzWkkU-FBbJZ_L8nwZ0XrUYIOoL9GS-ZtNAh1pKQrvRuGKFHmSamjf_e2Q-5BFQ_zWIDHTZOWIBoOJo-O39s0NBXRmZKe4Vtk3EszCGEMd52gZObD8uEMiW3v5dqy1ie9ObPjmup7016eTpk9-eGdW7ZPotOlmJe4ApiMEssileRzMSpweBGDVJZ5E1O4fyGjYUsOYoAjvmSK65x-gVXxGZsg4SvOAdj2NXvujUX1BoIPmVnRP5kd228ZWZMgRVarZfmVbq4G_tSrtF_KIaZAZ10ZKmyCyv16yA2ulSWXYsQniLp7vgysUV4rh4oOSfm8Jv5m91hv6haSpu14AV1ofHYN2grPmPAfGdIJkV263uAlLZJyF2HhNcA1hJM188C1ekg&cid=CAQSYQDZpuyzwCN4uOsfKTq1sd3vh4RV294yyJ_RydfWa-AF8XjGT7A12WjtHsqkaCBFY5_UWAEFgdua95OFVlDp6_BMHss00VjVJk2Y_eZVaqjSIe3knajWrKjWzkv7C3slJ0sYAQ&applied_timeout_ms=0&duration_ms=2
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504220101/pubads_impl.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.186.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s07-in-f2.1e100.net
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

GET
H3 200 container.html Show response
e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com/safeframe/1-0-41/html/ Frame 3DDE 7 KB
0 0ms
0ms Document
text/html 142.250.185.97
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504220101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f1.1e100.net

Software

sffe /

Resource Hash

c173503f8ae4fdbb42c06c514edf25e62e81503e418ee3a0cdbd884e1a741444

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.mediafire.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 3024
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 26 Apr 2025 10:48:19 GMT
expires: Sat, 26 Apr 2025 10:48:19 GMT
last-modified: Thu, 30 Jan 2025 19:28:58 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ezadfilled.js Show response
go.ezodn.com/porpoiseant/ 5 KB
3 KB 55ms
55ms Script
application/javascript 188.114.96.3
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://go.ezodn.com/porpoiseant/ezadfilled.js?gcb=195-13&cb=612
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2180adfc4b8cdfd2ea48e647e3bb17e531b2b3e2dd99f0277b044387fc929cbe

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex
content-encoding: zstd
cf-cache-status: HIT
age: 133017
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=W5JIU8UsLjYoVb06oOvFmTlRJx88Wrm%2BufJi4pfMRqzwAr5j1NOlaKBrg327aaKuOA0RLsrVYpS07qnJTwd4iaVyk%2BaPgTF1CUJomqxILampy33aSlSFELD%2FQFnmxUo%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=45547&min_rtt=44590&rtt_var=442&sent=417&recv=104&lost=0&retrans=0&sent_bytes=440618&recv_bytes=13332&delivery_rate=490424&cwnd=199200&unsent_bytes=0&cid=b8cb5485a5b7503b&ts=1446&x=1", cfExtPri, cfHdrFlush;dur=0
date: Sat, 26 Apr 2025 10:48:20 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding
last-modified: Thu, 24 Apr 2025 21:51:22 GMT
priority: u=3,i=?0
cache-control: public, max-age=31536000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 936581d5191edb8d-IST
server: cloudflare

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 3DDE 0
0 132ms
131ms Fetch
text/html 142.250.186.34
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CM4yl87kMaKTLLNSOjuwP0orYyQnw8POreJKH_Ir4EsCNtwEQASAAYJn-noa4IYIBF2NhLXB1Yi02Mzk2ODQ0NzQyNDk3MjA4yAEJ4AIAqAMByAMCqgSiAk_Q76Ke2lvUR_XFGqEOm2jCIZjNPVG9LguPbvPhzxyG2Ed85xVLqbX5v9koOUllIqNlRAoY4hSDtRxGwX4pr8QycsMBwVdKpFJSAoKklR59UeRps7y8RHiSUnO1ZQ8tPJftHsHxRcLix9Ha3qXz6sSfd7yCeco8pmpSfYIonwoRsyKUgzXIRfGioLWdJm5BsxVCoirvWhB7rVr32TWiWMRbIBBcudAsWBwrS0NiV_eawhCfYvjOeVivNinPbA8v98x_Z83gMSJ72b75yo50zX0N9aMAhFlVMFG4ZuN4KHfXSTKm8DgBKTFwwtl0UPKeqlgymTEJPjlelKYuYHKl3vHMyJt0diQh1rdODcuwk15vpixwQsCBLGVY6DwpsxNCv6N04AQBgAasqMWn26GPrxegBiGoB6a-G6gHltgbqAe2ubECqAeqm7ECqAf_nrECqAffn7ECqAetvrEC2AcA0gglCIBhEAEyAooCOgyAQIDAgICAgKiAAiBIvf3BOljVkJuDw_WMA4AKA_oLAggBgAwBgA0Bqg0CVFLiDRMIvbubg8P1jAMVVIeDBx1SBTaZ6g0TCP3jnIPD9YwDFVSHgwcdUgU2mdAVAYAXAbIXKgoaEhRwdWItNjM5Njg0NDc0MjQ5NzIwOBi-yQcYDCoKMzM0NTM4Mzc3NA&sigh=leTwmyrkQpY&uach_m=%5BUACH%5D&cid=CAQSYQDZpuyzwCN4uOsfKTq1sd3vh4RV294yyJ_RydfWa-AF8XjGT7A12WjtHsqkaCBFY5_UWAEFgdua95OFVlDp6_BMHss00VjVJk2Y_eZVaqjSIe3knajWrKjWzkv7C3slJ0sYAQ
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.186.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s04-in-f2.1e100.net
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com/

Response headers

GET
H2 200 vTnSl68CAAAAAAAAeJxF0E1v0nAABnA6EJEYs3DC2xInMUbG6BvtEjL7BhRaKFAG5dL8-8rboGsL_1Jj4sGDxx2Np8WP4N3ocdHs5LfwZLIv4HxZ9uQ5_I5PnqyfSe4ieeTZ9fWnr2n0iYkbFdJE0aJFoASJW3SRxvBKhXDMIgEMEpC4QyH-g8wFtXtB5S_T8R3fI...
abs.yandex.ru/ex-event/ Frame 3DDE 0
0 368ms
124ms Fetch 87.250.254.222
YANDEX YANDEX LLC

General

Check archive.org

Download Go to

Full URL: https://abs.yandex.ru/ex-event/vTnSl68CAAAAAAAAeJxF0E1v0nAABnA6EJEYs3DC2xInMUbG6BvtEjL7BhRaKFAG5dL8-8rboGsL_1Jj4sGDxx2Np8WP4N3ocdHs5LfwZLIv4HxZ9uQ5_I5PnqyfSe4ieeTZ9fWnr2n0iYkbFdJE0aJFoASJW3SRxvBKhXDMIgEMEpC4QyH-g8wFtXtB5S_T8R3fIIl3CHKO_Hj7_ufV-bcv-x-QVG4nk_iIPMpmM1epXHKzAPnEbir3PZn9nJyEoRcclUrACA62YGnZ0YG_LgWBV7I39jIslY_NKoUfFuywihWcqhmDmcLILPM_djOerdtwi9OjMQcc9AxOKN2PPaa5EYgi7ofYWUc3zixP5laR2WBbMjOBQGU0WeVhn2dEue7CFs9qMutGpsHyxW7U8RbQaJA6TccRCuhRZdgdDJVmpIedUS2yKMfUVm6PPRGmcCPRjqQOsKYqxJIk-Cd9qqLwtjSna4QnjXlXrM8dYRzAaRzOuCXVY6GtQG5xOgVYUBtE7VkjMkcsrAy1vrbFxH6z5wpDaaXhRkutK3NCCsrFokb0NFlXLHRjuf1W7DalgPE7Y1eOajMemqZsSkGLmBI8OGy3h3HQ5mK5LceorIrMpivhsFJvObDhKq4gUnJNbAz5m1WsuJUZlYy0dfcpyt204FX3XzEDThU7bV3piZzwugCqXJfyT7sMc_c45P9JeJG7D6a-bgVePvU48Te_jvcu0-Vb07d4mWgkxlwe2UOepw2wXNo--rBMohSOkmQZpTH0XrgKweIora79ub1l8xMQ6MbU0oGx2th_5CxWK18_NHYyyAT5DduW0kM,?pr=aAy58wALJaQHg4dUADYFUpotC3ybitv188E3Rw
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 87.250.254.222 , Russian Federation, ASN13238 (YANDEX YANDEX LLC, RU),
Reverse DNS: air.yandex.ru
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com/

Response headers

x-yt-trace-id: 4b6609e3-67061135-5ac45cab-a602bd0d
x-yt-request-id: 1e4fe2c3-48b895a8-fd488ad1-8c768067
content-length: 0

GET
H2 200 loader.js Show response
pcode.yads.tech/pcode-bundles/1247521/air/ Frame 3DDE 295 KB
78 KB 300ms
124ms Script
text/javascript 18.245.46.90
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://pcode.yads.tech/pcode-bundles/1247521/air/loader.js

Requested by

Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.46.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-46-90.fra56.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

37bf6032b7c8f558425059ffc65bbb0e467422a8fbe00475f01a32ae7f5c9698

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: W/"61558cab76c4526e877702e8b59d65c1"
age: 1100089
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: uMpgTFLT2J52xc3Y4ijD4GHrmy-_OkEiRpQvTWII7vaUClDV6Y9GPg==
date: Sun, 13 Apr 2025 17:13:32 GMT
content-type: text/javascript; charset=utf-8
vary: accept-encoding, Origin
last-modified: Wed, 09 Apr 2025 15:18:33 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
cache-control: public, max-age=946708560
referrer-policy: strict-origin-when-cross-origin
via: 1.1 90b31bff657d66dd87e437e4a49bf7a6.cloudfront.net (CloudFront)
x-xss-protection: 1; mode=block
x-amz-cf-pop: FRA56-P9
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20250423/r20110914/client/ Frame 3DDE 3 KB
1 KB 262ms
84ms Script
text/javascript 142.250.185.225
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20250423/r20110914/client/window_focus_fy2021.js

Requested by

Host: e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com
URL: https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f1.1e100.net

Software

cafe /

Resource Hash

1b994e81ed210e3b4c3f3cb8081ef51af130cf67f018be884bee2b3fd26440bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 13535622416105346230
age: 74108
x-content-type-options: nosniff
expires: Fri, 09 May 2025 14:13:12 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Fri, 25 Apr 2025 14:13:12 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 1232
x-xss-protection: 0
server: cafe

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20250423/r20110914/client/ Frame 3DDE 19 KB
8 KB 255ms
78ms Script
text/javascript 142.250.185.225
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20250423/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com
URL: https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f1.1e100.net

Software

cafe /

Resource Hash

dd30b37750df28657b28327eddf6c1070ac35f6f65b88ceae491d74f08cbff31

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 6337841753791346050
age: 74108
x-content-type-options: nosniff
expires: Fri, 09 May 2025 14:13:12 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Fri, 25 Apr 2025 14:13:12 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 7957
x-xss-protection: 0
server: cafe

GET
H2 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-41/js/ Frame 3DDE 25 KB
7 KB 803ms
626ms Script
text/javascript 142.250.185.225
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-41/js/ext.js

Requested by

Host: e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com
URL: https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f1.1e100.net

Software

sffe /

Resource Hash

b7545b5d8b366cf7960d74ef16f2c98425f17d34a392e909bdf5fa53f340b134

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com/

Response headers

content-encoding: br
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
x-content-type-options: nosniff
expires: Sat, 26 Apr 2025 10:48:20 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 26 Apr 2025 10:48:20 GMT
content-type: text/javascript
vary: Accept-Encoding
last-modified: Thu, 30 Jan 2025 19:28:58 GMT
cache-control: private, max-age=300
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
content-length: 6870
x-xss-protection: 0
server: sffe

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 3DDE 220 KB
68 KB 167ms
79ms Script
text/javascript 142.250.185.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com
URL: https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

a798986e0dce849145906cae97bf77a273b5ffb8880fc0f7da14eff4a9b85aea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 4151480097505160345
age: 254
x-content-type-options: nosniff
expires: Sat, 26 Apr 2025 11:44:06 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sat, 26 Apr 2025 10:44:06 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=ISO-8859-1
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 69290
x-xss-protection: 0
server: cafe

GET
H3 200 auctionwinner
googleads.g.doubleclick.net/td/ 0
0 172ms
126ms Fetch
text/html 142.250.186.130
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://googleads.g.doubleclick.net/td/auctionwinner?status=nowinner&winner_qid=CITCnYPD9YwDFf_TEQgdvlUuUw&xfpQid=CLqum4PD9YwDFf_TEQgdvlUuUw&ecrs=Ae0eij0GO3-z08HT1IfH1__KjjHvGSgSmcPyHsRkx7T-LoGbCv7QlyoPBng55dGV_RCkDXMsd9pCOYVmofOLSGjOVji5mb-0rZ101VpzV1BmF3GnYd1VU-1foZaWeWFGz8AMlJAYfU5pvOEJCxDOjOZgoWHZetcI96ZVESAnLS6DKPrZ5fhMmbQLWzESpOYS360tj-JNxtnxRnhYMKrsYR0Qd5G1GFK1CtFBUNIr7Dm8Ocs03MmGxONjKOfiggGGsxjxAn3mwR3tZb7vamsjwqURI6_BQzP5JE5Tq80rNn1pEEJk9xrOrqgcdIA3KADSO7-EafGm3eLXtg5aeLDQ2oZosGNeMLEUgvUb7pRhw6YdoNcSzpJlGEPc9GCsl80ZuwrZ3--XOHbktjAx9jF6UYPqlwpmyYDtKwb-r_K4jKje5ivSyE3JBtnLF_rr_HQwAwdnTBuDgbbK5hhcYi0JWDoVPWYok6dKr1Hv7XgD9v4NxDMWtYSliKepw_mnADm0Ccf5SaUAAXyX9WjP7GbXx6HENiTmhVxFTaJCX4I1s3k1i1XfVFBjCEOV_Shj2Uwg29zX_Hj-cqzIOqPkSbeQBse5QWkOUPwxf1enMTBmccBnU1A3g5QnyPIB-ygsy58Ai4YSpgqcafKCOCQ6ab90Owl2ImeALhyvI9LM5oQ22CWSKZTV12quYI6EdDhX173fjQMsv7KrvTmGZVctBy7507UmvM2lAH1BqOsexjisbJCNCAFLHqlL6okLuRr6jeAFr7UcsLdHF-O-jMU9Cw0sQj8ydbWv3jbe6PkBY9KnXtewC1EpMuop435shsTtlflSvakJFU44edKPv8L5NE_4OCqGFfuxW5vCMV3_JRc0kTKN6moqXdIf86O3Ip5VfWlDHcNH_AGWDgTj0cl8mR-n7EXU6gj07jeqqN6IeRAzCeLi_gsAwyvrLZkQAbAi4r_ptg1coAq0V3tqWwzvVwjEAaqpkeAwySIT4vnA4Eho9ulfShGWzRdvyjmQD952JWRZNz4HP6RnJtntBS6HaMrA8OhEmQih1kPMfATrDNO7hWVKM2TQgYw9eylSZkBj7IbP3tH_b30MAQsSv27y6uoplV5Lz1WLv1Sbca3-oFl9gZbM1ALnOQhPupzZw2KyjhLcqJb3H21RSTozwhTlUI9LUQK2hB-85d1SSrAZmOI-uKfKAqxe-UDbCdYjInJLTjdubXtUR_udWC-II4w9OK59_gj043ihyjqDvNxwWIn9WENOjayO4RLxB9nouDWb-Ez38d706sQgaLOLVRrH35knHS_vYU3JIBIkDXENPa3V9YivhLUfNFtOSPNwCCCgWY9yJUqkbUXh1tQsFX_HmmgZBJIXexHuu9GywccGo21qeRRQ3_wDDAYQZxA8G2DSW21ZyxE42fCVKbUErgyZRkzu0p9_2-HR9VOtfbl4mxAFC_7VfH2O0F1oy3AURwAftbZ1BnwhUTVqWn9X9kRgRVFMbKPbuPQn5JEwhhYSGNCw2dlNc9aXh2qse-jEygv7qZEmV0lMZLgUl-w1u6XayIRtgbA_2y5Ec7Riujdc7brMCSKdGRGwGCGqmY6slXJLeJJjWNzvsYhaBgodJTr3tQgiFPWpW5vRA23VLIP1aux42GchgP0zZsq-w_on4h4EPNt3&cid=CAQSYQDZpuyzzeZRlBFDAQ9E7RL45-KmtGZYnaI1wxIewzf-k-Y9bipcyxrkFFkmFePraAt6uRwlqxAKZ00h3mIQrb64lVYb0ivWQfp1_-mb109Rz8UPzDXrVwxeXH_W_IUEBZcYAQ&applied_timeout_ms=0&duration_ms=6
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504220101/pubads_impl.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.186.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s07-in-f2.1e100.net
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

GET
H3 200 auctionwinner
googleads.g.doubleclick.net/td/ 0
0 169ms
128ms Fetch
text/html 142.250.186.130
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://googleads.g.doubleclick.net/td/auctionwinner?status=nowinner&winner_qid=CMiNnYPD9YwDFe87vwQd6bU5-A&xfpQid=CPOnm4PD9YwDFe87vwQd6bU5-A&ecrs=Ae0eij03_ab1x0hIGsri9w1f4vtJ2CgmtVgBcFY8RgZ7FhuMGhqbwEQagu3JUT9HQxWXvkd6pyu0LyVJKkw_fVclS1h-7GkmWtFBUf7DKty5V_UgQol0Bgp6SOZQ1AhQ6F8zKWWaUs4e4dx3uvPaR0r2rTLPW7m6g__RAeSoyff0IrVTpXGsr-MsK7RmSq1hmKDa-MqgKh7pY097gEgWI_VuqZCgdXKcDuIuWPpepeCq4UYiPdE8ZbndMvTkgPm4YcLgEBNu_NYCklVj2nZAqdN-BYIOlxEMuhgJTgHw3JaXughDoUzd9IBPqzmSyg0EJILs-AGtcI236TEFygFOJB15281OwALQsTXduUsGqm6kIQgsfm6vAmVa-hs3-dLZaZ3jZBxAyrFFINIhol-2qsJYlYZLMu357mp2jA2rmOEDGnZ61HhPktWO7SiTf08Jt1eCjWUV4KgLbU_IzcclVVMrx8L2OCHQrqkrGLY_aWswubb4r3lbJO7M1L8mvSpl4tqP_RK262hu5YKiXsOS57X9s2wyQDn2Z329coW6KHghhjYzjdlg-YZCD5rrsEy12JDipOzQTbKWnpF7Toi7Lr0UL3RDZZcJYiKsB5nOvxAWDZVp7Iiffjkx-xukB3P-jFA9jaJc_3PXt-O6AQVMPwEW6ZGFUCiBhz3562XMLu_HvoSU0SGtHzkodZ9srKMqagg8TnE6wF_7GjI5j7bgUG_kCAi4hjn84BTMOXH8T1TUwx_VF7IoZmufgkApag3yNAbyURd-apNc4A1rtGRsn6cS7njZBuyBmxsI4c-nYZqwEawa9chtAHC2mA7kBNQV97plqPQ59p2sUUShTgdxqNgvscaJK9Wzal-cCMq5YADun9ss-uZVmmvH23Ncob15QxOtU97YVRRfhdu_ibwb2ZxrbQBNt7V2I2EwyL4rbE9p2TfEcJwHUpeQ58Fo6rl7P_Paj6u3pnhSHHQFQ0mvhH4VG6raHtQ7vhJIwWvnoukv7qIKUu98EkHzCAySmkYyaxtuy4jd85DGS8_YB98uQ6zpVkrgaocQrbbZJibJpz89ybrL0rMMm7RRYGNHF1LbTGBcizKKQzaQ4BsxCFXEqe4coXUtUOa4x_4RQEPehRxPnausrKMEXl1yI5Jexepocia2l6qiiKgLSARSTImUyTtgJQUo0RwTw17EZmk6sGrcCixYBq7xGJ3wJFBNySC0Di2gUP6RGDG26BAk2pDFIQf_onmgd3NSqlg9colGVt-9S3QuYIvw8A&cid=CAQSYADZpuyz2Os18jCz0er6_OrXU8o5Uboi-_PIQcism3bu5i4LxE5Q48FGd7BgayG4HMy3jtYRP734zxkLgz8jH1nHWg-KFI7xk4Q7K9H4c3wcuT0CQ0RyP1t_klrUmg_LBhgB&applied_timeout_ms=0&duration_ms=7
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504220101/pubads_impl.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.186.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s07-in-f2.1e100.net
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

GET
H3 200 container.html Show response
e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com/safeframe/1-0-41/html/ Frame AD50 7 KB
0 0ms
0ms Document
text/html 142.250.185.97
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504220101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f1.1e100.net

Software

sffe /

Resource Hash

c173503f8ae4fdbb42c06c514edf25e62e81503e418ee3a0cdbd884e1a741444

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.mediafire.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 3024
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 26 Apr 2025 10:48:19 GMT
expires: Sat, 26 Apr 2025 10:48:19 GMT
last-modified: Thu, 30 Jan 2025 19:28:58 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame AD50 0
0 131ms
130ms Fetch
text/html 142.250.186.34
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=C7oSj87kMaOGcLOeOjuwPmZLDWfDw86t4kof8ivgSwI23ARABIABgmf6ehrghggEXY2EtcHViLTYzOTY4NDQ3NDI0OTcyMDjIAQngAgCoAwHIAwKqBKICT9AGWvO5E_JCPo-Ozg7MNzfutnCT6f5xAAVsk6fzZkkM-ZZbCwiZHseHCytyUaWofBr5o4_nlUFBZTUho2S3--uWZxyVS-emcVxC650z-hu7fVNdQM8tAgU4Wx1rOqGZkEX9u8k5-VcsKKGbyBQOENDsr7a3NF9-b2jBsWeQ7RMIzPQ3hK2IY3eVM_XSZY3dikdp5lNbeizc_5invMyTJy5k8EIytyhiCGsvnqBjHONeL2gzuCiJbVaYSIh_j0p_ELu1TvOrFLgkSECBnejhKPj6hjGsTgR1TqgmJ7gpiRw_mLC-xkiKuBs1vdevJD4J0hRcHPtPyqwubZen7_sfEAey3QbjWTVPBciZ549awsdRK689SSesHBjkfwra1zWWb-XgBAGABtqd0IHU8O3Q2AGgBiGoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7ECqAetvrEC2AcA0gglCIBhEAEyAooCOgyAQIDAgICAgKiAAiBIvf3BOliniZuDw_WMA4AKA_oLAggBgAwBqg0CVFLiDRMI5babg8P1jAMVZ4eDBx0ZyTAL6g0TCI68nIPD9YwDFWeHgwcdGckwC9AVAYAXAbIXKgoaEhRwdWItNjM5Njg0NDc0MjQ5NzIwOBi-yQcYDCoKMzM0NTM4Mzc3NA&sigh=FfuXCiDcznY&uach_m=%5BUACH%5D&cid=CAQSYADZpuyzbepQKnfv8HVNz_qsg6oi6tO8gPJtSnJ-Ez0n-_qYhKeWTkqIyauSz9Jd_7NjTsrwtp5eW9QndNEeHsBXOvHk1L4Ln2pD365phCrmFXv8g8qpuu2xQ17y-h_yJBgB
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.186.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s04-in-f2.1e100.net
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com/

Response headers

GET
H2 200 Bv-QlawCAAAAAAAAeJxF0E1v0nAAx3E6EJEYs3DC22ImMUYG9Il2CZn__ltaCh2MstH10pQ-8lSgLbTFmHjw4HFnj74Erx70iL4LE08mJiZ7Az4u-54-l9_ll1_l0vtIEXlyff3-UxZ9ZNqoQdaMskng9Zql42XK1inDqNJlEidoytQJCvHv5XbY_g4r7rLbW75CU...
abs.yandex.ru/ex-event/ Frame AD50 0
0 309ms
127ms Fetch 87.250.254.222
YANDEX YANDEX LLC

General

Check archive.org

Download Go to

Full URL: https://abs.yandex.ru/ex-event/Bv-QlawCAAAAAAAAeJxF0E1v0nAAx3E6EJEYs3DC22ImMUYG9Il2CZn__ltaCh2MstH10pQ-8lSgLbTFmHjw4HFnj74Erx70iL4LE08mJiZ7Az4u-54-l9_ll1_l0vtIEXlyff3-UxZ9ZNqoQdaMskng9Zql42XK1inDqNJlEidoytQJCvHv5XbY_g4r7rLbW75CUm8Q5Ar5_nr34-vVl4-Hb5FMYS-Xeoc8yOdz3zKFdKAHxdR-pvA5nf-QdsNwGRxXKvooOEp0z7TiI39dCYJlxdpYXlipnRgNCq-WrLCBlewGacI-FkkM-J8lbifW6UWCrzEW6ja6ilxK87dLIG44gloPZmucLisXyfysPWk6hrCIoMCIEnRirsfgEnAimQULiXcinm32A6FHsALJD2BgezTm9QS1Tluhetq_lNodYkF37CmNUyrTB2N-JTZdS1mRypxYyXN1PByq8mpGJDZPDUTU4GOjO5wxagflFE6U6852uQGKoTARTGJ3Fk7aSiCcx9JEiA0l9qrD1nowjoctkXHaww4n4_WxytuXVG-CmYbKjPRg4w8YIDsJTCZix4ccNFzj954FikWBbrDqzwlWrkk0jAIabiXaqaJSh4Oa1CUcTxI10HJ7EisaoNnCeGZqS2wLAmnSGcrVxygsLRuHL8A5HLS6p1qv34Lcy5LegGeUPz8D4PbviP0n7lnhrj72NTNYFjMPU3_7eXKwy9ZuTN_geUpIqbCIHCBPsyPd8ywfvV8jUQpHSbKG0hh6J1yE-uw4O1j7Uythiq4eaKOxqemjxcb6I3u2WPhadbSXQ1zkF_uD0Os,?pr=aAy58wALDmEHg4dnADDJGUwFg5Wz4s0noC-b_w
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 87.250.254.222 , Russian Federation, ASN13238 (YANDEX YANDEX LLC, RU),
Reverse DNS: air.yandex.ru
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com/

Response headers

x-yt-trace-id: a705f52b-f04563c8-3b61c0a0-e2c95c48
x-yt-request-id: c5367d65-a9aab49b-8f787036-b4f4f4ce
content-length: 0

GET
H2 200 loader.js Show response
pcode.yads.tech/pcode-bundles/1247521/air/ Frame AD50 295 KB
0 237ms
237ms Script
text/javascript 18.245.46.90
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://pcode.yads.tech/pcode-bundles/1247521/air/loader.js

Requested by

Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.46.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-46-90.fra56.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

37bf6032b7c8f558425059ffc65bbb0e467422a8fbe00475f01a32ae7f5c9698

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: W/"61558cab76c4526e877702e8b59d65c1"
age: 1100089
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: uMpgTFLT2J52xc3Y4ijD4GHrmy-_OkEiRpQvTWII7vaUClDV6Y9GPg==
date: Sun, 13 Apr 2025 17:13:32 GMT
content-type: text/javascript; charset=utf-8
vary: accept-encoding, Origin
last-modified: Wed, 09 Apr 2025 15:18:33 GMT
x-frame-options: SAMEORIGIN
cache-control: public, max-age=946708560
referrer-policy: strict-origin-when-cross-origin
via: 1.1 90b31bff657d66dd87e437e4a49bf7a6.cloudfront.net (CloudFront)
x-xss-protection: 1; mode=block
x-amz-cf-pop: FRA56-P9
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20250423/r20110914/client/ Frame AD50 3 KB
0 198ms
198ms Script
text/javascript 142.250.185.225
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20250423/r20110914/client/window_focus_fy2021.js

Requested by

Host: e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com
URL: https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f1.1e100.net

Software

cafe /

Resource Hash

1b994e81ed210e3b4c3f3cb8081ef51af130cf67f018be884bee2b3fd26440bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 13535622416105346230
age: 74108
x-content-type-options: nosniff
expires: Fri, 09 May 2025 14:13:12 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Fri, 25 Apr 2025 14:13:12 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 1232
x-xss-protection: 0
server: cafe

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20250423/r20110914/client/ Frame AD50 19 KB
0 192ms
192ms Script
text/javascript 142.250.185.225
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20250423/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com
URL: https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f1.1e100.net

Software

cafe /

Resource Hash

dd30b37750df28657b28327eddf6c1070ac35f6f65b88ceae491d74f08cbff31

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 6337841753791346050
age: 74108
x-content-type-options: nosniff
expires: Fri, 09 May 2025 14:13:12 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Fri, 25 Apr 2025 14:13:12 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 7957
x-xss-protection: 0
server: cafe

GET
H2 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-41/js/ Frame AD50 25 KB
0 740ms
740ms Script
text/javascript 142.250.185.225
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-41/js/ext.js

Requested by

Host: e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com
URL: https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f1.1e100.net

Software

sffe /

Resource Hash

b7545b5d8b366cf7960d74ef16f2c98425f17d34a392e909bdf5fa53f340b134

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com/

Response headers

content-encoding: br
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
x-content-type-options: nosniff
expires: Sat, 26 Apr 2025 10:48:20 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 26 Apr 2025 10:48:20 GMT
content-type: text/javascript
vary: Accept-Encoding
last-modified: Thu, 30 Jan 2025 19:28:58 GMT
cache-control: private, max-age=300
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
content-length: 6870
x-xss-protection: 0
server: sffe

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame AD50 220 KB
0 106ms
106ms Script
text/javascript 142.250.185.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com
URL: https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

a798986e0dce849145906cae97bf77a273b5ffb8880fc0f7da14eff4a9b85aea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 4151480097505160345
age: 254
x-content-type-options: nosniff
expires: Sat, 26 Apr 2025 11:44:06 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sat, 26 Apr 2025 10:44:06 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=ISO-8859-1
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 69290
x-xss-protection: 0
server: cafe

GET
H2 200 script-load
ingestion-router-api.ccgateway.net/v1/event/record/ 0
44 B 178ms
172ms Image
text/plain 3.237.175.195
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ingestion-router-api.ccgateway.net/v1/event/record/script-load?engttl=60&engcount=0&engid=2e8aadfe-8536-4c5a-8861-acc112744d45&prevPvid=&pageVisits=1&landingUrl=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F0z4njtfe7z5sca3%2FEX13_RP8-FP.rar%2Ffile&extReferer=&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F0z4njtfe7z5sca3%2FEX13_RP8-FP.rar%2Ffile&pvid=72af4a96-6832-429c-b22b-cedb933cdc11&ccuid=f0344ebd-6fbe-4bdf-ab54-b54c0d278c3c&sid=025f28ab-fc9c-47b5-9f13-e0b0827f7933&nct=1745664500000&r=&ns=true&lang=tr-TR&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F135.0.0.0%20Safari%2F537.36&devicefp=195.88.86.189%3A2&browserCache=true&localCache=false&cookieType=0&nocookies=false&ios=false&parentId=0dae949f4b&scriptId=www.mediafire.com&skey=446e33fe-4731-4085-a4a3-1097b35452e6&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F0z4njtfe7z5sca3%2FEX13_RP8-FP.rar%2Ffile
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.237.175.195 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-237-175-195.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

date: Sat, 26 Apr 2025 10:48:20 GMT
content-length: 0

GET
H3 200 banner_db.php Show response
fundingchoicesmessages.google.com/f/AGSKWxVVuojGx1Pc39hAO8kI8hiqAgDR5ADCACt13jLIlmWrktO8GdDNZsz6-t3goX5HiWU2HvsvTB4uuhrdZMc-LLOUX0VzGbuikWE6om1g9_rtZOvBZmR_ukSFerhzB90LLLEAAFHvcNm5Cc6dH4UoKZ_013MUw... 54 B
109 B 95ms
95ms Script
application/javascript 142.250.184.206
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxVVuojGx1Pc39hAO8kI8hiqAgDR5ADCACt13jLIlmWrktO8GdDNZsz6-t3goX5HiWU2HvsvTB4uuhrdZMc-LLOUX0VzGbuikWE6om1g9_rtZOvBZmR_ukSFerhzB90LLLEAAFHvcNm5Cc6dH4UoKZ_013MUwFR3_WlcmHpGTRIW5AJe_PHeiJEavOJM/_/Ads/Refresher./externalad./banner_db.php?/html/ads_?bannerXGroupId=

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.tr.iCXLdUr9n0U.es5.O/d=1/exm=kernel_loader,loader_js_executable/ed=1/rs=AJlcJMx33TfqXOkz4ovzXLrLmOe_QovRhg/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.206 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f14.1e100.net

Software

ESF /

Resource Hash

1ed5f71318c84661ff6156c7e5a9a63408a51cee9f3ff31ec226db9a2c2ea5f5

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-gc3SgSrBz7274R-5Lm8I0g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 26 Apr 2025 10:48:20 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjStDikmJw05BiaL15jnUqEButPc_qBMSGCpdYHYH4_rpLrM-B-EP9ZdYfQFwkcYW1CYg_Vd1gFaq-wRqbdpM1FYh7995kvXHkJuuajbdYtwBxk_Zt1i4gFuLh-PJ50wE2gQ1Tl25iVNJIyi-MT87PKynKTCotyS9KS05LLU4tKkstijcyMDI1MDEy0TMwiC8wAACrHj-I"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-gc3SgSrBz7274R-5Lm8I0g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 153 KB
52 KB 186ms
100ms Script
text/javascript 142.250.185.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?fcd=true

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

c2ca8116f6c0c1149b713c208d71a99214885d4d0b7cadfca4600cba2770065f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: br
etag: 10374008333295271073
x-content-type-options: nosniff
expires: Sat, 26 Apr 2025 10:48:20 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sat, 26 Apr 2025 10:48:20 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
link: <https://googleads.g.doubleclick.net>; rel="preconnect"; crossorigin
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 52752
x-xss-protection: 0
server: cafe

POST
H3 204 AGSKWxUbIcarlbAXcvxGC7lKCSbtM2GUWgA_vK7NNuctdNSjXVoQftcDS456q5kfQt4AEacydR806XYhhkmuYfFHZiu3VOU3NUMMbR-jzPs7vhWImUWgjdFZkE4yTtz4-yeJicmPYJXTzA== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 201ms
100ms XHR
text/html 142.250.184.206
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUbIcarlbAXcvxGC7lKCSbtM2GUWgA_vK7NNuctdNSjXVoQftcDS456q5kfQt4AEacydR806XYhhkmuYfFHZiu3VOU3NUMMbR-jzPs7vhWImUWgjdFZkE4yTtz4-yeJicmPYJXTzA==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.206 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f14.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-Ubxcz6K9chtrT5Mv211ERw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://www.mediafire.com/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 26 Apr 2025 10:48:20 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtDikmII1JBi-FB_mfUHEAvxcHz5vOkAm8CL25seMCq5JOUXxifn55Wk5pXoJqYU64LYRZlJpSX5RSjs1DKQipz89PTMvPR4IwMjUwMTIxM9A7P4AgMAvFklnA"
content-security-policy: script-src 'report-sample' 'nonce-Ubxcz6K9chtrT5Mv211ERw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://www.mediafire.com
content-length: 0
x-xss-protection: 0
server: ESF

GET
H3 200 fc2c603440c2d325f842.js Show response
pcode.yads.tech/pcode-bundles/1247521/air/ Frame AD50 699 KB
156 KB 165ms
82ms Script
text/javascript 18.245.46.90
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://pcode.yads.tech/pcode-bundles/1247521/air/fc2c603440c2d325f842.js

Requested by

Host: pcode.yads.tech
URL: https://pcode.yads.tech/pcode-bundles/1247521/air/loader.js

Protocol

Security

QUIC, , AES_128_GCM

Server

18.245.46.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-46-90.fra56.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

6671c632aa8365a3588e7276803c7f0f1aa00cfc94fd9b16caa5eac5b1a9c624

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Origin: https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com
Referer: https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com/

Response headers

access-control-expose-headers: *
content-encoding: br
etag: W/"5bb0113300fc0f77c352c6e49409ded5"
age: 1100089
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: erHHXQmT6FR-WIwVSMLZKNHWyCv60eFWmIpHy8D0O285nnj57-qA1w==
date: Sun, 13 Apr 2025 17:13:32 GMT
content-type: text/javascript; charset=utf-8
vary: accept-encoding
last-modified: Wed, 09 Apr 2025 15:18:33 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
cache-control: public, max-age=946708560
referrer-policy: strict-origin-when-cross-origin
via: 1.1 3a52599b74209adc8297b59f7eaa4bce.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 1; mode=block
x-amz-cf-pop: FRA56-P9
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 text-variable-full.woff2
yastatic.net/s3/home/fonts/ys/3/ Frame AD50 25 KB
26 KB 342ms
113ms Font
font/woff2 37.9.64.225
YANDEX YANDEX LLC

General

Check archive.org

Download Go to

Full URL

https://yastatic.net/s3/home/fonts/ys/3/text-variable-full.woff2

Requested by

Host: pcode.yads.tech
URL: https://pcode.yads.tech/pcode-bundles/1247521/air/loader.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

37.9.64.225 , Russian Federation, ASN13238 (YANDEX YANDEX LLC, RU),

Reverse DNS

cloud.cdn.yandex.net

Software

nginx /

Resource Hash

033696b7f1ac04d1dcc102be84550e146236ceffc25a6cabc12aa51a6ee410b9

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Origin: https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com
Referer: https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com/

Response headers

x-request-id: 52d7053ed4c35b4d
etag: "7f0cdaf91230f9789ca4162aedff612e"
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
expires: Sun, 26 Apr 2026 16:34:53 GMT
date: Sat, 26 Apr 2025 10:48:20 GMT
content-type: font/woff2
last-modified: Mon, 25 Apr 2022 14:02:39 GMT
vary: Accept-Encoding
cache-host: cloudcdn-m9-5.cdn.yandex.net
strict-transport-security: max-age=43200000; includeSubDomains;
cache-control: public, max-age=31556952
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
timing-allow-origin: *
x-amz-meta-owner: {"role":"admin","login":"4eb0da"}
x-nginx-request-id: 2e290827cfacdf3c
accept-ranges: bytes
access-control-allow-origin: *
content-length: 26004
x-strm-log-split: 3
cache-status: HIT
server: nginx

GET
H2 200 host.js Show response
yastatic.net/safeframe-bundles/0.83/ Frame AD50 33 KB
9 KB 434ms
216ms Script
text/javascript 37.9.64.225
YANDEX YANDEX LLC

General

Check archive.org

Download Go to

Full URL

https://yastatic.net/safeframe-bundles/0.83/host.js

Requested by

Host: pcode.yads.tech
URL: https://pcode.yads.tech/pcode-bundles/1247521/air/loader.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

37.9.64.225 , Russian Federation, ASN13238 (YANDEX YANDEX LLC, RU),

Reverse DNS

cloud.cdn.yandex.net

Software

nginx /

Resource Hash

34806ef573086241dd1a596a860b0295b51c24f1c37eab36eb9d0665683abb55

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Origin: https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com
Referer: https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com/

Response headers

x-robots-tag: noindex, noarchive, nofollow
x-request-id: 3ea20a2fab17519e
content-encoding: br
etag: "f80882bf67cf261aa08d636da095149a"
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
expires: Mon, 26 Apr 2055 17:21:41 GMT
date: Sat, 26 Apr 2025 10:48:20 GMT
content-type: text/javascript; charset=utf-8
last-modified: Wed, 03 Nov 2021 13:42:58 GMT
vary: Accept-Encoding
cache-host: cloudcdn-m9-5.cdn.yandex.net
strict-transport-security: max-age=43200000; includeSubDomains;
cache-control: public, max-age=946708560
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
timing-allow-origin: *
accept-ranges: bytes
access-control-allow-origin: *
content-length: 8878
x-strm-log-split: 3
cache-status: HIT
server: nginx

POST
H2 200 / Show response
display.yads.tech/ads/render/ Frame AD50 42 KB
10 KB 364ms
164ms XHR
application/json 13.248.176.26
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://display.yads.tech/ads/render/?target-ref=https%3A%2F%2Fwww.mediafire.com%2F&pcode-version=1247521&pcodever=1247521&comboblock-unencoded-vast=1&ad-session-id=9854421745664500392&target-id=86043245&disable-base64=1&imp-id=1&banner-lang=en&ecma-version=es2017&same-node-hit-number=0&test-tag=158879430218754&tga-with-creatives=1&top-ancestor=https%3A%2F%2Fwww.mediafire.com&top-ancestor-undetermined=0&layout-config=%7B%22win_width%22%3A336%2C%22win_height%22%3A280%2C%22pixel_ratio%22%3A1%2C%22bandwidth%22%3A10%2C%22isInIframe%22%3Atrue%2C%22w%22%3A336%2C%22h%22%3A280%2C%22width%22%3A336%2C%22height%22%3A280%2C%22visible%22%3A1%2C%22fullscreenHeaderHeight%22%3A80%2C%22left%22%3A0%2C%22top%22%3A0%2C%22sspInfo%22%3A%7B%22deviceSizeSsp%22%3A%7B%7D%2C%22requestedSize%22%3A%7B%22width%22%3A336%2C%22height%22%3A280%7D%7D%2C%22ad_no%22%3A0%2C%22safeArea%22%3A%7B%22top%22%3A0%2C%22bottom%22%3A0%2C%22left%22%3A0%2C%22right%22%3A0%7D%2C%22req_no%22%3A0%7D&grab-orig-len=0&uniformat=true&callback=Ya%5B3205397440003%5D&

Requested by

Host: pcode.yads.tech
URL: https://pcode.yads.tech/pcode-bundles/1247521/air/loader.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.248.176.26 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

a20e0f9587322a99e.awsglobalaccelerator.com

Software

Resource Hash

6e71a0c1bf79458c3050fd9c4e6d3c01e103e17752bbb3dec97b077a8f412835

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-request-id: 1383086cbd63c1e5e4c08c38c98eea2c
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
content-encoding: br
etag: W/"a7e1-Be+GXQTuTgKV6vw4zEUdI+j/Gc4"
access-control-allow-credentials: true
access-control-allow-methods: *
x-content-type-options: nosniff
access-control-allow-origin: https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com
date: Sat, 26 Apr 2025 10:48:20 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
access-control-allow-headers: *

GET
H3 200 fc2c603440c2d325f842.js Show response
pcode.yads.tech/pcode-bundles/1247521/air/ Frame 3DDE 699 KB
0 151ms
151ms Script
text/javascript 18.245.46.90
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://pcode.yads.tech/pcode-bundles/1247521/air/fc2c603440c2d325f842.js

Requested by

Host: pcode.yads.tech
URL: https://pcode.yads.tech/pcode-bundles/1247521/air/loader.js

Protocol

Security

QUIC, , AES_128_GCM

Server

18.245.46.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-46-90.fra56.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

6671c632aa8365a3588e7276803c7f0f1aa00cfc94fd9b16caa5eac5b1a9c624

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Origin: https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com
Referer: https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com/

Response headers

access-control-expose-headers: *
content-encoding: br
etag: W/"5bb0113300fc0f77c352c6e49409ded5"
age: 1100089
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: erHHXQmT6FR-WIwVSMLZKNHWyCv60eFWmIpHy8D0O285nnj57-qA1w==
date: Sun, 13 Apr 2025 17:13:32 GMT
content-type: text/javascript; charset=utf-8
vary: accept-encoding
last-modified: Wed, 09 Apr 2025 15:18:33 GMT
x-frame-options: SAMEORIGIN
cache-control: public, max-age=946708560
referrer-policy: strict-origin-when-cross-origin
via: 1.1 3a52599b74209adc8297b59f7eaa4bce.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 1; mode=block
x-amz-cf-pop: FRA56-P9
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 text-variable-full.woff2
yastatic.net/s3/home/fonts/ys/3/ Frame 3DDE 25 KB
0 330ms
330ms Font
font/woff2 37.9.64.225
YANDEX YANDEX LLC

General

Check archive.org

Download Go to

Full URL: https://yastatic.net/s3/home/fonts/ys/3/text-variable-full.woff2
Requested by: Host: pcode.yads.tech
URL: https://pcode.yads.tech/pcode-bundles/1247521/air/loader.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 37.9.64.225 , Russian Federation, ASN13238 (YANDEX YANDEX LLC, RU),
Reverse DNS: cloud.cdn.yandex.net
Software: nginx /
Resource Hash: 033696b7f1ac04d1dcc102be84550e146236ceffc25a6cabc12aa51a6ee410b9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Origin: https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com
Referer: https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com/

Response headers

x-request-id: 52d7053ed4c35b4d
etag: "7f0cdaf91230f9789ca4162aedff612e"
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
expires: Sun, 26 Apr 2026 16:34:53 GMT
date: Sat, 26 Apr 2025 10:48:20 GMT
content-type: font/woff2
last-modified: Mon, 25 Apr 2022 14:02:39 GMT
vary: Accept-Encoding
cache-host: cloudcdn-m9-5.cdn.yandex.net
cache-control: public, max-age=31556952
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
timing-allow-origin: *
x-amz-meta-owner: {"role":"admin","login":"4eb0da"}
x-nginx-request-id: 2e290827cfacdf3c
accept-ranges: bytes
access-control-allow-origin: *
content-length: 26004
x-strm-log-split: 3
cache-status: HIT
server: nginx

GET
H2 200 host.js Show response
yastatic.net/safeframe-bundles/0.83/ Frame 3DDE 33 KB
0 430ms
430ms Script
text/javascript 37.9.64.225
YANDEX YANDEX LLC

General

Check archive.org

Download Go to

Full URL: https://yastatic.net/safeframe-bundles/0.83/host.js
Requested by: Host: pcode.yads.tech
URL: https://pcode.yads.tech/pcode-bundles/1247521/air/loader.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 37.9.64.225 , Russian Federation, ASN13238 (YANDEX YANDEX LLC, RU),
Reverse DNS: cloud.cdn.yandex.net
Software: nginx /
Resource Hash: 34806ef573086241dd1a596a860b0295b51c24f1c37eab36eb9d0665683abb55

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Origin: https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com
Referer: https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com/

Response headers

x-robots-tag: noindex, noarchive, nofollow
x-request-id: 3ea20a2fab17519e
content-encoding: br
etag: "f80882bf67cf261aa08d636da095149a"
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
expires: Mon, 26 Apr 2055 17:21:41 GMT
date: Sat, 26 Apr 2025 10:48:20 GMT
content-type: text/javascript; charset=utf-8
last-modified: Wed, 03 Nov 2021 13:42:58 GMT
vary: Accept-Encoding
cache-host: cloudcdn-m9-5.cdn.yandex.net
cache-control: public, max-age=946708560
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
timing-allow-origin: *
accept-ranges: bytes
access-control-allow-origin: *
content-length: 8878
x-strm-log-split: 3
cache-status: HIT
server: nginx

POST
H2 200 / Show response
display.yads.tech/ads/render/ Frame 3DDE 42 KB
10 KB 327ms
132ms XHR
application/json 13.248.176.26
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://display.yads.tech/ads/render/?target-ref=https%3A%2F%2Fwww.mediafire.com%2F&pcode-version=1247521&pcodever=1247521&comboblock-unencoded-vast=1&ad-session-id=2848341745664500399&target-id=87703570&disable-base64=1&imp-id=1&banner-lang=en&ecma-version=es2017&same-node-hit-number=0&test-tag=158879430218754&tga-with-creatives=1&top-ancestor=https%3A%2F%2Fwww.mediafire.com&top-ancestor-undetermined=0&layout-config=%7B%22win_width%22%3A336%2C%22win_height%22%3A280%2C%22pixel_ratio%22%3A1%2C%22bandwidth%22%3A10%2C%22isInIframe%22%3Atrue%2C%22w%22%3A336%2C%22h%22%3A280%2C%22width%22%3A336%2C%22height%22%3A280%2C%22visible%22%3A1%2C%22fullscreenHeaderHeight%22%3A80%2C%22left%22%3A0%2C%22top%22%3A0%2C%22sspInfo%22%3A%7B%22deviceSizeSsp%22%3A%7B%7D%2C%22requestedSize%22%3A%7B%22width%22%3A336%2C%22height%22%3A280%7D%7D%2C%22ad_no%22%3A0%2C%22safeArea%22%3A%7B%22top%22%3A0%2C%22bottom%22%3A0%2C%22left%22%3A0%2C%22right%22%3A0%7D%2C%22req_no%22%3A0%7D&grab-orig-len=0&uniformat=true&callback=Ya%5B6307232895645%5D&

Requested by

Host: pcode.yads.tech
URL: https://pcode.yads.tech/pcode-bundles/1247521/air/loader.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.248.176.26 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

a20e0f9587322a99e.awsglobalaccelerator.com

Software

Resource Hash

90ff447725b75ca9f4e22bf08799aa7963fbca98a509359d96a77b82c39a7d6d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-request-id: dcf7ec549f0a8b49c182f93b2d593d56
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
content-encoding: br
etag: W/"a750-a4ZfvWfIefR3cGNA5EF85LdmQho"
access-control-allow-credentials: true
access-control-allow-methods: *
x-content-type-options: nosniff
access-control-allow-origin: https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com
date: Sat, 26 Apr 2025 10:48:20 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
access-control-allow-headers: *

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 411 B
190 B 331ms
330ms Fetch
text/plain 142.250.186.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=5966717732066796&correlator=1650069068883913&eid=31086815%2C31090592%2C83321072%2C31091673%2C95340253%2C95340255&output=ldjh&gdfp_req=1&vrg=202504220101&ptt=17&impl=fif&gdpr=0&us_privacy=1---&gpp_sid=-1&iu_parts=1254144%3A183096492%2Cmediafire_com-edge-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C160x600&fluid=height&ifi=7&didk=2994425013&dids=div-gpt-ad-mediafire_com-edge-&adfs=1145427683&sfv=1-0-41&rcs=1&eri=1&sc=1&cookie=ID%3D10dade855c8dff6b%3AT%3D1745664499%3ART%3D1745664499%3AS%3DALNI_Ma_1Fpvm5ahLciUmw4fdswd_99oyg&gpic=UID%3D00001090e6cf4f86%3AT%3D1745664499%3ART%3D1745664499%3AS%3DALNI_Mbo-mfP4WIQHZ6MctbqnhRKNw10vA&abxe=1&dt=1745664500408&lmt=1745664500&adxs=1440&adys=300&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=5&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=180&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F0z4njtfe7z5sca3%2FEX13_RP8-FP.rar%2Ffile&vis=1&aee=1&psz=160x-1&msz=160x-1&fws=512&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGsl3RkXoEw02nSgSF0wfZw3h9DaRSF8cKpBHIdgl_E1y&topics=3&tps=3&htps=10&a3p=EjQKCnB1YmNpZC5vcmcSJGVjM2VmZjY4LTBlMWEtNDExMi04ZTIxLWY4YmQzNjFjNDIwZFgBEloKDWNyd2RjbnRybC5uZXQSQDIwMzNiYjg1ZGI2ODk1MjYzMjY1YThhY2Y0ZmIxODVjYTAyY2U4ZGEyMWExNzFlZDllMTZjODlhNDliMTQ4ODAYt8HZjecySAASHQoOZXNwLmNyaXRlby5jb20Yob_ZjecySABSAghkEhgKCXlhaG9vLmNvbRivwdmN5zJIAFICCG8SGQoKdWlkYXBpLmNvbRihv9mN5zJIAFICCGQSVgoMaWQ1LXN5bmMuY29tEkRJRDUqS3VHeDBOZlpnaWVORnpjZE1IYmRjTlhQdTl2c0xMR1pvR2tadU9XYUlhVVNqNG9HMUwwUEZwaU5meUlNUGtmdlgBEhQKBW9wZW54GNTA2Y3nMkgAUgIIbxIbCgwzM2Fjcm9zcy5jb20Yob_ZjecySABSAghkEoICCghydGJob3VzZRLsAWFhUjdOeEpVREtnV2tnOFlKZzFVQjZ2Y0JrMFJQMEdYbWVoM0NGZE9XczY4ZGh4M0x0dFhqODcxeVJTUnI3RlVLcEFJWExRT1hpMzJZMktJbFA0M1N6SFdWUVEvdXozRi90clo0dWdsSXh4VnNoTkJBUi9PVWhZM05ZSW0zellsUURWVXh2cEcwT3EvbE1haC82c2hxampVTDlTSEc4aHRwWUhaQWlRbzBnRW53Y0d4b0RwTmJENktoMmlSOFZQejAvUmJsSG1Ecnd6QVMvS1pMak8vYk9pY3VCdDFEdE5CWlN6NXh3ZnFWYm89GO3C2Y3nMkgA&nt=1&psd=WzMxLFtudWxsLFtbIi8xMjU0MTQ0LDE4MzA5NjQ5Mi9tZWRpYWZpcmVfY29tLWVkZ2UtMiIsW1s0MTQyNzk3MTY1LDEwNDgzNTkwNzUsMzMwMDE3ODU3Nl1dXV1dLG51bGwsM10.&dlt=1745664497579&idt=1785&ppid=e1c37ebfc1a9a27cfae119775cae22e8&prev_scp=a%3D1%26iid1%3D4932720536473080%26eid%3D4932720536473080%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D0%26ap%3D1102%26sap%3D1102%26as%3Drevenue%26plat%3D1%26bra%3Dmod31-c%26ic%3D2%26at%3Dbf%26adr%3D399%26ezosn%3D1%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D39%26al%3D1039%26compid%3D0%26tap%3Dmediafire_com-edge-2-4932720536473080%26eb_br%3Dzero%26eba%3D0%26bv%3D38%26bvm%3D4%26bvr%3D0%26avc%3D7%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D0%26br2%3D4%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D157%2C168%2C0%2C0%2C0%2C193%2C196%2C20%2C0%2C0%2C192%2C31%2C902%2C903%2C901%2C902%2C903%26deal1%3D17%2C18%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1428%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C2764%2C2765%2C3044%2C3045%2C3052%2C3053%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C3856%2C4184%2C4186%2C4276%2C5747%2C6293%2C6294%2C6295%2C7035%2C7036%2C7330%2C7331%2C7605%2C7606%2C7607%2C7608%2C7609%2C7610%2C7611%2C7612%2C7613%2C7614%2C7615%2C7616%2C7617%2C7618%2C6772%2C5534%2C7661%2C7713%26adxf%3D1%26lb%3D10%26ss38%3D1%26ss9%3D1%26reqt%3D1745664500022&cust_params=carbon_segment%3D&adks=3081006461&frm=20&eo_id_str=ID%3D3c90627c638c6682%3AT%3D1745664499%3ART%3D1745664499%3AS%3DAA-AfjacEzd8vr0aExHgjT2vBZ_B&pbbce=1&td=1&egid=38815&tan=a9d4574a-b146-43f0-b55d-8d6d45dae5ef&tdf=2

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504220101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

f71e7883010774fb54f616ed345e0ab93dc65fd98f20af75f13fe4bd116f5aee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: dcb
google-lineitem-id: -2
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Sat, 26 Apr 2025 10:48:20 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.mediafire.com
content-length: 160
x-xss-protection: 0
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 409 B
184 B 309ms
308ms Fetch
text/plain 142.250.186.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=5966717732066796&correlator=1636524535435158&eid=31086815%2C31090592%2C83321072%2C31091673%2C95340253%2C95340255&output=ldjh&gdfp_req=1&vrg=202504220101&ptt=17&impl=fif&gdpr=0&us_privacy=1---&gpp_sid=-1&iu_parts=1254144%3A183096492%2Cmediafire_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=8&didk=1697938527&dids=div-gpt-ad-mediafire_com-box-2&adfs=2211965457&sfv=1-0-41&rcs=1&eri=1&sc=1&cookie=ID%3D10dade855c8dff6b%3AT%3D1745664499%3ART%3D1745664499%3AS%3DALNI_Ma_1Fpvm5ahLciUmw4fdswd_99oyg&gpic=UID%3D00001090e6cf4f86%3AT%3D1745664499%3ART%3D1745664499%3AS%3DALNI_Mbo-mfP4WIQHZ6MctbqnhRKNw10vA&abxe=1&dt=1745664500413&lmt=1745664500&adxs=552&adys=10&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=180&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F0z4njtfe7z5sca3%2FEX13_RP8-FP.rar%2Ffile&vis=1&aee=1&psz=728x-1&msz=728x-1&fws=0&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGsl3RkXoEw02nSgSF0wfZw3h9DaRSF8cKpBHIdgl_E1y&topics=3&tps=3&htps=10&a3p=EjQKCnB1YmNpZC5vcmcSJGVjM2VmZjY4LTBlMWEtNDExMi04ZTIxLWY4YmQzNjFjNDIwZFgBEloKDWNyd2RjbnRybC5uZXQSQDIwMzNiYjg1ZGI2ODk1MjYzMjY1YThhY2Y0ZmIxODVjYTAyY2U4ZGEyMWExNzFlZDllMTZjODlhNDliMTQ4ODAYt8HZjecySAASHQoOZXNwLmNyaXRlby5jb20Yob_ZjecySABSAghkEhgKCXlhaG9vLmNvbRivwdmN5zJIAFICCG8SGQoKdWlkYXBpLmNvbRihv9mN5zJIAFICCGQSVgoMaWQ1LXN5bmMuY29tEkRJRDUqS3VHeDBOZlpnaWVORnpjZE1IYmRjTlhQdTl2c0xMR1pvR2tadU9XYUlhVVNqNG9HMUwwUEZwaU5meUlNUGtmdlgBEhQKBW9wZW54GNTA2Y3nMkgAUgIIbxIbCgwzM2Fjcm9zcy5jb20Yob_ZjecySABSAghkEoICCghydGJob3VzZRLsAWFhUjdOeEpVREtnV2tnOFlKZzFVQjZ2Y0JrMFJQMEdYbWVoM0NGZE9XczY4ZGh4M0x0dFhqODcxeVJTUnI3RlVLcEFJWExRT1hpMzJZMktJbFA0M1N6SFdWUVEvdXozRi90clo0dWdsSXh4VnNoTkJBUi9PVWhZM05ZSW0zellsUURWVXh2cEcwT3EvbE1haC82c2hxampVTDlTSEc4aHRwWUhaQWlRbzBnRW53Y0d4b0RwTmJENktoMmlSOFZQejAvUmJsSG1Ecnd6QVMvS1pMak8vYk9pY3VCdDFEdE5CWlN6NXh3ZnFWYm89GO3C2Y3nMkgA&nt=1&psd=WzMxLFtudWxsLFtbIi8xMjU0MTQ0LDE4MzA5NjQ5Mi9tZWRpYWZpcmVfY29tLWJveC0yIixbWzQxNDI3OTcxNjUsMTA0ODM1OTA3NSwzMzAwMTc4NTc2XV1dXV0sbnVsbCwzXQ..&dlt=1745664497579&idt=1785&ppid=e1c37ebfc1a9a27cfae119775cae22e8&prev_scp=a%3D1%26iid1%3D7992908034463469%26eid%3D7992908034463469%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D0%26ap%3D1103%26sap%3D1103%26as%3Drevenue%26plat%3D1%26bra%3Dmod31-c%26ic%3D2%26at%3Dbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D1%26tap%3Dmediafire_com-box-2-7992908034463469%26eb_br%3Dzero%26eba%3D0%26bv%3D38%26bvm%3D4%26bvr%3D0%26avc%3D6%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D0%26br2%3D0%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D157%2C131%2C0%2C0%2C0%2C193%2C196%2C20%2C0%2C0%2C192%2C31%2C902%2C903%2C901%2C902%2C903%26deal1%3D17%2C18%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1428%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C2764%2C2765%2C3044%2C3045%2C3052%2C3053%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C3856%2C4184%2C4186%2C4276%2C5747%2C6293%2C6294%2C6295%2C7035%2C7036%2C7330%2C7331%2C7605%2C7606%2C7607%2C7608%2C7609%2C7610%2C7611%2C7612%2C7613%2C7614%2C7615%2C7616%2C7617%2C7618%2C6772%2C5534%2C7661%2C7713%26nocompoverride%3D1%26adxf%3D1%26lb%3D0%26ss38%3D1%26ss9%3D1%26reqt%3D1745664500025&cust_params=carbon_segment%3D&adks=3106951849&frm=20&eo_id_str=ID%3D3c90627c638c6682%3AT%3D1745664499%3ART%3D1745664499%3AS%3DAA-AfjacEzd8vr0aExHgjT2vBZ_B&pbbce=1&td=1&egid=38815&tan=a9d4574a-b146-43f0-b55d-8d6d45dae5f0&tdf=2

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504220101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

594eeb029da4673f762e5e11871c12fbdb6d8727ab0507001dba25f26a17c643

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: dcb
google-lineitem-id: -2
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Sat, 26 Apr 2025 10:48:20 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.mediafire.com
content-length: 154
x-xss-protection: 0
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 564 B
270 B 258ms
257ms Fetch
text/plain 142.250.186.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=5966717732066796&correlator=4013870889722213&eid=31086815%2C31090592%2C83321072%2C31091673%2C95340253%2C95340255&output=ldjh&gdfp_req=1&vrg=202504220101&ptt=17&impl=fif&gdpr=0&us_privacy=1---&gpp_sid=-1&iu_parts=1254144%3A183096492%2Cmediafire_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=1x1&ifi=9&didk=674410252&dids=gpt_unit_%2F1254144%2C183096492%2Fme&sfv=1-0-41&rcs=1&fas=1&eri=1&sc=1&cookie=ID%3D10dade855c8dff6b%3AT%3D1745664499%3ART%3D1745664499%3AS%3DALNI_Ma_1Fpvm5ahLciUmw4fdswd_99oyg&gpic=UID%3D00001090e6cf4f86%3AT%3D1745664499%3ART%3D1745664499%3AS%3DALNI_Mbo-mfP4WIQHZ6MctbqnhRKNw10vA&abxe=1&dt=1745664500417&lmt=1745664500&adxs=-9&adys=-9&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=6&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=180&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F0z4njtfe7z5sca3%2FEX13_RP8-FP.rar%2Ffile&vis=1&aee=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&topics=3&tps=3&htps=10&a3p=EjQKCnB1YmNpZC5vcmcSJGVjM2VmZjY4LTBlMWEtNDExMi04ZTIxLWY4YmQzNjFjNDIwZFgBEloKDWNyd2RjbnRybC5uZXQSQDIwMzNiYjg1ZGI2ODk1MjYzMjY1YThhY2Y0ZmIxODVjYTAyY2U4ZGEyMWExNzFlZDllMTZjODlhNDliMTQ4ODAYt8HZjecySAASHQoOZXNwLmNyaXRlby5jb20Yob_ZjecySABSAghkEhgKCXlhaG9vLmNvbRivwdmN5zJIAFICCG8SGQoKdWlkYXBpLmNvbRihv9mN5zJIAFICCGQSVgoMaWQ1LXN5bmMuY29tEkRJRDUqS3VHeDBOZlpnaWVORnpjZE1IYmRjTlhQdTl2c0xMR1pvR2tadU9XYUlhVVNqNG9HMUwwUEZwaU5meUlNUGtmdlgBEhQKBW9wZW54GNTA2Y3nMkgAUgIIbxIbCgwzM2Fjcm9zcy5jb20Yob_ZjecySABSAghkEoICCghydGJob3VzZRLsAWFhUjdOeEpVREtnV2tnOFlKZzFVQjZ2Y0JrMFJQMEdYbWVoM0NGZE9XczY4ZGh4M0x0dFhqODcxeVJTUnI3RlVLcEFJWExRT1hpMzJZMktJbFA0M1N6SFdWUVEvdXozRi90clo0dWdsSXh4VnNoTkJBUi9PVWhZM05ZSW0zellsUURWVXh2cEcwT3EvbE1haC82c2hxampVTDlTSEc4aHRwWUhaQWlRbzBnRW53Y0d4b0RwTmJENktoMmlSOFZQejAvUmJsSG1Ecnd6QVMvS1pMak8vYk9pY3VCdDFEdE5CWlN6NXh3ZnFWYm89GO3C2Y3nMkgA&nt=1&psd=WzMxLFtudWxsLFtbIi8xMjU0MTQ0LDE4MzA5NjQ5Mi9tZWRpYWZpcmVfY29tLW1lZHJlY3RhbmdsZS0yIixbWzQxNDI3OTcxNjUsMTA0ODM1OTA3NSwzMzAwMTc4NTc2XV1dXV0sbnVsbCwzXQ..&dlt=1745664497579&idt=1785&ppid=e1c37ebfc1a9a27cfae119775cae22e8&prev_scp=a%3D1%26iid1%3D8330223226438365%26eid%3D8330223226438365%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D0%26ap%3D1100%26sap%3D1100%26as%3Drevenue%26plat%3D1%26bra%3Dmod31-c%26ic%3D2%26at%3Dbf%26adr%3D399%26ezosn%3D5%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26tap%3Dmediafire_com-medrectangle-2-8330223226438365%26eb_br%3Dzero%26eba%3D0%26bv%3D38%26bvm%3D4%26bvr%3D0%26avc%3D8%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D0%26br2%3D4%26ezoic%3D1%26nmau%3D0%26mau%3D0%26ganc%3D1%26cal%3D0%26stl%3D82%2C25%2C133%2C4%2C50%2C131%2C87%2C20%2C71%2C164%2C205%2C0%2C147%2C166%2C901%2C902%2C903%26deal1%3D17%2C18%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C760%2C761%2C813%2C815%2C816%2C817%2C818%2C819%2C893%2C899%2C903%2C917%2C918%2C919%2C1428%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C2764%2C2765%2C3044%2C3045%2C3052%2C3053%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C3856%2C3915%2C3919%2C3933%2C4184%2C4185%2C4186%2C4276%2C4604%2C4605%2C5747%2C6044%2C6045%2C6293%2C6294%2C6295%2C6983%2C7035%2C7036%2C7046%2C7144%2C7327%2C7330%2C7331%2C7605%2C7606%2C7607%2C7608%2C7609%2C7610%2C7611%2C7612%2C7613%2C7614%2C7615%2C7616%2C7617%2C7618%2C6772%2C5534%2C7661%2C7713%26adxf%3D1%26lb%3D10%26ss38%3D1%26ss9%3D1%26reqt%3D1745664499935&cust_params=carbon_segment%3D&adks=318048222&frm=20&eo_id_str=ID%3D3c90627c638c6682%3AT%3D1745664499%3ART%3D1745664499%3AS%3DAA-AfjacEzd8vr0aExHgjT2vBZ_B&pbbce=1&td=1&egid=38815&tan=a9d4574a-b146-43f0-b55d-8d6d45dae5f1&tdf=2

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504220101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

c73d79f4ab4c93336fb3ebe631f63f72879ad92e7a842e7cffb82a7a475e9f9e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: dcb
google-lineitem-id: -2
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Sat, 26 Apr 2025 10:48:20 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.mediafire.com
content-length: 240
x-xss-protection: 0
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 411 B
187 B 299ms
299ms Fetch
text/plain 142.250.186.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=5966717732066796&correlator=1257170860395835&eid=31086815%2C31090592%2C83321072%2C31091673%2C95340253%2C95340255&output=ldjh&gdfp_req=1&vrg=202504220101&ptt=17&impl=fif&gdpr=0&us_privacy=1---&gpp_sid=-1&iu_parts=1254144%3A183096492%2Cmediafire_com-edge-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C160x600&fluid=height&ifi=10&didk=2994273263&dids=div-gpt-ad-mediafire_com-edge-&adfs=2968723417&sfv=1-0-41&rcs=1&eri=1&sc=1&cookie=ID%3D10dade855c8dff6b%3AT%3D1745664499%3ART%3D1745664499%3AS%3DALNI_Ma_1Fpvm5ahLciUmw4fdswd_99oyg&gpic=UID%3D00001090e6cf4f86%3AT%3D1745664499%3ART%3D1745664499%3AS%3DALNI_Mbo-mfP4WIQHZ6MctbqnhRKNw10vA&abxe=1&dt=1745664500421&lmt=1745664500&adxs=0&adys=300&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=180&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F0z4njtfe7z5sca3%2FEX13_RP8-FP.rar%2Ffile&vis=1&aee=1&psz=160x-1&msz=160x-1&fws=512&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGsl3RkXoEw02nSgSF0wfZw3h9DaRSF8cKpBHIdgl_E1y&topics=3&tps=3&htps=10&a3p=EjQKCnB1YmNpZC5vcmcSJGVjM2VmZjY4LTBlMWEtNDExMi04ZTIxLWY4YmQzNjFjNDIwZFgBEloKDWNyd2RjbnRybC5uZXQSQDIwMzNiYjg1ZGI2ODk1MjYzMjY1YThhY2Y0ZmIxODVjYTAyY2U4ZGEyMWExNzFlZDllMTZjODlhNDliMTQ4ODAYt8HZjecySAASHQoOZXNwLmNyaXRlby5jb20Yob_ZjecySABSAghkEhgKCXlhaG9vLmNvbRivwdmN5zJIAFICCG8SGQoKdWlkYXBpLmNvbRihv9mN5zJIAFICCGQSVgoMaWQ1LXN5bmMuY29tEkRJRDUqS3VHeDBOZlpnaWVORnpjZE1IYmRjTlhQdTl2c0xMR1pvR2tadU9XYUlhVVNqNG9HMUwwUEZwaU5meUlNUGtmdlgBEhQKBW9wZW54GNTA2Y3nMkgAUgIIbxIbCgwzM2Fjcm9zcy5jb20Yob_ZjecySABSAghkEoICCghydGJob3VzZRLsAWFhUjdOeEpVREtnV2tnOFlKZzFVQjZ2Y0JrMFJQMEdYbWVoM0NGZE9XczY4ZGh4M0x0dFhqODcxeVJTUnI3RlVLcEFJWExRT1hpMzJZMktJbFA0M1N6SFdWUVEvdXozRi90clo0dWdsSXh4VnNoTkJBUi9PVWhZM05ZSW0zellsUURWVXh2cEcwT3EvbE1haC82c2hxampVTDlTSEc4aHRwWUhaQWlRbzBnRW53Y0d4b0RwTmJENktoMmlSOFZQejAvUmJsSG1Ecnd6QVMvS1pMak8vYk9pY3VCdDFEdE5CWlN6NXh3ZnFWYm89GO3C2Y3nMkgA&nt=1&psd=WzMxLFtudWxsLFtbIi8xMjU0MTQ0LDE4MzA5NjQ5Mi9tZWRpYWZpcmVfY29tLWVkZ2UtMSIsW1s0MTQyNzk3MTY1LDEwNDgzNTkwNzUsMzMwMDE3ODU3Nl1dXV1dLG51bGwsM10.&dlt=1745664497579&idt=1785&ppid=e1c37ebfc1a9a27cfae119775cae22e8&prev_scp=a%3D1%26iid1%3D7924875182434044%26eid%3D7924875182434044%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D0%26ap%3D1101%26sap%3D1101%26as%3Drevenue%26plat%3D1%26bra%3Dmod31-c%26ic%3D2%26at%3Dbf%26adr%3D399%26ezosn%3D2%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D38%26al%3D1038%26compid%3D0%26tap%3Dmediafire_com-edge-1-7924875182434044%26eb_br%3Dzero%26eba%3D0%26bv%3D38%26bvm%3D4%26bvr%3D0%26avc%3D4%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D0%26br2%3D4%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D34%2C193%2C0%2C0%2C0%2C168%2C132%2C0%2C0%2C0%2C143%2C0%2C901%2C182%2C901%2C902%2C903%26deal1%3D17%2C18%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1428%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C2764%2C2765%2C3044%2C3045%2C3052%2C3053%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C3856%2C4184%2C4186%2C4276%2C5747%2C6293%2C6294%2C6295%2C7035%2C7036%2C7330%2C7331%2C7605%2C7606%2C7607%2C7608%2C7609%2C7610%2C7611%2C7612%2C7613%2C7614%2C7615%2C7616%2C7617%2C7618%2C6772%2C5534%2C7661%2C7713%26adxf%3D1%26lb%3D10%26ss38%3D1%26ss9%3D1%26reqt%3D1745664500072&cust_params=carbon_segment%3D&adks=3527628052&frm=20&eo_id_str=ID%3D3c90627c638c6682%3AT%3D1745664499%3ART%3D1745664499%3AS%3DAA-AfjacEzd8vr0aExHgjT2vBZ_B&pbbce=1&td=1&egid=38815&tan=a9d4574a-b146-43f0-b55d-8d6d45dae5f2&tdf=2

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504220101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

c472bc944f0ab65826401c2286f2962f3a668284e74faa6ec50fa0d30885476d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: dcb
google-lineitem-id: -2
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Sat, 26 Apr 2025 10:48:20 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.mediafire.com
content-length: 157
x-xss-protection: 0
server: cafe

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUbIcarlbAXcvxGC7lKCSbtM2GUWgA_vK7NNuctdNSjXVoQftcDS456q5kfQt4AEacydR806XYhhkmuYfFHZiu3VOU3NUMMbR-jzPs7vhWImUWgjdFZkE4yTtz4-yeJicmPYJXTzA==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.206 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f14.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-_KzULNfslKkmhC2TMF-Ejw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://www.mediafire.com/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 26 Apr 2025 10:48:20 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtDikmJw1JBi-FB_mfUHEAvxcHz5vOkAm8CFGSceMiq5JOUXxifn55Wk5pXoJqYU64LYRZlJpSX5RSjs1DKQipz89PTMvPR4IwMjUwMTIxM9A7P4AgMAooElSA"
content-security-policy: script-src 'report-sample' 'nonce-_KzULNfslKkmhC2TMF-Ejw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://www.mediafire.com
content-length: 0
x-xss-protection: 0
server: ESF

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUbIcarlbAXcvxGC7lKCSbtM2GUWgA_vK7NNuctdNSjXVoQftcDS456q5kfQt4AEacydR806XYhhkmuYfFHZiu3VOU3NUMMbR-jzPs7vhWImUWgjdFZkE4yTtz4-yeJicmPYJXTzA==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.206 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f14.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-wXe2oADTBPjVcEbwu-Kivg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://www.mediafire.com/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 26 Apr 2025 10:48:20 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtDikmLw05Bi-FB_mfUHEAvxcHz5vOkAm8CLM-u3MSm5JOUXxifn55Wk5pXoJqYU64LYRZlJpSX5RSjs1DKQipz89PTMvPR4IwMjUwMTIxM9A7P4AgMAqn8lXg"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-wXe2oADTBPjVcEbwu-Kivg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://www.mediafire.com
content-length: 0
x-xss-protection: 0
server: ESF

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUbIcarlbAXcvxGC7lKCSbtM2GUWgA_vK7NNuctdNSjXVoQftcDS456q5kfQt4AEacydR806XYhhkmuYfFHZiu3VOU3NUMMbR-jzPs7vhWImUWgjdFZkE4yTtz4-yeJicmPYJXTzA==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.206 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f14.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-JFDkyrihXcqiOCs1MVyszQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://www.mediafire.com/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 26 Apr 2025 10:48:20 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtDikmJw1ZBi-FB_mfUHEAvxcHz5vOkAm8CCzS-3MSm5JOUXxifn55Wk5pXoJqYU64LYRZlJpSX5RSjs1DKQipz89PTMvPR4IwMjUwMTIxM9A7P4AgMAm1clLg"
content-security-policy: script-src 'report-sample' 'nonce-JFDkyrihXcqiOCs1MVyszQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://www.mediafire.com
content-length: 0
x-xss-protection: 0
server: ESF

GET
H3 200 AGSKWxVGwl81iuDpgyS_foju13STpsYBqJyWerpahmsY2zDnH3QDEHWwnjWIY31QfdjkU6eIBiFngvap8tIbatuDJPxeEwUQm-m-ksAAC2I6wocnHWE9SpB8YztQCEROqvsZMG0wUyR0Og== Show response
fundingchoicesmessages.google.com/f/ 5 KB
2 KB 99ms
99ms Script
application/javascript 142.250.184.206
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxVGwl81iuDpgyS_foju13STpsYBqJyWerpahmsY2zDnH3QDEHWwnjWIY31QfdjkU6eIBiFngvap8tIbatuDJPxeEwUQm-m-ksAAC2I6wocnHWE9SpB8YztQCEROqvsZMG0wUyR0Og==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQ1NjY0NTAwLDYwNTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsNl0sbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsMV0sImh0dHBzOi8vd3d3Lm1lZGlhZmlyZS5jb20vZmlsZS8wejRuanRmZTd6NXNjYTMvRVgxM19SUDgtRlAucmFyL2ZpbGUiLG51bGwsW1s4LCJpQ1hMZFVyOW4wVSJdLFs5LCJ0ciJdLFsxOSwiMiJdLFsyNCwiIl0sWzI1LCJbWzk1MzQwMjUzLDk1MzQwMjU1XV0iXSxbMjksImZhbHNlIl1dXQ

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.206 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f14.1e100.net

Software

ESF /

Resource Hash

95c6932a51b812fb1c02efcfca1688d325417086e5738bfb5f4c97ddf17c5c9e

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-rZsBsv1pVMluf5aPppJkFw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 26 Apr 2025 10:48:20 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjytDikmLw0pBiOHHrNtMFIG69eY51KhAbrT3P6gTEhgqXWB2B-P66S6zPgfhD_WXWH0BcJHGFtQmIP1XdYBWqvsEam3aTNRWIe_feZL1x5Cbrro23WA8BcZP2bdYuIBbi4fjyedMBNoEX1z7sZlLSSMovjE_OzyspykwqLckvSktOSy1OLSpLLYo3MjAyNTAxMtEzMIgvMAAA1ZdFhA"
content-security-policy: script-src 'report-sample' 'nonce-rZsBsv1pVMluf5aPppJkFw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

POST
H3 204 ping
pagead2.googlesyndication.com/pagead/ 0
0 196ms
109ms Fetch
text/html 142.250.185.130
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://pagead2.googlesyndication.com/pagead/ping?e=1
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504220101/pubads_impl.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.185.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s50-in-f2.1e100.net
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://www.mediafire.com/

Response headers

GET
H3 200 AGSKWxXWzJVxO542m8zJCmfrZ_7mwXUTdfCTAKJNyM6-zc9JAymLKLwNuZgtuoi35fqoTr2xdsMEBjruICNwKL4IYQzy6xBJwDBKldrn9F7JxjzpZbeGzipkqNrMgzthYpnXSDu7VUEm7Q== Show response
fundingchoicesmessages.google.com/f/ 2 KB
1 KB 100ms
100ms Script
application/javascript 142.250.184.206
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxXWzJVxO542m8zJCmfrZ_7mwXUTdfCTAKJNyM6-zc9JAymLKLwNuZgtuoi35fqoTr2xdsMEBjruICNwKL4IYQzy6xBJwDBKldrn9F7JxjzpZbeGzipkqNrMgzthYpnXSDu7VUEm7Q==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQ1NjY0NTAwLDcwODAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsNiwxMF0sbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsMV0sImh0dHBzOi8vd3d3Lm1lZGlhZmlyZS5jb20vZmlsZS8wejRuanRmZTd6NXNjYTMvRVgxM19SUDgtRlAucmFyL2ZpbGUiLG51bGwsW1s4LCJpQ1hMZFVyOW4wVSJdLFs5LCJ0ciJdLFsxOSwiMiJdLFsyNCwiIl0sWzI1LCJbWzk1MzQwMjUzLDk1MzQwMjU1XV0iXSxbMjksImZhbHNlIl1dXQ

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.206 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f14.1e100.net

Software

ESF /

Resource Hash

4770d2acd764a9137df6e2538b33291bc2c2f04a5561fbc2dff87a0c99e61a01

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-KEfewdr8nDEOLyC51Vykfw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 26 Apr 2025 10:48:20 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjStDikmJw0pBiaL15jnUqEButPc_qBMSGCpdYHYH4_rpLrM-B-EP9ZdYfQFwkcYW1CYg_Vd1gFaq-wRqbdpM1FYh7995kvXHkJuuajbdYtwBxk_Zt1i4gFuLh-PJ50wE2gRsPH79lUtJIyi-MT87PKynKTCotyS9KS05LLU4tKkstijcyMDI1MDEy0TMwiC8wAADTA0By"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-KEfewdr8nDEOLyC51Vykfw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H2 200 huge
avatars.yads.tech/get-air/5481271/2a0000019516b5afeaabe64473ef1187bb6e/ Frame 3DDE 15 KB
15 KB 286ms
118ms Image
image/webp 3.167.227.120
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://avatars.yads.tech/get-air/5481271/2a0000019516b5afeaabe64473ef1187bb6e/huge
Requested by: Host: e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com
URL: https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.167.227.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-167-227-120.fra60.r.cloudfront.net
Software: nginx /
Resource Hash: 7b87efc8babe3bfb9145d76e745fd2b0ce8643f87aea7c9779ac12f83a899081

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com/

Response headers

x-request-id: 932b0520100c73cc
cache-control: max-age=31536000,immutable
timing-allow-origin: *
age: 5798245
access-control-allow-credentials: true
via: 1.1 112ea1671f1dfc4e484af72377a98408.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Hit from cloudfront
content-length: 15256
x-amz-cf-id: -GJuiUtJkzj2YAeeOr-oGYKhm6zdRV0zj8dsTasXsh7JXIW8gFHxIQ==
date: Tue, 18 Feb 2025 08:10:55 GMT
content-type: image/webp
last-modified: Tue, 18 Feb 2025 08:10:55 GMT
server: nginx
x-amz-cf-pop: FRA60-P11

GET
H2 200 x80
avatars.yads.tech/get-air/12379249/2a000001953a93bef0122fac21578eaba519/ Frame 3DDE 10 KB
11 KB 299ms
132ms Image
image/webp 3.167.227.120
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://avatars.yads.tech/get-air/12379249/2a000001953a93bef0122fac21578eaba519/x80
Requested by: Host: e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com
URL: https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.167.227.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-167-227-120.fra60.r.cloudfront.net
Software: nginx /
Resource Hash: d3f48db3af3edaa22ee5a91e20eb932b77ff2a145dea6d97e7d28873de33b13a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com/

Response headers

x-request-id: 8ff98c25322d3225
cache-control: max-age=31536000,immutable
timing-allow-origin: *
age: 5180176
access-control-allow-credentials: true
via: 1.1 112ea1671f1dfc4e484af72377a98408.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Hit from cloudfront
content-length: 10688
x-amz-cf-id: Ot5AePv2iSHTNe-KU-viwvSt20wDt7sdmu5V9C8DMN8HeL5tD3neug==
date: Tue, 25 Feb 2025 11:52:04 GMT
content-type: image/webp
last-modified: Tue, 25 Feb 2025 11:52:04 GMT
server: nginx
x-amz-cf-pop: FRA60-P11

GET
H2 200 x80
avatars.yads.tech/get-air/12379249/2a000001953a93bef0122fac21578eaba519/ Frame AD50 10 KB
0 288ms
288ms Image
image/webp 3.167.227.120
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://avatars.yads.tech/get-air/12379249/2a000001953a93bef0122fac21578eaba519/x80
Requested by: Host: pcode.yads.tech
URL: https://pcode.yads.tech/pcode-bundles/1247521/air/fc2c603440c2d325f842.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.167.227.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-167-227-120.fra60.r.cloudfront.net
Software: nginx /
Resource Hash: d3f48db3af3edaa22ee5a91e20eb932b77ff2a145dea6d97e7d28873de33b13a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com/

Response headers

x-request-id: 8ff98c25322d3225
cache-control: max-age=31536000,immutable
timing-allow-origin: *
age: 5180176
access-control-allow-credentials: true
via: 1.1 112ea1671f1dfc4e484af72377a98408.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Hit from cloudfront
content-length: 10688
x-amz-cf-id: Ot5AePv2iSHTNe-KU-viwvSt20wDt7sdmu5V9C8DMN8HeL5tD3neug==
date: Tue, 25 Feb 2025 11:52:04 GMT
content-type: image/webp
last-modified: Tue, 25 Feb 2025 11:52:04 GMT
server: nginx
x-amz-cf-pop: FRA60-P11

GET
H2 200 huge
avatars.yads.tech/get-air/5481271/2a000001957b83a8a2cea1c9bbf0e310584b/ Frame AD50 24 KB
24 KB 299ms
148ms Image
image/webp 3.167.227.120
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://avatars.yads.tech/get-air/5481271/2a000001957b83a8a2cea1c9bbf0e310584b/huge
Requested by: Host: e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com
URL: https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.167.227.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-167-227-120.fra60.r.cloudfront.net
Software: nginx /
Resource Hash: 73993d9c19c08e36c4dae3837f6cd59b936ce1eb0c3bab861c97beec914a2a18

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com/

Response headers

x-request-id: 87494b335544d2ac
cache-control: max-age=31536000,immutable
timing-allow-origin: *
age: 4122917
access-control-allow-credentials: true
via: 1.1 112ea1671f1dfc4e484af72377a98408.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Hit from cloudfront
content-length: 24624
x-amz-cf-id: MwVNAv0Hp3LZeqlE-5kZBnd5glqNhlyQaS5xoy-TEJ8O33ymqKUrEw==
date: Sun, 09 Mar 2025 17:33:03 GMT
content-type: image/webp
last-modified: Sun, 09 Mar 2025 17:33:03 GMT
server: nginx
x-amz-cf-pop: FRA60-P11

GET
H3 200 AGSKWxWO6_61HkEl5YPsmaYVVEwlexagVwbSodX5AbYE68SqxPzEU_LT_13mgOD1ouRg_h1q5vgDRmK-E7rW4TrMQkH3hX6guUCiqFHunJofXlAWUoJOfL4af1lkfwBfBzijfic9TFVlYg== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 99ms
99ms Script
application/javascript 142.250.184.206
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxWO6_61HkEl5YPsmaYVVEwlexagVwbSodX5AbYE68SqxPzEU_LT_13mgOD1ouRg_h1q5vgDRmK-E7rW4TrMQkH3hX6guUCiqFHunJofXlAWUoJOfL4af1lkfwBfBzijfic9TFVlYg==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQ1NjY0NTAwLDgxNTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsNiwxMCw5XSxudWxsLDIsbnVsbCwiZW4iLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCwxXSwiaHR0cHM6Ly93d3cubWVkaWFmaXJlLmNvbS9maWxlLzB6NG5qdGZlN3o1c2NhMy9FWDEzX1JQOC1GUC5yYXIvZmlsZSIsbnVsbCxbWzgsImlDWExkVXI5bjBVIl0sWzksInRyIl0sWzE5LCIyIl0sWzI0LCIiXSxbMjUsIltbOTUzNDAyNTMsOTUzNDAyNTVdXSJdLFsyOSwiZmFsc2UiXV1d

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.206 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f14.1e100.net

Software

ESF /

Resource Hash

fc1f845b1a0d0037a1c6039fbe42ae68acb84119cb8f56822cdf0ec962b5bc37

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-P1o3CkLyiegUj2sikpwWTg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 26 Apr 2025 10:48:20 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjStDikmLw0ZBiaL15jnUqEButPc_qBMSGCpdYHYH4_rpLrM-B-EP9ZdYfQFwkcYW1CYg_Vd1gFaq-wRqbdpM1FYh7995kvXHkJuuujbdYDwFxk_Zt1i4gFuLh-PJ50wE2gYbfN-czK2kk5RfGJ-fnlRRlJpWW5BelJaelFqcWlaUWxRsZGJkamBiZ6BkYxBcYAADF-EAD"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-P1o3CkLyiegUj2sikpwWTg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3DDE 0
0 131ms
131ms Fetch
image/gif 142.250.185.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=fle-fetch-start2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sat, 26 Apr 2025 10:48:20 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3DDE 0
0 127ms
127ms Fetch
image/gif 142.250.185.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sat, 26 Apr 2025 10:48:20 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame AD50 0
0 237ms
124ms Fetch
image/gif 142.250.185.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=fle-fetch-start2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sat, 26 Apr 2025 10:48:21 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame AD50 0
0 237ms
125ms Fetch
image/gif 142.250.185.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sat, 26 Apr 2025 10:48:21 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
DATA 200
OK truncated
/ Frame 3DDE 213 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 39b49e77affa7cc68e0dc77604ebbb42e85bf71fae5547fcc1c83c206c7d51c9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame AD50 213 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cc8d34633fbc5174ba5a91be362875660fcb4d0415ba699dcb8722d52583c7a4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3DDE 0
0 124ms
124ms Fetch
image/gif 142.250.185.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sat, 26 Apr 2025 10:48:20 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame AD50 0
0 247ms
124ms Fetch
image/gif 142.250.185.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sat, 26 Apr 2025 10:48:21 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 event
abs.yandex.ru/dsp/ Frame 3DDE 43 B
136 B 127ms
126ms Image
image/gif 87.250.254.222
YANDEX YANDEX LLC

General

Check archive.org

Download Go to Show image

Full URL: https://abs.yandex.ru/dsp/event?dt=1&et=3&f=UwLrV9UAAAAAAAAAeJzjuNwy49XZCaf2qwh8_rzpAJvE5-4rt3qO_bqdpMXBwSjAIcGkwGDEw8EgwCDBoMCgwWDAYMXGwQ_kMTqZcGx-v_fc8dmvV-1kFFjycf7TlxcXfH3GKIEQVRIsLy_Xy01NyUxMyyxK1UvOz82ILeLj4uLYySLEXJaTKMEgwNLAyNrFyCXxJVLjOrsBqwXjJEYeDrgjBFhnMDIuYGTYxMgCdA3jTsa2rVddwk742x1k_FWXtadkcof9CUaGS4zMElvZXzAyfmBk_ME4ixsAh5dPiw%2C%2C&pcode-test-ids-from-count=
Requested by: Host: e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com
URL: https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 87.250.254.222 , Russian Federation, ASN13238 (YANDEX YANDEX LLC, RU),
Reverse DNS: air.yandex.ru
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com/

Response headers

content-encoding: gzip
x-yt-trace-id: ec7b2cbe-c2e3a20d-1485b17b-6d69a0a5
content-length: 57
content-type: image/gif
x-content-encoding: gzip
x-yt-request-id: c113996d-76b90214-306d9af-791c7942

GET
H2 200 event
abs.yandex.ru/dsp/ Frame AD50 43 B
181 B 123ms
123ms Image
image/gif 87.250.254.222
YANDEX YANDEX LLC

General

Check archive.org

Download Go to Show image

Full URL: https://abs.yandex.ru/dsp/event?dt=1&et=3&f=fT81nNUAAAAAAAAAeJzjeNVy4u3DCaf2qwh8_rzpAJvE58uTlu49-XVymRYHB6MAhwSTAoMRDweDAIMEgwKDBoMBgxUbBz-Qx-hkwrH5_d5zx2e_XrWTUWDCi-aPS35PePGQUQIhqiRYXl6ul5uakpmYllmUqpecn5sRV8THxcXxn0WIuTixWIJBgKWBkbWLkUviS6TGdXYDVgvGSYw8HHBHCLDOYGRcwMiwiZEF6BrGnYwXH-g7eZoE2R1k3OXJw6Td3mZ_gpHhEiOzxFb2F4yMHxgZfzAu4QYAPQ1MuA%2C%2C&pcode-test-ids-from-count=
Requested by: Host: e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com
URL: https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 87.250.254.222 , Russian Federation, ASN13238 (YANDEX YANDEX LLC, RU),
Reverse DNS: air.yandex.ru
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com/

Response headers

content-length: 57
x-yt-trace-id: 605bf90f-57f4b5ca-da97a3b0-adea9530
x-content-encoding: gzip
content-type: image/gif
content-encoding: gzip
x-yt-request-id: 23509fba-eb304713-ed9a1a00-e5f4ae8e

POST
H3 204 AGSKWxUN4XLaKKrmj-JREg40VKEl1aybgeJm_QgfA4N143TzOlzdEmnzyA0gys0_PWZ-ONmDv-ymYhemI-FYId51SroKm0zL1K6j4SMfe446xd4NsiUT2H3ZPGhiDMyC3ekPiAastjHSQg== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 101ms
100ms XHR
text/html 142.250.184.206
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUN4XLaKKrmj-JREg40VKEl1aybgeJm_QgfA4N143TzOlzdEmnzyA0gys0_PWZ-ONmDv-ymYhemI-FYId51SroKm0zL1K6j4SMfe446xd4NsiUT2H3ZPGhiDMyC3ekPiAastjHSQg==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.206 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f14.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-jTIqqKUCYISfeRORAVhR_w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://www.mediafire.com/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 26 Apr 2025 10:48:20 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtDikmJw1ZBi-FB_mfUHEAvxcHz5vOkAm8CNns4zzEouSfmF8cn5eSWpeSW6iSnFuiB2UWZSaUl-EQo7tQykIic_PT0zLz3eyMDI1MDEyETPwCy-wAAAi5Ak9g"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-jTIqqKUCYISfeRORAVhR_w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://www.mediafire.com
content-length: 0
x-xss-protection: 0
server: ESF

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame 52B4 16 KB
6 KB 255ms
86ms Document
text/html 178.250.1.11
ASN-CRITEO-EUROPE...

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=www.mediafire.com&gdpr=0&gdpr_consent=&gpp=&gpp_sid=-1

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.ids.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.11 , France, ASN44788 (ASN-CRITEO-EUROPE Criteo Technology SAS, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

30b7f0adc63bb1e3010cee77e9aa68b9aa8511ec29abb030a2a7d710473951a9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://www.mediafire.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sat, 26 Apr 2025 10:48:20 GMT
server: Kestrel
server-processing-duration-in-ticks: 942388
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding
x-robots-tag: noindex

GET
H2 200 json Show response
gum.criteo.com/sid/ Frame 52B4 457 B
928 B 88ms
87ms Fetch
application/json 178.250.1.11
ASN-CRITEO-EUROPE...

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=publishertagids&domain=mediafire.com&sn=ChromeSyncframe&so=3&topUrl=www.mediafire.com&bundle=TOh1519ySmxtUiUyRm5QVEh0RG9HcjlycmJFT1hDU1dQUEdFdDhIZ3ZaQ09leXpjQndaMnhUZDJqVFVESk5YVHdIbjRZeGt3d05JVUtJdlh1OEVxRmVZSjkweUR1cE04N0NLeXZCUlZhSWRiakZNNE9BcENVJTJGd1BoJTJGbiUyRjN4bG1UWjgzU2Nm&topicsavail=1&fledgeavail=1

Requested by

Host: gum.criteo.com
URL: https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=www.mediafire.com&gdpr=0&gdpr_consent=&gpp=&gpp_sid=-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.11 , France, ASN44788 (ASN-CRITEO-EUROPE Criteo Technology SAS, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

78c0fa67503accd350299cb21c7571186ccba7e897549f17813a00256bf36933

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=www.mediafire.com&gdpr=0&gdpr_consent=&gpp=&gpp_sid=-1

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
server-processing-duration-in-ticks: 1504157
expires: 0
date: Sat, 26 Apr 2025 10:48:21 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 388 B
191 B 295ms
294ms Fetch
text/plain 142.250.186.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=5966717732066796&correlator=2657919377497034&eid=31086815%2C31090592%2C83321072%2C31091673%2C95340253%2C95340255&output=ldjh&gdfp_req=1&vrg=202504220101&ptt=17&impl=fif&gdpr=0&us_privacy=1---&gpp_sid=-1&iu_parts=1254144%3A183096492%2Cmediafire_com-edge-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C160x600&fluid=height&ifi=11&didk=2994425013&dids=div-gpt-ad-mediafire_com-edge-&adfs=1145427683&sfv=1-0-41&rcs=2&eri=1&sc=1&cookie=ID%3D10dade855c8dff6b%3AT%3D1745664499%3ART%3D1745664499%3AS%3DALNI_Ma_1Fpvm5ahLciUmw4fdswd_99oyg&gpic=UID%3D00001090e6cf4f86%3AT%3D1745664499%3ART%3D1745664499%3AS%3DALNI_Mbo-mfP4WIQHZ6MctbqnhRKNw10vA&abxe=1&dt=1745664501407&lmt=1745664501&adxs=1440&adys=300&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=5&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=180&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F0z4njtfe7z5sca3%2FEX13_RP8-FP.rar%2Ffile&vis=1&aee=1&psz=160x-1&msz=160x-1&fws=512&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGskDHt1QT8b-kKcnseZcCRUhgac5ZF-0DM94bpr_XPHT&topics=3&tps=3&htps=10&a3p=EjQKCnB1YmNpZC5vcmcSJGVjM2VmZjY4LTBlMWEtNDExMi04ZTIxLWY4YmQzNjFjNDIwZFgBEloKDWNyd2RjbnRybC5uZXQSQDIwMzNiYjg1ZGI2ODk1MjYzMjY1YThhY2Y0ZmIxODVjYTAyY2U4ZGEyMWExNzFlZDllMTZjODlhNDliMTQ4ODAYt8HZjecySAAS2AEKDmVzcC5jcml0ZW8uY29tErwBVE9oMTUxOXlTbXh0VWlVeVJtNVFWRWgwUkc5SGNqbHljbUpGVDFoRFUxZFFVRWRGZERoSVozWmFRMDlsZVhwalFuZGFNbmhVWkRKcVZGVkVTazVZVkhkSWJqUlplR3QzZDA1SlZVdEpkbGgxT0VWeFJtVlpTamt3ZVVSMWNFMDROME5MZVhaQ1VsWmhTV1JpYWtaTk5FOUJjRU5WSlRKR2QxQm9KVEpHYmlVeVJqTjRiRzFVV2pnelUyTm0Y78nZjecySAASGAoJeWFob28uY29tGK_B2Y3nMkgAUgIIbxIZCgp1aWRhcGkuY29tGKG_2Y3nMkgAUgIIZBJWCgxpZDUtc3luYy5jb20SRElENSpLdUd4ME5mWmdpZU5GemNkTUhiZGNOWFB1OXZzTExHWm9Ha1p1T1dhSWFVU2o0b0cxTDBQRnBpTmZ5SU1Qa2Z2WAESFAoFb3BlbngY1MDZjecySABSAghvEhsKDDMzYWNyb3NzLmNvbRihv9mN5zJIAFICCGQSggIKCHJ0YmhvdXNlEuwBYWFSN054SlVES2dXa2c4WUpnMVVCNnZjQmswUlAwR1htZWgzQ0ZkT1dzNjhkaHgzTHR0WGo4NzF5UlNScjdGVUtwQUlYTFFPWGkzMlkyS0lsUDQzU3pIV1ZRUS91ejNGL3RyWjR1Z2xJeHhWc2hOQkFSL09VaFkzTllJbTN6WWxRRFZVeHZwRzBPcS9sTWFoLzZzaHFqalVMOVNIRzhodHBZSFpBaVFvMGdFbndjR3hvRHBOYkQ2S2gyaVI4VlB6MC9SYmxIbURyd3pBUy9LWkxqTy9iT2ljdUJ0MUR0TkJaU3o1eHdmcVZibz0Y7cLZjecySAA.&nt=1&psd=WzMxLFtudWxsLFtbIi8xMjU0MTQ0LDE4MzA5NjQ5Mi9tZWRpYWZpcmVfY29tLWVkZ2UtMiIsW1s0MTQyNzk3MTY1LDEwNDgzNTkwNzUsMzMwMDE3ODU3Nl1dXV1dLG51bGwsM10.&dlt=1745664497579&idt=1785&ppid=e1c37ebfc1a9a27cfae119775cae22e8&prev_scp=a%3D1%26iid1%3D4932720536473080%26eid%3D4932720536473080%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D0%26ap%3D1102%26sap%3D1102%26as%3Drevenue%26plat%3D1%26bra%3Dmod31-c%26ic%3D3%26at%3Dbf%26adr%3D399%26ezosn%3D1%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D39%26al%3D1039%26compid%3D1%26tap%3Dmediafire_com-edge-2-4932720536473080%26eb_br%3Dzero%26eba%3D0%26bv%3D38%26bvm%3D4%26bvr%3D0%26avc%3D7%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D0%26br2%3D4%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D157%2C168%2C0%2C0%2C0%2C193%2C196%2C20%2C0%2C0%2C192%2C31%2C902%2C903%2C901%2C902%2C903%26deal1%3D17%2C18%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1428%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C2764%2C2765%2C3044%2C3045%2C3052%2C3053%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C3856%2C4184%2C4186%2C4276%2C5747%2C6293%2C6294%2C6295%2C7035%2C7036%2C7330%2C7331%2C7605%2C7606%2C7607%2C7608%2C7609%2C7610%2C7611%2C7612%2C7613%2C7614%2C7615%2C7616%2C7617%2C7618%2C6772%2C5534%2C7661%2C7713%26adxf%3D1%26lb%3D0%26ss38%3D1%26ss9%3D1%26reqt%3D1745664500787%26nocompoverride%3D1&cust_params=carbon_segment%3D&adks=3081006461&frm=20&eo_id_str=ID%3D3c90627c638c6682%3AT%3D1745664499%3ART%3D1745664499%3AS%3DAA-AfjacEzd8vr0aExHgjT2vBZ_B&pbbce=1&td=1&egid=38815&tan=a9d4574a-b146-43f0-b55d-8d6d45dae5f3&tdf=2

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504220101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

3b83ad6e7a219be0f2b937af826809b211e5c3148f51fd0a0f9405dc1075ba1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: dcb
google-lineitem-id: -2
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Sat, 26 Apr 2025 10:48:21 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.mediafire.com
content-length: 161
x-xss-protection: 0
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 411 B
188 B 297ms
296ms Fetch
text/plain 142.250.186.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=5966717732066796&correlator=942139644442875&eid=31086815%2C31090592%2C83321072%2C31091673%2C95340253%2C95340255&output=ldjh&gdfp_req=1&vrg=202504220101&ptt=17&impl=fif&gdpr=0&us_privacy=1---&gpp_sid=-1&iu_parts=1254144%3A183096492%2Cmediafire_com-edge-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C160x600&fluid=height&ifi=12&didk=2994273263&dids=div-gpt-ad-mediafire_com-edge-&adfs=2968723417&sfv=1-0-41&rcs=2&eri=1&sc=1&cookie=ID%3D10dade855c8dff6b%3AT%3D1745664499%3ART%3D1745664499%3AS%3DALNI_Ma_1Fpvm5ahLciUmw4fdswd_99oyg&gpic=UID%3D00001090e6cf4f86%3AT%3D1745664499%3ART%3D1745664499%3AS%3DALNI_Mbo-mfP4WIQHZ6MctbqnhRKNw10vA&abxe=1&dt=1745664501421&lmt=1745664501&adxs=0&adys=300&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=180&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F0z4njtfe7z5sca3%2FEX13_RP8-FP.rar%2Ffile&vis=1&aee=1&psz=160x-1&msz=160x-1&fws=512&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGskDHt1QT8b-kKcnseZcCRUhgac5ZF-0DM94bpr_XPHT&topics=3&tps=3&htps=10&a3p=EjQKCnB1YmNpZC5vcmcSJGVjM2VmZjY4LTBlMWEtNDExMi04ZTIxLWY4YmQzNjFjNDIwZFgBEloKDWNyd2RjbnRybC5uZXQSQDIwMzNiYjg1ZGI2ODk1MjYzMjY1YThhY2Y0ZmIxODVjYTAyY2U4ZGEyMWExNzFlZDllMTZjODlhNDliMTQ4ODAYt8HZjecySAAS2AEKDmVzcC5jcml0ZW8uY29tErwBVE9oMTUxOXlTbXh0VWlVeVJtNVFWRWgwUkc5SGNqbHljbUpGVDFoRFUxZFFVRWRGZERoSVozWmFRMDlsZVhwalFuZGFNbmhVWkRKcVZGVkVTazVZVkhkSWJqUlplR3QzZDA1SlZVdEpkbGgxT0VWeFJtVlpTamt3ZVVSMWNFMDROME5MZVhaQ1VsWmhTV1JpYWtaTk5FOUJjRU5WSlRKR2QxQm9KVEpHYmlVeVJqTjRiRzFVV2pnelUyTm0Y78nZjecySAASGAoJeWFob28uY29tGK_B2Y3nMkgAUgIIbxIZCgp1aWRhcGkuY29tGKG_2Y3nMkgAUgIIZBJWCgxpZDUtc3luYy5jb20SRElENSpLdUd4ME5mWmdpZU5GemNkTUhiZGNOWFB1OXZzTExHWm9Ha1p1T1dhSWFVU2o0b0cxTDBQRnBpTmZ5SU1Qa2Z2WAESFAoFb3BlbngY1MDZjecySABSAghvEhsKDDMzYWNyb3NzLmNvbRihv9mN5zJIAFICCGQSggIKCHJ0YmhvdXNlEuwBYWFSN054SlVES2dXa2c4WUpnMVVCNnZjQmswUlAwR1htZWgzQ0ZkT1dzNjhkaHgzTHR0WGo4NzF5UlNScjdGVUtwQUlYTFFPWGkzMlkyS0lsUDQzU3pIV1ZRUS91ejNGL3RyWjR1Z2xJeHhWc2hOQkFSL09VaFkzTllJbTN6WWxRRFZVeHZwRzBPcS9sTWFoLzZzaHFqalVMOVNIRzhodHBZSFpBaVFvMGdFbndjR3hvRHBOYkQ2S2gyaVI4VlB6MC9SYmxIbURyd3pBUy9LWkxqTy9iT2ljdUJ0MUR0TkJaU3o1eHdmcVZibz0Y7cLZjecySAA.&nt=1&psd=WzMxLFtudWxsLFtbIi8xMjU0MTQ0LDE4MzA5NjQ5Mi9tZWRpYWZpcmVfY29tLWVkZ2UtMSIsW1s0MTQyNzk3MTY1LDEwNDgzNTkwNzUsMzMwMDE3ODU3Nl1dXV1dLG51bGwsM10.&dlt=1745664497579&idt=1785&ppid=e1c37ebfc1a9a27cfae119775cae22e8&prev_scp=a%3D1%26iid1%3D7924875182434044%26eid%3D7924875182434044%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D0%26ap%3D1101%26sap%3D1101%26as%3Drevenue%26plat%3D1%26bra%3Dmod31-c%26ic%3D3%26at%3Dbf%26adr%3D399%26ezosn%3D2%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D38%26al%3D1038%26compid%3D1%26tap%3Dmediafire_com-edge-1-7924875182434044%26eb_br%3Dzero%26eba%3D0%26bv%3D38%26bvm%3D4%26bvr%3D0%26avc%3D4%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D0%26br2%3D4%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D34%2C193%2C0%2C0%2C0%2C168%2C132%2C0%2C0%2C0%2C143%2C0%2C901%2C182%2C901%2C902%2C903%26deal1%3D17%2C18%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1428%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C2764%2C2765%2C3044%2C3045%2C3052%2C3053%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C3856%2C4184%2C4186%2C4276%2C5747%2C6293%2C6294%2C6295%2C7035%2C7036%2C7330%2C7331%2C7605%2C7606%2C7607%2C7608%2C7609%2C7610%2C7611%2C7612%2C7613%2C7614%2C7615%2C7616%2C7617%2C7618%2C6772%2C5534%2C7661%2C7713%26adxf%3D1%26lb%3D0%26ss38%3D1%26ss9%3D1%26reqt%3D1745664500726%26nocompoverride%3D1&cust_params=carbon_segment%3D&adks=3527628052&frm=20&eo_id_str=ID%3D3c90627c638c6682%3AT%3D1745664499%3ART%3D1745664499%3AS%3DAA-AfjacEzd8vr0aExHgjT2vBZ_B&pbbce=1&td=1&egid=38815&tan=a9d4574a-b146-43f0-b55d-8d6d45dae5f4&tdf=2

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504220101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

e0387f5b484bed89a880c937991ea3aef765b92011ad4027503bb7f3402297d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: dcb
google-lineitem-id: -2
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Sat, 26 Apr 2025 10:48:21 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.mediafire.com
content-length: 158
x-xss-protection: 0
server: cafe

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 3DDE 42 B
65 B 125ms
125ms Fetch
image/gif 142.250.185.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstl4oraiXffv2bWRmrv-oMmUT-zJR50ezQ1uqXqBft1yYha9cn9vE5-TVjeVX9dSdnRFu1aW5t1Ss4EmWHPVAUwBXtxtdUP5myYwyIDa57vpbDZzKkuoNtahe5XBuBUf_Q_pzMWy6SGLLljworoHSIDnGQiLLoiX8x0w1kE5KpmcH0&sig=Cg0ArKJSzBO8PtgD_JUKEAE&id=lidar2&mcvt=1000&p=420,320,700,656&tm=1241.2999992370605&tu=241.70000076293945&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20250423&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1277606936&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=4159730000&rst=1745664499984&rpt=1086&isd=0&lsd=0&met=mue&wmsd=0&pbe=0&fle=0&vae=0&spb=0&sfl=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Sat, 26 Apr 2025 10:48:22 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame AD50 42 B
65 B 126ms
126ms Fetch
image/gif 142.250.185.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvjsDNftRKO5M_l1QYm9UVpNALdWvOf4lTTsT2NQo323BxrFFhlHjKDmLo8-KNtgxz532zkY0WAfcqKx6Lsw1Aznmerxfuo49A0J7n0iknMf-4OlDKN7biBVqci0GaC6tYkW0PLj18D7b-8DdJxcDdM36GPxIHj4D4bX8ZWjA&sig=Cg0ArKJSzLdE3m23z30AEAE&id=lidar2&mcvt=1000&p=120,320,400,656&tm=1245&tu=245.29999923706055&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20250423&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=4079446691&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=4159730000&rst=1745664500052&rpt=1044&isd=0&lsd=0&met=mue&wmsd=0&pbe=0&fle=0&vae=0&spb=0&sfl=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Sat, 26 Apr 2025 10:48:22 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

POST
H3 204 ping
pagead2.googlesyndication.com/pagead/ 0
0 111ms
110ms Fetch
text/html 142.250.185.130
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://pagead2.googlesyndication.com/pagead/ping?e=1
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504220101/pubads_impl.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.185.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s50-in-f2.1e100.net
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://www.mediafire.com/

Response headers

GET
H2 200 event
abs.yandex.ru/dsp/ Frame 3DDE 43 B
135 B 123ms
123ms Image
image/gif 87.250.254.222
YANDEX YANDEX LLC

General

Check archive.org

Download Go to Show image

Full URL: https://abs.yandex.ru/dsp/event?bi=kHy9_QYAAAAAAAAAeJyzmMLvMIUfAAZtAb8%2C&dt=1&et=5&f=UwLrV9UAAAAAAAAAeJzjuNwy49XZCaf2qwh8_rzpAJvE5-4rt3qO_bqdpMXBwSjAIcGkwGDEw8EgwCDBoMCgwWDAYMXGwQ_kMTqZcGx-v_fc8dmvV-1kFFjycf7TlxcXfH3GKIEQVRIsLy_Xy01NyUxMyyxK1UvOz82ILeLj4uLYySLEXJaTKMEgwNLAyNrFyCXxJVLjOrsBqwXjJEYeDrgjBFhnMDIuYGTYxMgCdA3jTsa2rVddwk742x1k_FWXtadkcof9CUaGS4zMElvZXzAyfmBk_ME4ixsAh5dPiw%2C%2C&confirmTime=2100000&confirmRatio=1000000&test-tag=158879430218754&ctime=1745664502988&actual-format=13&rnd=7878565839526&banner-sizes=eyI2NDQzNTI3OSI6IjMzNngyODAifQ%3D%3D&rendered-direct-assets=eyI2NDQzNTI3OSI6MzN9&width=336&height=280&top-screen-block-area=94080&top-screen-block-area-portion=1
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 87.250.254.222 , Russian Federation, ASN13238 (YANDEX YANDEX LLC, RU),
Reverse DNS: air.yandex.ru
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com/

Response headers

content-encoding: gzip
content-length: 57
x-yt-trace-id: a54c2cb6-198d20c-1bc47255-3e772782
x-content-encoding: gzip
content-type: image/gif
x-yt-request-id: e6e717b7-8478529f-e2fa604c-eea5ccb5

GET
H2 200 event
abs.yandex.ru/dsp/ Frame AD50 43 B
135 B 126ms
126ms Image
image/gif 87.250.254.222
YANDEX YANDEX LLC

General

Check archive.org

Download Go to Show image

Full URL: https://abs.yandex.ru/dsp/event?bi=kHy9_QYAAAAAAAAAeJyzmMLvMIUfAAZtAb8%2C&dt=1&et=5&f=fT81nNUAAAAAAAAAeJzjeNVy4u3DCaf2qwh8_rzpAJvE58uTlu49-XVymRYHB6MAhwSTAoMRDweDAIMEgwKDBoMBgxUbBz-Qx-hkwrH5_d5zx2e_XrWTUWDCi-aPS35PePGQUQIhqiRYXl6ul5uakpmYllmUqpecn5sRV8THxcXxn0WIuTixWIJBgKWBkbWLkUviS6TGdXYDVgvGSYw8HHBHCLDOYGRcwMiwiZEF6BrGnYwXH-g7eZoE2R1k3OXJw6Td3mZ_gpHhEiOzxFb2F4yMHxgZfzAu4QYAPQ1MuA%2C%2C&confirmTime=2100000&confirmRatio=1000000&test-tag=158879430218754&ctime=1745664502990&actual-format=13&rnd=5173273964533&banner-sizes=eyI2NDQzNjIzNyI6IjMzNngyODAifQ%3D%3D&rendered-direct-assets=eyI2NDQzNjIzNyI6MzN9&width=336&height=280&top-screen-block-area=94080&top-screen-block-area-portion=1
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 87.250.254.222 , Russian Federation, ASN13238 (YANDEX YANDEX LLC, RU),
Reverse DNS: air.yandex.ru
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com/

Response headers

content-encoding: gzip
content-length: 57
x-yt-trace-id: 11949650-704daba8-8ec16d85-ffa9e235
x-content-encoding: gzip
content-type: image/gif
x-yt-request-id: dce3750-2b6ffa2f-67eaeeaa-8fbb8a63

GET
H2 200 event
abs.yandex.ru/dsp/ Frame 3DDE 43 B
135 B 125ms
124ms Image
image/gif 87.250.254.222
YANDEX YANDEX LLC

General

Check archive.org

Download Go to Show image

Full URL: https://abs.yandex.ru/dsp/event?dt=1&et=1&f=UwLrV9UAAAAAAAAAeJzjuNwy49XZCaf2qwh8_rzpAJvE5-4rt3qO_bqdpMXBwSjAIcGkwGDEw8EgwCDBoMCgwWDAYMXGwQ_kMTqZcGx-v_fc8dmvV-1kFFjycf7TlxcXfH3GKIEQVRIsLy_Xy01NyUxMyyxK1UvOz82ILeLj4uLYySLEXJaTKMEgwNLAyNrFyCXxJVLjOrsBqwXjJEYeDrgjBFhnMDIuYGTYxMgCdA3jTsa2rVddwk742x1k_FWXtadkcof9CUaGS4zMElvZXzAyfmBk_ME4ixsAh5dPiw%2C%2C&bi=jAT6NiYAAAAAAAAAeJwBJgDZ_wjP6NweEJQPGJQPIJHwsy8yDgjSDhCy5NaQk-v31NgBOJQPQJQPPp0Qvw%2C%2C&test-tag=6914278871859217&banner-sizes=eyI2NDQzNTI3OSI6IjMzNngyODAifQ%3D%3D&ctime=1745664503190&actual-format=13&pcodever=1247521&banner-test-tags=eyI2NDQzNTI3OSI6IjI4MTQ3NDk4MDk1NDEyOSJ9&constructor-rendered-assets=eyI2NDQzNTI3OSI6MTI5fQ&rendered-direct-assets=eyI2NDQzNTI3OSI6MzN9&width=336&height=280&stat-id=1&top-screen-block-area=94080&top-screen-block-area-portion=1&confirmTime=2100000&confirmRatio=1000000&wmode=0
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 87.250.254.222 , Russian Federation, ASN13238 (YANDEX YANDEX LLC, RU),
Reverse DNS: air.yandex.ru
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com/

Response headers

content-length: 57
x-yt-trace-id: fc426138-87003f03-bb8167c9-16cd204b
x-content-encoding: gzip
content-type: image/gif
content-encoding: gzip
x-yt-request-id: f400994a-50ba4ace-f80ca2f-281ea623

GET
H2 200 event
abs.yandex.ru/dsp/ Frame AD50 43 B
135 B 120ms
120ms Image
image/gif 87.250.254.222
YANDEX YANDEX LLC

General

Check archive.org

Download Go to Show image

Full URL: https://abs.yandex.ru/dsp/event?dt=1&et=1&f=fT81nNUAAAAAAAAAeJzjeNVy4u3DCaf2qwh8_rzpAJvE58uTlu49-XVymRYHB6MAhwSTAoMRDweDAIMEgwKDBoMBgxUbBz-Qx-hkwrH5_d5zx2e_XrWTUWDCi-aPS35PePGQUQIhqiRYXl6ul5uakpmYllmUqpecn5sRV8THxcXxn0WIuTixWIJBgKWBkbWLkUviS6TGdXYDVgvGSYw8HHBHCLDOYGRcwMiwiZEF6BrGnYwXH-g7eZoE2R1k3OXJw6Td3mZ_gpHhEiOzxFb2F4yMHxgZfzAu4QYAPQ1MuA%2C%2C&bi=jhgjPSYAAAAAAAAAeJwBJgDZ_wiN8NweEJQPGJQPIJHwsy8yDgjSDhDLp66J6drUofQBOJQPQJQPMqkQPQ%2C%2C&test-tag=6914278871859217&banner-sizes=eyI2NDQzNjIzNyI6IjMzNngyODAifQ%3D%3D&ctime=1745664503191&actual-format=13&pcodever=1247521&banner-test-tags=eyI2NDQzNjIzNyI6IjI4MTQ3NDk4MDk1NDEyOSJ9&constructor-rendered-assets=eyI2NDQzNjIzNyI6MTI5fQ&rendered-direct-assets=eyI2NDQzNjIzNyI6MzN9&width=336&height=280&stat-id=1&top-screen-block-area=94080&top-screen-block-area-portion=1&confirmTime=2101000&confirmRatio=1000000&wmode=0
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 87.250.254.222 , Russian Federation, ASN13238 (YANDEX YANDEX LLC, RU),
Reverse DNS: air.yandex.ru
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com/

Response headers

content-length: 57
x-yt-trace-id: e5b77417-75ca42e3-259bda39-15c0f524
x-content-encoding: gzip
content-type: image/gif
content-encoding: gzip
x-yt-request-id: 77f1ea8b-992e6050-b640b986-43906dae

POST
H2 204 collect
analytics.google.com/g/ 0
0 90ms
88ms Fetch
text/plain 216.58.212.174
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-K68XP6D85D&gtm=45je54n0v887485693za200zb6304663&_p=1745664498043&gcs=G111&gcd=13n3n3l3l5l1&npa=0&dma=0&tcfd=10000&tag_exp=102887800~103051953~103077950~103106314~103106316~103116025~103130360~103130362~103200001&ptag_exp=102887800~103051953~103077950~103106314~103106316~103116025~103130360~103130362~103200001&cid=128592636.1745664499&ul=tr-tr&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&pae=1&frm=0&pscdl=noapi&_eu=AEIAAAI&sid=1745664498&sct=1&seg=0&dl=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F0z4njtfe7z5sca3%2FEX13_RP8-FP.rar%2Ffile&dt=EX13_RP8-FP&_s=2&tfd=8054
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-K68XP6D85D&l=dataLayer&cx=c&gtm=45He54n0v6304663za200&tag_exp=102887800~103051953~103077950~103106314~103106316~103116025~103130360~103130362~103200001
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 216.58.212.174 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: ams15s22-in-f174.1e100.net
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://www.mediafire.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:153:0
report-to: {"group":"ascnsrsggc:153:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:153:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.mediafire.com
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:153:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 26 Apr 2025 10:48:25 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 country Show response
api.btloader.com/ 37 B
215 B 308ms
192ms Fetch
application/json 130.211.23.194

General

Check archive.org

Download Go to

Full URL: https://api.btloader.com/country?o=5678961798414336
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.23.194 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 78b80cc043c0792a4d0f69f0c5a4eaae062c7d58f7c08e9c3b253cd37026496d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cache-control: private, max-age=300, stale-while-revalidate=600, stale-if-error=600
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37
date: Sat, 26 Apr 2025 10:48:25 GMT
content-type: application/json
vary: Origin

GET
H2 204 pv Show response
api.btloader.com/ 0
66 B 310ms
196ms XHR
text/plain 130.211.23.194

General

Check archive.org

Download Go to

Full URL: https://api.btloader.com/pv?tid=zLeDPc92pp-e4yTalLN-9671b65a53&w=5115845767331840&o=5678961798414336&cv=2.1.85-1-gbe83a9e&widget=false&nlf=false&r=false&vr=1600x1200&pageURL=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F0z4njtfe7z5sca3%2FEX13_RP8-FP.rar%2Ffile&sid=tIAVRmjn-QTD42FVz-9671b65a53&pm=true&upapi=true
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.23.194 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

via: 1.1 google
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 26 Apr 2025 10:48:25 GMT
vary: Origin

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: ag.dns-finder.com
URL: https://ag.dns-finder.com/px.gif

Domain: www.mediafiredls.com
URL: https://www.mediafiredls.com/onclick/0

Domain: cdn-ima.33across.com
URL: https://cdn-ima.33across.com/ob.js

Verdicts & Comments Add Verdict or Comment

516 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

90 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar	1969-12-31 23:59:59	Name: g36FastPopSessionRequestNumber Value: 1
.ccgateway.net/1	1970-01-21 07:02:34	Name: ccuid Value: f0344ebd-6fbe-4bdf-ab54-b54c0d278c3c
.ccgateway.net/1	1970-01-21 04:54:26	Name: ccsid Value: 025f28ab-fc9c-47b5-9f13-e0b0827f7933
.mediafire.com/	1970-01-21 14:30:24	Name: ukey Value: 3uzemsro3m1kcxtafjy7vadvb4i4at6f
.mediafire.com/	1970-01-21 04:58:43	Name: 0zen Value: 1
.mediafire.com/	1970-01-21 05:37:36	Name: conv_tracking_data-2 Value: %7B%22mf_source%22%3A%22regular_download-59%22%2C%22mf_content%22%3A%22Free%22%2C%22mf_medium%22%3A%22linux%5C%2FChrome%22%2C%22mf_campaign%22%3A%220z4njtfe7z5sca3%22%2C%22mf_term%22%3A%22608952f8ad61fd2d6c427fdc0b040672%22%7D
.mediafire.com/	1970-01-21 04:54:26	Name: __cf_bm Value: 0XzYRisw5ncdMRAluL4gkn8ZKWudGHE7Q4D2DF0HSaw-1745664497-1.0.1.1-.WykaYGwApd48C9g4xLGpqGM88Dd1p1sp5ZvIMf7DjZUZzPJ0KU399j2T9ZQ3U.IDXVsYBrK.L5HdRAJ_E62CY8SMg4vTxd.zhs13bknBp8
.mediafire.com/	1970-01-21 04:54:31	Name: ezoab_484470 Value: mod31-c
.mediafire.com/	1970-01-21 04:54:26	Name: lp_484470 Value: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file
.mediafire.com/	1970-01-21 04:57:17	Name: ezovuuidtime_484470 Value: 1745664498
.mediafire.com/	1970-01-21 04:54:26	Name: ezovuuid_484470 Value: 6677ec7a-9ab4-4d1d-65a2-7e3f2fb8300e
.mediafire.com/	1970-01-21 04:54:26	Name: ezoref_484470 Value:
.mediafire.com/	1970-01-21 04:57:17	Name: active_template::484470 Value: pub_site.1745664498
www.mediafire.com/	1970-01-21 04:57:17	Name: ezstandaloneuser Value: true
.mediafire.com/	1970-01-21 13:40:00	Name: amp_28916b Value: QXXZkij4GNgAog-Y7LV2n9...1iporcmt4.1iporcmt4.0.1.1
.mediafire.com/	1970-01-21 04:54:26	Name: ezopvc_484470 Value: 2
.mediafire.com/	1970-01-21 13:40:00	Name: cf_clearance Value: YQ5U_J.FVHN8GT0bmgRGQzB578bk2pu4YibDx26Fo4A-1745664498-1.2.1.1-qKNWDoID.SSpUDg5B86PXoxKa7pnQ82l1cb3LKEAeHpoJiZ97Nw8hgziAFmmfANG_.lmXlKh1MBsGyZDT0CLIPrGHtY_tEK2W0hXSJpZbNA9cjsilYqVQ0TO_i1IwPXjGV7khcZ_XA37APlY39xUcS5Uf2Yu7BYC6TWsDmWnYNYjdNvZMKsorEgu3lnyY2MBraN7jxgTocSNHRCCpYIXIOrS9GOv7RZjm825pAVCZeWj7XOgZJbYhaeel7rbmV9Xi8JCf7uspeOMfovIH.6J6Pb.FJKbQWaLYXhGRwxjCdKvsbocZk6QedJe4kHS13CJ6V85_jJB03NjXqD5R56GP6bqhexmiwrHGdZDFZagTsI
.mediafire.com/	1970-01-21 14:30:24	Name: _ga Value: GA1.2.128592636.1745664499
.mediafire.com/	1970-01-21 04:55:50	Name: _gid Value: GA1.2.683673704.1745664499
.mediafire.com/	1970-01-21 04:54:24	Name: _gat_gtag_UA_829541_1 Value: 1
www.mediafire.com/	1969-12-31 23:59:59	Name: ezhbf Value: 0
.mediafire.com/	1970-01-21 13:40:00	Name: _sharedid Value: ec3eff68-0e1a-4112-8e21-f8bd361c420d
.mediafire.com/	1970-01-21 13:40:00	Name: _sharedid_cst Value: zix7LPQsHA%3D%3D
www.mediafire.com/	1970-01-21 04:54:28	Name: _lr_retry_request Value: true
www.mediafire.com/	1970-01-21 05:37:36	Name: _lr_env_src_ats Value: false
econventa.com/	1969-12-31 23:59:59	Name: IKSR Value: {}
econventa.com/	1969-12-31 23:59:59	Name: INF_DFL8 Value: false
econventa.com/	1970-01-21 14:30:24	Name: IUID Value: 26bff720-b8d9-490f-8f7c-2d82dd575f96
econventa.com/	1969-12-31 23:59:59	Name: ISSH Value: 7AEB24
econventa.com/	1969-12-31 23:59:59	Name: VMI Value:
econventa.com/	1970-01-21 14:30:24	Name: CHN Value: #[]
econventa.com/	1970-01-21 14:30:24	Name: MSSH Value: #{}
econventa.com/	1970-01-21 14:30:24	Name: MSRH Value: #{}
econventa.com/	1970-01-21 14:30:24	Name: ILP Value: null
econventa.com/	1970-01-21 14:30:24	Name: ILPLU Value: #1/1/0001 12:00:00 AM
econventa.com/	1970-01-21 14:30:24	Name: ILEALC Value: #1/1/0001 12:00:00 AM
econventa.com/	1970-01-21 04:54:38	Name: ILMPF Value: #False
econventa.com/	1970-01-21 14:30:24	Name: IPMPLU Value: #1/1/0001 12:00:00 AM
econventa.com/	1970-01-21 14:30:24	Name: IPMUID Value: #
econventa.com/	1970-01-21 14:30:24	Name: BSWUID Value: #
econventa.com/	1970-01-21 14:30:24	Name: IBL Value: #[]
econventa.com/	1970-01-21 14:30:24	Name: IOPT Value: #[]
econventa.com/	1970-01-21 14:30:24	Name: ISH Value: #{"101":[{"SId":"7AEB24","D":"25/4/26T3:48:18"}]}
econventa.com/	1970-01-21 14:30:24	Name: ISH_Q Value: #[101]
www.mediafire.com/	1970-01-21 14:30:24	Name: ezds Value: ffid%3D1%2Cw%3D1600%2Ch%3D1200
www.mediafire.com/	1970-01-21 14:30:24	Name: ezohw Value: w%3D1600%2Ch%3D1200
.a-mx.com/	1970-01-21 13:40:00	Name: amdt_t Value: g::1745664499271
.a-mx.com/	1970-01-21 13:40:00	Name: amuid2 Value: d7dd4e2b-7034-4838-9ffb-9b09dcd4709a
.a-mx.com/	1970-01-21 13:40:00	Name: pamdt_t Value: g::1745664499271
.a-mx.com/	1970-01-21 13:40:00	Name: pamuid2 Value: d7dd4e2b-7034-4838-9ffb-9b09dcd4709a
.yahoo.com/	1970-01-21 13:40:22	Name: A3 Value: d=AQABBPO5DGgCEHheW5vvUtlocrAz3MLX--EFEgEBAQELDmgWaMcZ0SMA_eMCAA&S=AQAAAqsphNJCRGJWHRnbhdl4tZQ
www.mediafire.com/	1970-01-21 11:23:12	Name: ezppid_ck Value: e1c37ebfc1a9a27cfae119775cae22e8
.crwdcntrl.net/	1970-01-21 11:23:09	Name: _cc_dc Value: 1
.crwdcntrl.net/	1970-01-21 11:23:09	Name: _cc_id Value: 7375b1ee29148d736cca8d31f6175554
.crwdcntrl.net/	1970-01-21 11:23:12	Name: _cc_cc Value: "ACZ4nGNQMDc2N00yTE01sjQ0sUgxNzZLTk60SDE2TDMzNDc1NTVhAIIMnp2fGRAAAEjHCn4%3D"
.crwdcntrl.net/	1970-01-21 11:23:12	Name: _cc_aud Value: "ABR4nGNgYGDI4Nn5mQEOABl7AiE%3D"
www.mediafire.com/	1970-01-21 06:20:48	Name: pbjs-unifiedid Value: %7B%22TDID_LOOKUP%22%3A%22FALSE%22%2C%22TDID_CREATED_AT%22%3A%222025-04-26T10%3A48%3A19%22%7D
www.mediafire.com/	1970-01-21 06:20:48	Name: pbjs-unifiedid_cst Value: zix7LPQsHA%3D%3D
.mediafire.com/	1970-01-21 05:04:29	Name: panoramaId_expiry Value: 1746269299317
.mediafire.com/	1970-01-21 11:23:12	Name: _cc_id Value: 7375b1ee29148d736cca8d31f6175554
.mediafire.com/	1970-01-21 05:04:29	Name: panoramaId Value: 2033bb85db6895263265a8acf4fb185ca02ce8da21a171ed9e16c89a49b14880
.mediafire.com/	1970-01-21 14:16:11	Name: cto_bidid Value: MLzwgF9KWGEwR0dtdzNWS0VCR295cVcxNSUyQlo2UENncjZLVGh1U3IlMkZLNlFBcmwwT1pwSlhjNU51a01JeVJGeDZIVDZOdDklMkJvcEVxWmlKWTZKQXhOMGxrbTclMkJ3JTNEJTNE
.a-mo.net/	1970-01-21 13:40:00	Name: amdt_t Value: p::1745664499543
.a-mo.net/	1970-01-21 13:40:00	Name: amuid2 Value: d7dd4e2b-7034-4838-9ffb-9b09dcd4709a
.a-mo.net/	1970-01-21 13:40:00	Name: pamdt_t Value: p::1745664499543
.a-mo.net/	1970-01-21 13:40:00	Name: pamuid2 Value: d7dd4e2b-7034-4838-9ffb-9b09dcd4709a
.id5-sync.com/	1970-01-21 07:04:00	Name: id5 Value: 5ee76d6d-c038-77f9-a049-2dd8626251af#1745664499249#4
.mediafire.com/	1970-01-21 14:30:24	Name: _ga_K68XP6D85D Value: GS1.1.1745664498.1.0.1745664500.58.0.0
.mediafire.com/	1970-01-21 14:16:00	Name: __gads Value: ID=10dade855c8dff6b:T=1745664499:RT=1745664499:S=ALNI_Ma_1Fpvm5ahLciUmw4fdswd_99oyg
.mediafire.com/	1970-01-21 14:16:00	Name: __gpi Value: UID=00001090e6cf4f86:T=1745664499:RT=1745664499:S=ALNI_Mbo-mfP4WIQHZ6MctbqnhRKNw10vA
.mediafire.com/	1970-01-21 09:13:36	Name: __eoi Value: ID=3c90627c638c6682:T=1745664499:RT=1745664499:S=AA-AfjacEzd8vr0aExHgjT2vBZ_B
.ccgateway.net/	1970-01-21 07:02:34	Name: ccuid Value: f0344ebd-6fbe-4bdf-ab54-b54c0d278c3c
.ccgateway.net/	1970-01-21 04:54:26	Name: ccsid Value: 025f28ab-fc9c-47b5-9f13-e0b0827f7933
.semasio.net/	1970-01-21 13:40:00	Name: SEUNCY Value: 478191D71E4A1F02
.doubleclick.net/	1970-01-21 14:30:24	Name: IDE Value: AHWqTUkS3Hx4iZv95xPngwCs1cy9CdNU1N9RtawdVjTMiUAw1l_D0V9zMFqMRFZYwS0
.id5-sync.com/	1970-01-21 07:04:00	Name: 3pi Value: 112#1745664500300#-1535768705#478191D71E4A1F02
.id5-sync.com/	1970-01-21 04:54:24	Name: cf Value: gif
.id5-sync.com/	1970-01-21 04:54:24	Name: cip Value: 457
.id5-sync.com/	1970-01-21 04:54:24	Name: cnac Value: 6
.id5-sync.com/	1970-01-21 04:54:24	Name: car Value: 3
.id5-sync.com/	1970-01-21 04:54:24	Name: gdpr Value: 0\|
.yandex.ru/	1970-01-21 14:30:24	Name: bh Value: YPTzssAGahncyumIDvKst6UL+/rw5w3r//32D8TTz4cI
.yandex.ru/	1970-01-21 14:30:24	Name: i Value: VzhRvLVBcdoiAeG6UU0Dqdb9VJgkMjvFN2IYZN0CmJ7Ft4QO5CnVLwTgiz+2vjSQm9r2Jca6Hm+0BkCO6X7vH36Bbeg=
.yandex.ru/	1970-01-21 14:30:24	Name: yandexuid Value: 6233364021745664500
.yandex.ru/	1970-01-21 13:40:00	Name: yashr Value: 7044216971745664500
.mediafire.com/	1970-01-21 13:40:00	Name: FCNEC Value: %5B%5B%22AKsRol9GCi3CwQz1Vorw6JASxoAiH3lon_FQKi9KidaJBGy6ZhSPVMUgaJGFUC72v939P8cGlVQE0GkhpK6zcS8gPnHWqrZ-lC3EsuCB3NCZ0fjreWh7qQ-tZRb01usxBlFdt8ObF_Yl2yjNQGFOoS6c6dt9YbnesQ%3D%3D%22%5D%5D
.criteo.com/	1970-01-21 14:16:00	Name: uid Value: 2463349e-16d7-4124-961e-5be1f96699d0
.criteo.com/	1970-01-21 14:16:00	Name: receive-cookie-deprecation Value: 1
.criteo.com/	1970-01-21 14:16:00	Name: cto_bundle Value: sXw-W19IUDFPMFFDOGhzVCUyQnE0V1NpUTNKUGhMVWdkdGMyTWxYMVdsUCUyQllqQ2xKeGdheEZ4WHolMkJhb0J1bWRGQ3RvQyUyQmF3bzR4NmJ4eVNyM0FCZlBJJTJGRjlMWVZJWlkwek9JaTZYVjBxT3ppT25sYW5sOGdOVE9iVENpdllFU09RRW5Id251d2VRWk9hd3VlRmolMkJuTUtGem5yUkElM0QlM0Q
.mediafire.com/	1970-01-21 14:16:00	Name: cto_bundle Value: 7kouKl9ySmxtUiUyRm5QVEh0RG9HcjlycmJFT1VteWslMkI4NzRFTTFaNGFoZEJQMVk4eEkxQUNZZDBMN2tsc1pvc3plbXM3R1BXclRoZDRaMWRwJTJGOHdZJTJCMktEejJydUc3Q1JJVlFlNmhEUTZBT1ZqbHJEYTNkTkg4Y1M0dVdCZEI2SDVCMXN4eDJTNlFFZGFGcHdKYUMlMkJjNlpjNnYxTmpkdm5Malh5VkQzWTVhR2dxRjBNJTNE

6 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file(Line 2428) Message: document.domain mutation is ignored because the surrounding agent cluster is origin-keyed.
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'bluetooth'.
network	error	URL: https://api.rlcdn.com/api/identity/envelope?pid=14067 Message: Failed to load resource: the server responded with a status of 451 ()
javascript	error	URL: https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file Message: Access to XMLHttpRequest at 'https://www.mediafiredls.com/onclick/0' from origin 'https://www.mediafire.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://www.mediafiredls.com/onclick/0 Message: Failed to load resource: net::ERR_FAILED
network	error	URL: https://ups.analytics.yahoo.com/ups/58713/fed?v=1&1p=0&gdpr=0&gdpr_consent=&us_privacy=&url=https://www.mediafire.com/file/0z4njtfe7z5sca3/EX13_RP8-FP.rar/file&pixelId=58713 Message: Failed to load resource: the server responded with a status of 400 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=0
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

abs.yandex.ru
ad-delivery.net
ad.doubleclick.net
ag.dns-finder.com
analytics.google.com
api.amplitude.com
api.btloader.com
api.rlcdn.com
avatars.yads.tech
bshr.ezodn.com
btloader.com
c3.a-mo.net
carbon-cdn.ccgateway.net
cdn-ima.33across.com
cdn.amplitude.com
cdn.econventa.com
cdn.id5-sync.com
cdn.jsdelivr.net
cdn.prod.uidapi.com
connectid.analytics.yahoo.com
display.yads.tech
e7ae9ab66d3a8e389652abc960c12afc.safeframe.googlesyndication.com
econventa.com
esp.rtbhouse.com
fonts.gstatic.com
fundingchoicesmessages.google.com
g.ezoic.net
go.ezodn.com
googleads.g.doubleclick.net
gum.criteo.com
id.a-mx.com
id.crwdcntrl.net
id.hadron.ad.gt
id5-sync.com
ingestion-router-api.ccgateway.net
invstatic101.creativecdn.com
lb.eu-1-id5-sync.com
lexicon.33across.com
link.rubiconproject.com
match.adsrvr.org
oa.openxcdn.net
pagead2.googlesyndication.com
pcode.yads.tech
privacy.gatekeeperconsent.com
script-api.ccgateway.net
securepubads.g.doubleclick.net
static.cloudflareinsights.com
static.criteo.net
static.mediafire.com
static.xx.fbcdn.net
stats.g.doubleclick.net
tags.crwdcntrl.net
the.gatekeeperconsent.com
tpc.googlesyndication.com
translate.google.com
translate.googleapis.com
uipglob.semasio.net
ups.analytics.yahoo.com
www.ezojs.com
www.facebook.com
www.google-analytics.com
www.google.com.tr
www.googletagmanager.com
www.gstatic.com
www.mediafire.com
www.mediafiredls.com
yastatic.net
ag.dns-finder.com
cdn-ima.33across.com
www.mediafiredls.com
104.16.174.226
104.16.79.73
104.17.150.117
104.21.42.32
104.22.4.69
104.22.5.65
104.22.74.216
104.26.8.66
13.248.176.26
130.211.23.194
141.95.98.64
141.95.98.65
142.250.181.227
142.250.184.198
142.250.184.206
142.250.185.130
142.250.185.163
142.250.185.225
142.250.185.97
142.250.186.130
142.250.186.138
142.250.186.34
157.240.0.35
157.240.0.6
172.217.16.142
172.217.18.3
172.67.170.144
172.67.199.186
172.67.38.106
173.194.76.156
178.250.1.11
178.250.1.39
18.173.204.202
18.245.46.90
18.245.86.4
18.66.102.31
184.30.26.29
188.114.96.3
188.114.97.3
216.58.206.40
216.58.212.174
3.167.227.120
3.237.175.195
34.102.146.192
34.120.133.55
34.96.70.87
35.190.39.111
35.244.193.51
35.71.131.137
35.82.174.89
37.9.64.225
52.57.221.121
54.194.27.185
65.9.66.104
77.243.51.121
79.127.216.47
79.127.227.46
87.248.119.251
87.250.254.222
007036d465b81110214bfc2593974dfd94e31304794dd2e2f0a85adf880cf472
02b8824bd47ff5abde631d5dad8206e74bf7aea212f3873eda3c9dfb37d1fcea
033696b7f1ac04d1dcc102be84550e146236ceffc25a6cabc12aa51a6ee410b9
03c8d2dc7d985c3004ff2cd6d8148dd03560f37ed15efdf6c2d7f4d771d0e599
04a0c16b9bf4c97a4f3734845a0f22e0847ae29cd7a8725cc388636cc9da030c
04c94ecaae50f713607dd45d40c5756d0e6a9e58c6398433ac098bc9bee89f5d
0852600515cbe8f4f936e0344eeace63836dc0fd79c8e1d553fd921e05430128
0a18f1d1a038a61a76a04b783020b0f52bcd997b4b83015b566a8f3e9093c2e1
0f67393986c012dbf48aa3149e2874bd84ed5f466362ad1ac31305f697f1da7b
119385575c02b729504d08b6f9608505971197ca65d7d4acfcc6ec266d748765
136a2a86b537e7fe909a0479f565714e476c88055ca3fe81209e1e17c6f43bd4
14bca899e1d5bbb4c331967a0772e0071cb7c16f19eb8e0aa350bf79dc2346d6
190f676ee781e35d2d2a8c07e56b2ca05fe36625bbc7a5cfec2f3a060a45c3e2
1b994e81ed210e3b4c3f3cb8081ef51af130cf67f018be884bee2b3fd26440bc
1c11dc2ad05325563e9fd3a8201b49acdc45798ffc3fc8b6e5df513ea8a64569
1c6ba1010c2cc88c59de9e9584728da124770fa399643ffc1beffcec54b84be7
1ec8d6434ddffa8344c2927b90398dc5e02475eead44b7f9d9902d7acafb1a02
1ed5f71318c84661ff6156c7e5a9a63408a51cee9f3ff31ec226db9a2c2ea5f5
20b06cd91ae1eb1b7a30afb2d6d6255de0cf46aa2d6458401e55819d7aad88b0
2180adfc4b8cdfd2ea48e647e3bb17e531b2b3e2dd99f0277b044387fc929cbe
241dac7da9d2782f58c2ffdc05090ac486b49cde149c879675d189dee66aedf6
2450e5580136f94bda7ccf95e3167b57e15b05b513a430967943a50036fa47a4
2588095be4106a2ae22605a31874b4da0a3ca9e895d52be5d95ff08ea07685a8
2e5f5cb912c0619933ea6c3ad8ac1466a005f792e3338d96a8432d144c63520f
30b32e97f2e3e06deb742bf2e19daeb4f4657a956e836c2a25a7df2bc72f7500
30b7f0adc63bb1e3010cee77e9aa68b9aa8511ec29abb030a2a7d710473951a9
30be558393bd8b0585c806a6eaed6d6f5b51d1ca63c0113061dfe35eaa128ce3
30cf1059a83ec858f901696eae5bd84fcf7dbc39123879b45ba4090180b05728
334b1b036b22a598fbc80da1d7edae26bfefc739b7b41d3f47649cf197bab2fc
34806ef573086241dd1a596a860b0295b51c24f1c37eab36eb9d0665683abb55
35158712d8c8e8fb3a83624967b46e6ac3aa11879123de066042aa0e1d0e8a03
368499ba3f7e2b4ea9bb3187d0d7be2928b59f12bb76a9d327d9d8006d593a26
37bf6032b7c8f558425059ffc65bbb0e467422a8fbe00475f01a32ae7f5c9698
39b49e77affa7cc68e0dc77604ebbb42e85bf71fae5547fcc1c83c206c7d51c9
3aae934f52b6e8e431ea4255052e857321c8dc97241ff0c5ca2ce11ec8204bc0
3b2967f25021d925d140758ccf20d77145e08676196c4c75d7ce576560a4fe7c
3b83ad6e7a219be0f2b937af826809b211e5c3148f51fd0a0f9405dc1075ba1b
3cefef7fc952707c97375ef3fa95a8c45a96eda7845d02bc1c28bf3570c0cfba
41da135a5039e2aad02bd25c14cf5105752de0ccbd088374499b08559d4378c4
4342feac38021c4fe3069eba0edf1c2e1b4345e2b548b0afb7ab21b7369b3bc8
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
4448e430d3c53bad548a5d135e1c7e2f9593e806ba47892640d430ea752e979e
446a24acf9272b37cf14bf847684201154b6648113a148f1381b7489db6294f3
45fd2ba3960eed5c593360163563e703c8c333d4be5736119d53b84d666783ef
4770d2acd764a9137df6e2538b33291bc2c2f04a5561fbc2dff87a0c99e61a01
47878b1adcd923dcfcf5d29ade971275259a236199ca23114deaaa409b138c18
482a94c1ba7976b2b97757f9004facd785bee598b9678fb64e2a07542f86e5b9
49d11f0270bb45cc7220ec668b5a6fbcda43a50dc207a2eeccd85e28802ebdbd
4dac0026fbfa2615dce30c0af12830863fe885f84387a0147b9e338f548d5d82
4f0f55570e972d3bbcb8729daf5ff64bfa16819a7f5cc81147d6772fdd1cbbb2
50a63bf06dcdc62ce03de6a07d10770dc80cfa47ef2b63db1e9f6a5fbd786a7d
50fbbe164918e6fb86e26b49d99c193d1c36ec6bbf9a51b9967ca74f2282ccde
5220004114d5a7e1eceb622b4606637de3daf733ca0b4e7024dbe5bd4436973e
53731718ab10d0a5e783bd3eaef381aa420a233d429903bcde616619e25d330b
544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
56351c084d8d56437d41f1e58b7eb184b563871e88bab60f6b15486c39f13996
594eeb029da4673f762e5e11871c12fbdb6d8727ab0507001dba25f26a17c643
596dfdf90e479a2d9c42b36372b5e3cc1be3439e3294119ed7d15920a22f8f5f
608883c72927c2e177f748d474aad3962becb40794b134fa5204f6b0315d8d00
6318394f737c66f0e2ccfcd88e3935c6667633a1b95fa29fba2b75431d55eef2
6671c632aa8365a3588e7276803c7f0f1aa00cfc94fd9b16caa5eac5b1a9c624
67942c522b8f0e187f291d3dde230596fa526a323a9f50a0d667b6956839d98e
68d8dfa93b4e38c1b0c7149805dad2a10785abfd56d10aac2822537d195e4c3b
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6cf6a5393ba05e0dcf96520ea3e10986184c04140346e3962cd20a0a88c150e3
6e71a0c1bf79458c3050fd9c4e6d3c01e103e17752bbb3dec97b077a8f412835
6fca1361d81b8d8d05afbe947e257aef026891372b45e0d2de123a907a4ed1af
6ff39e2e085828036c40efa08d69febb971361f0c11eb21f7c382e7443c08015
71ca2652e2b3ffd3c0ec966958604714ce6c7af01d961b44adc438518eb58cb3
720671166ac43aba99e3952b0b9341ab4e0fee1fd891db54e2a07f05db653142
73993d9c19c08e36c4dae3837f6cd59b936ce1eb0c3bab861c97beec914a2a18
77b2f35b2aee5d890fe0b78354bc7a04342ec767906919382dee04f646e005a7
78b80cc043c0792a4d0f69f0c5a4eaae062c7d58f7c08e9c3b253cd37026496d
78c0fa67503accd350299cb21c7571186ccba7e897549f17813a00256bf36933
7a3d8e2d5b065e99d9780a4627cc5922132af4a67de8c2fbafa811e131769846
7b87efc8babe3bfb9145d76e745fd2b0ce8643f87aea7c9779ac12f83a899081
7ba1bc2084def769e77a7dbf97cd91d68fe6c6d55b5d183a7d36630da8da2b02
7bc60d3f868be943f071cecb9ed0a3c66cbcf4e7a1e84146d9acdd2cdffa9b3c
7efe760d93c9b9e43e76decf6cb39f9cad9ef5ee106f090fbfa38326906e583c
7f8c2e0e993d935444e4c330556184bedd195ed9bfc3b1c62ed655dc7c8221e3
81b49dbd181c58edb92ec92edaa0f0e982d841ab735978cfe98e7ec2eb503f7c
82b94716473aa225e715e117802145c5d2d725aa1ba9d476d61a5d3da16a8c26
8539c91ae0a82f8cab27d481ea38ac4e66d1e5b36701fe295bcba4399b9255bd
8787abba1a566d5492523a12b1a7f8927db9296e83ad14efe3acd1a07037cf19
893719087a8bc6dcdfabc4e1d54fd6d724953d40da2ad369f8b4fb5f689394d7
8a16e1f89f566a4d9144c44c480457b9aeb83827402b2baf9b3baf51ebff2f0e
8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f
8b3a000db28359e0512e1484988806b9cdaeb457e29ef6b82bfe097e6eed3231
8b9649ecf99400f7fefce2ec3568d60386481da0991d4cb519b901aa4aca6c3e
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
8ebf53e90b302dd92548c42edc336eb170d3c6ada29dcac4d70cea8137913b8f
8f2706997957ef1c1004e3ade43f1805894a4f4b2846d1a8801c8ab151fee421
90ff447725b75ca9f4e22bf08799aa7963fbca98a509359d96a77b82c39a7d6d
91f2fceb37be6396e8f5b416d15a007ddb33034dd8496aa4a681d5bf7360761b
91fcf8f726654f0d20fa8c4b2b7ce9d14f7dabc3d0ee429f3a3e3c63130ce81f
95c6932a51b812fb1c02efcfca1688d325417086e5738bfb5f4c97ddf17c5c9e
9b41253384e2818bd0f76171d6ffd723d4c85c5e1a69da74f174489cb52a40ce
9c5b591f10c8fb4d85649e71bdc40e72a316fdceb1aab3ce125ac064ffa5f6e3
a11d3b4b6f2902037c365146ff80b5bf95923f3176f1a827355e45177314d423
a285bc82f73dbd55244657449b4d9b2ecae8b2ea622d5558432bc818bb847df2
a4fafcd389d58bbd82e49d9a68e81e9dc8384330ff14ec3283a4d0d11812047b
a5230196df9a4e9f6382c504668862efc8e25c1ec093c7dc997fbedb4b3ec54e
a5e87590d9232e0b0be4c640eeb47cb4f4299af754f195c802d49fe380ea1870
a750e9678bd32b1d95865354b09cdd855a4ef5db69bdb1a7831bf921d8bae0a8
a798986e0dce849145906cae97bf77a273b5ffb8880fc0f7da14eff4a9b85aea
a8b0878903af377a12fe490acb0df77cf52d1f84c1b9497cca6af6c0b86297f7
ab5c23a05e39deed14d9d8262b0dce9f024f86105a27196cad37d14a3f516e09
aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
b04cd869cfd41a48c006458f71969a0eb26f33fec12f3cfe00408f8b73bf3ff8
b05079bcb0c79db2e26f5a249c9c389ca2c44bbc575afebbd2415cbd1396dbf8
b551ad6701bd2ed5a5ade923a62692e3d2d66f833ece86a0989b9158531518b5
b7545b5d8b366cf7960d74ef16f2c98425f17d34a392e909bdf5fa53f340b134
b866d909afc582d7c400417d7bb441cb74d6d297f33a2ad07052a07255f7aa4e
bab561008f03f1dcbcf178605ebb782ca271615ca813a969799bef6b5a9b5fc7
bccb4111eb4c8b10e4cd76ec113f0d8786d91869f5913620ab4d8b7fe4408c44
bdb45214f548d4da3ec07c07d9f6f92f2fbff7d1ccefee55631d31729cf02a30
c173503f8ae4fdbb42c06c514edf25e62e81503e418ee3a0cdbd884e1a741444
c2ca8116f6c0c1149b713c208d71a99214885d4d0b7cadfca4600cba2770065f
c46112b521d8782f9ace52b74a86041d1378ad4ce71b94a8e6870f2823cadf94
c472bc944f0ab65826401c2286f2962f3a668284e74faa6ec50fa0d30885476d
c710cdd34e668d4b076117de6e491db51bfdb199410738766ebc187cf6bd625c
c73d79f4ab4c93336fb3ebe631f63f72879ad92e7a842e7cffb82a7a475e9f9e
cbb99c4149249b280f1d3d924d9bdd29a4a14cba1e71775fb3bdbdf13ebd5a48
cc8d34633fbc5174ba5a91be362875660fcb4d0415ba699dcb8722d52583c7a4
cdc3d73c7155b5769cba0ad4d53f308a7cd053d7612d0028b575019713fdd842
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d0d2e098cd489ef7bc528c86de8ab5c51b5d6cdf9b76a8b08766036992f0d2f4
d34364518d1fdc1b69ba193a0593a933aac3cc1327f6d36f87f5da9052caf62b
d3f48db3af3edaa22ee5a91e20eb932b77ff2a145dea6d97e7d28873de33b13a
d4e7fddec4f3b06b74237a4e12177dd8d5ca5e9e6775de5dbbb830f1fe407398
d65f4b2e8eee94ddc7f762d098de19558d879a3b597c8913b4d075532e3ed4b4
d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8
dc54b817820f14ce6395ba2a037f37d4bb0af75d5b017336140793fbe2f7f738
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dcfeafb915fb5e0eaf4cce1e3abf6eeace381b5926e07261cbceffc30fa4e699
dd30b37750df28657b28327eddf6c1070ac35f6f65b88ceae491d74f08cbff31
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e0387f5b484bed89a880c937991ea3aef765b92011ad4027503bb7f3402297d4
e0ff1aa498c3e7899a1ba72cea996bea56b397a6e93864cff709ce8d1776e5ea
e203523351f7a084281207ad35ed6eb81374d000f35b935d63040cff94a75d71
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e7c0df5d23898ea8e195222a6386aba911e9f282df4c0941d8baacbe35a18eea
e7cb12275e5da2a8fdf3a43876f8efb4bd89824cb34e3554f7dd7495872e0a23
e814d50a228f54aecf40d8a58e41d48ce1dfc4376fd5fbedc28078fe0a8c5526
eadb2140c433b64ca74a8e25665b4f80a54a4183c3cb01da578e7426fbae95c8
ed2fac09523ed9ca4b23fd845302db29d2c2b405457cfaa9601e9c35959e8dd8
eeda1175e4830a49aba285a77241ec5fdcf5640becff18d137f5777b032f7fec
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efb586bd61746a6503d4119a609a833c29e1c218076bd50343f27a38adc62919
f0db2da3ee90dcf1f14054ba3c18ccc331993a4f19fd95c56169f3de5047950e
f1a67642fc97b508ce07cf6df329022bf5184a1c573044dc021e0d6e64688c64
f1c02e9ba02a159b34fc2d7d2be0a743b497a6cd0a422a0c3acc88b871b2af96
f211169b2ebf63cf303b0a0164586df2715b16e3adbd75fc2ea4615b459f1d80
f24bc4aaf793e5b568771b4c9adf8b02e7ef9e576c28daf02bc28e38a53b8926
f52a0c7d9fa7ae8e45916c491ae7193f9a1e289f128f05264122c53d8da970db
f71e7883010774fb54f616ed345e0ab93dc65fd98f20af75f13fe4bd116f5aee
f7e685306e459b623f2f80ff3672d84ab2d5f5b362c881ea6ce8d8577074a9b9
f917a9105c311331b1d40f4d2bdbf11233c1c465616c1a9c46232f451463b061
fb082853fd42a22187c62aeff206e56a46d5344d984892473a8a927b521c9003
fc1f845b1a0d0037a1c6039fbe42ae68acb84119cb8f56822cdf0ec962b5bc37

www.mediafire.com Open in urlscan Pro 104.17.150.117 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

220 Requests

97 %HTTPS

0 %IPv6

45 Domains

67 Subdomains

59 IPs

9 Countries

2543 kBTransfer

9442 kBSize

90 Cookies

9 Outgoing links

Redirected requests

220 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.mediafire.com Open in urlscan Pro
104.17.150.117 Public Scan

Screenshot
Live screenshot

Full Image

220
Requests

97 %
HTTPS

0 %
IPv6

45
Domains

67
Subdomains

59
IPs

9
Countries

2543 kB
Transfer

9442 kB
Size

90
Cookies

220 HTTP transactions
3 data transactions