urlscan.io logo urlscan.io
SecurityTrails logo

www.mediafire.com Open in urlscan Pro
104.17.148.83  Public Scan

Go To Rescan Add Verdict Report
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Submission: On November 09 via manual from US — Scanned from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 81 IPs in 6 countries across 63 domains to perform 315 HTTP transactions. The main IP is 104.17.148.83, located in Ascension Island and belongs to CLOUDFLARENET, US. The main domain is www.mediafire.com. The Cisco Umbrella rank of the primary domain is 33804.
TLS certificate: Issued by Sectigo Public Server Authentication ... on August 5th 2025. Valid for: a year.
This is the only time www.mediafire.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 20 104.17.148.83 13335 (CLOUDFLAR...)
2 2606:4700:303... 13335 (CLOUDFLAR...)
1 2606:4700:303... 13335 (CLOUDFLAR...)
4 2607:f8b0:400... 15169 (GOOGLE)
1 2606:4700:10:... 13335 (CLOUDFLAR...)
2 2606:4700:303... 13335 (CLOUDFLAR...)
1 2607:f8b0:400... 15169 (GOOGLE)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 3.170.42.100 16509 (AMAZON-02)
2 2606:4700:20:... 13335 (CLOUDFLAR...)
1 2a03:2880:f10... 32934 (FACEBOOK)
1 35.165.50.35 16509 (AMAZON-02)
11 2606:4700:10:... 13335 (CLOUDFLAR...)
7 142.251.16.149 15169 (GOOGLE)
2 34.36.200.111 396982 (GOOGLE-CL...)
1 2606:4700:10:... 13335 (CLOUDFLAR...)
2 2a03:2880:f00... 32934 (FACEBOOK)
3 130.211.23.194 396982 (GOOGLE-CL...)
3 2607:f8b0:400... 15169 (GOOGLE)
3 2607:f8b0:400... 15169 (GOOGLE)
1 2607:f8b0:400... 15169 (GOOGLE)
21 2600:1f10:4c5... 14618 (AMAZON-AES)
22 2606:4700:303... 13335 (CLOUDFLAR...)
2 2001:4860:480... 15169 (GOOGLE)
1 2607:f8b0:400... 15169 (GOOGLE)
1 2607:f8b0:400... 15169 (GOOGLE)
39 2607:f8b0:400... 15169 (GOOGLE)
1 2600:9000:250... 16509 (AMAZON-02)
1 2600:1408:c40... 20940 (AKAMAI-AS...)
2 2606:4700:10:... 13335 (CLOUDFLAR...)
1 2606:4700:20:... 13335 (CLOUDFLAR...)
2 2606:4700:303... 13335 (CLOUDFLAR...)
7 18.212.140.196 14618 (AMAZON-AES)
3 6 2620:100:a00b... 19750 (AS-CRITEO)
2 2606:4700::68... 13335 (CLOUDFLAR...)
2 37.19.206.163 60068 (CDN77 Dat...)
4 6 138.199.41.120 60068 (CDN77 Dat...)
2 2001:4998:14:... 14777 (YAHOO)
5 74.119.117.62 19750 (AS-CRITEO)
2 100.24.186.222 14618 (AMAZON-AES)
2 2606:4700:10:... 13335 (CLOUDFLAR...)
16 23 141.95.33.120 16276 (OVH OVH SAS)
1 34.107.165.188 396982 (GOOGLE-CL...)
1 54.89.30.34 14618 (AMAZON-AES)
3 5 8.28.7.81 62713 (AS-PUBMATIC)
1 3 3.33.220.150 16509 (AMAZON-02)
2 3.221.183.211 14618 (AMAZON-AES)
1 52.54.41.155 14618 (AMAZON-AES)
1 3.237.175.195 14618 (AMAZON-AES)
12 2607:f8b0:400... 15169 (GOOGLE)
1 104.18.28.101 13335 (CLOUDFLAR...)
1 34.102.146.192 396982 (GOOGLE-CL...)
1 3.167.69.118 16509 (AMAZON-02)
1 2620:100:a00b... 19750 (AS-CRITEO)
1 34.96.70.87 396982 (GOOGLE-CL...)
1 2600:9000:27c... 16509 (AMAZON-02)
2 2607:f8b0:400... 15169 (GOOGLE)
1 1 2600:1f18:730... 14618 (AMAZON-AES)
1 34.206.130.144 14618 (AMAZON-AES)
1 2001:41d0:701... 16276 (OVH OVH SAS)
1 162.19.138.82 16276 (OVH OVH SAS)
1 2 34.120.135.53 396982 (GOOGLE-CL...)
1 35.190.39.111 396982 (GOOGLE-CL...)
43 34.210.204.30 16509 (AMAZON-02)
2 2607:f8b0:400... 15169 (GOOGLE)
5 35.244.159.8 396982 (GOOGLE-CL...)
5 2607:f8b0:400... 15169 (GOOGLE)
4 14 142.251.179.155 15169 (GOOGLE)
1 1 35.71.131.137 16509 (AMAZON-02)
1 1 2600:1f18:4e9... 14618 (AMAZON-AES)
1 1 2620:112:f008... 26120 (RHYTHMONE)
1 2607:f8b0:400... 15169 (GOOGLE)
1 2607:f8b0:400... 15169 (GOOGLE)
2 2 18.214.193.183 14618 (AMAZON-AES)
2 2 68.67.181.248 29990 (ASN-APPNEX)
3 3 34.111.113.62 396982 (GOOGLE-CL...)
2 2 2a02:2638:3::3f 44788 (ASN-CRITE...)
1 1 2607:f350:3:2... 27630 (AS-XFERNET)
3 3 3.223.154.179 14618 (AMAZON-AES)
1 1 3.225.222.210 14618 (AMAZON-AES)
1 1 34.1.234.235 15169 (GOOGLE)
2 2 54.165.159.98 14618 (AMAZON-AES)
1 2607:f8b0:400... 15169 (GOOGLE)
2 142.251.16.148 15169 (GOOGLE)
2 2607:f8b0:400... 15169 (GOOGLE)
1 2607:f8b0:400... 15169 (GOOGLE)
2 3 2620:1ec:50::12 8075 (MICROSOFT...)
2 2 35.211.202.130 19527 (GOOGLE-2)
1 1 2620:100:a00b... 19750 (AS-CRITEO)
4 6 104.18.27.193 13335 (CLOUDFLAR...)
1 1 3.213.55.140 14618 (AMAZON-AES)
1 1 74.214.194.131 19189 (PULSEPOINT)
3 3 35.212.59.62 19527 (GOOGLE-2)
2 2607:f8b0:400... 15169 (GOOGLE)
1 2 68.67.160.186 29990 (ASN-APPNEX)
1 4 2620:116:800b... 14618 (AMAZON-AES)
1 2600:9000:26a... 16509 (AMAZON-02)
2 2 35.244.154.8 396982 (GOOGLE-CL...)
1 1 107.178.254.65 396982 (GOOGLE-CL...)
315 81
20    104.17.148.83 (Ascension Island)

ASN13335 (CLOUDFLARENET, US)
www.mediafire.com
static.mediafire.com
2    2606:4700:3035::6815:2a20 (None, )

ASN13335 (CLOUDFLARENET, US)
cmp.gatekeeperconsent.com
privacy.gatekeeperconsent.com
1    2606:4700:3031::ac43:c7ba (None, )

ASN13335 (CLOUDFLARENET, US)
the.gatekeeperconsent.com
4    2607:f8b0:4004:c1f::61 (Washington, United States)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
1    2606:4700:10::ac42:ab85 (None, )

ASN13335 (CLOUDFLARENET, US)
btloader.com
2    2606:4700:3032::ac43:aa90 (None, )

ASN13335 (CLOUDFLARENET, US)
www.ezojs.com
1    2607:f8b0:4004:c08::71 (Washington, United States)

ASN15169 (GOOGLE, US)
translate.google.com
1    2606:4700::6810:4f49 (None, )

ASN13335 (CLOUDFLARENET, US)
static.cloudflareinsights.com
1    3.170.42.100 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-3-170-42-100.iad61.r.cloudfront.net
cdn.amplitude.com
2    2606:4700:20::ac43:4551 (None, )

ASN13335 (CLOUDFLARENET, US)
cdn.econventa.com
econventa.com
1    2a03:2880:f103:83:face:b00c:0:25de (Ashburn, United States)

ASN32934 (FACEBOOK, US)
www.facebook.com
1    35.165.50.35 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-165-50-35.us-west-2.compute.amazonaws.com
api.amplitude.com
11    2606:4700:10::ac42:948c (None, )

ASN13335 (CLOUDFLARENET, US)
ad-delivery.net
7    142.251.16.149 (United States)

ASN15169 (GOOGLE, US)
PTR: bl-in-f149.1e100.net
ad.doubleclick.net
2    34.36.200.111 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 111.200.36.34.bc.googleusercontent.com
ab.dns-finder.com
1    2606:4700:10::6814:14bd (None, )

ASN13335 (CLOUDFLARENET, US)
btloader.com
2    2a03:2880:f003:100:face:b00c:0:3 (Ashburn, United States)

ASN32934 (FACEBOOK, US)
static.xx.fbcdn.net
3    130.211.23.194 (United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 194.23.211.130.bc.googleusercontent.com
api.btloader.com
3    2607:f8b0:4004:c0b::5e (Washington, United States)

ASN15169 (GOOGLE, US)
www.gstatic.com
3    2607:f8b0:4004:c21::5f (Washington, United States)

ASN15169 (GOOGLE, US)
translate.googleapis.com
1    2607:f8b0:4004:c0b::66 (Washington, United States)

ASN15169 (GOOGLE, US)
www.google-analytics.com
21    2600:1f10:4c55:e23d:5d5b:8bb5:8ae2:1fff (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
g.ezoic.net
22    2606:4700:3037::6815:574f (None, )

ASN13335 (CLOUDFLARENET, US)
go.ezodn.com
2    2001:4860:4802:32::181 (United States)

ASN15169 (GOOGLE, US)
analytics.google.com
1    2607:f8b0:4004:c09::9d (Washington, United States)

ASN15169 (GOOGLE, US)
stats.g.doubleclick.net
1    2607:f8b0:4004:c23::5e (Washington, United States)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
39    2607:f8b0:4004:c21::9b (Washington, United States)

ASN15169 (GOOGLE, US)
securepubads.g.doubleclick.net
1    2600:9000:2508:3400:1c:2afd:fb00:93a1 (United States)

ASN16509 (AMAZON-02, US)
d-code.liadm.com
1    2600:1408:c400:1681::2300 (Ashburn, United States)

ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)
link.rubiconproject.com
2    2606:4700:10::ac42:a937 (None, )

ASN13335 (CLOUDFLARENET, US)
cdn.id5-sync.com
1    2606:4700:20::681a:2ad (None, )

ASN13335 (CLOUDFLARENET, US)
www.mediafiredls.com
2    2606:4700:3036::ac43:8e79 (None, )

ASN13335 (CLOUDFLARENET, US)
bshr.ezodn.com
7    18.212.140.196 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-212-140-196.compute-1.amazonaws.com
carbon-cdn.ccgateway.net
script-api.ccgateway.net
6    2620:100:a00b::3d (United States)

ASN19750 (AS-CRITEO, US)
gum.criteo.com
2    2606:4700::6810:aee2 (None, )

ASN13335 (CLOUDFLARENET, US)
cdn.jsdelivr.net
2    37.19.206.163 (Ashburn, United States)

ASN60068 (CDN77 Datacamp Limited, GB)
PTR: unn-37-19-206-163.datapacket.com
lexicon.33across.com
6    138.199.41.120 (New York, United States)

ASN60068 (CDN77 Datacamp Limited, GB)
PTR: unn-138-199-41-120.datapacket.com
id.a-mx.com
c3.a-mo.net
2    2001:4998:14:800::1000 (United States)

ASN14777 (YAHOO, US)
ups.analytics.yahoo.com
5    74.119.117.62 (United States)

ASN19750 (AS-CRITEO, US)
mug.criteo.com
2    100.24.186.222 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-100-24-186-222.compute-1.amazonaws.com
d9.flashtalking.com
2    2606:4700:10::6814:2396 (None, )

ASN13335 (CLOUDFLARENET, US)
id.hadron.ad.gt
23    141.95.33.120 (Germany)

ASN16276 (OVH OVH SAS, FR)
PTR: ns3203256.ip-141-95-33.eu
id5-sync.com
1    34.107.165.188 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 188.165.107.34.bc.googleusercontent.com
api.rlcdn.com
1    54.89.30.34 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-89-30-34.compute-1.amazonaws.com
id.crwdcntrl.net
5    8.28.7.81 (United States)

ASN62713 (AS-PUBMATIC, US)
image6.pubmatic.com
3    3.33.220.150 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: a12b7a488abeaa9e4.awsglobalaccelerator.com
match.adsrvr.org
2    3.221.183.211 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-221-183-211.compute-1.amazonaws.com
idx.liadm.com
1    52.54.41.155 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-54-41-155.compute-1.amazonaws.com
i.liadm.com
1    3.237.175.195 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-237-175-195.compute-1.amazonaws.com
privacy-location-edge.ccgateway.net
12    2607:f8b0:4004:c21::9a (Washington, United States)

ASN15169 (GOOGLE, US)
securepubads.g.doubleclick.net
pagead2.googlesyndication.com
1    104.18.28.101 (Ascension Island)

ASN13335 (CLOUDFLARENET, US)
cdn-ima.33across.com
1    34.102.146.192 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 192.146.102.34.bc.googleusercontent.com
oa.openxcdn.net
1    3.167.69.118 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-3-167-69-118.iad61.r.cloudfront.net
tags.crwdcntrl.net
1    2620:100:a00b::30 (United States)

ASN19750 (AS-CRITEO, US)
static.criteo.net
1    34.96.70.87 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 87.70.96.34.bc.googleusercontent.com
invstatic101.creativecdn.com
1    2600:9000:27c2:9200:10:dd8:5e40:93a1 (United States)

ASN16509 (AMAZON-02, US)
connectid.analytics.yahoo.com
2    2607:f8b0:4004:c17::84 (Washington, United States)

ASN15169 (GOOGLE, US)
322f9f81cfd88b7498cd441174614e0b.safeframe.googlesyndication.com
1    2600:1f18:730:b150:db37:2bdd:b575:f92a (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
rp.liadm.com
1    34.206.130.144 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-206-130-144.compute-1.amazonaws.com
rp4.liadm.com
1    2001:41d0:701:1000::20f2 (France)

ASN16276 (OVH OVH SAS, FR)
lbs.eu-1-id5-sync.com
1    162.19.138.82 (Frankfurt am Main, Germany)

ASN16276 (OVH OVH SAS, FR)
PTR: ns31532337.ip-162-19-138.eu
lb.eu-1-id5-sync.com
2    34.120.135.53 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 53.135.120.34.bc.googleusercontent.com
oajs.openx.net
1    35.190.39.111 (United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 111.39.190.35.bc.googleusercontent.com
esp.rtbhouse.com
43    34.210.204.30 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-210-204-30.us-west-2.compute.amazonaws.com
pb-ing-02.ccgateway.net
2    2607:f8b0:4004:c19::9d (Washington, United States)

ASN15169 (GOOGLE, US)
ep1.adtrafficquality.google
5    35.244.159.8 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 8.159.244.35.bc.googleusercontent.com
google-bidout-d.openx.net
us-u.openx.net
5    2607:f8b0:4004:c19::84 (Washington, United States)

ASN15169 (GOOGLE, US)
ep2.adtrafficquality.google
14    142.251.179.155 (United States)

ASN15169 (GOOGLE, US)
PTR: pd-in-f155.1e100.net
cm.g.doubleclick.net
1    35.71.131.137 (United States)

ASN16509 (AMAZON-02, US)
PTR: a6370ebea231e0c9a.awsglobalaccelerator.com
match.adsrvr.org
1    2600:1f18:4e9:5a01:eb39:489e:f392:607d (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
pr-bh.ybp.yahoo.com
1    2620:112:f008:200::101 (United States)

ASN26120 (RHYTHMONE, US)
ad.turn.com
1    2607:f8b0:4004:c19::68 (Washington, United States)

ASN15169 (GOOGLE, US)
www.google.com
1    2607:f8b0:4004:c21::9d (Washington, United States)

ASN15169 (GOOGLE, US)
pagead2.googlesyndication.com
2    18.214.193.183 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-214-193-183.compute-1.amazonaws.com
ice.360yield.com
2    68.67.181.248 (North Bergen, United States)

ASN29990 (ASN-APPNEX, US)
PTR: 1043.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
ib.adnxs.com
3    34.111.113.62 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 62.113.111.34.bc.googleusercontent.com
pixel.tapad.com
2    2a02:2638:3::3f (France)

ASN44788 (ASN-CRITEO-EUROPE Criteo Technology SAS, FR)
dis.eu.criteo.com
1    2607:f350:3:2569:0:10:0:d (United States)

ASN27630 (AS-XFERNET, US)
sync.go.sonobi.com
3    3.223.154.179 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-223-154-179.compute-1.amazonaws.com
sync.ipredictive.com
1    3.225.222.210 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-225-222-210.compute-1.amazonaws.com
rtb.gumgum.com
1    34.1.234.235 (Groningen, Netherlands)

ASN15169 (GOOGLE, US)
PTR: 235.234.1.34.bc.googleusercontent.com
csync.loopme.me
2    54.165.159.98 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-165-159-98.compute-1.amazonaws.com
ce.lijit.com
1    2607:f8b0:4004:c07::9b (Washington, United States)

ASN15169 (GOOGLE, US)
googleads.g.doubleclick.net
2    142.251.16.148 (United States)

ASN15169 (GOOGLE, US)
PTR: bl-in-f148.1e100.net
ad.doubleclick.net
2    2607:f8b0:4004:c07::84 (Washington, United States)

ASN15169 (GOOGLE, US)
tpc.googlesyndication.com
1    2607:f8b0:4004:c08::95 (Washington, United States)

ASN15169 (GOOGLE, US)
s0.2mdn.net
3    2620:1ec:50::12 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
px.ads.linkedin.com
2    35.211.202.130 (North Charleston, United States)

ASN19527 (GOOGLE-2, US)
PTR: 130.202.211.35.bc.googleusercontent.com
x.bidswitch.net
1    2620:100:a00b::38 (United States)

ASN19750 (AS-CRITEO, US)
dis.criteo.com
6    104.18.27.193 (Ascension Island)

ASN13335 (CLOUDFLARENET, US)
ssum-sec.casalemedia.com
dsum-sec.casalemedia.com
1    3.213.55.140 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-213-55-140.compute-1.amazonaws.com
ads.yieldmo.com
1    74.214.194.131 (United States)

ASN19189 (PULSEPOINT, US)
bh.contextweb.com
3    35.212.59.62 (Washington, United States)

ASN19527 (GOOGLE-2, US)
PTR: 62.59.212.35.bc.googleusercontent.com
sync.inmobi.com
2    2607:f8b0:4004:c19::9c (Washington, United States)

ASN15169 (GOOGLE, US)
ep1.adtrafficquality.google
2    68.67.160.186 (Brooklyn, United States)

ASN29990 (ASN-APPNEX, US)
PTR: 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
ib.adnxs.com
4    2620:116:800b:21:c1e8:5385:5098:6bf0 (United States)

ASN14618 (AMAZON-AES, US)
secure.quantserve.com
pixel.quantserve.com
1    2600:9000:26a0:b800:6:44e3:f8c0:93a1 (United States)

ASN16509 (AMAZON-02, US)
rules.quantcount.com
2    35.244.154.8 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 8.154.244.35.bc.googleusercontent.com
idsync.rlcdn.com
1    107.178.254.65 (United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 65.254.178.107.bc.googleusercontent.com
pippio.com
Apex Domain
Subdomains		 Transfer
65 doubleclick.net
ad.doubleclick.net — Cisco Umbrella Rank: 168
stats.g.doubleclick.net — Cisco Umbrella Rank: 191
securepubads.g.doubleclick.net — Cisco Umbrella Rank: 261
cm.g.doubleclick.net — Cisco Umbrella Rank: 318
googleads.g.doubleclick.net — Cisco Umbrella Rank: 62
348 KB
51 ccgateway.net
carbon-cdn.ccgateway.net — Cisco Umbrella Rank: 6548
privacy-location-edge.ccgateway.net — Cisco Umbrella Rank: 6924
script-api.ccgateway.net — Cisco Umbrella Rank: 7251
pb-ing-02.ccgateway.net — Cisco Umbrella Rank: 6507
28 KB
25 id5-sync.com
cdn.id5-sync.com — Cisco Umbrella Rank: 796
id5-sync.com — Cisco Umbrella Rank: 515
93 KB
24 ezodn.com
go.ezodn.com — Cisco Umbrella Rank: 13871
bshr.ezodn.com — Cisco Umbrella Rank: 17429
505 KB
21 ezoic.net
g.ezoic.net — Cisco Umbrella Rank: 11487
65 KB
20 mediafire.com
www.mediafire.com — Cisco Umbrella Rank: 33804
static.mediafire.com — Cisco Umbrella Rank: 80803
192 KB
16 googlesyndication.com
322f9f81cfd88b7498cd441174614e0b.safeframe.googlesyndication.com
pagead2.googlesyndication.com — Cisco Umbrella Rank: 132
tpc.googlesyndication.com — Cisco Umbrella Rank: 212
115 KB
14 criteo.com
gum.criteo.com — Cisco Umbrella Rank: 512
mug.criteo.com — Cisco Umbrella Rank: 4028
dis.eu.criteo.com — Cisco Umbrella Rank: 8242
dis.criteo.com — Cisco Umbrella Rank: 832
14 KB
11 ad-delivery.net
ad-delivery.net — Cisco Umbrella Rank: 1142
2 KB
9 adtrafficquality.google
ep1.adtrafficquality.google — Cisco Umbrella Rank: 341
ep2.adtrafficquality.google — Cisco Umbrella Rank: 348
72 KB
7 openx.net
oajs.openx.net — Cisco Umbrella Rank: 2932
google-bidout-d.openx.net — Cisco Umbrella Rank: 2852
us-u.openx.net — Cisco Umbrella Rank: 584
2 KB
6 casalemedia.com
ssum-sec.casalemedia.com — Cisco Umbrella Rank: 623
dsum-sec.casalemedia.com — Cisco Umbrella Rank: 694
5 KB
6 liadm.com
d-code.liadm.com — Cisco Umbrella Rank: 3183
idx.liadm.com — Cisco Umbrella Rank: 1364
i.liadm.com — Cisco Umbrella Rank: 629
rp.liadm.com — Cisco Umbrella Rank: 1014
rp4.liadm.com — Cisco Umbrella Rank: 5741
138 KB
5 pubmatic.com
image6.pubmatic.com — Cisco Umbrella Rank: 1062
924 B
5 btloader.com
btloader.com — Cisco Umbrella Rank: 1045
api.btloader.com — Cisco Umbrella Rank: 1182
31 KB
4 quantserve.com
secure.quantserve.com — Cisco Umbrella Rank: 1891
pixel.quantserve.com — Cisco Umbrella Rank: 1203
13 KB
4 adnxs.com
ib.adnxs.com — Cisco Umbrella Rank: 323
4 KB
4 adsrvr.org
match.adsrvr.org — Cisco Umbrella Rank: 439
2 KB
4 yahoo.com
ups.analytics.yahoo.com — Cisco Umbrella Rank: 491
connectid.analytics.yahoo.com — Cisco Umbrella Rank: 2456
pr-bh.ybp.yahoo.com — Cisco Umbrella Rank: 1216
10 KB
4 a-mx.com
id.a-mx.com — Cisco Umbrella Rank: 1485
4 KB
4 gstatic.com
www.gstatic.com
fonts.gstatic.com
11 KB
4 google.com
translate.google.com — Cisco Umbrella Rank: 1141
analytics.google.com — Cisco Umbrella Rank: 174
www.google.com — Cisco Umbrella Rank: 2
28 KB
4 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 44
487 KB
3 inmobi.com
sync.inmobi.com — Cisco Umbrella Rank: 939
1 KB
3 linkedin.com
px.ads.linkedin.com — Cisco Umbrella Rank: 371
1 KB
3 ipredictive.com
sync.ipredictive.com — Cisco Umbrella Rank: 988
1 KB
3 tapad.com
pixel.tapad.com — Cisco Umbrella Rank: 516
1 KB
3 rlcdn.com
api.rlcdn.com — Cisco Umbrella Rank: 1023
idsync.rlcdn.com — Cisco Umbrella Rank: 558
1 KB
3 33across.com
lexicon.33across.com — Cisco Umbrella Rank: 1406
cdn-ima.33across.com — Cisco Umbrella Rank: 1311
10 KB
3 googleapis.com
translate.googleapis.com — Cisco Umbrella Rank: 997
102 KB
3 gatekeeperconsent.com
cmp.gatekeeperconsent.com — Cisco Umbrella Rank: 23069
the.gatekeeperconsent.com — Cisco Umbrella Rank: 20283
privacy.gatekeeperconsent.com — Cisco Umbrella Rank: 27207
4 KB
2 bidswitch.net
x.bidswitch.net — Cisco Umbrella Rank: 453
1 KB
2 lijit.com
ce.lijit.com — Cisco Umbrella Rank: 1060
1015 B
2 360yield.com
ice.360yield.com — Cisco Umbrella Rank: 2717
1 KB
2 eu-1-id5-sync.com
lbs.eu-1-id5-sync.com — Cisco Umbrella Rank: 1220
lb.eu-1-id5-sync.com — Cisco Umbrella Rank: 974
497 B
2 crwdcntrl.net
id.crwdcntrl.net — Cisco Umbrella Rank: 2659
tags.crwdcntrl.net — Cisco Umbrella Rank: 1118
14 KB
2 ad.gt
id.hadron.ad.gt — Cisco Umbrella Rank: 1707
555 B
2 flashtalking.com
d9.flashtalking.com — Cisco Umbrella Rank: 1542
11 KB
2 a-mo.net
c3.a-mo.net — Cisco Umbrella Rank: 12386
2 KB
2 jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 308
3 KB
2 fbcdn.net
static.xx.fbcdn.net — Cisco Umbrella Rank: 872
140 KB
2 dns-finder.com
ab.dns-finder.com — Cisco Umbrella Rank: 1267
233 B
2 econventa.com
cdn.econventa.com — Cisco Umbrella Rank: 86049
econventa.com — Cisco Umbrella Rank: 73994
51 KB
2 amplitude.com
cdn.amplitude.com — Cisco Umbrella Rank: 2699
api.amplitude.com — Cisco Umbrella Rank: 3105
22 KB
2 ezojs.com
www.ezojs.com — Cisco Umbrella Rank: 14199
141 KB
1 pippio.com
pippio.com — Cisco Umbrella Rank: 937
632 B
1 quantcount.com
rules.quantcount.com — Cisco Umbrella Rank: 1999
632 B
1 contextweb.com
bh.contextweb.com — Cisco Umbrella Rank: 752
1 KB
1 yieldmo.com
ads.yieldmo.com — Cisco Umbrella Rank: 734
811 B
1 2mdn.net
s0.2mdn.net — Cisco Umbrella Rank: 436
41 KB
1 loopme.me
csync.loopme.me — Cisco Umbrella Rank: 865
257 B
1 gumgum.com
rtb.gumgum.com — Cisco Umbrella Rank: 1251
275 B
1 sonobi.com
sync.go.sonobi.com — Cisco Umbrella Rank: 1082
644 B
1 turn.com
ad.turn.com — Cisco Umbrella Rank: 901
442 B
1 rtbhouse.com
esp.rtbhouse.com — Cisco Umbrella Rank: 2666
550 B
1 creativecdn.com
invstatic101.creativecdn.com — Cisco Umbrella Rank: 2311
3 KB
1 criteo.net
static.criteo.net — Cisco Umbrella Rank: 1038
13 KB
1 openxcdn.net
oa.openxcdn.net — Cisco Umbrella Rank: 2558
8 KB
1 mediafiredls.com
www.mediafiredls.com — Cisco Umbrella Rank: 78639
524 B
1 rubiconproject.com
link.rubiconproject.com — Cisco Umbrella Rank: 10542
826 B
1 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 64
21 KB
1 facebook.com
www.facebook.com — Cisco Umbrella Rank: 123
23 KB
1 cloudflareinsights.com
static.cloudflareinsights.com — Cisco Umbrella Rank: 397
7 KB
315 63
Domain Requested by
43 pb-ing-02.ccgateway.net script-api.ccgateway.net
40 securepubads.g.doubleclick.net securepubads.g.doubleclick.net
www.mediafire.com
23 id5-sync.com 16 redirects go.ezodn.com
cdn.id5-sync.com
22 go.ezodn.com www.mediafire.com
go.ezodn.com
21 g.ezoic.net www.ezojs.com
www.mediafire.com
go.ezodn.com
14 cm.g.doubleclick.net 4 redirects google-bidout-d.openx.net
322f9f81cfd88b7498cd441174614e0b.safeframe.googlesyndication.com
googleads.g.doubleclick.net
12 pagead2.googlesyndication.com securepubads.g.doubleclick.net
ep2.adtrafficquality.google
www.mediafire.com
322f9f81cfd88b7498cd441174614e0b.safeframe.googlesyndication.com
pagead2.googlesyndication.com
12 static.mediafire.com www.mediafire.com
11 ad-delivery.net btloader.com
9 ad.doubleclick.net btloader.com
www.mediafire.com
8 www.mediafire.com 1 redirects www.mediafire.com
static.cloudflareinsights.com
6 script-api.ccgateway.net carbon-cdn.ccgateway.net
6 gum.criteo.com 3 redirects static.criteo.net
5 ep2.adtrafficquality.google securepubads.g.doubleclick.net
ep2.adtrafficquality.google
www.mediafire.com
5 image6.pubmatic.com 3 redirects go.ezodn.com
5 mug.criteo.com www.mediafire.com
4 dsum-sec.casalemedia.com 2 redirects googleads.g.doubleclick.net
4 ib.adnxs.com 3 redirects googleads.g.doubleclick.net
4 us-u.openx.net google-bidout-d.openx.net
4 ep1.adtrafficquality.google securepubads.g.doubleclick.net
ep2.adtrafficquality.google
4 match.adsrvr.org 2 redirects go.ezodn.com
4 id.a-mx.com 2 redirects www.mediafire.com
4 www.googletagmanager.com www.mediafire.com
www.googletagmanager.com
3 pixel.quantserve.com 1 redirects
3 sync.inmobi.com 3 redirects
3 px.ads.linkedin.com 2 redirects
3 sync.ipredictive.com 3 redirects
3 pixel.tapad.com 3 redirects
3 translate.googleapis.com translate.googleapis.com
3 www.gstatic.com www.mediafire.com
www.gstatic.com
3 api.btloader.com btloader.com
2 idsync.rlcdn.com 2 redirects
2 ssum-sec.casalemedia.com 2 redirects
2 x.bidswitch.net 2 redirects
2 tpc.googlesyndication.com 322f9f81cfd88b7498cd441174614e0b.safeframe.googlesyndication.com
2 ce.lijit.com 2 redirects
2 dis.eu.criteo.com 2 redirects
2 ice.360yield.com 2 redirects
2 oajs.openx.net 1 redirects www.mediafire.com
2 322f9f81cfd88b7498cd441174614e0b.safeframe.googlesyndication.com securepubads.g.doubleclick.net
2 idx.liadm.com go.ezodn.com
2 id.hadron.ad.gt go.ezodn.com
2 d9.flashtalking.com go.ezodn.com
d9.flashtalking.com
2 ups.analytics.yahoo.com go.ezodn.com
connectid.analytics.yahoo.com
2 c3.a-mo.net 2 redirects
2 lexicon.33across.com go.ezodn.com
2 cdn.jsdelivr.net go.ezodn.com
securepubads.g.doubleclick.net
2 bshr.ezodn.com go.ezodn.com
2 cdn.id5-sync.com www.ezojs.com
go.ezodn.com
2 analytics.google.com www.googletagmanager.com
2 static.xx.fbcdn.net www.facebook.com
2 ab.dns-finder.com btloader.com
2 www.ezojs.com www.mediafire.com
www.ezojs.com
2 btloader.com www.mediafire.com
btloader.com
1 pippio.com 1 redirects
1 rules.quantcount.com secure.quantserve.com
1 secure.quantserve.com go.ezodn.com
1 bh.contextweb.com 1 redirects
1 ads.yieldmo.com 1 redirects
1 dis.criteo.com 1 redirects
1 s0.2mdn.net 322f9f81cfd88b7498cd441174614e0b.safeframe.googlesyndication.com
1 googleads.g.doubleclick.net 322f9f81cfd88b7498cd441174614e0b.safeframe.googlesyndication.com
1 csync.loopme.me 1 redirects
1 rtb.gumgum.com 1 redirects
1 sync.go.sonobi.com 1 redirects
1 www.google.com ep2.adtrafficquality.google
322f9f81cfd88b7498cd441174614e0b.safeframe.googlesyndication.com
1 ad.turn.com 1 redirects
1 pr-bh.ybp.yahoo.com 1 redirects
1 google-bidout-d.openx.net oa.openxcdn.net
1 esp.rtbhouse.com invstatic101.creativecdn.com
1 lb.eu-1-id5-sync.com cdn.id5-sync.com
1 lbs.eu-1-id5-sync.com cdn.id5-sync.com
1 rp4.liadm.com www.mediafire.com
1 rp.liadm.com 1 redirects
1 connectid.analytics.yahoo.com securepubads.g.doubleclick.net
1 invstatic101.creativecdn.com securepubads.g.doubleclick.net
1 static.criteo.net securepubads.g.doubleclick.net
1 tags.crwdcntrl.net securepubads.g.doubleclick.net
1 oa.openxcdn.net securepubads.g.doubleclick.net
1 cdn-ima.33across.com securepubads.g.doubleclick.net
1 privacy-location-edge.ccgateway.net carbon-cdn.ccgateway.net
1 i.liadm.com d-code.liadm.com
1 id.crwdcntrl.net go.ezodn.com
1 api.rlcdn.com go.ezodn.com
1 carbon-cdn.ccgateway.net link.rubiconproject.com
1 www.mediafiredls.com www.mediafire.com
1 link.rubiconproject.com
1 d-code.liadm.com
1 fonts.gstatic.com www.mediafire.com
1 stats.g.doubleclick.net www.googletagmanager.com
1 econventa.com cdn.econventa.com
1 www.google-analytics.com www.googletagmanager.com
1 api.amplitude.com cdn.amplitude.com
1 www.facebook.com www.mediafire.com
1 cdn.econventa.com www.mediafire.com
1 cdn.amplitude.com www.mediafire.com
1 privacy.gatekeeperconsent.com the.gatekeeperconsent.com
1 static.cloudflareinsights.com www.mediafire.com
1 translate.google.com www.mediafire.com
1 the.gatekeeperconsent.com www.mediafire.com
1 cmp.gatekeeperconsent.com www.mediafire.com
315 101
Subject Issuer Validity Valid
*.mediafire.com
Sectigo Public Server Authentication CA DV R36		 2025-08-05 -
2026-07-30		 a year crt.sh
gatekeeperconsent.com
WE1		 2025-10-07 -
2026-01-05		 3 months crt.sh
*.google-analytics.com
WR2		 2025-10-13 -
2026-01-05		 3 months crt.sh
btloader.com
WE1		 2025-09-27 -
2025-12-26		 3 months crt.sh
www.ezojs.com
WE1		 2025-10-16 -
2026-01-14		 3 months crt.sh
*.google.com
WR2		 2025-10-13 -
2026-01-05		 3 months crt.sh
cloudflareinsights.com
WE1		 2025-10-22 -
2026-01-20		 3 months crt.sh
cdn.amplitude.com
Amazon RSA 2048 M01		 2025-10-15 -
2026-11-13		 a year crt.sh
econventa.com
WE1		 2025-09-14 -
2025-12-13		 3 months crt.sh
*.facebook.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2025-08-18 -
2025-11-16		 3 months crt.sh
*.amplitude.com
Amazon RSA 2048 M03		 2025-01-01 -
2026-01-30		 a year crt.sh
ad-delivery.net
WE1		 2025-10-30 -
2026-01-28		 3 months crt.sh
*.doubleclick.net
WR2		 2025-10-13 -
2026-01-05		 3 months crt.sh
ab.dns-finder.com
WR3		 2025-10-22 -
2026-01-20		 3 months crt.sh
api.btloader.com
WR3		 2025-09-23 -
2025-12-22		 3 months crt.sh
*.gstatic.com
WR2		 2025-10-13 -
2026-01-05		 3 months crt.sh
upload.video.google.com
WR2		 2025-10-13 -
2026-01-05		 3 months crt.sh
ezoic.net
E8		 2025-09-10 -
2025-12-09		 3 months crt.sh
ezodn.com
WE1		 2025-10-06 -
2026-01-04		 3 months crt.sh
*.g.doubleclick.net
WR2		 2025-10-13 -
2026-01-05		 3 months crt.sh
*.liadm.com
Amazon RSA 2048 M04		 2025-09-30 -
2026-10-28		 a year crt.sh
*.rubiconproject.com
DigiCert TLS RSA SHA256 2020 CA1		 2025-03-06 -
2026-04-03		 a year crt.sh
id5-sync.com
WE1		 2025-09-19 -
2025-12-18		 3 months crt.sh
mediafiredls.com
WE1		 2025-11-02 -
2026-01-31		 3 months crt.sh
ccgateway.net
E7		 2025-09-18 -
2025-12-17		 3 months crt.sh
*.criteo.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2025-09-03 -
2025-12-06		 3 months crt.sh
*.jsdelivr.net
Sectigo RSA Domain Validation Secure Server CA		 2025-04-25 -
2026-05-04		 a year crt.sh
*.33across.com
Sectigo Public Server Authentication CA DV R36		 2025-09-12 -
2026-09-30		 a year crt.sh
*.pubgw.ads.yahoo.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2025-10-23 -
2025-12-10		 2 months crt.sh
*.flashtalking.com
Amazon RSA 2048 M04		 2025-06-30 -
2026-07-29		 a year crt.sh
id.hadron.ad.gt
WE1		 2025-11-07 -
2026-02-05		 3 months crt.sh
*.rlcdn.com
Sectigo RSA Domain Validation Secure Server CA		 2025-02-06 -
2026-03-05		 a year crt.sh
*.crwdcntrl.net
Amazon RSA 2048 M04		 2025-08-09 -
2026-09-07		 a year crt.sh
*.pubmatic.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2025-02-19 -
2026-03-22		 a year crt.sh
*.adsrvr.org
GlobalSign GCC R3 DV TLS CA 2020		 2025-03-19 -
2026-04-02		 a year crt.sh
oa.openxcdn.net
WR3		 2025-11-06 -
2026-02-04		 3 months crt.sh
*.criteo.net
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2025-10-16 -
2026-01-18		 3 months crt.sh
invstatic101.creativecdn.com
WR3		 2025-10-08 -
2026-01-06		 3 months crt.sh
connectid.analytics.yahoo.com
GlobalSign ECC OV SSL CA 2018		 2025-08-19 -
2026-02-12		 6 months crt.sh
eu-1-id5-sync.com
R12		 2025-11-01 -
2026-01-30		 3 months crt.sh
esp.rtbhouse.com
WR3		 2025-10-06 -
2026-01-04		 3 months crt.sh
adtrafficquality.google
WR2		 2025-10-13 -
2026-01-05		 3 months crt.sh
*.openx.net
RapidSSL TLS RSA CA G1		 2025-08-12 -
2026-08-19		 a year crt.sh
tpc.googlesyndication.com
WR2		 2025-10-13 -
2026-01-05		 3 months crt.sh
quantserve.com
R13		 2025-10-17 -
2026-01-15		 3 months crt.sh

This page contains 16 frames:

Primary Page: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Frame ID: 94B8990EE0B15462305493698CC6BC3B
Requests: 245 HTTP requests in this frame

Frame: https://www.facebook.com/plugins/like.php?href=http://www.facebook.com/MediaFire&width=193&layout=button_count&action=like&show_faces=false&share=true&height=30&appId=124578887583575
Frame ID: 56F674B6F8FCB4B230B47D91A7D569CF
Requests: 3 HTTP requests in this frame

Frame: https://www.mediafire.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/fd468eb09fcf/main.js
Frame ID: 6C7435D7653EE1A9C97D511AD7EBB0AC
Requests: 2 HTTP requests in this frame

Frame: https://btloader.com/trustedIframe.html?o=5678961798414336&upapi=true
Frame ID: A511040CB6A139BBD38DC40AF3EA16A3
Requests: 1 HTTP requests in this frame

Frame: data://truncated
Frame ID: B20091594F3E2421B7FDF2AAFAC3198C
Requests: 1 HTTP requests in this frame

Frame: https://i.liadm.com/sync-container?duid=a738c2fb6c00--01k9m3z368kp41czwphh8wkwmd&ds=did-006t&euns=1&s=&version=v3.13.1&cd=.mediafire.com&pv=b5a00f56-1f22-43fe-84ee-484bf753880b
Frame ID: 45F90F4886992115A25F3FB0A571788F
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/static/topics/topics_frame.html
Frame ID: 401B1B9E3E05C5CFCCA372248B1EFF1F
Requests: 1 HTTP requests in this frame

Frame: https://322f9f81cfd88b7498cd441174614e0b.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html
Frame ID: 8D171D3BE28576DD3559CC7E42CDAD3A
Requests: 1 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=www.mediafire.com&gdpr=0&gdpr_consent=
Frame ID: 56E430450FB343D18B5807AD15DDB79A
Requests: 2 HTTP requests in this frame

Frame: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Frame ID: BA6056E6F1E000A148E446ABC41D3BC1
Requests: 6 HTTP requests in this frame

Frame: https://ep2.adtrafficquality.google/sodar/sodar2/237/runner.html
Frame ID: 169DD3D5F6A2EE04C411FC0A574368B8
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 80BEAFA8DC243272DA3689F1C0AC1D57
Requests: 2 HTTP requests in this frame

Frame: https://322f9f81cfd88b7498cd441174614e0b.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html
Frame ID: 2B49A4ED32081A7796535C1D740CC309
Requests: 17 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN7otKoDEIqmprYDGPya3rUCMAE&v=APEucNWKrdmZanr6IotHoe5Ya3Mb-jZHH1EqeABcH3Rw_sYPC5xPRYo4xzvTYRq2vN_zNHM3PdcoL5IknvQJPfWSt7rYTKB6cKOOefLTMBOeYoMyQ4JfREU
Frame ID: A025223B849C1A8DAC4C268C84176F4A
Requests: 5 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: F7F9DA3F6A6CCD31B29B5E5D1E4E37FF
Requests: 9 HTTP requests in this frame

Frame: https://ep2.adtrafficquality.google/sodar/Klz6NWr5.html
Frame ID: FE957A2BF3A0E282248AF9B908ADC573
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Rose's bot

Detected technologies

Overall confidence: 100%
Detected patterns
  • cdn\.amplitude\.com
Overall confidence: 100%
Detected patterns
  • adnxs\.(?:net|com)
Overall confidence: 100%
Detected patterns
  • static\.cloudflareinsights\.com/beacon(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • 2mdn\.net
Overall confidence: 100%
Detected patterns
  • googlesyndication\.com/
  • 2mdn\.net
Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js
Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.openx\.net
Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.pubmatic\.com
Overall confidence: 100%
Detected patterns
  • \.quantserve\.com/quant\.js
Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.rubiconproject\.com
Overall confidence: 100%
Detected patterns
  • //cdn\.jsdelivr\.net/

Page Statistics

315
Requests

91 %
HTTPS

53 %
IPv6

63
Domains

101
Subdomains

81
IPs

6
Countries

2748 kB
Transfer

8231 kB
Size

164
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 26
  • https://www.mediafire.com/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
  • https://www.mediafire.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/fd468eb09fcf/main.js
Request Chain 93
  • https://id.a-mx.com/sync/?tagId=&ref=null&u=https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file&tl=https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file&nf=0&rt=true&v=10.14.0&av=2.0&vg=epbjs&us_privacy=null&am=null&gdpr=0&gdpr_consent= HTTP 302
  • https://c3.a-mo.net/b?uid=1776ef42-7a13-465b-8e3b-9082f65aba5b&sh=id.a-mx.com& HTTP 302
  • https://id.a-mx.com/set?oid=1776ef42-7a13-465b-8e3b-9082f65aba5b&uid=1776ef42-7a13-465b-8e3b-9082f65aba5b&
Request Chain 95
  • https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.mediafire.com%2F&domain=www.mediafire.com&cw=1&lsw=1&gdpr=0 HTTP 302
  • https://mug.criteo.com/sid?cpp=-L4zFnxHdGhWc0R6NU9rZ3o0ejZ0TDNPVDduRTdTYUpsdXhGZ2pxOVluNU8vWWgwS0hsRjVKSzVWMTF5bWtId3VwYWZuVUFGTGdQMTJwYTJud0RNN3I0NWMyU0tZTXNoS1FHRWxCSktHdmhiVy8ydjhLck5xd0J5cExKV2tMYjhFcHhkM3o0ZkxhVWQ1dnR4WkRyN2dHNU45U3NZK0tHM0RwOFF4UFovK0RCU3grcGs3UENyQjNVclRyUmhLVHluTktPZmRwcCthaHc2Q0xraENZdSsrMkhWTUs1aW9aU0VDNXA1TmIwNVhXQnM4allFeFFrWjh3bk5TZlBOUUNXTFFqKy9PfA&cppv=2
Request Chain 146
  • https://rp.liadm.com/j?dtstmp=1762685587515&did=did-006t&se=e30&duid=a738c2fb6c00--01k9m3z368kp41czwphh8wkwmd&tv=10.14.0&pu=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fzh1io5g5cavqo7l%2FRose%252527s_bot.zip%2Ffile&wpn=prebid&gdpr=0&cd=.mediafire.com HTTP 302
  • https://rp4.liadm.com/j?dtstmp=1762685587515&did=did-006t&se=e30&duid=a738c2fb6c00--01k9m3z368kp41czwphh8wkwmd&tv=10.14.0&pu=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fzh1io5g5cavqo7l%2FRose%252527s_bot.zip%2Ffile&wpn=prebid&gdpr=0&cd=.mediafire.com&i6=MjYwMDo4MDM6YTg4OjMxMzE6OjEzMQ%3D%3D
Request Chain 154
  • https://oajs.openx.net/esp?url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fzh1io5g5cavqo7l%2FRose%252527s_bot.zip%2Ffile&rid=esp HTTP 302
  • https://oajs.openx.net/esp?url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fzh1io5g5cavqo7l%2FRose%252527s_bot.zip%2Ffile&rid=esp&cc=1
Request Chain 173
  • https://gum.criteo.com/sid/json?origin=publishertagids&domain=www.mediafire.com&sn=ChromeSyncframe&so=0&topUrl=www.mediafire.com&topicsavail=1&fledgeavail=1 HTTP 302
  • https://mug.criteo.com/sid?cpp=jTjTknw1amNVblBGVVZoNUZJSUhiZEVnSTYvLzFMcEVxNFRDN0JlTnRhcGlIZG1VemFsQWVxQy9xbTMyUFpMRCtDa0Z4eEMyaHY2RWpCRzh2V3crVEFRcVFjK3krQlRaM2NOMm1rRy9EOGNKT09pdStyK3NhWVFUdVlCWEZnUTBaeUZ6ekZOWDloWEhhcmRHMlpJT3JlY3A4ZjQxOU9PbUVzUU1Ub1N4Z3plTFdRUC85dlJIemhUeVZ3Qm9UT3Z3ZDdnSzBMNHFSVnVzVUVzRTJmQzc3bGovb1JWSitPd2l2K21MTVlRNzJpNk5tcVlBMitBaThCbk5VUXlBeTYwaXFWazVUR1RKQWlmM0VkVGI2Qm1Kbk9mZ3dhS3V3OHRramhWR3BFcUkvUUR1S0RpMjVqcERHZ1NHek0vMXE0dkJ4S20xL3w&cppv=2
Request Chain 182
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEPacmDdEEbRZZ4O8u2JbVvQ&google_cver=1
Request Chain 184
  • https://match.adsrvr.org/track/cmf/openx?oxid=94a04d86-68b3-7d05-c6a0-0f86a1088cdb&gdpr=0 HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072971&val=c485f9f6-2d7e-4627-890d-a71acdf647ae&ttd_puid=94a04d86-68b3-7d05-c6a0-0f86a1088cdb&gdpr=0&gdpr_consent=
Request Chain 185
  • https://pr-bh.ybp.yahoo.com/sync/openx/00672bc2-f81f-ef4c-f777-19735e5f4192?gdpr=0 HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-7ZrABcJE2p8tFuHy4aw0gs56wh7TEpXBSew-~A
Request Chain 186
  • https://ad.turn.com/r/cs?pid=9&gdpr=0 HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537073061&val=3112035968479487874&gdpr=0&gdpr_consent=&us_privacy=
Request Chain 201
  • https://id5-sync.com/i/457/8.gif?o=api&id5id=ID5*L6dcw9uBB7wA4dcBVyE0kiY9PyEflkDWHSk1rzW_3ED__2kQcpRaAAEBCmkQcpMAYKI1FCOKhaz2PqZ0no7AQg&gdpr_consent=&gdpr=false HTTP 302
  • https://ice.360yield.com/match?publisher_dsp_id=313&dsp_callback=1&external_user_id=ID5-4007wBZrSBt2u_VMtlhmPapT1QQBLCIGvllbLiiwtA&r=https%3A%2F%2Fid5-sync.com%2Fcq%2F457%2F124%2F7%2F2.gif%3Fpuid%3D%7BPUB_USER_ID%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP 302
  • https://ice.360yield.com/ul_cb/match?publisher_dsp_id=313&dsp_callback=1&external_user_id=ID5-4007wBZrSBt2u_VMtlhmPapT1QQBLCIGvllbLiiwtA&r=https%3A%2F%2Fid5-sync.com%2Fcq%2F457%2F124%2F7%2F2.gif%3Fpuid%3D%7BPUB_USER_ID%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP 302
  • https://id5-sync.com/cq/457/124/7/2.gif?puid=c707a058-2136-4f29-b1c4-083fa08a881b&gdpr=0&gdpr_consent=&gdpr=0&gdpr_consent= HTTP 302
  • https://ib.adnxs.com/getuid?https://id5-sync.com/c/457/2/6/3.gif?puid=$UID&gdpr=0&gdpr_consent= HTTP 307
  • https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fid5-sync.com%2Fc%2F457%2F2%2F6%2F3.gif%3Fpuid%3D%24UID%26gdpr%3D0%26gdpr_consent%3D HTTP 302
  • https://id5-sync.com/c/457/2/6/3.gif?puid=8235546582011012259&gdpr=0&gdpr_consent= HTTP 302
  • https://pixel.tapad.com/idsync/ex/push?partner_id=2922&partner_url=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F108%2F5%2F4.gif%3Fpuid%3D%24%7BTA_DEVICE_ID%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP 302
  • https://id5-sync.com/c/457/108/5/4.gif?puid=902b7e08-fa5e-4445-8e77-e3a6b377c57e&gdpr=0&gdpr_consent= HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=8h9u11h&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
  • https://id5-sync.com/k/264.gif?puid=c485f9f6-2d7e-4627-890d-a71acdf647ae&ttl=%%TTL%% HTTP 302
  • https://dis.eu.criteo.com/dis/usersync.aspx?r=30&p=59&cp=id5&cu=1&url=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F203%2F3%2F6.gif%3Fpuid%3D%40%40CRITEO_USERID%40%40%26gdpr%3D0%26gdpr_consent%3D HTTP 302
  • https://id5-sync.com/c/457/203/3/6.gif?puid=cba929f6-04ca-4b00-a349-fbf3c575ffa3&gdpr=0&gdpr_consent= HTTP 302
  • https://sync.go.sonobi.com/us?loc=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F434%2F2%2F7.gif%3Fpuid%3D%5BUID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&consent= HTTP 302
  • https://id5-sync.com/c/457/434/2/7.gif?puid=01942e64-87c8-403a-b0dd-ae16eb00c547&gdpr=0&gdpr_consent= HTTP 302
  • https://sync.ipredictive.com/d/sync/cookie/generic?partner=id5&cspid=18&cb=&redirect=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F796%2F1%2F8.gif%3Fpuid%3D%24%7BADELPHIC_CUID%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP 302
  • https://id5-sync.com/c/457/796/1/8.gif?puid=aecd7ee1-4168-4d56-868c-6e0a1600cece&gdpr=0&gdpr_consent= HTTP 302
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?p=50935&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&rd=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F429%2F0%2F9.gif%3Fpuid%3D%23PM_USER_ID%26gdpr%3D0%26gdpr_consent%3D HTTP 302
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?p=50935&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&rd=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F429%2F0%2F9.gif%3Fpuid%3D%23PM_USER_ID%26gdpr%3D0%26gdpr_consent%3D&rdf=1 HTTP 302
  • https://id5-sync.com/c/457/429/0/9.gif?puid=C1860927-6713-47E0-B05B-B74C5C3CA85E&gdpr=0&gdpr_consent=
Request Chain 204
  • https://id5-sync.com/i/457/8.gif?o=api&id5id=ID5*gHivrXRe9NKvPiRv-P7H_InizE-wSbO4svbGwZpgLy7__2kQcpRaAAEBCmkQcpMAYKJCBj5pNXu_LKbOgRHVTQ&gdpr_consent=&gdpr=false HTTP 302
  • https://rtb.gumgum.com/getuid/id5?r=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F441%2F7%2F2.gif%3Fpuid%3D%5BUID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP 302
  • https://id5-sync.com/c/457/441/7/2.gif?puid=u_d05d49cb-e2eb-4f7c-9240-19b8f0fc7950&gdpr=0&gdpr_consent= HTTP 302
  • https://pixel.tapad.com/idsync/ex/push?partner_id=2922&partner_url=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F108%2F6%2F3.gif%3Fpuid%3D%24%7BTA_DEVICE_ID%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP 302
  • https://pixel.tapad.com/idsync/ex/push/check?partner_id=2922&partner_url=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F108%2F6%2F3.gif%3Fpuid%3D%24%7BTA_DEVICE_ID%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP 302
  • https://id5-sync.com/c/457/108/6/3.gif?puid=902b7e08-fa5e-4445-8e77-e3a6b377c57e&gdpr=0&gdpr_consent= HTTP 302
  • https://csync.loopme.me/?redirect=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F821%2F5%2F4.gif%3Fpuid%3D%7Bdevice_id%7D%26gdpr%3D0%26gdpr_consent%3D HTTP 307
  • https://id5-sync.com/c/457/821/5/4.gif?puid=83649b06-be2d-403c-b81d-ec4595791399&gdpr=0&gdpr_consent= HTTP 302
  • https://dis.eu.criteo.com/dis/usersync.aspx?r=30&p=59&cp=id5&cu=1&url=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F203%2F4%2F5.gif%3Fpuid%3D%40%40CRITEO_USERID%40%40%26gdpr%3D0%26gdpr_consent%3D HTTP 302
  • https://id5-sync.com/c/457/203/4/5.gif?puid=cba929f6-04ca-4b00-a349-fbf3c575ffa3&gdpr=0&gdpr_consent= HTTP 302
  • https://sync.ipredictive.com/d/sync/cookie/generic?partner=id5&cspid=18&cb=&redirect=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F796%2F3%2F6.gif%3Fpuid%3D%24%7BADELPHIC_CUID%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP 302
  • https://id5-sync.com/c/457/796/3/6.gif?puid=aecd7ee1-4168-4d56-868c-6e0a1600cece&gdpr=0&gdpr_consent= HTTP 302
  • https://ce.lijit.com/merge?pid=27&3pid=c485f9f6-2d7e-4627-890d-a71acdf647ae&us_privacy=&gdpr=0&gdpr_consent=&location=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F1245%2F2%2F7.gif%3Fpuid%3D%5BSOVRNID%5D%26gdpr%3D0%26gdpr_consent%3D&s=id5 HTTP 302
  • https://ce.lijit.com/merge?pid=27&3pid=c485f9f6-2d7e-4627-890d-a71acdf647ae&us_privacy=&gdpr=0&gdpr_consent=&location=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F1245%2F2%2F7.gif%3Fpuid%3D%5BSOVRNID%5D%26gdpr%3D0%26gdpr_consent%3D&s=id5&dnr=1 HTTP 302
  • https://id5-sync.com/c/457/1245/2/7.gif?puid=LpHtARZHbtwqUZ8wRKKKaTbn&gdpr=0&gdpr_consent= HTTP 302
  • https://sync.ipredictive.com/d/sync/cookie/generic?partner=id5&cspid=18&cb=&redirect=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F796%2F1%2F8.gif%3Fpuid%3D%24%7BADELPHIC_CUID%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP 302
  • https://id5-sync.com/c/457/796/1/8.gif?puid=aecd7ee1-4168-4d56-868c-6e0a1600cece&gdpr=0&gdpr_consent= HTTP 302
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?p=50935&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&rd=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F429%2F0%2F9.gif%3Fpuid%3D%23PM_USER_ID%26gdpr%3D0%26gdpr_consent%3D HTTP 302
  • https://id5-sync.com/c/457/429/0/9.gif?puid=C1860927-6713-47E0-B05B-B74C5C3CA85E&gdpr=0&gdpr_consent=
Request Chain 212
  • https://id.a-mx.com/sync/?tagId=&ref=null&u=https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file&tl=https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file&nf=0&rt=true&v=10.14.0&av=2.0&vg=epbjs&us_privacy=null&am=null&gdpr=0&gdpr_consent= HTTP 302
  • https://c3.a-mo.net/b?uid=1776ef42-7a13-465b-8e3b-9082f65aba5b&sh=id.a-mx.com& HTTP 302
  • https://id.a-mx.com/set?oid=1776ef42-7a13-465b-8e3b-9082f65aba5b&uid=1776ef42-7a13-465b-8e3b-9082f65aba5b&
Request Chain 213
  • https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.mediafire.com%2F&domain=www.mediafire.com&bundle=l6ilVF9DZ0VsM281Zmp6WVNtMWNra3FxbWJPJTJGa1BNdThpUmtLcXgwRFNTMUwlMkZheVR5dEtWazJLSGxPODQ5bnpiJTJGQUltMDN2S0FrWXNZVXhOeDFpcFUyTEo3VnVDYWhGVm1NMFY3QVFZMFZlNiUyQm9IRVhDbDk1U3JKcFc5cnMlMkJHTHR4RTM&cw=1&pbt=1&lsw=1&gdpr=0 HTTP 302
  • https://mug.criteo.com/sid?cpp=aKnPi3xrRzVXOW5kU1IwK3dMem9ZMzBXUnV1YlZsYy84eEZNTjh3dHI5VVhUS2ZDWEdhYXZjeFpJL0dTejRNWHJUZjVDV1BRRTQ5S1ByN1pPVVFkYWtvVjRGWWZWekhVMzBydzZFZEJuL1JzbHVtd1BrcXVBcFFaa1dlNXN1T1hZWk51cVBYMW5nU29rdmwveko5NDcxeGdxME9abUMvRFVxbW5GZ2gyVS9jQTZJUXVKVDhXTjRGeTVWZkFmQXlHRzJUWnYwVklLV3JzaDJYenZqbjlYZCtrMis4OFFhdVI3RUE3K2VtbVlHZDFRMzZuNnFGVnNXQzI4SlRMZUF0U0FoZzk2V1Zkb2h3YTJlUXZzWlVmMU5JSHAzR3ltUElLL1U4dmdtRkNUR2pOc3lZNE5CSWoxYUFncTBxa05yQ1l3dlVPMno4UWxRTDcrWHNPWDhjajVoQ0hzZXc9PXw&cppv=2
Request Chain 276
  • https://px.ads.linkedin.com/setuid?partner=googleadxdb&google_gid=CAESEPen78XN-VRiJzvle6IuKBM&google_cver=1&google_push=AXcoOmRgOIsV09jWaKj_Cm1-HuDVqiU2MbB_bBKQyvcTbGzQ6BJE7lHH45FXDpsCh6ykMedQI9nsZ88DP0DHi0UQm9A4k1wbU7E5AjSWF9sdKbF_1a6lrut0dKR2ooXeveTXScTHY-JXsp8QBnyzJX8m4Aw HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=linkedin&google_push=AXcoOmRgOIsV09jWaKj_Cm1-HuDVqiU2MbB_bBKQyvcTbGzQ6BJE7lHH45FXDpsCh6ykMedQI9nsZ88DP0DHi0UQm9A4k1wbU7E5AjSWF9sdKbF_1a6lrut0dKR2ooXeveTXScTHY-JXsp8QBnyzJX8m4Aw
Request Chain 277
  • https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEJqe1KCjMklTsbjh8BZqcAI&google_cver=1&google_push=AXcoOmQMyJ3Vmi6FPOjRuu0EsbOcaWtYIWRMekiv06TEqnGOdTLJolNBJ8JcEUtjhNuRvxYTfpASUDuz37FQQTMdJcsYFaGzZ7fWQ_bjh22r9SQCStU84fy-PKiKA9WjiZVaLKExUngHeahRBAdO4Zxg5A HTTP 302
  • https://x.bidswitch.net/ul_cb/sync?ssp=google&google_gid=CAESEJqe1KCjMklTsbjh8BZqcAI&google_cver=1&google_push=AXcoOmQMyJ3Vmi6FPOjRuu0EsbOcaWtYIWRMekiv06TEqnGOdTLJolNBJ8JcEUtjhNuRvxYTfpASUDuz37FQQTMdJcsYFaGzZ7fWQ_bjh22r9SQCStU84fy-PKiKA9WjiZVaLKExUngHeahRBAdO4Zxg5A HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AXcoOmQMyJ3Vmi6FPOjRuu0EsbOcaWtYIWRMekiv06TEqnGOdTLJolNBJ8JcEUtjhNuRvxYTfpASUDuz37FQQTMdJcsYFaGzZ7fWQ_bjh22r9SQCStU84fy-PKiKA9WjiZVaLKExUngHeahRBAdO4Zxg5A&google_hm=OHviUSYvSHO6tFTQxmWbzw==&gdpr=&gdpr_consent=
Request Chain 278
  • https://dis.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DAXcoOmRX3tMVSQ1QzW14joFLJ_jMzwcQdA5nMIFN3Io9-ycQB2VFynoZu03g2spAm0a6fLEg0P6ERTyPA-YGC9argHTbYDPMltwAhXpUm4w6bmwkZOuehbKlaRGa7c0tpxyVVwmzJSUPfdERlVGpQ6bPb_8&google_gid=CAESEM32hqDhWmKjCwizncROLDs&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_hm=ay0tYWItcFdkdkl5U0lZTTUxSGxJaGxtSk56bldKRE9IMHIyb2JBZw&google_push=AXcoOmRX3tMVSQ1QzW14joFLJ_jMzwcQdA5nMIFN3Io9-ycQB2VFynoZu03g2spAm0a6fLEg0P6ERTyPA-YGC9argHTbYDPMltwAhXpUm4w6bmwkZOuehbKlaRGa7c0tpxyVVwmzJSUPfdERlVGpQ6bPb_8
Request Chain 279
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESENxhoYKpy0GX2m8wWPVGaLY&google_cver=1&google_push=AXcoOmTPGQyAYkYBT97DZEGlNjgLeARa6iL9Fr00324Q2UQGPijlb73jSymI3ZQFJ-chwkrdN5zYax2_1k9uKIQLmQJoSIUeZ3N0a4WN6XYNcUiFZ5rL9WbPd6LBc4QMVa4IdCliKCgE3cbROjP02iuCaGU HTTP 302
  • https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESENxhoYKpy0GX2m8wWPVGaLY&google_push=AXcoOmTPGQyAYkYBT97DZEGlNjgLeARa6iL9Fr00324Q2UQGPijlb73jSymI3ZQFJ-chwkrdN5zYax2_1k9uKIQLmQJoSIUeZ3N0a4WN6XYNcUiFZ5rL9WbPd6LBc4QMVa4IdCliKCgE3cbROjP02iuCaGU&s=184023&C=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESENxhoYKpy0GX2m8wWPVGaLY&google_hm=aRBymNHM56cAFDx0BU9sQQAAFjYAAAAB&google_nid=index&google_push=AXcoOmTPGQyAYkYBT97DZEGlNjgLeARa6iL9Fr00324Q2UQGPijlb73jSymI3ZQFJ-chwkrdN5zYax2_1k9uKIQLmQJoSIUeZ3N0a4WN6XYNcUiFZ5rL9WbPd6LBc4QMVa4IdCliKCgE3cbROjP02iuCaGU
Request Chain 280
  • https://ads.yieldmo.com/exptsync?google_gid=CAESELARk8zS-t1989Ff1M8EsXE&google_cver=1&google_push=AXcoOmSfK0v30jEuyI0WZdyzusYWFmPeiCwALpL7o5wXHNpjPQCMV2j3xVbwaZptRAcJiDDs0jb3lKpYP9HWuxCo_xyogjLybszKoDvbiGN2L0CrN0oE_Hqn97580uoXYem3ZauUkLCf2mqHqTcez2IYCy4 HTTP 302
  • https://cm.g.doubleclick.net/pixel?process_consent=T&google_nid=yieldmo&google_push=AXcoOmSfK0v30jEuyI0WZdyzusYWFmPeiCwALpL7o5wXHNpjPQCMV2j3xVbwaZptRAcJiDDs0jb3lKpYP9HWuxCo_xyogjLybszKoDvbiGN2L0CrN0oE_Hqn97580uoXYem3ZauUkLCf2mqHqTcez2IYCy4&google_hm=eEZSSnd6elR5SnpmemlKOElZclg=
Request Chain 281
  • https://bh.contextweb.com/bh/rtset?pid=559960&gp=1&google_gid=CAESEFQc3rKmeOSiWMR4HpR9XdQ&google_cver=1&google_push=AXcoOmThH1PShYm4DZ91gPs0mlM3-XWYaP1fZ4pgByh7bZIDvMpaeFbXdUk5iPqC44Q7_hyM1fN5oW8mFBrURw-EMHH65oQUgXL85OC51P8e-AJst4Ijts8OBEVe45VUufPnpJbkIH4kagd65JvBDKO0PP0 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=pulsepoint_inc_&google_push=AXcoOmThH1PShYm4DZ91gPs0mlM3-XWYaP1fZ4pgByh7bZIDvMpaeFbXdUk5iPqC44Q7_hyM1fN5oW8mFBrURw-EMHH65oQUgXL85OC51P8e-AJst4Ijts8OBEVe45VUufPnpJbkIH4kagd65JvBDKO0PP0&google_hm=TFE3NVdzUjZld3lp
Request Chain 282
  • https://sync.inmobi.com/gob?google_gid=CAESEC5pjWuQCXA7_Bx0uP3zlKM&google_cver=1&google_push=AXcoOmT0WGabffjw0Y6uUymWY6pIyle3W1MD7ABWtwGpin8OX2vZIg6Wm2k9maWkLDN202NJZw9UAwfRlXxROnQVfk68t1A9zw1FL_l5MJLES3omQj__o10SEmOyaVzLxO867deJr28EtmP4a2W1ZLskCbM HTTP 302
  • https://sync.inmobi.com/sync?redirect=&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=3&google_push=AXcoOmT0WGabffjw0Y6uUymWY6pIyle3W1MD7ABWtwGpin8OX2vZIg6Wm2k9maWkLDN202NJZw9UAwfRlXxROnQVfk68t1A9zw1FL_l5MJLES3omQj__o10SEmOyaVzLxO867deJr28EtmP4a2W1ZLskCbM&retry= HTTP 302
  • https://sync.inmobi.com/sync?redirect=&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=3&google_push=AXcoOmT0WGabffjw0Y6uUymWY6pIyle3W1MD7ABWtwGpin8OX2vZIg6Wm2k9maWkLDN202NJZw9UAwfRlXxROnQVfk68t1A9zw1FL_l5MJLES3omQj__o10SEmOyaVzLxO867deJr28EtmP4a2W1ZLskCbM&retry=true HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_hm=tyluxNoB4Yke6tEAVfJL&google_push=AXcoOmT0WGabffjw0Y6uUymWY6pIyle3W1MD7ABWtwGpin8OX2vZIg6Wm2k9maWkLDN202NJZw9UAwfRlXxROnQVfk68t1A9zw1FL_l5MJLES3omQj__o10SEmOyaVzLxO867deJr28EtmP4a2W1ZLskCbM&google_nid=inmobi_new_eb
Request Chain 285
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm&gdpr=0 HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJCFYz_tsR1OmH7dQ8IaljU&google_cver=1&gdpr=0
Request Chain 286
  • https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&gdpr=0&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
  • https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&gdpr=0&ixi=0&C=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=aRBymNHM56cAFDx0BU9sQQAA HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJCFYz_tsR1OmH7dQ8IaljU&google_cver=1
Request Chain 287
  • https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm&gdpr=0 HTTP 302
  • https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEKMrQDP0G8SjqVUVjTVYoXs&google_cver=1
Request Chain 288
  • https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}&gdpr=0 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODIzNTU0NjU4MjAxMTAxMjI1OQ%3D%3D&gdpr=0
Request Chain 307
  • https://pixel.quantserve.com/cs?a=p-31iz6hfFutd16&gdpr=0 HTTP 302
  • https://pixel.quantserve.com/cs?a=p-31iz6hfFutd16&gdpr=0&__qcmcs=1
Request Chain 308
  • https://idsync.rlcdn.com/380609.gif?gdpr=0&partner_uid=mugsUJvjJFmB4ylYmrUwUpjoeAOBtH5TmeE6z_db HTTP 307
  • https://idsync.rlcdn.com/1000.gif?memo=CMGdFxIzCi8IARCfOBoobXVnc1VKdmpKRm1CNHlsWW1yVXdVcGpvZUFPQnRINVRtZUU2el9kYhAAGg0ImeXByAYSBQjoBxAAQgBKAA HTTP 307
  • https://pippio.com/api/sync?pid=5324&it=1&iv=00053993b4a47158ab73734d1c15023d57239e4de99b021025e3262f438692a2791426b5417dce21&_=2 HTTP 307
  • https://px.ads.linkedin.com/db_sync?pid=10339&puuid=00053993b4a47158ab73734d1c15023d57239e4de99b021025e3262f438692a2791426b5417dce21&rand=06753740 HTTP 302
  • https://px.ads.linkedin.com/db_sync?pid=10339&puuid=00053993b4a47158ab73734d1c15023d57239e4de99b021025e3262f438692a2791426b5417dce21&rand=06753740&expected_cookie=9e57638b-1807-48ad-8c18-9b1a5c744ebf

315 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request file
www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/ 		323 KB
86 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.148.83 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b14fffccfdcc22d4bac07b2b82027b9caf51ca0adc9e4c9391db276fe14206ec
Security Headers
Name Value
Strict-Transport-Security max-age=0
X-Frame-Options SAMEORIGIN

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

access-control-allow-methods
OPTIONS, POST, GET
access-control-allow-origin
https://www.mediafire.com
alt-svc
h3=":443"; ma=86400
cache-control
no-cache, no-store, must-revalidate, max-age=0, post-check=0, pre-check=0
cf-cache-status
DYNAMIC
cf-ray
99bcc3a8dd025a29-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Sun, 09 Nov 2025 10:53:04 GMT
expires
0
pragma
no-cache
priority
u=0,i
server
cloudflare
server-timing
cfCacheStatus;desc="DYNAMIC" cfOrigin;dur=0,cfEdge;dur=133 cfExtPri
strict-transport-security
max-age=0
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
x-mf-env
liveApi
x-mf-fe
mf1
x-robots-tag
noindex, nofollow
min.js
cmp.gatekeeperconsent.com/ 		1 KB
835 B 		Script
General
Check archive.org
Download Go to
Full URL
https://cmp.gatekeeperconsent.com/min.js
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3035::6815:2a20 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
345dbaad5cd394bb195e79a7d835ee2af91c02c76413d974f2e7fd3b9fcbfe39

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-encoding
zstd
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=I3SXOyANHOkyAZ4qycr7QwNmsyY9mMwkfHIIFgDenpIkSNq3nH4ZVWFtJqeEv5V%2BSiN7PKKzQnDnAJefKvykuDSqd%2BPEy3ihhLcFcO9hUvMehflM4dZfp3Ga%2BilvJPKUqUv9hls%3D"}]}
cf-ray
99bcc3aafe9bdb6d-EWR
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sun, 09 Nov 2025 10:53:05 GMT
content-type
application/javascript
vary
accept-encoding
server
cloudflare
priority
u=1,i=?0
cmp.min.js
the.gatekeeperconsent.com/ 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://the.gatekeeperconsent.com/cmp.min.js
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::ac43:c7ba -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e0ff1aa498c3e7899a1ba72cea996bea56b397a6e93864cff709ce8d1776e5ea

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

x-robots-tag
noindex, follow
content-encoding
gzip
cf-cache-status
HIT
age
267
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=qwllWk5QBbZkDbXjRWiel0QRee2vMzIQimms0riz7zN0QKScgFB5LFkwNYhF0ZwZVYBlJR71%2F4s77EbB0wc3Hhd867%2BDrZwjJvvaVuIIPUOHdKLzS7M6J%2BZAHA5ImxJbWHRKM3c%3D"}]}
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sun, 09 Nov 2025 10:53:05 GMT
x-middleton-display
sol-js
content-type
application/javascript
vary
Accept-Encoding
last-modified
Sun, 09 Nov 2025 10:45:16 GMT
priority
u=1,i=?0
cache-control
max-age=300, public
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray
99bcc3aafd738153-EWR
server
cloudflare
js
www.googletagmanager.com/gtag/ 		281 KB
102 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=UA-829541-1
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c1f::61 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
46f8bed71e45edd8de227c7c08c24fba26c3834cfc5675b4294b11ab60f5bc8d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

content-encoding
zstd
expires
Sun, 09 Nov 2025 10:53:05 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sun, 09 Nov 2025 10:53:05 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
last-modified
Sun, 09 Nov 2025 09:00:00 GMT
access-control-allow-headers
Cache-Control
strict-transport-security
max-age=31536000; includeSubDomains
cache-control
private, max-age=900
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
*
content-length
104279
x-xss-protection
0
server
Google Tag Manager
tag
btloader.com/ 		91 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://btloader.com/tag?o=5678961798414336&upapi=true
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac42:ab85 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
643242e26749d72edbf48c27efff4b4ec689d352ff3698117c1d53018e4d926b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

x-robots-tag
noindex, nofollow
cache-control
public, max-age=300, stale-if-error=3600, stale-while-revalidate=300
content-encoding
gzip
cf-cache-status
HIT
etag
"b9b0e8d191f907a7311a6f44fab6a796"
via
1.1 google
cf-ray
99bcc3abeca60c9c-EWR
access-control-allow-origin
*
date
Sun, 09 Nov 2025 10:53:05 GMT
content-type
application/javascript
last-modified
Sun, 09 Nov 2025 10:15:35 GMT
server
cloudflare
vary
Accept-Encoding
sa.min.js
www.ezojs.com/ezoic/ 		164 KB
51 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.ezojs.com/ezoic/sa.min.js
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::ac43:aa90 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f303c517d2a00e19bcd56065330ac8a4cb82717cf1976e9c029e9a1442be288c

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

x-robots-tag
noindex, follow
content-encoding
gzip
cf-cache-status
HIT
etag
W/"205ee0647483fd8c83c0a3cb28f8a4e9"
age
467
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=EEXHt5tJBXh8pyHIIpiQXlftKnI5%2F30lNDkcJp8wqVN5KaJ%2BxZJwzqNhOxIthPsDFLJeVgu5SnzSpv8IeczisXezQIWEs6zSvubS%2BfZPNMyf20hVV5diKmM%3D"}]}
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sun, 09 Nov 2025 10:53:05 GMT
x-middleton-display
sol-js
content-type
application/javascript
vary
Accept-Encoding
priority
u=3,i=?0
cache-control
public, max-age=600, stale-while-revalidate=3600
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray
99bcc3abfaa941e1-EWR
server
cloudflare
element.js
translate.google.com/translate_a/ 		77 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://translate.google.com/translate_a/element.js?cb=googFooterTranslate
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c08::71 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
088c967af12cc5e78bb8334507229516e64013171dcd839c40aff86ac3c70246
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

cache-control
no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy
same-origin-allow-popups
content-encoding
gzip
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Mon, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sun, 09 Nov 2025 10:53:05 GMT
x-xss-protection
0
content-type
text/javascript; charset=utf-8
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
server
ESF
x-frame-options
SAMEORIGIN
vcd15cbe7772f49c399c6a5babf22c1241717689176015
static.cloudflareinsights.com/beacon.min.js/ 		19 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:4f49 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Origin
https://www.mediafire.com
Referer
https://www.mediafire.com/

Response headers

cache-control
public, max-age=86400
content-encoding
gzip
etag
W/"2024.6.1"
cross-origin-resource-policy
cross-origin
cf-ray
99bcc3abee25c269-EWR
access-control-allow-origin
*
date
Sun, 09 Nov 2025 10:53:05 GMT
content-type
text/javascript;charset=UTF-8
last-modified
Thu, 06 Jun 2024 15:52:56 GMT
vary
Accept-Encoding
server
cloudflare
consent_modules.json
privacy.gatekeeperconsent.com/ 		2 B
495 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://privacy.gatekeeperconsent.com/consent_modules.json
Requested by
Host: the.gatekeeperconsent.com
URL: https://the.gatekeeperconsent.com/cmp.min.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3035::6815:2a20 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

cache-control
max-age=15780000, public
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-encoding
zstd
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=N76rphw%2Bh3dSf9DPc13GgndcYAS6p0hPJKI8iZlYkulkOj3G%2BwoY7%2BpObeaPwMhrVUU3PXPI2l1XuC85b9p5o2BBKxFX%2F9Qpw0GbNAw1mF%2F1eDZ5TwHcx69kQF7%2Bk%2Fvn%2BFyz4q3%2B0hfj"}]}
cf-ray
99bcc3abbafdd2b1-EWR
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sun, 09 Nov 2025 10:53:05 GMT
content-type
application/json;charset=UTF-8
vary
accept-encoding
server
cloudflare
priority
u=1,i
amplitude-8.5.0-min.gz.js
cdn.amplitude.com/libs/ 		68 KB
22 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.amplitude.com/libs/amplitude-8.5.0-min.gz.js
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.170.42.100 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-3-170-42-100.iad61.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
2450e5580136f94bda7ccf95e3167b57e15b05b513a430967943a50036fa47a4

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Origin
https://www.mediafire.com
Referer
https://www.mediafire.com/

Response headers

access-control-max-age
3000
content-encoding
gzip
etag
"660c3b546f2a131de50b69b91f26c636"
x-amz-version-id
NY8_7uBz3xoXYJBVsMSBAGHOz8ixMBS3
age
157413
access-control-allow-methods
GET, HEAD
x-cache
Hit from cloudfront
x-amz-cf-id
eqbfRYGWa32hVG_nwirgj9bfYAfH0USR3LoRwHvOXLiVTFHGqWtjoA==
date
Fri, 07 Nov 2025 15:09:33 GMT
content-type
application/javascript
vary
Origin,Access-Control-Request-Headers,Access-Control-Request-Method
last-modified
Fri, 13 Aug 2021 22:37:42 GMT
cache-control
max-age=31536000
via
1.1 a41d734044cac7cfe09820f04854befc.cloudfront.net (CloudFront)
accept-ranges
bytes
access-control-allow-origin
*
content-length
22154
x-amz-cf-pop
IAD61-P10
server
AmazonS3
x-amz-server-side-encryption
AES256
gtm.js
www.googletagmanager.com/ 		381 KB
121 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-53LP4T
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c1f::61 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
255701179a3efc03d3bef75ae6551b7c2278a21fbeb1c479a49779d31d5cc985
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

content-encoding
zstd
expires
Sun, 09 Nov 2025 10:53:05 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sun, 09 Nov 2025 10:53:05 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
last-modified
Sun, 09 Nov 2025 09:00:00 GMT
access-control-allow-headers
Cache-Control
strict-transport-security
max-age=31536000; includeSubDomains
cache-control
private, max-age=900
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
*
content-length
123632
x-xss-protection
0
server
Google Tag Manager
mf_logo_full_color.svg
static.mediafire.com/images/backgrounds/header/ 		3 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.mediafire.com/images/backgrounds/header/mf_logo_full_color.svg
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.148.83 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8539c91ae0a82f8cab27d481ea38ac4e66d1e5b36701fe295bcba4399b9255bd

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

content-encoding
gzip
cf-cache-status
HIT
etag
W/"5813cfb2-d1d"
age
5687
access-control-allow-methods
OPTIONS, POST, GET
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
x-mf-env
liveApi
date
Sun, 09 Nov 2025 10:53:05 GMT
content-type
image/svg+xml
last-modified
Fri, 28 Oct 2016 22:22:42 GMT
vary
Accept-Encoding
priority
u=3,i
x-mf-fe
mf2
cf-ray
99bcc3ab7f995a29-EWR
access-control-allow-origin
*
server
cloudflare
file-zip-v3.png
static.mediafire.com/images/filetype/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.mediafire.com/images/filetype/file-zip-v3.png
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.148.83 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4448e430d3c53bad548a5d135e1c7e2f9593e806ba47892640d430ea752e979e

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

cf-cache-status
HIT
etag
"62deda56-750"
age
5713
access-control-allow-methods
OPTIONS, POST, GET
expires
Tue, 09 Dec 2025 09:17:28 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
x-mf-env
liveApi
date
Sun, 09 Nov 2025 10:53:05 GMT
content-type
image/png
last-modified
Mon, 25 Jul 2022 18:00:54 GMT
vary
Accept-Encoding
priority
u=3,i
cache-control
max-age=2592000
x-mf-fe
mf1
cf-ray
99bcc3ab7f9c5a29-EWR
accept-ranges
bytes
access-control-allow-origin
*
content-length
1872
server
cloudflare
icons_sprite.svg
www.mediafire.com/images/icons/svg_light/ 		36 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.mediafire.com/images/icons/svg_light/icons_sprite.svg
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.148.83 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7ba1bc2084def769e77a7dbf97cd91d68fe6c6d55b5d183a7d36630da8da2b02

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file

Response headers

content-encoding
gzip
cf-cache-status
HIT
etag
W/"62deda56-90ab"
age
5673
access-control-allow-methods
OPTIONS, POST, GET
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
x-mf-env
liveApi
date
Sun, 09 Nov 2025 10:53:05 GMT
content-type
image/svg+xml
last-modified
Mon, 25 Jul 2022 18:00:54 GMT
vary
Accept-Encoding
priority
u=3,i
cf-ray
99bcc3ab5f7d5a29-EWR
x-mf-fe
mf2
access-control-allow-origin
*
server
cloudflare
apps_list_sprite-v6.png
static.mediafire.com/images/backgrounds/download/ 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.mediafire.com/images/backgrounds/download/apps_list_sprite-v6.png
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.148.83 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc54b817820f14ce6395ba2a037f37d4bb0af75d5b017336140793fbe2f7f738

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

cf-cache-status
HIT
etag
"62deda56-1fd1"
age
5673
access-control-allow-methods
OPTIONS, POST, GET
expires
Tue, 09 Dec 2025 09:17:37 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
x-mf-env
liveApi
date
Sun, 09 Nov 2025 10:53:05 GMT
content-type
image/png
last-modified
Mon, 25 Jul 2022 18:00:54 GMT
vary
Accept-Encoding
priority
u=3,i
cache-control
max-age=2592000
cf-ray
99bcc3ab7f9e5a29-EWR
x-mf-fe
mf1
accept-ranges
bytes
access-control-allow-origin
*
content-length
8145
server
cloudflare
arrow_dropdown.svg
www.mediafire.com/images/icons/svg_dark/ 		315 B
504 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.mediafire.com/images/icons/svg_dark/arrow_dropdown.svg
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.148.83 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
82b94716473aa225e715e117802145c5d2d725aa1ba9d476d61a5d3da16a8c26

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file

Response headers

content-encoding
gzip
cf-cache-status
HIT
etag
W/"62deda56-13b"
age
5673
access-control-allow-methods
OPTIONS, POST, GET
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
x-mf-env
liveApi
date
Sun, 09 Nov 2025 10:53:05 GMT
content-type
image/svg+xml
last-modified
Mon, 25 Jul 2022 18:00:54 GMT
vary
Accept-Encoding
priority
u=3,i
cf-ray
99bcc3ab6f815a29-EWR
x-mf-fe
mf2
access-control-allow-origin
*
server
cloudflare
check_circle_green.svg
static.mediafire.com/images/icons/svg_dark/ 		444 B
568 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.mediafire.com/images/icons/svg_dark/check_circle_green.svg
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.148.83 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
03c8d2dc7d985c3004ff2cd6d8148dd03560f37ed15efdf6c2d7f4d771d0e599

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

content-encoding
gzip
cf-cache-status
HIT
etag
W/"62deda56-1bc"
age
5686
access-control-allow-methods
OPTIONS, POST, GET
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
x-mf-env
liveApi
date
Sun, 09 Nov 2025 10:53:05 GMT
content-type
image/svg+xml
last-modified
Mon, 25 Jul 2022 18:00:54 GMT
vary
Accept-Encoding
priority
u=1,i
x-mf-fe
mf2
cf-ray
99bcc3ab8fa75a29-EWR
access-control-allow-origin
*
server
cloudflare
fb_16x16.png
static.mediafire.com/images/backgrounds/download/social/ 		181 B
452 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.mediafire.com/images/backgrounds/download/social/fb_16x16.png
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.148.83 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
720671166ac43aba99e3952b0b9341ab4e0fee1fd891db54e2a07f05db653142

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

cf-cache-status
HIT
etag
"62deda56-b5"
age
5686
access-control-allow-methods
OPTIONS, POST, GET
expires
Tue, 09 Dec 2025 09:17:37 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
x-mf-env
liveApi
date
Sun, 09 Nov 2025 10:53:05 GMT
content-type
image/png
last-modified
Mon, 25 Jul 2022 18:00:54 GMT
vary
Accept-Encoding
priority
u=1,i
cache-control
max-age=2592000
x-mf-fe
mf2
cf-ray
99bcc3ab8fa65a29-EWR
accept-ranges
bytes
access-control-allow-origin
*
content-length
181
server
cloudflare
footerIcons.png
static.mediafire.com/images/backgrounds/footer/social/ 		583 B
855 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.mediafire.com/images/backgrounds/footer/social/footerIcons.png
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.148.83 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f917a9105c311331b1d40f4d2bdbf11233c1c465616c1a9c46232f451463b061

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

cf-cache-status
HIT
etag
"62deda56-247"
age
5714
access-control-allow-methods
OPTIONS, POST, GET
expires
Tue, 09 Dec 2025 09:17:29 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
x-mf-env
liveApi
date
Sun, 09 Nov 2025 10:53:05 GMT
content-type
image/png
last-modified
Mon, 25 Jul 2022 18:00:54 GMT
vary
Accept-Encoding
priority
u=3,i
cache-control
max-age=2592000
x-mf-fe
mf2
cf-ray
99bcc3ab9fc45a29-EWR
accept-ranges
bytes
access-control-allow-origin
*
content-length
583
server
cloudflare
infinity.js.aspx
cdn.econventa.com/Scripts/ 		164 KB
48 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.econventa.com/Scripts/infinity.js.aspx?guid=5ff0fb62-0643-4ff1-aaee-c737f9ffc0e0
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:20::ac43:4551 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2b8bdb8e1e345a290d728e5e3bb3866e954fe113a2dde5429d9a7ce9c7cdeb33

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

cache-control
max-age=1200, no-transform
content-encoding
gzip
cf-cache-status
HIT
age
223
cf-ray
99bcc3ac49a34225-EWR
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sun, 09 Nov 2025 10:53:05 GMT
content-type
text/javascript
vary
Accept-Encoding
server
cloudflare
last-modified
Sun, 09 Nov 2025 10:39:32 GMT
priority
u=3,i=?0
like.php
www.facebook.com/plugins/ Frame 56F6 		65 KB
23 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.facebook.com/plugins/like.php?href=http://www.facebook.com/MediaFire&width=193&layout=button_count&action=like&show_faces=false&share=true&height=30&appId=124578887583575
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f103:83:face:b00c:0:25de Ashburn, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
e83fa6da04321fcd6ed898ff965996c22c8a7fb008371b452334a117dc890912
Security Headers
Name Value
Content-Security-Policy default-src blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'nonce-9x9rd4Lv' blob: 'self' connect.facebook.net 'wasm-unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;child-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net accounts.meta.com *.accounts.meta.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;manifest-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;object-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.mediafire.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
private, no-cache, no-store, must-revalidate
content-encoding
zstd
content-security-policy
default-src blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'nonce-9x9rd4Lv' blob: 'self' connect.facebook.net 'wasm-unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;child-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net accounts.meta.com *.accounts.meta.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;manifest-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;object-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
content-type
text/html; charset="utf-8"
cross-origin-opener-policy
unsafe-none
cross-origin-resource-policy
cross-origin
date
Sun, 09 Nov 2025 10:53:05 GMT
document-policy
force-load-at-top include-js-call-stacks-in-crash-reports
expires
Sat, 01 Jan 2000 00:00:00 GMT
origin-agent-cluster
?1
permissions-policy
accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
pragma
no-cache
priority
u=0,i
report-to
{"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7570676941223863074&cpp=C3&cv=1029628212&st=1762685585420"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
reporting-endpoints
coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7570676941223863074&cpp=C3&cv=1029628212&st=1762685585420", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
strict-transport-security
max-age=15552000; preload
vary
Accept-Encoding
x-content-type-options
nosniff
x-fb-connection-quality
EXCELLENT; q=0.9, rtt=36, rtx=0, c=23, mss=1232, tbw=6203, tp=10, tpl=0, uplat=106, ullat=0
x-fb-debug
i1wpNMDgXmXIyt+71VC6hGCDvR7+tgf8emohxuv3DNyxbL8ChFj/03NMKos4ka/KErh5An0Q4GiqyRG8Ggr8yg==
x-xss-protection
0
world.svg
static.mediafire.com/images/backgrounds/download/additional_content/ 		143 KB
53 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.mediafire.com/images/backgrounds/download/additional_content/world.svg
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.148.83 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4342feac38021c4fe3069eba0edf1c2e1b4345e2b548b0afb7ab21b7369b3bc8

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

content-encoding
gzip
cf-cache-status
HIT
etag
W/"62deda56-23ce2"
age
5686
access-control-allow-methods
OPTIONS, POST, GET
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
x-mf-env
liveApi
date
Sun, 09 Nov 2025 10:53:05 GMT
content-type
image/svg+xml
last-modified
Mon, 25 Jul 2022 18:00:54 GMT
vary
Accept-Encoding
priority
u=3,i
x-mf-fe
mf2
cf-ray
99bcc3ac18565a29-EWR
access-control-allow-origin
*
server
cloudflare
continent-na.svg
static.mediafire.com/images/backgrounds/download/additional_content/ 		50 KB
19 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.mediafire.com/images/backgrounds/download/additional_content/continent-na.svg
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.148.83 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
05cfe92d9794a54258a19bfec7ae0faa73f61b66416983136594b4f95bb114dd

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

content-encoding
gzip
cf-cache-status
HIT
etag
W/"62deda56-c817"
age
5611
access-control-allow-methods
OPTIONS, POST, GET
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
x-mf-env
liveApi
date
Sun, 09 Nov 2025 10:53:05 GMT
content-type
image/svg+xml
last-modified
Mon, 25 Jul 2022 18:00:54 GMT
vary
Accept-Encoding
priority
u=3,i
x-mf-fe
mf2
cf-ray
99bcc3ac18595a29-EWR
access-control-allow-origin
*
server
cloudflare
usa.svg
static.mediafire.com/images/flags_svg/ 		1 KB
712 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.mediafire.com/images/flags_svg/usa.svg
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.148.83 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8bacb685be7cec7f41a0270e694fa90c0fb448b2c0ded5f1734baf51050d695c

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

content-encoding
gzip
cf-cache-status
HIT
etag
W/"62deda56-5c7"
age
5256
access-control-allow-methods
OPTIONS, POST, GET
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
x-mf-env
liveApi
date
Sun, 09 Nov 2025 10:53:05 GMT
content-type
image/svg+xml
last-modified
Mon, 25 Jul 2022 18:00:54 GMT
vary
Accept-Encoding
priority
u=3,i
x-mf-fe
mf2
cf-ray
99bcc3ac185b5a29-EWR
access-control-allow-origin
*
server
cloudflare
flag.svg
static.mediafire.com/images/backgrounds/download/additional_content/ 		234 B
470 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.mediafire.com/images/backgrounds/download/additional_content/flag.svg
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.148.83 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f52a0c7d9fa7ae8e45916c491ae7193f9a1e289f128f05264122c53d8da970db

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

content-encoding
gzip
cf-cache-status
HIT
etag
W/"62deda56-ea"
age
5632
access-control-allow-methods
OPTIONS, POST, GET
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
x-mf-env
liveApi
date
Sun, 09 Nov 2025 10:53:05 GMT
content-type
image/svg+xml
last-modified
Mon, 25 Jul 2022 18:00:54 GMT
vary
Accept-Encoding
priority
u=3,i
x-mf-fe
mf2
cf-ray
99bcc3ac185f5a29-EWR
access-control-allow-origin
*
server
cloudflare
mf_round.svg
static.mediafire.com/images/backgrounds/download/additional_content/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.mediafire.com/images/backgrounds/download/additional_content/mf_round.svg
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.148.83 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f1a67642fc97b508ce07cf6df329022bf5184a1c573044dc021e0d6e64688c64

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

content-encoding
gzip
cf-cache-status
HIT
etag
W/"62deda56-5b1"
age
5443
access-control-allow-methods
OPTIONS, POST, GET
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
x-mf-env
liveApi
date
Sun, 09 Nov 2025 10:53:05 GMT
content-type
image/svg+xml
last-modified
Mon, 25 Jul 2022 18:00:54 GMT
vary
Accept-Encoding
priority
u=3,i
x-mf-fe
mf1
cf-ray
99bcc3ac18605a29-EWR
access-control-allow-origin
*
server
cloudflare
browser_chrome.svg
static.mediafire.com/images/backgrounds/download/additional_content/ 		8 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.mediafire.com/images/backgrounds/download/additional_content/browser_chrome.svg
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.148.83 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1c6ba1010c2cc88c59de9e9584728da124770fa399643ffc1beffcec54b84be7

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

content-encoding
gzip
cf-cache-status
HIT
etag
W/"62deda56-1e24"
age
5026
access-control-allow-methods
OPTIONS, POST, GET
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
x-mf-env
liveApi
date
Sun, 09 Nov 2025 10:53:05 GMT
content-type
image/svg+xml
last-modified
Mon, 25 Jul 2022 18:00:54 GMT
vary
Accept-Encoding
priority
u=3,i
x-mf-fe
mf1
cf-ray
99bcc3ac18615a29-EWR
access-control-allow-origin
*
server
cloudflare
main.js
www.mediafire.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/fd468eb09fcf/ Frame 6C74
Redirect Chain
  • https://www.mediafire.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
  • https://www.mediafire.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/fd468eb09fcf/main.js?
10 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.mediafire.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/fd468eb09fcf/main.js?
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H3
Server
104.17.148.83 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d4c82997625475c5f3e3e97b615d3da0709ed525947749da6c235dbe3270d458
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer

Response headers

cache-control
max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public
content-encoding
gzip
x-content-type-options
nosniff
cf-ray
99bcc3ad09375a29-EWR
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sun, 09 Nov 2025 10:53:05 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
server
cloudflare
priority
u=3,i=?0

Redirect headers

cache-control
max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public
location
/cdn-cgi/challenge-platform/h/g/scripts/jsd/fd468eb09fcf/main.js?
cf-ray
99bcc3ac38765a29-EWR
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
content-length
0
server-timing
cfExtPri
date
Sun, 09 Nov 2025 10:53:05 GMT
vary
Accept-Encoding
server
cloudflare
priority
u=3,i=?0
/
api.amplitude.com/ 		7 B
137 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.amplitude.com/
Requested by
Host: cdn.amplitude.com
URL: https://cdn.amplitude.com/libs/amplitude-8.5.0-min.gz.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.165.50.35 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-165-50-35.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8
Referer
https://www.mediafire.com/

Response headers

strict-transport-security
max-age=15768000
access-control-allow-origin
*
content-length
7
date
Sun, 09 Nov 2025 10:53:05 GMT
content-type
text/html;charset=utf-8
px.gif
ad-delivery.net/ 		43 B
110 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ad-delivery.net/px.gif?ch=2&e=0.2181984881953435
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac42:948c -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

x-goog-metageneration
5
access-control-expose-headers
*, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash
crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status
HIT
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3"
age
499287
x-goog-stored-content-encoding
identity
expires
Mon, 03 Nov 2025 16:44:11 GMT
x-goog-stored-content-length
43
date
Sun, 09 Nov 2025 10:53:05 GMT
content-type
image/gif
last-modified
Wed, 05 May 2021 19:25:32 GMT
vary
accept-encoding
x-guploader-uploadid
AAwnv3LS2q6BRDz0udyMq8SGqsPxAD9_9_o6mzrHaQCRyGk0sZz7XK3QmjtCjxaiR2NTdoeX6-0UZCs
cache-control
public, max-age=86400
x-goog-storage-class
MULTI_REGIONAL
cf-ray
99bcc3addbf17d0b-EWR
accept-ranges
bytes
access-control-allow-origin
*
x-goog-generation
1620242732037093
content-length
43
server
cloudflare
favicon.ico
ad.doubleclick.net/ 		1 KB
129 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.5973742768245104
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.16.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bl-in-f149.1e100.net
Software
sffe /
Resource Hash
d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

content-encoding
gzip
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options
nosniff
expires
Mon, 10 Nov 2025 10:53:05 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sun, 09 Nov 2025 10:53:05 GMT
content-type
image/x-icon
vary
Accept-Encoding
last-modified
Tue, 08 May 2012 13:08:06 GMT
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
content-length
104
x-xss-protection
0
server
sffe
px.gif
ad-delivery.net/ 		43 B
629 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ad-delivery.net/px.gif?ch=1&e=0.20572783246923254
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac42:948c -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

x-goog-metageneration
5
access-control-expose-headers
*, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash
crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status
HIT
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3"
age
499287
x-goog-stored-content-encoding
identity
expires
Mon, 03 Nov 2025 16:44:11 GMT
x-goog-stored-content-length
43
date
Sun, 09 Nov 2025 10:53:05 GMT
content-type
image/gif
last-modified
Wed, 05 May 2021 19:25:32 GMT
vary
accept-encoding
x-guploader-uploadid
AAwnv3LS2q6BRDz0udyMq8SGqsPxAD9_9_o6mzrHaQCRyGk0sZz7XK3QmjtCjxaiR2NTdoeX6-0UZCs
cache-control
public, max-age=86400
x-goog-storage-class
MULTI_REGIONAL
cf-ray
99bcc3addbf47d0b-EWR
accept-ranges
bytes
access-control-allow-origin
*
x-goog-generation
1620242732037093
content-length
43
server
cloudflare
dns
ab.dns-finder.com/meta/ 		2 B
233 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ab.dns-finder.com/meta/dns
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.36.200.111 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
111.200.36.34.bc.googleusercontent.com
Software
/
Resource Hash
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

cache-control
private, max-age=180, stale-if-error=180, stale-while-revalidate=180
access-control-expose-headers
X-Resolver
x-resolver
default
via
1.1 google
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
2
date
Sun, 09 Nov 2025 10:53:05 GMT
content-type
text/plain; charset=utf-8
vary
Origin
trustedIframe.html
btloader.com/ Frame A511 		6 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://btloader.com/trustedIframe.html?o=5678961798414336&upapi=true
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:14bd -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
76b14705bcd5752ac05035c95c7f53bfe8e65dda03bc77662e0aff067e3258e7

Request headers

Referer
https://www.mediafire.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

cache-control
public, max-age=3600, stale-while-revalidate=3600
cf-ray
99bcc3add998c47d-EWR
content-encoding
br
content-type
text/html
date
Sun, 09 Nov 2025 10:53:05 GMT
server
cloudflare
vary
accept-encoding
99bcc3a8dd025a29
www.mediafire.com/cdn-cgi/challenge-platform/h/g/jsd/r/0.1579608968735335:1762684405:hRMCaCJowWoG7lcvFEq0QA6B2D2RIsd57nwQJRx3I4M/ Frame 6C74 		0
471 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.mediafire.com/cdn-cgi/challenge-platform/h/g/jsd/r/0.1579608968735335:1762684405:hRMCaCJowWoG7lcvFEq0QA6B2D2RIsd57nwQJRx3I4M/99bcc3a8dd025a29
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.148.83 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8
Referer

Response headers

cf-ray
99bcc3ae5aad5a29-EWR
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
content-length
0
date
Sun, 09 Nov 2025 10:53:05 GMT
content-type
text/plain; charset=UTF-8
server
cloudflare
priority
u=1,i
FEppCFCt76d.png
static.xx.fbcdn.net/rsrc.php/v4/yD/r/ Frame 56F6 		299 B
441 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.xx.fbcdn.net/rsrc.php/v4/yD/r/FEppCFCt76d.png
Requested by
Host: www.facebook.com
URL: https://www.facebook.com/plugins/like.php?href=http://www.facebook.com/MediaFire&width=193&layout=button_count&action=like&show_faces=false&share=true&height=30&appId=124578887583575
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f003:100:face:b00c:0:3 Ashburn, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
d65f4b2e8eee94ddc7f762d098de19558d879a3b597c8913b4d075532e3ed4b4
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.facebook.com/

Response headers

content-md5
OIlAxCmR79nrM/Ez4ygGlg==
report-to
{"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options
nosniff
expires
Tue, 27 Oct 2026 22:28:21 GMT
alt-svc
h3=":443"; ma=86400
date
Sun, 09 Nov 2025 10:53:05 GMT
content-type
image/png
last-modified
Mon, 01 Jan 2001 08:00:00 GMT
x-fb-debug
JKztsrXnpNIYKKUFf0z4kCvic7eYaSwpz3JRYQmxcpoWM5RC13rh0ESeGpHFbbg+1ATamvLyZqPp5BqDweMrfA==
priority
u=1,i
reporting-endpoints
permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
cache-control
public,max-age=31536000,immutable
timing-allow-origin
*
x-fb-connection-quality
EXCELLENT; q=0.9, rtt=30, rtx=0, c=23, mss=1232, tbw=6203, tp=10, tpl=0, uplat=0, ullat=-1
cross-origin-resource-policy
cross-origin
permissions-policy
accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy
force-load-at-top, include-js-call-stacks-in-crash-reports
access-control-allow-origin
*
content-length
299
origin-agent-cluster
?1
vgrlgP7L72d.js
static.xx.fbcdn.net/rsrc.php/v4iEpO4/yP/l/en_US-j/ Frame 56F6 		533 KB
140 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://static.xx.fbcdn.net/rsrc.php/v4iEpO4/yP/l/en_US-j/vgrlgP7L72d.js
Requested by
Host: www.facebook.com
URL: https://www.facebook.com/plugins/like.php?href=http://www.facebook.com/MediaFire&width=193&layout=button_count&action=like&show_faces=false&share=true&height=30&appId=124578887583575
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f003:100:face:b00c:0:3 Ashburn, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
e99789d450a9dab1fea76362b595a87823157c4b4b886f02aaebf7649167b829
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.facebook.com/

Response headers

content-md5
CwkXXRJXkVcYDI164UZnbA==
content-encoding
zstd
report-to
{"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options
nosniff
expires
Fri, 06 Nov 2026 23:42:06 GMT
alt-svc
h3=":443"; ma=86400
date
Sun, 09 Nov 2025 10:53:05 GMT
content-type
application/x-javascript; charset=utf-8
last-modified
Mon, 01 Jan 2001 08:00:00 GMT
x-fb-debug
ndb1PipvXr9XwIAAuUaN+/yr+zewhglYXPH810wGjszgh17386WR1kEE7G/wnUuYyy9ALqE49YrBMBKZjBBlbQ==
priority
u=1,i
vary
Origin
reporting-endpoints
permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
cache-control
public,max-age=31536000,immutable
timing-allow-origin
*
x-fb-connection-quality
EXCELLENT; q=0.9, rtt=30, rtx=0, c=23, mss=1232, tbw=6200, tp=10, tpl=0, uplat=0, ullat=-1
cross-origin-resource-policy
cross-origin
permissions-policy
accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy
force-load-at-top, include-js-call-stacks-in-crash-reports
access-control-allow-origin
https://www.facebook.com
content-length
143045
origin-agent-cluster
?1
exd
api.btloader.com/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://api.btloader.com/exd?tid=ldqO3n1I-KCDjvyRuZN-9a683f8824&sid=IZ3al3p4-6v2EyAqHYq-9a683f8824&cv=2.1.167&upapi=true
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
130.211.23.194 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
194.23.211.130.bc.googleusercontent.com
Software
/
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

via
1.1 google
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sun, 09 Nov 2025 10:53:05 GMT
vary
Origin
m=el_main_css
www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.2f3WBw8L4SI.L.W.O/am=AAAD/d=0/rs=AN8SPfpxZ_PDqjwQqfIDlbJ_9iabaVfvFA/ 		22 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.2f3WBw8L4SI.L.W.O/am=AAAD/d=0/rs=AN8SPfpxZ_PDqjwQqfIDlbJ_9iabaVfvFA/m=el_main_css
Requested by
Host:
URL: /_/translate_http/_/js/k=translate_http.tr.en_US.xPuPSiyNUy0.O/am=AAAD/d=1/rs=AN8SPfq6ghGcX3QSIaUYMTYKa-OSuS5-1g/m=el_conf
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c0b::5e Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
fb1bd700eb83832fc2ca14c9fd537e5facad95f3bd15632db0c4b1c5a5bd7e20
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

content-encoding
gzip
age
101608
report-to
{"group":"rosetta","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/rosetta"}]}
x-content-type-options
nosniff
expires
Sun, 08 Nov 2026 06:39:37 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 08 Nov 2025 06:39:37 GMT
last-modified
Wed, 15 Oct 2025 01:09:54 GMT
content-type
text/css; charset=UTF-8
vary
Accept-Encoding
cache-control
public, max-age=31536000
cross-origin-opener-policy
same-origin; report-to="rosetta"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/rosetta
accept-ranges
bytes
access-control-allow-origin
*
content-length
4155
x-xss-protection
0
server
sffe
m=el_main
translate.googleapis.com/_/translate_http/_/js/k=translate_http.tr.en_US.xPuPSiyNUy0.O/am=AAAQ/d=1/exm=el_conf/ed=1/rs=AN8SPfodCXDLj_Grv-NAABawhDfbD7sLJg/ 		352 KB
102 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://translate.googleapis.com/_/translate_http/_/js/k=translate_http.tr.en_US.xPuPSiyNUy0.O/am=AAAQ/d=1/exm=el_conf/ed=1/rs=AN8SPfodCXDLj_Grv-NAABawhDfbD7sLJg/m=el_main
Requested by
Host:
URL: /_/translate_http/_/js/k=translate_http.tr.en_US.xPuPSiyNUy0.O/am=AAAD/d=1/rs=AN8SPfq6ghGcX3QSIaUYMTYKa-OSuS5-1g/m=el_conf
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2607:f8b0:4004:c21::5f Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
696642980342cdb9c2e57d199ea188db4928c518de52d9dbe349cd0ca8e400bc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

content-encoding
gzip
age
8415
report-to
{"group":"rosetta","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/rosetta"}]}
x-content-type-options
nosniff
expires
Mon, 09 Nov 2026 08:32:50 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sun, 09 Nov 2025 08:32:50 GMT
last-modified
Wed, 05 Nov 2025 10:10:01 GMT
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
cache-control
public, max-age=31536000
cross-origin-opener-policy
same-origin; report-to="rosetta"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/rosetta
accept-ranges
bytes
access-control-allow-origin
*
content-length
103949
x-xss-protection
0
server
sffe
js
www.googletagmanager.com/gtag/ 		500 KB
162 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=G-K68XP6D85D&cx=c&gtm=4e5b50
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-53LP4T
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c1f::61 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
456d1d598f7ae1db54b77a49bca6a0d304d9bbb990123bce91c33bf4115d8ac7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
cache-control
private, max-age=900
content-encoding
zstd
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
expires
Sun, 09 Nov 2025 10:53:05 GMT
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
166047
date
Sun, 09 Nov 2025 10:53:05 GMT
x-xss-protection
0
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
server
Google Tag Manager
access-control-allow-headers
Cache-Control
js
www.googletagmanager.com/gtag/ 		281 KB
102 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=UA-829541-1&cx=c&gtm=4e5b50
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-53LP4T
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c1f::61 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
bbe98ca541dc9afec7186d90ad5c268c57094f6df73a18e0a70b8b2bed286744
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

content-encoding
zstd
expires
Sun, 09 Nov 2025 10:53:05 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sun, 09 Nov 2025 10:53:05 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
last-modified
Sun, 09 Nov 2025 09:00:00 GMT
access-control-allow-headers
Cache-Control
strict-transport-security
max-age=31536000; includeSubDomains
cache-control
private, max-age=900
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
*
content-length
104294
x-xss-protection
0
server
Google Tag Manager
analytics.js
www.google-analytics.com/ 		51 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-829541-1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c0b::66 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
f1a61277e3f902f50ab42015d8b07218db9b7601bb0967e54a52bfdcb4fa7e81
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

content-encoding
gzip
age
7139
report-to
{"group":"ascnsrsgac:225:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:225:0"}],}
x-content-type-options
nosniff
expires
Sun, 09 Nov 2025 10:54:06 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sun, 09 Nov 2025 08:54:06 GMT
last-modified
Tue, 15 Jul 2025 00:44:26 GMT
content-type
text/javascript
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:225:0
cross-origin-opener-policy-report-only
same-origin; report-to=ascnsrsgac:225:0
content-length
20737
server
Golfe2
saa.go
g.ezoic.net/ 		10 KB
4 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://g.ezoic.net/saa.go
Requested by
Host: www.ezojs.com
URL: https://www.ezojs.com/ezoic/sa.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1f10:4c55:e23d:5d5b:8bb5:8ae2:1fff Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
557e96fc45df3f432925767711a0576d55f03256d8ef666fe8f63db372e66920

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type
text/plain
Referer
https://www.mediafire.com/

Response headers

x-robots-tag
noindex
access-control-max-age
1728000
cache-control
private, max-age=0, must-revalidate, no-cache, no-store
content-encoding
br
access-control-allow-credentials
true
access-control-allow-methods
GET, POST, PUT, OPTIONS
expires
Sat, 08 Nov 2025 10:53:05 GMT
access-control-allow-origin
https://www.mediafire.com
date
Sun, 09 Nov 2025 10:53:05 GMT
content-type
text/javascript
vary
Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
access-control-allow-headers
Content-Type
boise.js
go.ezodn.com/detroitchicago/ 		824 B
955 B 		Script
General
Check archive.org
Download Go to
Full URL
https://go.ezodn.com/detroitchicago/boise.js?gcb=195-13&cb=5
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3037::6815:574f -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a4fafcd389d58bbd82e49d9a68e81e9dc8384330ff14ec3283a4d0d11812047b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

x-robots-tag
noindex, follow
content-encoding
br
cf-cache-status
HIT
age
866476
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=koAFivQwqOz365rzaUdxpKrXtrEgKWkLQWjos21lYWVTH7tfhZpIS4ea%2FFfXoES%2Fppsl5hQse1azzEXroICEF4y0OjjA8I3Qx8%2B8Vr%2FPNMMVRE438viaLg%3D%3D"}]}
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sun, 09 Nov 2025 10:53:06 GMT
x-middleton-display
sol-js
content-type
application/javascript
vary
Accept-Encoding
last-modified
Fri, 03 Oct 2025 02:16:39 GMT
priority
u=3,i=?0
cache-control
public, max-age=31536000
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray
99bcc3b15f184693-EWR
content-length
426
server
cloudflare
abilene.js
go.ezodn.com/parsonsmaize/ 		11 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://go.ezodn.com/parsonsmaize/abilene.js?gcb=195-13&cb=dc112bb7ea
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3037::6815:574f -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f1c02e9ba02a159b34fc2d7d2be0a743b497a6cd0a422a0c3acc88b871b2af96

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

x-robots-tag
noindex, follow
content-encoding
br
cf-cache-status
HIT
age
868378
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=4KrEQEvPPWJxXSgMmwb7VKDJub%2BeGN4j72fAIwpVpTFLOTWgrOj6g70%2FBBmZqetTMsZMUBx9GLFhM%2BINqJKB6TyDJOi%2FeD8TmgXzsQGTUbjuP9mJEM7FEw%3D%3D"}]}
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sun, 09 Nov 2025 10:53:06 GMT
x-middleton-display
sol-js
content-type
application/javascript
vary
Accept-Encoding
last-modified
Sat, 04 Oct 2025 08:27:17 GMT
priority
u=3,i=?0
cache-control
public, max-age=31536000
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray
99bcc3b15f194693-EWR
server
cloudflare
identity.js
www.ezojs.com/ 		301 KB
90 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.ezojs.com/identity.js
Requested by
Host: www.ezojs.com
URL: https://www.ezojs.com/ezoic/sa.min.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::ac43:aa90 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7f596391730ffc1ae1aaa2b67074a27da2706c305f11fa1b1231a2bd9fae289e

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

x-robots-tag
noindex, follow
content-encoding
gzip
cf-cache-status
HIT
etag
W/"d5f5d9ca38e16d7ca490a0c49b6c41b6"
age
548
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=VMz3AO3Q6LnF%2FP4va%2Bw4hxL4JHd6CA46iirko%2BzSEKRnN82i6ME7%2Fy3S8mEoe7Vc1mBaYa03wjUibVQWDalkoO11W5PFO9uQeJMgSL9wRsFcpYTlUp9jHnI%3D"}]}
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sun, 09 Nov 2025 10:53:06 GMT
x-middleton-display
sol-js
content-type
application/javascript
vary
Accept-Encoding
priority
u=3,i=?0
cache-control
public, max-age=900, stale-while-revalidate=3600
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray
99bcc3b0bab141e1-EWR
server
cloudflare
ezintegration
g.ezoic.net/ 		43 B
236 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://g.ezoic.net/ezintegration?d=www.mediafire.com&ts=1762685585790
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1f10:4c55:e23d:5d5b:8bb5:8ae2:1fff Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

expires
Sat, 08 Nov 2025 10:53:06 GMT
cache-control
private, max-age=0, must-revalidate, no-cache, no-store
content-length
43
date
Sun, 09 Nov 2025 10:53:06 GMT
x-middleton-display
integration_verify
content-type
image/gif
vary
Accept-Encoding
px.gif
ad-delivery.net/ 		43 B
134 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ad-delivery.net/px.gif?ch=1&e=0.6367918144406488
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac42:948c -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

x-goog-metageneration
5
access-control-expose-headers
*, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash
crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status
HIT
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3"
age
499287
x-goog-stored-content-encoding
identity
expires
Mon, 03 Nov 2025 16:44:11 GMT
x-goog-stored-content-length
43
date
Sun, 09 Nov 2025 10:53:06 GMT
content-type
image/gif
last-modified
Wed, 05 May 2021 19:25:32 GMT
vary
accept-encoding
x-guploader-uploadid
AAwnv3LS2q6BRDz0udyMq8SGqsPxAD9_9_o6mzrHaQCRyGk0sZz7XK3QmjtCjxaiR2NTdoeX6-0UZCs
cache-control
public, max-age=86400
x-goog-storage-class
MULTI_REGIONAL
cf-ray
99bcc3b0cd117d0b-EWR
accept-ranges
bytes
access-control-allow-origin
*
x-goog-generation
1620242732037093
content-length
43
server
cloudflare
favicon.ico
ad.doubleclick.net/ 		1 KB
129 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.963780951472351
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.16.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bl-in-f149.1e100.net
Software
sffe /
Resource Hash
d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

content-encoding
gzip
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options
nosniff
expires
Mon, 10 Nov 2025 10:53:06 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sun, 09 Nov 2025 10:53:06 GMT
content-type
image/x-icon
vary
Accept-Encoding
last-modified
Tue, 08 May 2012 13:08:06 GMT
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
content-length
104
x-xss-protection
0
server
sffe
px.gif
ad-delivery.net/ 		43 B
117 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ad-delivery.net/px.gif?ch=2&e=0.18257659441574214
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac42:948c -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

x-goog-metageneration
5
access-control-expose-headers
*, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash
crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status
HIT
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3"
age
499288
x-goog-stored-content-encoding
identity
expires
Mon, 03 Nov 2025 16:44:11 GMT
x-goog-stored-content-length
43
date
Sun, 09 Nov 2025 10:53:06 GMT
content-type
image/gif
last-modified
Wed, 05 May 2021 19:25:32 GMT
vary
accept-encoding
x-guploader-uploadid
AAwnv3LS2q6BRDz0udyMq8SGqsPxAD9_9_o6mzrHaQCRyGk0sZz7XK3QmjtCjxaiR2NTdoeX6-0UZCs
cache-control
public, max-age=86400
x-goog-storage-class
MULTI_REGIONAL
cf-ray
99bcc3b13d4a7d0b-EWR
accept-ranges
bytes
access-control-allow-origin
*
x-goog-generation
1620242732037093
content-length
43
server
cloudflare
Tag.engine
econventa.com/ 		2 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://econventa.com/Tag.engine?time=600&id=5ff0fb62-0643-4ff1-aaee-c737f9ffc0e0&rand=65575&ver=async&referrerUrl=&fingerPrint=123&abr=false&stdTime=-600&fpe=1&bw=1600&bh=1200&res=1600x1200&curl=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fzh1io5g5cavqo7l%2FRose%252527s_bot.zip%2Ffile&kw=online%20storage%2Cfree%20storage%2Ccloud%20storage%2Ccollaboration%2Cbackup%20file%20sharing%2Cshare%20files%2Cphoto%20backup%2Cphoto%20sharing%2Cftp%20replacement%2Ccross%20platform%2Cremote%20access%2Cmobile%20access%2Csend%20large%20files%2Crecover%20files%2Cfile%20versioning%2Cundelete%2Cwindows%2Cpc%2Cmac%2Cos%20x%2Clinux%2Ciphone
Requested by
Host: cdn.econventa.com
URL: https://cdn.econventa.com/Scripts/infinity.js.aspx?guid=5ff0fb62-0643-4ff1-aaee-c737f9ffc0e0
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:20::ac43:4551 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e5c5c1dfc824c40c00e2885c5b2b868752d7f2d7696bae2f28ce36d5d81691c0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

content-encoding
gzip
cf-cache-status
DYNAMIC
accept-ch
Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version
cf-ray
99bcc3b179c94225-EWR
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sun, 09 Nov 2025 10:53:06 GMT
content-type
application/json
vary
Accept-Encoding
server
cloudflare
priority
u=3,i=?0
collect
analytics.google.com/g/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://analytics.google.com/g/collect?v=2&tid=G-K68XP6D85D&gtm=45je5b50v887485693z86304663za200zb6304663zd6304663&_p=1762685585140&_gaz=1&gcd=13l3l3l3l1l1&npa=0&dma=0&tcfd=10000&cid=1178700374.1762685586&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&tag_exp=101509157~103116026~103200004~103233427~104527907~104528500~104684208~104684211~104948813~105391252~115480710~115583767~115938466~115938469~116217636~116217638&sid=1762685586&sct=1&seg=0&dl=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fzh1io5g5cavqo7l%2FRose%2527s_bot.zip%2Ffile&dt=Rose%27s%20bot&en=page_view&_fv=1&_nsi=1&_ss=1&up.page_url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fzh1io5g5cavqo7l%2FRose%252527s_bot.zip%2Ffile&tfd=1499
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-K68XP6D85D&cx=c&gtm=4e5b50
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:32::181 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:164:0
report-to
{"group":"ascnsrsggc:164:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:164:0"}],}
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
https://www.mediafire.com
cross-origin-opener-policy-report-only
same-origin; report-to=ascnsrsggc:164:0
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sun, 09 Nov 2025 10:53:06 GMT
content-type
text/plain
server
Golfe2
collect
stats.g.doubleclick.net/g/ 		0
558 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/g/collect?v=2&tid=G-K68XP6D85D&cid=1178700374.1762685586&gtm=45je5b50v887485693z86304663za200zb6304663zd6304663&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=0&tag_exp=101509157~103116026~103200004~103233427~104527907~104528500~104684208~104684211~104948813~105391252~115480710~115583767~115938466~115938469~116217636~116217638
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-K68XP6D85D&cx=c&gtm=4e5b50
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c09::9d Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:132:0
report-to
{"group":"ascnsrsggc:132:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:132:0"}],}
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
https://www.mediafire.com
cross-origin-opener-policy-report-only
same-origin; report-to=ascnsrsggc:132:0
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sun, 09 Nov 2025 10:53:06 GMT
content-type
text/plain
server
Golfe2
sa.go
g.ezoic.net/ 		140 KB
33 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://g.ezoic.net/sa.go
Requested by
Host: www.ezojs.com
URL: https://www.ezojs.com/ezoic/sa.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1f10:4c55:e23d:5d5b:8bb5:8ae2:1fff Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
ed1db5491cbd7a9d8fe7212eb39dc0b71af3c836edd99c8cfff4d2eb17710ad3

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type
text/plain
Referer
https://www.mediafire.com/

Response headers

x-robots-tag
noindex
access-control-max-age
1728000
cache-control
private, max-age=0, must-revalidate, no-cache, no-store
content-encoding
br
access-control-allow-credentials
true
access-control-allow-methods
GET, POST, PUT, OPTIONS
expires
Sat, 08 Nov 2025 10:53:06 GMT
access-control-allow-origin
https://www.mediafire.com
date
Sun, 09 Nov 2025 10:53:06 GMT
content-type
text/javascript
vary
Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
access-control-allow-headers
Content-Type
truncated
/ Frame B200 		2 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
0dcae222606cf25659d185a62f2fcd41caf42f6dd3d9dda50eda1f281e304065

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

Content-Type
text/html;charset=UTF-8
24px.svg
fonts.gstatic.com/s/i/productlogos/translate/v14/ 		6 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://fonts.gstatic.com/s/i/productlogos/translate/v14/24px.svg
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c23::5e Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ab5c23a05e39deed14d9d8262b0dce9f024f86105a27196cad37d14a3f516e09
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

content-encoding
gzip
age
233634
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Fri, 06 Nov 2026 17:59:12 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Thu, 06 Nov 2025 17:59:12 GMT
last-modified
Wed, 20 Apr 2022 14:24:23 GMT
content-type
image/svg+xml
vary
Accept-Encoding
cache-control
public, max-age=31536000
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
3340
x-xss-protection
0
server
sffe
googlelogo_color_42x16dp.png
www.gstatic.com/images/branding/googlelogo/1x/ 		910 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.gstatic.com/images/branding/googlelogo/1x/googlelogo_color_42x16dp.png
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c0b::5e Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
6318394f737c66f0e2ccfcd88e3935c6667633a1b95fa29fba2b75431d55eef2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

age
4984
report-to
{"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
x-content-type-options
nosniff
expires
Mon, 09 Nov 2026 09:30:02 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sun, 09 Nov 2025 09:30:02 GMT
last-modified
Thu, 02 Nov 2023 22:48:00 GMT
content-type
image/png
vary
Origin
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="static-on-bigtable"
content-length
910
x-xss-protection
0
server
sffe
translate_24dp.png
www.gstatic.com/images/branding/product/2x/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.gstatic.com/images/branding/product/2x/translate_24dp.png
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.2f3WBw8L4SI.L.W.O/am=AAAD/d=0/rs=AN8SPfpxZ_PDqjwQqfIDlbJ_9iabaVfvFA/m=el_main_css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c0b::5e Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
4dac0026fbfa2615dce30c0af12830863fe885f84387a0147b9e338f548d5d82
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.2f3WBw8L4SI.L.W.O/am=AAAD/d=0/rs=AN8SPfpxZ_PDqjwQqfIDlbJ_9iabaVfvFA/m=el_main_css

Response headers

age
4984
report-to
{"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
x-content-type-options
nosniff
expires
Mon, 09 Nov 2026 09:30:02 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sun, 09 Nov 2025 09:30:02 GMT
last-modified
Thu, 14 Oct 2021 09:08:00 GMT
content-type
image/png
vary
Origin
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="static-on-bigtable"
content-length
1842
x-xss-protection
0
server
sffe
jellyfish.js
go.ezodn.com/porpoiseant/ 		23 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://go.ezodn.com/porpoiseant/jellyfish.js?a=a&cb=18&dcb=195-13&shcb=34
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3037::6815:574f -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
46468ec4089d4bea3f0e0811eea2d9e9cde6305118df0673d2972d290f1d00f0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

x-robots-tag
noindex, follow
content-encoding
br
cf-cache-status
HIT
age
949969
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=77wYSyi8UhldrjPXVeZrTTKUXAb645Fj%2FoNexfq4mtTxmRn3%2BIByCaumBhQmubdTU%2Bxs%2FdkNStYaE0k6Y%2BEnzzDzBHPXL441f%2FX3WiY8TnhD%2B%2BwCMBk8Eg%3D%3D"}]}
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sun, 09 Nov 2025 10:53:06 GMT
x-middleton-display
sol-js
content-type
application/javascript
vary
Accept-Encoding
last-modified
Thu, 16 Oct 2025 15:09:49 GMT
priority
u=3,i=?0
cache-control
public, max-age=31536000
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray
99bcc3b28f1e4693-EWR
server
cloudflare
sidebarwall.js
go.ezodn.com/detroitchicago/ 		9 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://go.ezodn.com/detroitchicago/sidebarwall.js?gcb=13&cb=22
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3037::6815:574f -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c46112b521d8782f9ace52b74a86041d1378ad4ce71b94a8e6870f2823cadf94

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

x-robots-tag
noindex, follow
content-encoding
br
cf-cache-status
HIT
age
1040562
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=yxb6dImmw6pW%2FIKNpsxJT98UyA5Qx7bePEegclYyaYiJgUSrkoQ7JZUOLpY4jXuw6bvP5IZkBGEKCw17fa0sPym85ViMgghZiCNNPP5ti5W%2BUhtjhWYTMw%3D%3D"}]}
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sun, 09 Nov 2025 10:53:06 GMT
x-middleton-display
sol-js
content-type
application/javascript
vary
Accept-Encoding
last-modified
Wed, 22 Oct 2025 22:23:13 GMT
priority
u=3,i=?0
cache-control
public, max-age=31536000
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray
99bcc3b28f1f4693-EWR
server
cloudflare
ezadcreator.js
go.ezodn.com/porpoiseant/ 		11 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://go.ezodn.com/porpoiseant/ezadcreator.js?gcb=195-13&cb=808
Requested by
Host:
URL: ez-standalone.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3037::6815:574f -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c818e16bc6f5bdd6be3ec1a4506a787bd7f1fa6cb7c5a15db07516f373d16d9b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

x-robots-tag
noindex, follow
content-encoding
br
cf-cache-status
HIT
age
125083
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=DrrWLrNkvM%2F7EUoqTWY1rVnxl8MNYtBFWHqave6MsIM74TPDkjIgC5tFv3FjKJ9osr8IF1Zl6cdZ45Ux3M78B9ifG1MoxGSxoPyHEgRqH8yFXwinvf8R2Q%3D%3D"}]}
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sun, 09 Nov 2025 10:53:06 GMT
x-middleton-display
sol-js
content-type
application/javascript
vary
Accept-Encoding
last-modified
Sat, 08 Nov 2025 00:08:22 GMT
priority
u=3,i=?0
cache-control
public, max-age=31536000
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray
99bcc3b28f204693-EWR
server
cloudflare
gpt.js
securepubads.g.doubleclick.net/tag/js/ 		110 KB
34 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/tag/js/gpt.js
Requested by
Host:
URL: ez-standalone.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c21::9b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
1235cf3868c73a8ec94a47dd99325637a5571d430e87d58401e9c6e4ff394a45
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

content-encoding
br
etag
700 / 20401 / 31095648 / config-hash: 853804471933052373
x-content-type-options
nosniff
expires
Sun, 09 Nov 2025 10:53:06 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sun, 09 Nov 2025 10:53:06 GMT
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
content-disposition
attachment; filename="f.txt"
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
content-length
34748
x-xss-protection
0
server
cafe
tuscon.js
go.ezodn.com/detroitchicago/ 		7 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://go.ezodn.com/detroitchicago/tuscon.js?gcb=13&cb=14
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3037::6815:574f -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
50fbbe164918e6fb86e26b49d99c193d1c36ec6bbf9a51b9967ca74f2282ccde

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

x-robots-tag
noindex, follow
content-encoding
br
cf-cache-status
HIT
age
601268
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=4PcdGtq12sBTLB%2BqGsuWxTe1DATJwzUb0eptrQlfEN4bQDAiyDA1O6Y0sHUG1s2a%2BctSwCSvJ6mbenbiQQQ%2FLz13J%2BIxLIKVOHafIOUEj%2BCCW9KtPTCzow%3D%3D"}]}
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sun, 09 Nov 2025 10:53:06 GMT
x-middleton-display
sol-js
content-type
application/javascript
vary
Accept-Encoding
last-modified
Thu, 16 Oct 2025 15:07:48 GMT
priority
u=3,i=?0
cache-control
public, max-age=31536000
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray
99bcc3b29f214693-EWR
server
cloudflare
kenai.js
go.ezodn.com/detroitchicago/ 		16 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://go.ezodn.com/detroitchicago/kenai.js?gcb=13&cb=301a848234
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3037::6815:574f -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
81941d9798c90799ffb82dcc0bc90d36612a447d3de901c7a22109806b421807

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

x-robots-tag
noindex, follow
content-encoding
br
cf-cache-status
HIT
age
962887
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=QcfOvhGyKkMtVSOJUyMMKOCzXytZizXTTW2ocM9vB1H1anQQoyv6LQcjJHcUhWVzn4hkxi7lr4SChHcKNxulI6mwkWxOiCNvd8FFyEdHHal498u7FFVv2A%3D%3D"}]}
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sun, 09 Nov 2025 10:53:06 GMT
x-middleton-display
sol-js
content-type
application/javascript
vary
Accept-Encoding
last-modified
Fri, 10 Oct 2025 17:39:00 GMT
priority
u=3,i=?0
cache-control
public, max-age=31536000
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray
99bcc3b29f224693-EWR
server
cloudflare
portland.js
go.ezodn.com/detroitchicago/ 		217 KB
46 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://go.ezodn.com/detroitchicago/portland.js?gcb=13&cb=94dc0f4f79
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3037::6815:574f -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d6012d5a18f33f8846ac4b536bb591a82274c8906237d252299d90e664836f4e

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

x-robots-tag
noindex, follow
content-encoding
br
cf-cache-status
HIT
age
128876
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=q3wb7F1qdFWB0U0XvikamuUZ7FBYZJwxT0qprLF1%2BdfjUSzroXZEUKCmU6ZGAfcclz5iw0C3RapziLOetCKYgQMsJOCnFtu9BcyeqxAJhIMLgkMzZdB65w%3D%3D"}]}
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sun, 09 Nov 2025 10:53:06 GMT
x-middleton-display
sol-js
content-type
application/javascript
vary
Accept-Encoding
last-modified
Fri, 07 Nov 2025 23:04:40 GMT
priority
u=3,i=?0
cache-control
public, max-age=31536000
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray
99bcc3b29f234693-EWR
server
cloudflare
dall.js
go.ezodn.com/hb/ 		793 KB
234 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://go.ezodn.com/hb/dall.js?cb=195-13-135
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3037::6815:574f -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
949c848844b8376179ced65ad92c21360c3593420a3e0a7a58678ae4dd119df0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

server
cloudflare
cache-control
public, max-age=31536000
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-encoding
br
cf-cache-status
HIT
age
140253
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=USZhINXny90%2FfWabd3Ho3Ua4DK4Xcdn7dSI8%2BGmtgcArJZPiC9wZB6UMWgoLKhBXDckUpcoY9Ll5e2CYksDC3OnK5UG9HENZD7MdbVSlwhXiuvKDTiSS9Q%3D%3D"}]}
cf-ray
99bcc3b29f244693-EWR
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sun, 09 Nov 2025 10:53:06 GMT
last-modified
Fri, 07 Nov 2025 19:55:32 GMT
content-type
application/javascript
vary
Accept-Encoding
priority
u=3,i=?0
augusta.js
go.ezodn.com/detroitchicago/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://go.ezodn.com/detroitchicago/augusta.js?gcb=195-13&cb=49
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3037::6815:574f -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bccb4111eb4c8b10e4cd76ec113f0d8786d91869f5913620ab4d8b7fe4408c44

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

x-robots-tag
noindex, follow
content-encoding
br
cf-cache-status
HIT
age
871442
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=VDv7vgL9Nzcsi0drpuv4LArkC32fnmAezwp58VFKlasE5H4NwRpNxXEf3U4nerCuiD1s4j%2BJvcazPiXoQXNNdM7IAA5Fj2Vvxhke%2F7rAqf6kUHWbpKtzwA%3D%3D"}]}
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sun, 09 Nov 2025 10:53:06 GMT
x-middleton-display
sol-js
content-type
application/javascript
vary
Accept-Encoding
last-modified
Thu, 30 Oct 2025 06:06:45 GMT
priority
u=3,i=?0
cache-control
public, max-age=31536000
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray
99bcc3b29f254693-EWR
server
cloudflare
qubit.js
g.ezoic.net/porpoiseant/ 		6 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://g.ezoic.net/porpoiseant/qubit.js?did=484470
Requested by
Host:
URL: ez-standalone.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1f10:4c55:e23d:5d5b:8bb5:8ae2:1fff Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
546e9b88af3630057667ae1a422f04b1043b4883bffac25be4bea1d8e84fc17c

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

cache-control
max-age=604800, public
content-encoding
br
date
Sun, 09 Nov 2025 10:53:06 GMT
content-type
application/javascript
vary
Accept-Encoding
ezadloadrewarded.js
go.ezodn.com/porpoiseant/ 		215 KB
56 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://go.ezodn.com/porpoiseant/ezadloadrewarded.js?gcb=195-13&cb=808
Requested by
Host:
URL: ez-standalone.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3037::6815:574f -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5ff12e3286ff6a7014e58f2bc0617b332d877d3b6f2913f66f15995efd7b6fac

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

x-robots-tag
noindex, follow
content-encoding
br
cf-cache-status
HIT
age
125051
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=%2BmcBYzkcKi1i3KHh6NALmF00%2BHxzFMtU6J8fEoqJhMRFbs5C3KKKzs6TDScKTUvdQgfF0hzEdwpLFXtiyKoX73Cwwdbb1Qd41L6wDAx7i%2BIBl8HO8NAIfA%3D%3D"}]}
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sun, 09 Nov 2025 10:53:06 GMT
x-middleton-display
sol-js
content-type
application/javascript
vary
Accept-Encoding
last-modified
Sat, 08 Nov 2025 00:08:34 GMT
priority
u=3,i=?0
cache-control
public, max-age=31536000
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray
99bcc3b29f264693-EWR
server
cloudflare
banger.js
go.ezodn.com/porpoiseant/ 		56 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://go.ezodn.com/porpoiseant/banger.js?cb=195-13&bv=451&PageSpeed=off
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3037::6815:574f -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
35db39227832bface3f1eb2f23df430f154e190afcd8239cfddc4bd75cb72f22

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

x-robots-tag
noindex, follow
content-encoding
br
cf-cache-status
HIT
age
1042944
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=Utd7vA8o%2B9gj54UznBGZAVlrRbOG64LF3LjW9jdkV8biKVzA0Rm%2B59HRRf2B5KjdHkKFSXAkZSUlPkeVF0OwThDP933YJRZomwTJX3uBR5Drz1Cg23XVGA%3D%3D"}]}
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sun, 09 Nov 2025 10:53:06 GMT
x-middleton-display
sol-js
content-type
application/javascript
vary
Accept-Encoding
last-modified
Sun, 05 Oct 2025 04:53:01 GMT
priority
u=3,i=?0
cache-control
public, max-age=31536000
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray
99bcc3b29f274693-EWR
server
cloudflare
did-006t.min.js
d-code.liadm.com/ 		135 KB
136 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://d-code.liadm.com/did-006t.min.js
Requested by
Host:
URL: ez-standalone.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2508:3400:1c:2afd:fb00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
afcc45131a73ff6860e6b9bc28ba2fd93e8ec178bf0df3a95240164070401a63

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

cache-control
public,max-age=86400
age
4226
via
1.1 34411558fb3a23efdbbaaddb8a12b574.cloudfront.net (CloudFront)
x-cache
Hit from cloudfront
content-length
138750
x-amz-cf-id
zRcI2hHK5KLVqeaSQp02xf1hternI3vUcmddllZRn9YiuaeOt7h_9w==
date
Sun, 09 Nov 2025 09:42:40 GMT
content-type
application/javascript
x-amz-cf-pop
IAD12-P1
21150.js
link.rubiconproject.com/magnite/ 		2 KB
826 B 		Script
General
Check archive.org
Download Go to
Full URL
https://link.rubiconproject.com/magnite/21150.js
Requested by
Host:
URL: ez-standalone.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:1408:c400:1681::2300 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software
Apache/2.4.65 (Debian) PHP/8.3.24 OpenSSL/3.5.1 / PHP/8.3.24
Resource Hash
045cdffe2577a8720fbe2ca26df9bfc988096023c2c429cd3a3b275f9859507b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

cache-control
max-age=45151
content-encoding
gzip
expires
Sun, 09 Nov 2025 23:25:37 GMT
content-length
606
date
Sun, 09 Nov 2025 10:53:06 GMT
last-modified
Thu, 23 Oct 2025 19:29:44 GMT
x-powered-by
PHP/8.3.24
server
Apache/2.4.65 (Debian) PHP/8.3.24 OpenSSL/3.5.1
content-type
text/javascript;charset=UTF-8
vary
Accept-Encoding
ezoicbwa.png
go.ezodn.com/utilcave_com/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://go.ezodn.com/utilcave_com/ezoicbwa.png
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3037::6815:574f -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
44b848ce1bea5ca25251a1c22058f8df660f1c8161c21ebc13a9ba55ec479d10

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

cache-control
public, max-age=86400
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-cache-status
HIT
age
11999
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=kc26DM9xbfljGbVTawkIneokF3iVBO9PW%2FWFMiMwvyEdO92nu4M85oTNe5GNQ4jzfJ5z32yIos9K%2BVHq3wkA%2FFx6kgBVZN7%2FnCFDLjmoj9z0hYMMqPJdOg%3D%3D"}]}
cf-ray
99bcc3b29f294693-EWR
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
content-length
1331
date
Sun, 09 Nov 2025 10:53:06 GMT
content-type
image/png
vary
Accept-Encoding
server
cloudflare
last-modified
Sat, 08 Nov 2025 08:07:59 GMT
priority
u=3,i
ezadloadhb.js
go.ezodn.com/porpoiseant/ 		32 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://go.ezodn.com/porpoiseant/ezadloadhb.js?gcb=195-13&cb=808
Requested by
Host:
URL: ez-standalone.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3037::6815:574f -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4f32453269c5e10a9745848684624f6155103ffe1d6e7571f652775856766684

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

x-robots-tag
noindex, follow
content-encoding
br
cf-cache-status
HIT
age
125056
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=qAw%2BShSPF8xODGoO%2FikSDwd6AybYqeiu2EWsWBeRXaqFWccpispfD2a%2FDiuCaqX1QomjUfKmZbN6DWfF%2FFGRh0TX5Kb9W%2FoslBCs4Gn6es1wgbBvf4k%2FbA%3D%3D"}]}
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sun, 09 Nov 2025 10:53:06 GMT
x-middleton-display
sol-js
content-type
application/javascript
vary
Accept-Encoding
last-modified
Sat, 08 Nov 2025 00:08:31 GMT
priority
u=3,i=?0
cache-control
public, max-age=31536000
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray
99bcc3b2af2a4693-EWR
server
cloudflare
ezconfig
g.ezoic.net/detroitchicago/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://g.ezoic.net/detroitchicago/ezconfig
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1f10:4c55:e23d:5d5b:8bb5:8ae2:1fff Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.mediafire.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
content-type
access-control-allow-methods
GET, POST, PUT, OPTIONS
access-control-allow-origin
https://www.mediafire.com
access-control-max-age
1728000
content-length
0
date
Sun, 09 Nov 2025 10:53:06 GMT
vary
Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
id5-api.js
cdn.id5-sync.com/api/1.0/ 		112 KB
32 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.id5-sync.com/api/1.0/id5-api.js
Requested by
Host: www.ezojs.com
URL: https://www.ezojs.com/identity.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac42:a937 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d17e84af7ba998526041e90409fec0d80e0bf436fecd99cd94ea4124f1047141
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

x-amz-id-2
zfKXC5INiO3GB8oMF7NVm+YEZa1MleqxNagIgmVMDAo8/3B0vmngL8fMa1sIMHv6YCdxWz9vY2NeLCn+9harnZ4YNlS+1g9xecjWitUUZeU=
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=3600
content-encoding
br
cf-cache-status
HIT
etag
W/"9d3ef6e0b1008a729462806417366a8e"
age
2210
x-amz-request-id
2T4E4DPDH45QD6AF
cf-ray
99bcc3b40f270f61-EWR
date
Sun, 09 Nov 2025 10:53:06 GMT
content-type
text/javascript;charset=utf-8
last-modified
Tue, 04 Nov 2025 08:00:55 GMT
vary
accept-encoding
server
cloudflare
x-amz-server-side-encryption
AES256
ezconfig
g.ezoic.net/detroitchicago/ 		49 B
109 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://g.ezoic.net/detroitchicago/ezconfig
Requested by
Host: www.ezojs.com
URL: https://www.ezojs.com/identity.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1f10:4c55:e23d:5d5b:8bb5:8ae2:1fff Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
50a63bf06dcdc62ce03de6a07d10770dc80cfa47ef2b63db1e9f6a5fbd786a7d

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type
application/json
Referer
https://www.mediafire.com/

Response headers

access-control-max-age
1728000
content-encoding
gzip
access-control-allow-credentials
true
access-control-allow-methods
GET, POST, PUT, OPTIONS
access-control-allow-origin
https://www.mediafire.com
content-length
73
date
Sun, 09 Nov 2025 10:53:06 GMT
content-type
application/json
vary
Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
access-control-allow-headers
Content-Type
ezconfig
g.ezoic.net/detroitchicago/ 		29 B
83 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://g.ezoic.net/detroitchicago/ezconfig
Requested by
Host: www.ezojs.com
URL: https://www.ezojs.com/identity.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1f10:4c55:e23d:5d5b:8bb5:8ae2:1fff Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
893719087a8bc6dcdfabc4e1d54fd6d724953d40da2ad369f8b4fb5f689394d7

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type
application/json
Referer
https://www.mediafire.com/

Response headers

access-control-max-age
1728000
access-control-allow-credentials
true
access-control-allow-methods
GET, POST, PUT, OPTIONS
access-control-allow-origin
https://www.mediafire.com
content-length
29
date
Sun, 09 Nov 2025 10:53:06 GMT
content-type
application/json
vary
Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
access-control-allow-headers
Content-Type
ezconfig
g.ezoic.net/detroitchicago/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://g.ezoic.net/detroitchicago/ezconfig
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1f10:4c55:e23d:5d5b:8bb5:8ae2:1fff Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.mediafire.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
content-type
access-control-allow-methods
GET, POST, PUT, OPTIONS
access-control-allow-origin
https://www.mediafire.com
access-control-max-age
1728000
content-length
0
date
Sun, 09 Nov 2025 10:53:06 GMT
vary
Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
mulvane.js
go.ezodn.com/parsonsmaize/ 		1 KB
1012 B 		Script
General
Check archive.org
Download Go to
Full URL
https://go.ezodn.com/parsonsmaize/mulvane.js?gcb=195-13&cb=e75e48eec0
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3037::6815:574f -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9b41253384e2818bd0f76171d6ffd723d4c85c5e1a69da74f174489cb52a40ce

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

x-robots-tag
noindex, follow
content-encoding
br
cf-cache-status
HIT
age
1044743
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=og7IYE941npvxD5hOCtX8aBcG%2BUQx3Gct%2FguWjqf2UB4JsYOUK9y0mXLGLaZCGw1YCJP7y9kiuCzAWriovr3XYRHnsiiZVGzdNS89ABAqgXcDVzQnSsbfQ%3D%3D"}]}
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sun, 09 Nov 2025 10:53:06 GMT
x-middleton-display
sol-js
content-type
application/javascript
vary
Accept-Encoding
last-modified
Wed, 01 Oct 2025 09:27:55 GMT
priority
u=3,i=?0
cache-control
public, max-age=31536000
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray
99bcc3b35f324693-EWR
content-length
522
server
cloudflare
birmingham.js
go.ezodn.com/detroitchicago/ 		752 B
871 B 		Script
General
Check archive.org
Download Go to
Full URL
https://go.ezodn.com/detroitchicago/birmingham.js?gcb=195-13&cb=539c47377c
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3037::6815:574f -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
30be558393bd8b0585c806a6eaed6d6f5b51d1ca63c0113061dfe35eaa128ce3

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

x-robots-tag
noindex, follow
content-encoding
br
cf-cache-status
HIT
age
1054102
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=VZFX3B9Bpe9No%2BxLO0cJwl98YWNycJfSlMNcUbmfxY2FrTvl2OzVNEcYcfdRGeNr4iXtbwAhqke1pJlzF3XdysKtZGRIDrJDSNWKYM8LKU0ZXUmWtxWXrQ%3D%3D"}]}
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sun, 09 Nov 2025 10:53:06 GMT
x-middleton-display
sol-js
content-type
application/javascript
vary
Accept-Encoding
last-modified
Thu, 09 Oct 2025 18:12:16 GMT
priority
u=3,i=?0
cache-control
public, max-age=31536000
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray
99bcc3b35f334693-EWR
content-length
380
server
cloudflare
ezoicanalytics.js
go.ezodn.com/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://go.ezodn.com/ezoicanalytics.js?cb=1&dcb=195-13&shcb=34
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3037::6815:574f -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e814d50a228f54aecf40d8a58e41d48ce1dfc4376fd5fbedc28078fe0a8c5526

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

x-robots-tag
noindex, follow
content-encoding
br
cf-cache-status
HIT
age
13527
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=4ng9L2wnQgNIvSZ%2FYFKLMOoEm8maLTaDpzcO43nanThHqKIt9sx9OBP%2F3VTYOLvRn%2FH1WzfarISNVtcftF34Aq6V8bCiMOaVys343%2FuLO%2B1j97F6aSMZTg%3D%3D"}]}
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sun, 09 Nov 2025 10:53:06 GMT
x-middleton-display
sol-js
content-type
application/javascript
vary
Accept-Encoding
last-modified
Sat, 08 Nov 2025 09:33:42 GMT
priority
u=3,i=?0
cache-control
public, max-age=86400
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray
99bcc3b35f344693-EWR
server
cloudflare
0
www.mediafiredls.com/onclick/ 		5 B
524 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.mediafiredls.com/onclick/0
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:2ad -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c6c094bc0054f9cbe34102ff49f86b3928b5ac09f3d2ac87e170d0500675921f
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

cache-control
private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-encoding
br
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=hVJ%2FA3ucADyelWv5N8TRPORt%2B%2B4T9RbySSgvHRMWkdGbFYvdj6sfP3%2FCgP4YerLrIigyEk7qkm1pTWx3mIUwun%2Fi9JTwHo2%2FSjgZQFi4hhiBY%2BmFw6QTGnyTgrxBem4%3D"}]}
referrer-policy
same-origin
cf-ray
99bcc3b4090eb734-EWR
expires
Thu, 01 Jan 1970 00:00:01 GMT
access-control-allow-origin
*
date
Sun, 09 Nov 2025 10:53:06 GMT
content-type
text/plain
vary
accept-encoding
server
cloudflare
x-frame-options
SAMEORIGIN
/
bshr.ezodn.com/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://bshr.ezodn.com/?bf=30000&dc=1254144
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3036::ac43:8e79 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type,x-pingback
Access-Control-Request-Method
GET
Origin
https://www.mediafire.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
content-type,x-pingback
access-control-allow-methods
GET, POST, PUT, OPTIONS
access-control-allow-origin
https://www.mediafire.com
access-control-max-age
1728000
alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
99bcc3b4de4b2ef5-EWR
content-length
0
date
Sun, 09 Nov 2025 10:53:06 GMT
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
priority
u=1,i
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=HQufnEtqS8O6aHCKSNpQD87Fb6xoe2%2FesLYQV9sABb8N%2BhMPLWBZHw3stGwHGdZTU1o53s1F8HH6LN2hRPWoqgf1GplL5v8o70Rtbk2PCX3jOkTXsHRF0K96"}]}
server
cloudflare
server-timing
cfExtPri
vary
Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
nmash.js
go.ezodn.com/porpoiseant/ 		65 KB
22 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://go.ezodn.com/porpoiseant/nmash.js?bv=451
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/porpoiseant/banger.js?cb=195-13&bv=451&PageSpeed=off
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3037::6815:574f -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
923c9d6153ab7d3f69fd38564c0a63f4d02dabd800a9d93f10306d1de5d6513d

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

x-robots-tag
noindex, follow
content-encoding
br
cf-cache-status
HIT
age
963556
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=164rIMD%2Bx3znLMdxklWlNbKrpfPVkE8piKxegcRDDqsFGKkXIUC5kZ8sl9dDil%2Fa3EnJ7%2BXTd5YaoVNzGLE5a4HAEu057l7qD%2FU48E73%2FlUnPqGQzX5j%2BQ%3D%3D"}]}
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sun, 09 Nov 2025 10:53:06 GMT
x-middleton-display
sol-js
content-type
application/javascript
vary
Accept-Encoding
last-modified
Sat, 04 Oct 2025 10:52:43 GMT
priority
u=3,i=?0
cache-control
public, max-age=31536000
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray
99bcc3b3af364693-EWR
server
cloudflare
/
bshr.ezodn.com/ 		5 KB
3 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://bshr.ezodn.com/?bf=30000&dc=1254144
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/porpoiseant/banger.js?cb=195-13&bv=451&PageSpeed=off
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3036::ac43:8e79 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a6e1d04a1635eefd471a8a7d496e140154fc383b219156d24c3becfc2fc87cc5

Request headers

Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type
application/json
X-PINGBACK
pingpong

Response headers

access-control-max-age
1728000
content-encoding
br
cf-cache-status
HIT
age
952386
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=2Cp9uqyCkR5g7sLd88RKyXMKEhXc07mgXILNAuxpb06IFzfJEr7A7Xny2%2BgP31hTDESue2Z80IKXFRn5hNWYr1jgJcCNhr0aiRMSh%2BtRoNm7xO3X7ClWf9Nm"}]}
access-control-allow-methods
GET, POST, PUT, OPTIONS
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sun, 09 Nov 2025 10:53:06 GMT
content-type
application/json; charset=utf8
vary
Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
priority
u=1,i
access-control-allow-headers
Content-Type
last-modified
Sun, 05 Oct 2025 08:16:37 GMT
cache-control
public, max-age=1209600
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
access-control-allow-credentials
true
cf-ray
99bcc3b52e4f2ef5-EWR
access-control-allow-origin
https://www.mediafire.com
server
cloudflare
ezjitpos.js
go.ezodn.com/porpoiseant/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://go.ezodn.com/porpoiseant/ezjitpos.js?gcb=195-13&cb=808
Requested by
Host:
URL: ez-standalone.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3037::6815:574f -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d34364518d1fdc1b69ba193a0593a933aac3cc1327f6d36f87f5da9052caf62b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

x-robots-tag
noindex, follow
content-encoding
br
cf-cache-status
HIT
age
125083
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=8lH7zG7mL2zPmK3GeBSMRvyZj3nPTlo6cupp6MVReDYhv5xlkWhzYQgb6DJcH2ZkhVJBpxSAowRmYHYjmnKI2ypAJxvrWu0LMkvi9fOHltTFhp5wOE3gZQ%3D%3D"}]}
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sun, 09 Nov 2025 10:53:06 GMT
x-middleton-display
sol-js
content-type
application/javascript
vary
Accept-Encoding
last-modified
Sat, 08 Nov 2025 00:08:15 GMT
priority
u=3,i=?0
cache-control
public, max-age=31536000
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray
99bcc3b3ef374693-EWR
server
cloudflare
script
carbon-cdn.ccgateway.net/ 		31 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://carbon-cdn.ccgateway.net/script?id=www.mediafire.com&parentId=0dae949f4b
Requested by
Host: link.rubiconproject.com
URL: https://link.rubiconproject.com/magnite/21150.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.212.140.196 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-212-140-196.compute-1.amazonaws.com
Software
/
Resource Hash
8890000c6b81e5c81f0d333f7008b244275a61b934dc6db94ef384d1421c54bb

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

cache-control
private,max-age=900
content-encoding
gzip
date
Sun, 09 Nov 2025 10:53:06 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
indy.js
go.ezodn.com/detroitchicago/ 		301 KB
83 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://go.ezodn.com/detroitchicago/indy.js?cb=74&gcb=0
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3037::6815:574f -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7f596391730ffc1ae1aaa2b67074a27da2706c305f11fa1b1231a2bd9fae289e

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

x-robots-tag
noindex, follow
content-encoding
br
cf-cache-status
HIT
age
201101
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=SzO1tB3KlCTgu9sXlQDMOcmDSlLhbRn1hfDSOY%2FwrIngRDsHPwMVP3d6tbRVUQRhfxDMOxCmW%2FyTiwHn86n%2FdygJ8LlRdDu%2F7OpeLWVV5WrPx6rMKCzwOA%3D%3D"}]}
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sun, 09 Nov 2025 10:53:06 GMT
x-middleton-display
sol-js
content-type
application/javascript
vary
Accept-Encoding
last-modified
Fri, 07 Nov 2025 03:01:24 GMT
priority
u=3,i=?0
cache-control
public, max-age=31536000
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray
99bcc3b44f3a4693-EWR
server
cloudflare
analytics
g.ezoic.net/ezais/ 		14 KB
4 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://g.ezoic.net/ezais/analytics?cb=1
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/ezoicanalytics.js?cb=1&dcb=195-13&shcb=34
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1f10:4c55:e23d:5d5b:8bb5:8ae2:1fff Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
27895cf369160e709d241aec25915f2deea50df26a516fb817c4cc62f4729b04

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type
text/plain
Referer
https://www.mediafire.com/

Response headers

x-robots-tag
noindex
access-control-max-age
1728000
content-encoding
br
access-control-allow-credentials
true
access-control-allow-methods
GET, POST, PUT, OPTIONS
access-control-allow-origin
https://www.mediafire.com
date
Sun, 09 Nov 2025 10:53:06 GMT
content-type
text/plain; charset=utf-8
vary
Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
access-control-allow-headers
Content-Type
json
gum.criteo.com/sid/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.mediafire.com%2F&domain=www.mediafire.com&cw=1&lsw=1&gdpr=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a00b::3d , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
GET
Origin
https://www.mediafire.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
content-type
access-control-allow-methods
GET
access-control-allow-origin
https://www.mediafire.com
cache-control
no-cache, no-store, must-revalidate
content-encoding
gzip
content-type
application/json; charset=utf-8
date
Sun, 09 Nov 2025 10:53:06 GMT
expires
0
pragma
no-cache
server
Kestrel
server-processing-duration-in-ticks
268903
strict-transport-security
max-age=31536000; preload;
vary
Accept-Encoding
latest.json
cdn.jsdelivr.net/gh/prebid/currency-file@1/ 		2 KB
2 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/gh/prebid/currency-file@1/latest.json
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-13-135
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:aee2 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9c6edfb7305332d09b0d4dc3dce7d5566bc16e09539991f3dad93d037e0d9d46
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
content-type
text/plain
Referer
https://www.mediafire.com/

Response headers

access-control-expose-headers
*
content-encoding
br
cf-cache-status
HIT
etag
W/"64c-pDpcaDKEeIWKXnHOZZG8O/QZBz0"
age
23944
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Aof0Hi9i%2BNNx9IlXs97vYjd8sUn%2FU%2FqnS%2BpdSp7JzlcJ%2BT%2BU0OE58EeZu4pm%2BcK1mXvUQby0o%2BqFv1lGxgJpuvLGohURevHWuZH%2FzOJKw2E7NtRHinn167ymtm1c9z5jHV5WYnAS4qhCp6GsFik%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
x-jsd-version-type
version
alt-svc
h3=":443"; ma=86400
x-cache
HIT, HIT
date
Sun, 09 Nov 2025 10:53:07 GMT
content-type
application/json; charset=utf-8
x-served-by
cache-fra-etou8220102-FRA, cache-iad-kiad7000024-IAD
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
public, max-age=604800, s-maxage=43200
timing-allow-origin
*
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy
cross-origin
cf-ray
99bcc3b70b507ce8-EWR
accept-ranges
bytes
access-control-allow-origin
*
content-length
856
server
cloudflare
x-jsd-version
1.0.2604
envelope
lexicon.33across.com/v1/ 		2 KB
2 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://lexicon.33across.com/v1/envelope?pid=0010b00002MpnPqAAJ&gdpr=0&src=pbjs&ver=10.14.0&coppa=0
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-13-135
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
37.19.206.163 Ashburn, United States, ASN60068 (CDN77 Datacamp Limited, GB),
Reverse DNS
unn-37-19-206-163.datapacket.com
Software
/
Resource Hash
9d431a83a03e924ac1a1afa9cb3e75ef35dec2e51784bb68f3d34fda527143bf

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
content-type
text/plain
Referer
https://www.mediafire.com/

Response headers

access-control-allow-origin
https://www.mediafire.com
content-length
1636
content-type
application/json
vary
origin
access-control-allow-credentials
true
set
id.a-mx.com/
Redirect Chain
  • https://id.a-mx.com/sync/?tagId=&ref=null&u=https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file&tl=https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file&nf=0&rt=...
  • https://c3.a-mo.net/b?uid=1776ef42-7a13-465b-8e3b-9082f65aba5b&sh=id.a-mx.com&
  • https://id.a-mx.com/set?oid=1776ef42-7a13-465b-8e3b-9082f65aba5b&uid=1776ef42-7a13-465b-8e3b-9082f65aba5b&
99 B
957 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://id.a-mx.com/set?oid=1776ef42-7a13-465b-8e3b-9082f65aba5b&uid=1776ef42-7a13-465b-8e3b-9082f65aba5b&
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
HTTP/1.1
Server
138.199.41.120 New York, United States, ASN60068 (CDN77 Datacamp Limited, GB),
Reverse DNS
unn-138-199-41-120.datapacket.com
Software
/
Resource Hash
0af95d67b93560269da520b2de788733a368bb8fec764e7d49cef92b468d51ce

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

access-control-allow-origin
null
content-length
99
date
Sun, 9 Nov 2025 10:53:06 GMT
content-type
application/json
access-control-allow-credentials
true

Redirect headers

access-control-allow-origin
null
location
https://id.a-mx.com/set?oid=1776ef42-7a13-465b-8e3b-9082f65aba5b&uid=1776ef42-7a13-465b-8e3b-9082f65aba5b&
content-length
0
date
Sun, 9 Nov 2025 10:53:06 GMT
access-control-allow-credentials
true
fed
ups.analytics.yahoo.com/ups/58713/ 		0
415 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ups.analytics.yahoo.com/ups/58713/fed?v=1&1p=0&gdpr=0&gdpr_consent=&us_privacy=&url=https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file&pixelId=58713
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-13-135
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4998:14:800::1000 , United States, ASN14777 (YAHOO, US),
Reverse DNS
Software
ATS /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
content-type
text/plain
Referer
https://www.mediafire.com/

Response headers

strict-transport-security
max-age=31536000
age
0
access-control-allow-credentials
true
x-content-type-options
nosniff
referrer-policy
no-referrer-when-downgrade
access-control-allow-origin
https://www.mediafire.com
content-length
0
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date
Sun, 09 Nov 2025 10:53:07 GMT
content-type
application/json
vary
Origin
server
ATS
sid
mug.criteo.com/
Redirect Chain
  • https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.mediafire.com%2F&domain=www.mediafire.com&cw=1&lsw=1&gdpr=0
  • https://mug.criteo.com/sid?cpp=-L4zFnxHdGhWc0R6NU9rZ3o0ejZ0TDNPVDduRTdTYUpsdXhGZ2pxOVluNU8vWWgwS0hsRjVKSzVWMTF5bWtId3VwYWZuVUFGTGdQMTJwYTJud0RNN3I0NWMyU0tZTXNoS1FHRWxCSktHdmhiVy8ydjhLck5xd0J5cExKV2...
357 B
929 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://mug.criteo.com/sid?cpp=-L4zFnxHdGhWc0R6NU9rZ3o0ejZ0TDNPVDduRTdTYUpsdXhGZ2pxOVluNU8vWWgwS0hsRjVKSzVWMTF5bWtId3VwYWZuVUFGTGdQMTJwYTJud0RNN3I0NWMyU0tZTXNoS1FHRWxCSktHdmhiVy8ydjhLck5xd0J5cExKV2tMYjhFcHhkM3o0ZkxhVWQ1dnR4WkRyN2dHNU45U3NZK0tHM0RwOFF4UFovK0RCU3grcGs3UENyQjNVclRyUmhLVHluTktPZmRwcCthaHc2Q0xraENZdSsrMkhWTUs1aW9aU0VDNXA1TmIwNVhXQnM4allFeFFrWjh3bk5TZlBOUUNXTFFqKy9PfA&cppv=2
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H2
Server
74.119.117.62 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
df4523ddcd305ecbe557879564a20eb7209260523a1f19f0ba973d7579a4885e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

strict-transport-security
max-age=31536000; preload;
cache-control
no-cache, no-store, must-revalidate
content-encoding
gzip
pragma
no-cache
access-control-allow-credentials
true
access-control-allow-methods
GET
server-processing-duration-in-ticks
652804
expires
0
access-control-allow-origin
null
date
Sun, 09 Nov 2025 10:53:07 GMT
content-type
application/json; charset=utf-8
vary
Accept-Encoding
server
Kestrel

Redirect headers

strict-transport-security
max-age=31536000; preload;
cache-control
no-cache, no-store, must-revalidate
location
https://mug.criteo.com/sid?cpp=-L4zFnxHdGhWc0R6NU9rZ3o0ejZ0TDNPVDduRTdTYUpsdXhGZ2pxOVluNU8vWWgwS0hsRjVKSzVWMTF5bWtId3VwYWZuVUFGTGdQMTJwYTJud0RNN3I0NWMyU0tZTXNoS1FHRWxCSktHdmhiVy8ydjhLck5xd0J5cExKV2tMYjhFcHhkM3o0ZkxhVWQ1dnR4WkRyN2dHNU45U3NZK0tHM0RwOFF4UFovK0RCU3grcGs3UENyQjNVclRyUmhLVHluTktPZmRwcCthaHc2Q0xraENZdSsrMkhWTUs1aW9aU0VDNXA1TmIwNVhXQnM4allFeFFrWjh3bk5TZlBOUUNXTFFqKy9PfA&cppv=2
pragma
no-cache
access-control-allow-credentials
true
access-control-allow-methods
GET
server-processing-duration-in-ticks
350660
expires
0
access-control-allow-origin
https://www.mediafire.com
content-length
0
date
Sun, 09 Nov 2025 10:53:06 GMT
server
Kestrel
d9core
d9.flashtalking.com/ 		11 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://d9.flashtalking.com/d9core
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-13-135
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
100.24.186.222 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-100-24-186-222.compute-1.amazonaws.com
Software
Apache/2.4.59 (Amazon Linux) OpenSSL/3.0.8 /
Resource Hash
7871780d48bd635be91dd8ab36bdcb632e07c0c94cd0d36ebe60f97412fb6de1

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

cache-control
private, must-revalidate, proxy-revalidate, max-age=172800
etag
5bc31bf7d4a298e1bef9d35fce222bfc
access-control-allow-credentials
true
access-control-allow-methods
GET,POST,SERVER
access-control-allow-origin
d9.flashtalking.com
p3p
policyref="localhost/w3c/D9_p3p_.xml", CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"
date
Sun, 09 Nov 2025 10:53:07 GMT
content-type
application/javascript;charset=utf-8
server
Apache/2.4.59 (Amazon Linux) OpenSSL/3.0.8
pbhid
id.hadron.ad.gt/api/v1/ 		227 B
357 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://id.hadron.ad.gt/api/v1/pbhid?partner_id=524&_it=prebid&t=1&src=id&domain=www.mediafire.com&gdpr=0
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-13-135
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:2396 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7d0d5581c216a6d698f0e57d6f39895da9e8069b49abe21e5311b3f05468d5b6

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
content-type
text/plain
Referer
https://www.mediafire.com/

Response headers

content-encoding
br
access-control-allow-methods
GET, POST, OPTIONS
allow
POST, OPTIONS, GET
cf-ray
99bcc3b73c34c463-EWR
access-control-allow-origin
*
date
Sun, 09 Nov 2025 10:53:07 GMT
content-type
application/json
vary
accept-encoding
server
cloudflare
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, *
prebid
id5-sync.com/api/config/ 		194 B
655 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://id5-sync.com/api/config/prebid
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-13-135
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.95.33.120 , Germany, ASN16276 (OVH OVH SAS, FR),
Reverse DNS
ns3203256.ip-141-95-33.eu
Software
/
Resource Hash
446a24acf9272b37cf14bf847684201154b6648113a148f1381b7489db6294f3
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8
Referer
https://www.mediafire.com/

Response headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
content-encoding
gzip
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
p3p
CP="CAO PSA OUR"
date
Sun, 09 Nov 2025 10:53:06 GMT
content-type
application/json;charset=UTF-8
vary
origin,access-control-request-method,access-control-request-headers,accept-encoding
id5PrebidModule.js
cdn.id5-sync.com/api/1.0/ 		97 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.id5-sync.com/api/1.0/id5PrebidModule.js
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-13-135
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac42:a937 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8d0380a2602ecc27249a4264bf13382b9f579bce5fb60c3e4a02a033cd4078dd
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

x-amz-id-2
rIK19rW1ZUqIAoBi2WfIiRVcmesAqQPJfgYH8WkrDfmhat37TKijdMmGqpMjVqS/UG/pLsa9FIw=
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=3600
content-encoding
br
cf-cache-status
HIT
etag
W/"b1b0e6d7b1e5e1c98c1bc67f13b69f85"
age
3242
x-amz-request-id
22G0Y7D2MFTPD4VM
cf-ray
99bcc3b689c70f61-EWR
date
Sun, 09 Nov 2025 10:53:06 GMT
content-type
text/javascript;charset=utf-8
last-modified
Tue, 04 Nov 2025 08:00:55 GMT
vary
accept-encoding
server
cloudflare
x-amz-server-side-encryption
AES256
envelope
api.rlcdn.com/api/identity/ 		0
280 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://api.rlcdn.com/api/identity/envelope?pid=14067
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-13-135
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.107.165.188 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
188.165.107.34.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
content-type
text/plain
Referer
https://www.mediafire.com/

Response headers

cache-control
no-cache, no-store
timing-allow-origin
*
access-control-allow-credentials
true
access-control-allow-methods
GET, OPTIONS
via
1.1 google
access-control-allow-origin
https://www.mediafire.com
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sun, 09 Nov 2025 10:53:07 GMT
access-control-allow-headers
Accept, Authorization, Content-Type, Cookie, Origin, X-Requested-With
id
id.crwdcntrl.net/ 		152 B
907 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://id.crwdcntrl.net/id?gdpr_applies=false
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-13-135
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.89.30.34 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-89-30-34.compute-1.amazonaws.com
Software
/
Resource Hash
b06b7e01b88155274071a175c1f887e315afe0efcb976d165bd88f293f83f3e0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000 ; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
content-type
text/plain
Referer
https://www.mediafire.com/

Response headers

strict-transport-security
max-age=31536000 ; includeSubDomains
cache-control
no-cache
pragma
no-cache
access-control-allow-credentials
true
expires
0
access-control-allow-origin
https://www.mediafire.com
p3p
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length
152
date
Sun, 09 Nov 2025 10:53:07 GMT
content-type
application/json;charset=utf-8
UCookieSetPug
image6.pubmatic.com/AdServer/ 		0
265 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=5&p=156983&publisherId=156983&gdpr=0&gdpr_consent=&src=pbjs_uid&ver=1&coppa=0&us_privacy=&gpp=&gpp_sid=
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-13-135
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
8.28.7.81 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=16070400; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
content-type
text/plain
Referer
https://www.mediafire.com/

Response headers

strict-transport-security
max-age=16070400; includeSubDomains
cache-control
no-cache, no-store, must-revalidate
access-control-allow-origin
https://www.mediafire.com
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date
Sun, 09 Nov 2025 10:53:07 GMT
content-type
text/html; charset=UTF-8
access-control-allow-credentials
true
rid
match.adsrvr.org/track/ 		109 B
574 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://match.adsrvr.org/track/rid?ttd_pid=muno13d&fmt=json
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-13-135
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.33.220.150 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a12b7a488abeaa9e4.awsglobalaccelerator.com
Software
Kestrel /
Resource Hash
0192b6a72305c64520e6d5a6e07912cf2aff915d4c6279148a7eac5d1e3e6d60

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
content-type
text/plain
Referer
https://www.mediafire.com/

Response headers

cache-control
private
content-encoding
gzip
access-control-allow-credentials
true
expires
Tue, 09 Dec 2025 10:53:07 GMT
access-control-allow-origin
https://www.mediafire.com
date
Sun, 09 Nov 2025 10:53:07 GMT
content-type
application/json
vary
Origin,Accept-Encoding
server
Kestrel
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept, x-integration-type
any
idx.liadm.com/idex/did-006t/ 		0
372 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://idx.liadm.com/idex/did-006t/any?duid=a738c2fb6c00--01k9m3z368kp41czwphh8wkwmd&gdpr=0&did=did-006t&cd=.mediafire.com&pu=https%3A%2F%2Fwww.mediafire.com&resolve=nonId&resolve=uid2&resolve=bidswitch&resolve=medianet&resolve=magnite&resolve=pubmatic&resolve=index&resolve=openx&resolve=thetradedesk&resolve=sovrn&resolve=vidazoo&resolve=sonobi&resolve=sharethrough&resolve=triplelift&resolve=nexxen&resolve=zetassp
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-13-135
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.221.183.211 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-221-183-211.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
content-type
text/plain
Referer
https://www.mediafire.com/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
cache-control
max-age=3599, private
trace-id
f254af84bb01e65b
request-time
2
access-control-allow-credentials
true
expires
Sun, 09 Nov 2025 11:53:07 GMT
access-control-allow-origin
https://www.mediafire.com
date
Sun, 09 Nov 2025 10:53:07 GMT
vary
Origin
px.gif
ad-delivery.net/ 		43 B
111 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ad-delivery.net/px.gif?ch=2&e=0.3859993667360112
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac42:948c -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

x-goog-metageneration
5
access-control-expose-headers
*, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash
crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status
HIT
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3"
age
499288
x-goog-stored-content-encoding
identity
expires
Mon, 03 Nov 2025 16:44:11 GMT
x-goog-stored-content-length
43
date
Sun, 09 Nov 2025 10:53:06 GMT
content-type
image/gif
last-modified
Wed, 05 May 2021 19:25:32 GMT
vary
accept-encoding
x-guploader-uploadid
AAwnv3LS2q6BRDz0udyMq8SGqsPxAD9_9_o6mzrHaQCRyGk0sZz7XK3QmjtCjxaiR2NTdoeX6-0UZCs
cache-control
public, max-age=86400
x-goog-storage-class
MULTI_REGIONAL
cf-ray
99bcc3b6bf4e7d0b-EWR
accept-ranges
bytes
access-control-allow-origin
*
x-goog-generation
1620242732037093
content-length
43
server
cloudflare
favicon.ico
ad.doubleclick.net/ 		1 KB
129 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.23990621999234707
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.16.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bl-in-f149.1e100.net
Software
sffe /
Resource Hash
d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

content-encoding
gzip
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options
nosniff
expires
Mon, 10 Nov 2025 10:53:06 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sun, 09 Nov 2025 10:53:06 GMT
content-type
image/x-icon
vary
Accept-Encoding
last-modified
Tue, 08 May 2012 13:08:06 GMT
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
content-length
104
x-xss-protection
0
server
sffe
px.gif
ad-delivery.net/ 		43 B
111 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ad-delivery.net/px.gif?ch=1&e=0.1627123905874407
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac42:948c -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

x-goog-metageneration
5
access-control-expose-headers
*, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash
crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status
HIT
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3"
age
499288
x-goog-stored-content-encoding
identity
expires
Mon, 03 Nov 2025 16:44:11 GMT
x-goog-stored-content-length
43
date
Sun, 09 Nov 2025 10:53:06 GMT
content-type
image/gif
last-modified
Wed, 05 May 2021 19:25:32 GMT
vary
accept-encoding
x-guploader-uploadid
AAwnv3LS2q6BRDz0udyMq8SGqsPxAD9_9_o6mzrHaQCRyGk0sZz7XK3QmjtCjxaiR2NTdoeX6-0UZCs
cache-control
public, max-age=86400
x-goog-storage-class
MULTI_REGIONAL
cf-ray
99bcc3b6bf517d0b-EWR
accept-ranges
bytes
access-control-allow-origin
*
x-goog-generation
1620242732037093
content-length
43
server
cloudflare
dns
ab.dns-finder.com/meta/ 		2 B
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ab.dns-finder.com/meta/dns
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.36.200.111 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
111.200.36.34.bc.googleusercontent.com
Software
/
Resource Hash
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

cache-control
private, max-age=180, stale-if-error=180, stale-while-revalidate=180
access-control-expose-headers
X-Resolver
x-resolver
default
via
1.1 google
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
2
date
Sun, 09 Nov 2025 10:53:05 GMT
content-type
text/plain; charset=utf-8
vary
Origin
sync-container
i.liadm.com/ Frame 45F9 		162 B
569 B 		Document
General
Check archive.org
Download Go to
Full URL
https://i.liadm.com/sync-container?duid=a738c2fb6c00--01k9m3z368kp41czwphh8wkwmd&ds=did-006t&euns=1&s=&version=v3.13.1&cd=.mediafire.com&pv=b5a00f56-1f22-43fe-84ee-484bf753880b
Requested by
Host: d-code.liadm.com
URL: https://d-code.liadm.com/did-006t.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.54.41.155 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-54-41-155.compute-1.amazonaws.com
Software
/
Resource Hash
40092961c1ff1439f1e452cfd24fd924c4caa6f12323895a159e43f6158cdef0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.mediafire.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

Cache-Control
private, no-cache, max-age=0
Connection
keep-alive
Content-Length
162
Content-Type
text/html; charset=UTF-8
Date
Sun, 09 Nov 2025 10:53:07 GMT
Request-Time
0
Strict-Transport-Security
max-age=31536000; includeSubDomains
trace-id
fa129410f6e2c0fb
olathe.js
g.ezoic.net/parsonsmaize/ 		2 KB
960 B 		Script
General
Check archive.org
Download Go to
Full URL
https://g.ezoic.net/parsonsmaize/olathe.js?gcb=195-13&cb=30
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1f10:4c55:e23d:5d5b:8bb5:8ae2:1fff Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
3cefef7fc952707c97375ef3fa95a8c45a96eda7845d02bc1c28bf3570c0cfba

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

x-robots-tag
noindex, follow
cache-control
max-age=31536000, public
content-encoding
br
date
Sun, 09 Nov 2025 10:53:07 GMT
x-middleton-display
sol-js
content-type
application/javascript
vary
Accept-Encoding
et.js
g.ezoic.net/porpoiseant/ 		1 KB
602 B 		Script
General
Check archive.org
Download Go to
Full URL
https://g.ezoic.net/porpoiseant/et.js?gcb=195-13&cb=3
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1f10:4c55:e23d:5d5b:8bb5:8ae2:1fff Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
0f67393986c012dbf48aa3149e2874bd84ed5f466362ad1ac31305f697f1da7b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

x-robots-tag
noindex, follow
cache-control
max-age=31536000, public
content-encoding
br
content-length
571
date
Sun, 09 Nov 2025 10:53:07 GMT
x-middleton-display
sol-js
content-type
application/javascript
vary
Accept-Encoding
reno.js
g.ezoic.net/detroitchicago/ 		2 KB
601 B 		Script
General
Check archive.org
Download Go to
Full URL
https://g.ezoic.net/detroitchicago/reno.js?gcb=195-13&cb=45171a0f72
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1f10:4c55:e23d:5d5b:8bb5:8ae2:1fff Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
6896b59e8034378b31284eea779e568986c0337a8eb3e648efbf52fd8d5d3781

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

x-robots-tag
noindex, follow
cache-control
max-age=31536000, public
content-encoding
br
content-length
570
date
Sun, 09 Nov 2025 10:53:07 GMT
x-middleton-display
sol-js
content-type
application/javascript
vary
Accept-Encoding
overlandpark.js
g.ezoic.net/detroitchicago/ 		1 KB
519 B 		Script
General
Check archive.org
Download Go to
Full URL
https://g.ezoic.net/detroitchicago/overlandpark.js?gcb=195-13&cb=301bbdaf04
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1f10:4c55:e23d:5d5b:8bb5:8ae2:1fff Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
8b3a000db28359e0512e1484988806b9cdaeb457e29ef6b82bfe097e6eed3231

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

x-robots-tag
noindex, follow
cache-control
max-age=31536000, public
content-encoding
br
content-length
488
date
Sun, 09 Nov 2025 10:53:07 GMT
x-middleton-display
sol-js
content-type
application/javascript
vary
Accept-Encoding
denver.js
g.ezoic.net/detroitchicago/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://g.ezoic.net/detroitchicago/denver.js?gcb=195-13&cb=4ff75c6f00
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1f10:4c55:e23d:5d5b:8bb5:8ae2:1fff Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
3b9ffd186b78d9ad93b8f8f63b927976df2c98d29ecf5186c18b80d645cfd134

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

x-robots-tag
noindex, follow
cache-control
max-age=31536000, public
content-encoding
br
date
Sun, 09 Nov 2025 10:53:07 GMT
x-middleton-display
sol-js
content-type
application/javascript
vary
Accept-Encoding
wichita.js
g.ezoic.net/detroitchicago/ 		2 KB
982 B 		Script
General
Check archive.org
Download Go to
Full URL
https://g.ezoic.net/detroitchicago/wichita.js?gcb=195-13&cb=e49d8d9bca
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1f10:4c55:e23d:5d5b:8bb5:8ae2:1fff Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
b837449c7254dd5887b620b7903bb4dbafbf2424ae3eb25e7a9f3471ff105365

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

x-robots-tag
noindex, follow
cache-control
max-age=31536000, public
content-encoding
br
date
Sun, 09 Nov 2025 10:53:07 GMT
x-middleton-display
sol-js
content-type
application/javascript
vary
Accept-Encoding
vitals.js
g.ezoic.net/tardisrocinante/ 		11 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://g.ezoic.net/tardisrocinante/vitals.js?gcb=13&cb=5
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1f10:4c55:e23d:5d5b:8bb5:8ae2:1fff Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
6fca1361d81b8d8d05afbe947e257aef026891372b45e0d2de123a907a4ed1af

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

x-robots-tag
noindex, follow
cache-control
max-age=31536000, public
content-encoding
br
date
Sun, 09 Nov 2025 10:53:07 GMT
x-middleton-display
sol-js
content-type
application/javascript
vary
Accept-Encoding
drake.js
g.ezoic.net/beardeddragon/ 		4 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://g.ezoic.net/beardeddragon/drake.js?gcb=13&cb=1b0a0a9dcc
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1f10:4c55:e23d:5d5b:8bb5:8ae2:1fff Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
a5e87590d9232e0b0be4c640eeb47cb4f4299af754f195c802d49fe380ea1870

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

x-robots-tag
noindex, follow
cache-control
max-age=31536000, public
content-encoding
br
date
Sun, 09 Nov 2025 10:53:07 GMT
x-middleton-display
sol-js
content-type
application/javascript
vary
Accept-Encoding
chanute.js
g.ezoic.net/parsonsmaize/ 		20 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://g.ezoic.net/parsonsmaize/chanute.js?a=a&cb=17&dcb=195-13&shcb=34
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1f10:4c55:e23d:5d5b:8bb5:8ae2:1fff Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
89786a1f649d6044a4702e297404445af6a3eab8332d9f676cb4312196da3d7f

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

x-robots-tag
noindex, follow
cache-control
max-age=31536000, public
content-encoding
br
date
Sun, 09 Nov 2025 10:53:07 GMT
x-middleton-display
sol-js
content-type
application/javascript
vary
Accept-Encoding
jellyfish.js
g.ezoic.net/porpoiseant/ 		23 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://g.ezoic.net/porpoiseant/jellyfish.js?a=a&cb=18&dcb=195-13&shcb=34
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1f10:4c55:e23d:5d5b:8bb5:8ae2:1fff Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
46468ec4089d4bea3f0e0811eea2d9e9cde6305118df0673d2972d290f1d00f0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

x-robots-tag
noindex, follow
cache-control
max-age=31536000, public
content-encoding
br
date
Sun, 09 Nov 2025 10:53:07 GMT
x-middleton-display
sol-js
content-type
application/javascript
vary
Accept-Encoding
location
privacy-location-edge.ccgateway.net/privacy/ 		5 B
191 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://privacy-location-edge.ccgateway.net/privacy/location
Requested by
Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=www.mediafire.com&parentId=0dae949f4b
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.237.175.195 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-237-175-195.compute-1.amazonaws.com
Software
/
Resource Hash
1c55d9b826e8dfa994370e306ae8dc2e849f3e003381dc848a0b95f782c0c0e3

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

access-control-allow-origin
*
content-encoding
gzip
date
Sun, 09 Nov 2025 10:53:07 GMT
content-type
text/plain; charset=utf-8
vary
Accept-Encoding
access-control-allow-credentials
true
pubads_impl.js
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511040101/ 		600 KB
189 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511040101/pubads_impl.js?cb=31095648
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c21::9b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ea47742e94e6a95b08832e9e5875a5a73ab2ea3bc740e6938d927c39e03273bf
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

content-encoding
br
etag
14735669544948044405
age
12130
x-content-type-options
nosniff
expires
Mon, 09 Nov 2026 07:30:57 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sun, 09 Nov 2025 07:30:57 GMT
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
cache-control
public, immutable, max-age=31536000
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
content-length
193950
x-xss-protection
0
server
cafe
imp.gif
g.ezoic.net/detroitchicago/ 		43 B
205 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://g.ezoic.net/detroitchicago/imp.gif
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/parsonsmaize/abilene.js?gcb=195-13&cb=dc112bb7ea
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1f10:4c55:e23d:5d5b:8bb5:8ae2:1fff Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type
text/plain
Referer
https://www.mediafire.com/

Response headers

access-control-max-age
1728000, 1728000
cache-control
private, max-age=0, must-revalidate, no-cache, no-store
access-control-allow-credentials
true
access-control-allow-methods
GET, POST, PUT, OPTIONS, HEAD, PUT, POST, GET, OPTIONS
expires
Sat, 08 Nov 2025 10:53:07 GMT
access-control-allow-origin
https://www.mediafire.com, https://www.mediafire.com
content-length
43
date
Sun, 09 Nov 2025 10:53:07 GMT
x-middleton-display
imp_sol
content-type
image/gif
vary
Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
access-control-allow-headers
Content-Type, Content-Type
omaha.js
g.ezoic.net/detroitchicago/ 		1 KB
624 B 		Script
General
Check archive.org
Download Go to
Full URL
https://g.ezoic.net/detroitchicago/omaha.js?gcb=195-13&cb=8f3688675f
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1f10:4c55:e23d:5d5b:8bb5:8ae2:1fff Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
032e1fdc72c9c669bbd7dcb841fc1cdcd7a9148a5802dd668c508efd0c11d7a0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

x-robots-tag
noindex, follow
cache-control
max-age=31536000, public
content-encoding
br
content-length
593
date
Sun, 09 Nov 2025 10:53:07 GMT
x-middleton-display
sol-js
content-type
application/javascript
vary
Accept-Encoding
lgc
d9.flashtalking.com/ 		103 B
539 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://d9.flashtalking.com/lgc
Requested by
Host: d9.flashtalking.com
URL: https://d9.flashtalking.com/d9core
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
100.24.186.222 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-100-24-186-222.compute-1.amazonaws.com
Software
Apache/2.4.59 (Amazon Linux) OpenSSL/3.0.8 /
Resource Hash
83a7b3a37afdc71c3fdaadc4c5ce1eeebdf01dd2d4154dc891ef7bc187ba3b68

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type
application/x-www-form-urlencoded
Referer
https://www.mediafire.com/

Response headers

access-control-allow-credentials
true
access-control-allow-methods
GET,POST,SERVER
access-control-allow-origin
https://www.mediafire.com
content-length
103
p3p
policyref="localhost/w3c/D9_p3p_.xml", CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"
date
Sun, 09 Nov 2025 10:53:07 GMT
content-type
application/json;charset=UTF-8
server
Apache/2.4.59 (Amazon Linux) OpenSSL/3.0.8
gpt
securepubads.g.doubleclick.net/pagead/managed/dict/m202510140101/ 		63 KB
23 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pagead/managed/dict/m202510140101/gpt
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c21::9b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
2505b331cfe3905b07926e49104c7949bf384b8c4b4ff6f3709e91c6f5cd6366
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer

Response headers

content-encoding
br
etag
13283420341987886150
age
3342
x-content-type-options
nosniff
expires
Sun, 16 Nov 2025 09:57:25 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sun, 09 Nov 2025 09:57:25 GMT
content-type
text/plain; charset=UTF-8
vary
Accept-Encoding
cache-control
public, immutable, max-age=604800, stale-while-revalidate=7200
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
content-length
23314
x-xss-protection
0
server
cafe
use-as-dictionary
match="/gampad/ads", id="m202510140101"
px.gif
ad-delivery.net/ 		43 B
140 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ad-delivery.net/px.gif?ch=1&e=0.34673917544583
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac42:948c -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

x-goog-metageneration
5
access-control-expose-headers
*, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash
crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status
HIT
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3"
age
499289
x-goog-stored-content-encoding
identity
expires
Mon, 03 Nov 2025 16:44:11 GMT
x-goog-stored-content-length
43
date
Sun, 09 Nov 2025 10:53:07 GMT
content-type
image/gif
last-modified
Wed, 05 May 2021 19:25:32 GMT
vary
accept-encoding
x-guploader-uploadid
AAwnv3LS2q6BRDz0udyMq8SGqsPxAD9_9_o6mzrHaQCRyGk0sZz7XK3QmjtCjxaiR2NTdoeX6-0UZCs
cache-control
public, max-age=86400
x-goog-storage-class
MULTI_REGIONAL
cf-ray
99bcc3b8882d7d0b-EWR
accept-ranges
bytes
access-control-allow-origin
*
x-goog-generation
1620242732037093
content-length
43
server
cloudflare
sid
mug.criteo.com/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://mug.criteo.com/sid?cpp=-L4zFnxHdGhWc0R6NU9rZ3o0ejZ0TDNPVDduRTdTYUpsdXhGZ2pxOVluNU8vWWgwS0hsRjVKSzVWMTF5bWtId3VwYWZuVUFGTGdQMTJwYTJud0RNN3I0NWMyU0tZTXNoS1FHRWxCSktHdmhiVy8ydjhLck5xd0J5cExKV2tMYjhFcHhkM3o0ZkxhVWQ1dnR4WkRyN2dHNU45U3NZK0tHM0RwOFF4UFovK0RCU3grcGs3UENyQjNVclRyUmhLVHluTktPZmRwcCthaHc2Q0xraENZdSsrMkhWTUs1aW9aU0VDNXA1TmIwNVhXQnM4allFeFFrWjh3bk5TZlBOUUNXTFFqKy9PfA&cppv=2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
74.119.117.62 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
GET
Origin
null
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
content-type
access-control-allow-methods
GET
access-control-allow-origin
null
cache-control
no-cache, no-store, must-revalidate
content-encoding
gzip
content-type
application/json; charset=utf-8
date
Sun, 09 Nov 2025 10:53:06 GMT
expires
0
pragma
no-cache
server
Kestrel
server-processing-duration-in-ticks
173498
strict-transport-security
max-age=31536000; preload;
vary
Accept-Encoding
topics_frame.html
securepubads.g.doubleclick.net/static/topics/ Frame 401B 		105 KB
29 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/static/topics/topics_frame.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511040101/pubads_impl.js?cb=31095648
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c21::9a Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
018185e30fbbce704be5b336095797ee6594f767c5c81ebc4945257994adad3f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.mediafire.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

accept-ranges
bytes
age
105
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=3000, stale-while-revalidate=3600
content-encoding
br
content-length
29887
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Sun, 09 Nov 2025 10:51:22 GMT
expires
Sun, 09 Nov 2025 11:41:22 GMT
last-modified
Mon, 03 Nov 2025 20:43:45 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
ob.js
cdn-ima.33across.com/ 		18 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-ima.33across.com/ob.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511040101/pubads_impl.js?cb=31095648
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.28.101 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8da9b8dc7a16d03966226d79b3ab81fac5710dd28a52a6769568fdd4ac789159

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

cache-control
public, max-age=259200
content-encoding
gzip
cf-cache-status
HIT
etag
W/"68c447fb-47f6"
age
518603
cf-ray
99bcc3b9fbbc8095-EWR
expires
Wed, 12 Nov 2025 10:53:07 GMT
date
Sun, 09 Nov 2025 10:53:07 GMT
content-type
application/javascript
last-modified
Fri, 12 Sep 2025 16:19:07 GMT
vary
Accept-Encoding
server
cloudflare
esp.js
oa.openxcdn.net/ 		24 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://oa.openxcdn.net/esp.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511040101/pubads_impl.js?cb=31095648
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.102.146.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
192.146.102.34.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

x-goog-metageneration
1
content-encoding
gzip
x-goog-hash
crc32c=f21hYg==, md5=31VCuIvA42jGmZdUpbniug==
etag
"df5542b88bc0e368c6999754a5b9e2ba"
age
2129206
x-goog-stored-content-encoding
gzip
expires
Thu, 15 Oct 2026 19:26:21 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length
7927
date
Wed, 15 Oct 2025 19:26:21 GMT
last-modified
Thu, 27 May 2021 18:30:51 GMT
content-type
application/javascript
x-guploader-uploadid
AAwnv3LdN7h0lpTzIMFARjFDl2uFLJF1OI9wmfJjHWFJLoe5C5rcURMu1BTISzyR8WZCoyXe
cache-control
no-transform
x-goog-storage-class
MULTI_REGIONAL
accept-ranges
bytes
x-goog-generation
1622140251693895
content-length
7927
server
UploadServer
sync.min.js
tags.crwdcntrl.net/lt/c/16589/ 		43 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511040101/pubads_impl.js?cb=31095648
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.167.69.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-3-167-69-118.iad61.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
3733ce04a5c4dbb8b07b847650fd68e82f93ab8abf6b35ca294d6d40130f06c0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

vary
Accept-Encoding
cache-control
public, max-age=86400
content-encoding
gzip
etag
W/"a01b40a9ecb8db243294facf32753015"
age
8358
via
1.1 03b64d1ce32a0f3adb02ed474d405102.cloudfront.net (CloudFront)
alt-svc
h3=":443"; ma=86400
x-cache
Hit from cloudfront
x-amz-cf-id
6qID78pY1o81ZduoCKeVc7tLux17Agbt9ntdtRi9uz6_KwWU9dQqhw==
date
Sun, 09 Nov 2025 08:33:50 GMT
content-type
text/javascript
last-modified
Thu, 16 Oct 2025 16:30:59 GMT
server
AmazonS3
x-amz-cf-pop
IAD61-P6
x-amz-server-side-encryption
AES256
pubcid.min.js
cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/ 		382 B
991 B 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/pubcid.min.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511040101/pubads_impl.js?cb=31095648
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6810:aee2 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6b9ae1fa0d1fc51ee0ad3feb565083bee200289c71bb346020f9b3d80cf73636
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

access-control-expose-headers
*
content-encoding
br
cf-cache-status
HIT
etag
W/"17e-goBKDsAq4SrgyL37A4bNh/aMb7I"
age
33865
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cFuLV%2BYWtWcNKvhc0lPYkVJI4Yb12VMyMMZUhpqqAUd7tIbS8FO6FdgxiCG3TE9ma2GSRGKQw2tnIgQOKC4r4bTfkMSbcqFTj5ctlt%2FUmZ7Cb6yye%2Fb5dqPct34vQES9bfEQZy4z6k9I5pnk1eA%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
x-jsd-version-type
branch
alt-svc
h3=":443"; ma=86400
x-cache
HIT, HIT
server-timing
cfExtPri
date
Sun, 09 Nov 2025 10:53:07 GMT
content-type
application/javascript; charset=utf-8
x-served-by
cache-fra-eddf8230081-FRA, cache-chi-klot8100132-CHI
vary
Accept-Encoding
priority
u=3,i=?0
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
public, max-age=604800, s-maxage=43200
timing-allow-origin
*
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy
cross-origin
cf-ray
99bcc3b9c90ac34d-EWR
accept-ranges
bytes
access-control-allow-origin
*
content-length
237
server
cloudflare
x-jsd-version
master
publishertag.ids.js
static.criteo.net/js/ld/ 		42 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.criteo.net/js/ld/publishertag.ids.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511040101/pubads_impl.js?cb=31095648
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a00b::30 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
nginx /
Resource Hash
89ec2a5152f4f214a0fe49725345dc70848ed05f13cf20646d372d339477a11d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

strict-transport-security
max-age=31536000; preload;
cache-control
max-age=86400, public
timing-allow-origin
*
content-encoding
gzip
cross-origin-resource-policy
cross-origin
expires
Mon, 10 Nov 2025 10:53:07 GMT
access-control-allow-origin
*
date
Sun, 09 Nov 2025 10:53:07 GMT
content-type
text/javascript
vary
x-geo-country
server
nginx
encrypted-tag-g.js
invstatic101.creativecdn.com/encrypted-signals/ 		3 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511040101/pubads_impl.js?cb=31095648
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.96.70.87 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
87.70.96.34.bc.googleusercontent.com
Software
Google Frontend /
Resource Hash
2e5f5cb912c0619933ea6c3ad8ac1466a005f792e3338d96a8432d144c63520f

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

etag
861bdaf24bda5c0db45c6ebe1c94a9eb
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
2729
date
Sun, 09 Nov 2025 10:53:07 GMT
content-type
text/javascript; charset=utf-8
last-modified
Wed, 05 Feb 2025 14:45:21 GMT
server
Google Frontend
x-cloud-trace-context
0cf7c0323f99361cee98f0d1b5ab27cf
connectId-gpt.js
connectid.analytics.yahoo.com/ 		9 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connectid.analytics.yahoo.com/connectId-gpt.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511040101/pubads_impl.js?cb=31095648
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:27c2:9200:10:dd8:5e40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
56351c084d8d56437d41f1e58b7eb184b563871e88bab60f6b15486c39f13996
Security Headers
Name Value
Content-Security-Policy default-src 'self'

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

etag
"faa388a163b1b6d0377ee77a861591e5"
age
1820
x-cache
Hit from cloudfront
x-amz-cf-id
kGyiGF0JuZ0FFwkS4nFn1tpJefYthP3RWFyfOrPfIlqlBZIfjkczfA==
date
Sun, 09 Nov 2025 10:22:48 GMT
content-type
application/javascript
last-modified
Mon, 22 Apr 2024 18:18:45 GMT
x-amz-expiration
expiry-date="Mon, 23 Apr 2029 00:00:00 GMT", rule-id="webapp-standard-lifecycle"
content-security-policy
default-src 'self'
cache-control
max-age=3600
via
1.1 f2f0cb8191da3bf07a9ca31ece94ab68.cloudfront.net (CloudFront)
accept-ranges
bytes
content-length
8729
x-amz-cf-pop
IAD61-P4
server
AmazonS3
x-amz-server-side-encryption
AES256
ads
securepubads.g.doubleclick.net/gampad/ 		897 B
501 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4347117103472909&correlator=2415957724548867&eid=31095133%2C31095250%2C31095648%2C83321072&output=ldjh&gdfp_req=1&vrg=202511040101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=1&didk=1697938527&dids=div-gpt-ad-mediafire_com-box-2&adfs=2211965457&sfv=1-0-45&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1762685587410&lmt=1762685587&adxs=552&adys=10&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fzh1io5g5cavqo7l%2FRose%252527s_bot.zip%2Ffile&vis=1&aee=0&topics=9&tps=9&htps=10&a3p=EkYKDGF1ZGlnZW50LmNvbRI0MDAwMXl1bTBlYWJrYmE5OGJjaWFlNmdpYmRkajk2bGRjbGY3ODZraGRhYWJhY2trYzJqbFgBEjYKDGFkc2VydmVyLm9yZxIkYzQ4NWY5ZjYtMmQ3ZS00NjI3LTg5MGQtYTcxYWNkZjY0N2FlWAESUwoNY3J3ZGNudHJsLm5ldBJAZDJlNzViOGU0OTJlNzQzMDA0ZWQwZGJjNmMwNDE4NWNhMDJjYzUxZTRkYTE2NDNiYjA2NDc3NGZiYzk0YjdkYlgBEjQKCnB1YmNpZC5vcmcSJGRlNmQyYWY2LWIwNWEtNGVlOS1hNzdlLWM3MzQwMjZmZjQ5Y1gBEh0KDmVzcC5jcml0ZW8uY29tGL2f_sGmM0gAUgIIZBIUCgVvcGVueBi8n_7BpjNIAFICCGQSGAoJeWFob28uY29tGL2f_sGmM0gAUgIIZBIbCgwzM2Fjcm9zcy5jb20YvJ_-waYzSABSAghkEhcKCHJ0YmhvdXNlGL2f_sGmM0gAUgIIZA..&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1762685584931&idt=2383&ppid=3b25ce83c75aeff52ef9657aec7de9f7&prev_scp=a%3D1%26iid1%3D6146046926352970%26eid%3D6146046926352970%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D0%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252Fzh1io5g5cavqo7l%252FRose%25252527s_bot.zip%252Ffile%26path%3D%252Ffile%252Fzh1io5g5cavqo7l%252FRose%252527s_bot.zip%252Ffile%26ap%3D1103%26sap%3D1103%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-box-2%26tap%3Dmediafire_com-box-2-6146046926352970%26eb_br%3D90c3c48d0172916d27c102ea4aa9d49c%26eba%3D0%26bv%3D5%26bvm%3D0%26bvr%3D5%26avc%3D115%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D300%26br2%3D160%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D146%2C168%2C0%2C0%2C0%2C168%2C184%2C20%2C0%2C0%2C192%2C0%2C902%2C903%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2764%2C2765%2C3054%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4186%2C5747%2C6293%2C6294%2C6295%2C7036%2C7605%2C7606%2C7607%2C7608%2C7609%2C7610%2C7611%2C7612%2C7613%2C7614%2C7615%2C7616%2C7617%2C7618%2C7788%2C7790%2C7993%2C7994%2C7995%2C7996%2C7997%2C7998%2C7999%2C6772%2C5534%2C7661%2C7713%2C10%2C11%2C12%2C13%2C14%2C15%2C16%26osb%3DLinux%252FChrome&cust_params=li-module-enabled%3Dt1&adks=3106951849&frm=20&eoidce=1&pbbce=1&td=1&egid=3721&tan=5e3107b9-1e1c-45dc-be13-7701b2f8f586&tdf=2
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511040101/pubads_impl.js?cb=31095648
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c21::9b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
521b509ca1eb22bc11428a8beed65e19f0d548e1c625286e41bb6be1fff1c9c8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

content-encoding
dcb
google-lineitem-id
-2
observe-browsing-topics
?1
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sun, 09 Nov 2025 10:53:07 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-2
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
470
x-xss-protection
0
server
cafe
ads
securepubads.g.doubleclick.net/gampad/ 		773 B
390 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4347117103472909&correlator=2326160152583444&eid=31095133%2C31095250%2C31095648%2C83321072&output=ldjh&gdfp_req=1&vrg=202511040101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-medrectangle-3&enc_prev_ius=%2F0%2F1&prev_iu_szs=336x280&ifi=2&didk=46179496&dids=div-gpt-ad-mediafire_com-medre&adfs=1911771697&sfv=1-0-45&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1762685587424&lmt=1762685587&adxs=320&adys=120&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fzh1io5g5cavqo7l%2FRose%252527s_bot.zip%2Ffile&vis=1&aee=0&topics=9&tps=9&htps=10&a3p=EkYKDGF1ZGlnZW50LmNvbRI0MDAwMXl1bTBlYWJrYmE5OGJjaWFlNmdpYmRkajk2bGRjbGY3ODZraGRhYWJhY2trYzJqbFgBEjYKDGFkc2VydmVyLm9yZxIkYzQ4NWY5ZjYtMmQ3ZS00NjI3LTg5MGQtYTcxYWNkZjY0N2FlWAESUwoNY3J3ZGNudHJsLm5ldBJAZDJlNzViOGU0OTJlNzQzMDA0ZWQwZGJjNmMwNDE4NWNhMDJjYzUxZTRkYTE2NDNiYjA2NDc3NGZiYzk0YjdkYlgBEjQKCnB1YmNpZC5vcmcSJGRlNmQyYWY2LWIwNWEtNGVlOS1hNzdlLWM3MzQwMjZmZjQ5Y1gBEh0KDmVzcC5jcml0ZW8uY29tGL2f_sGmM0gAUgIIZBIUCgVvcGVueBi8n_7BpjNIAFICCGQSGAoJeWFob28uY29tGL2f_sGmM0gAUgIIZBIbCgwzM2Fjcm9zcy5jb20YvJ_-waYzSABSAghkEhcKCHJ0YmhvdXNlGL2f_sGmM0gAUgIIZA..&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1762685584931&idt=2383&ppid=3b25ce83c75aeff52ef9657aec7de9f7&prev_scp=a%3D1%26iid1%3D7611442246396448%26eid%3D7611442246396448%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D0%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252Fzh1io5g5cavqo7l%252FRose%25252527s_bot.zip%252Ffile%26path%3D%252Ffile%252Fzh1io5g5cavqo7l%252FRose%252527s_bot.zip%252Ffile%26ap%3D1104%26sap%3D1104%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D5%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D21%26al%3D1021%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-medrectangle-3%26tap%3Dmediafire_com-medrectangle-3-7611442246396448%26eb_br%3D6e85b37de1b1ffc2593baa5d6e4b02fc%26eba%3D0%26bv%3D5%26bvm%3D0%26bvr%3D5%26avc%3D194%26shp%3D3%26ftsn%3D12%26ftsng%3D12%26br1%3D450%26br2%3D240%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D157%2C168%2C0%2C0%2C0%2C168%2C184%2C20%2C0%2C0%2C192%2C0%2C902%2C903%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C760%2C761%2C815%2C816%2C817%2C818%2C893%2C899%2C903%2C919%2C1794%2C2339%2C3054%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3915%2C3919%2C3933%2C4185%2C4186%2C4604%2C4605%2C5747%2C6044%2C6045%2C6293%2C6294%2C6295%2C6983%2C7036%2C7046%2C7144%2C7605%2C7606%2C7607%2C7608%2C7609%2C7610%2C7611%2C7612%2C7613%2C7614%2C7615%2C7616%2C7617%2C7618%2C7788%2C7790%2C7993%2C7994%2C7995%2C7996%2C7997%2C7998%2C7999%2C8057%2C8069%2C6772%2C5534%2C7661%2C7713%2C11%2C12%2C13%2C14%2C15%2C16%26osb%3DLinux%252FChrome&cust_params=li-module-enabled%3Dt1&adks=4079446691&frm=20&eoidce=1&pbbce=1&td=1&egid=3721&tan=5e3107b9-1e1c-45dc-be13-7701b2f8f587&tdf=2
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511040101/pubads_impl.js?cb=31095648
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c21::9b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7b73200d535d1abd879761a9c8a28f55f34303597bb68a96f3c2276a5bebc1c6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

content-encoding
dcb
google-lineitem-id
-2
observe-browsing-topics
?1
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sun, 09 Nov 2025 10:53:07 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-2
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
359
x-xss-protection
0
server
cafe
ads
securepubads.g.doubleclick.net/gampad/ 		766 B
385 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4347117103472909&correlator=1385791204189890&eid=31095133%2C31095250%2C31095648%2C83321072&output=ldjh&gdfp_req=1&vrg=202511040101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-medrectangle-4&enc_prev_ius=%2F0%2F1&prev_iu_szs=336x280%7C300x250&ifi=3&didk=46192883&dids=div-gpt-ad-mediafire_com-medre&adfs=1749122204&sfv=1-0-45&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1762685587434&lmt=1762685587&adxs=320&adys=420&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fzh1io5g5cavqo7l%2FRose%252527s_bot.zip%2Ffile&vis=1&aee=0&topics=9&tps=9&htps=10&a3p=EkYKDGF1ZGlnZW50LmNvbRI0MDAwMXl1bTBlYWJrYmE5OGJjaWFlNmdpYmRkajk2bGRjbGY3ODZraGRhYWJhY2trYzJqbFgBEjYKDGFkc2VydmVyLm9yZxIkYzQ4NWY5ZjYtMmQ3ZS00NjI3LTg5MGQtYTcxYWNkZjY0N2FlWAESUwoNY3J3ZGNudHJsLm5ldBJAZDJlNzViOGU0OTJlNzQzMDA0ZWQwZGJjNmMwNDE4NWNhMDJjYzUxZTRkYTE2NDNiYjA2NDc3NGZiYzk0YjdkYlgBEjQKCnB1YmNpZC5vcmcSJGRlNmQyYWY2LWIwNWEtNGVlOS1hNzdlLWM3MzQwMjZmZjQ5Y1gBEh0KDmVzcC5jcml0ZW8uY29tGL2f_sGmM0gAUgIIZBIUCgVvcGVueBi8n_7BpjNIAFICCGQSGAoJeWFob28uY29tGL2f_sGmM0gAUgIIZBIbCgwzM2Fjcm9zcy5jb20YvJ_-waYzSABSAghkEhcKCHJ0YmhvdXNlGL2f_sGmM0gAUgIIZA..&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1762685584931&idt=2383&ppid=3b25ce83c75aeff52ef9657aec7de9f7&prev_scp=a%3D1%26iid1%3D6017477134385895%26eid%3D6017477134385895%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D0%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252Fzh1io5g5cavqo7l%252FRose%25252527s_bot.zip%252Ffile%26path%3D%252Ffile%252Fzh1io5g5cavqo7l%252FRose%252527s_bot.zip%252Ffile%26ap%3D1105%26sap%3D1105%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D6%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D22%26al%3D1022%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-medrectangle-4%26tap%3Dmediafire_com-medrectangle-4-6017477134385895%26eb_br%3D8de2c8ca79e8623e3cb37120a35ebaa2%26eba%3D0%26bv%3D13%26bvm%3D0%26bvr%3D3%26avc%3D89%26shp%3D3%26ftsn%3D12%26ftsng%3D12%26br1%3D240%26br2%3D120%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D34%2C168%2C0%2C0%2C0%2C168%2C184%2C20%2C0%2C0%2C192%2C0%2C902%2C903%2C901%2C902%2C903%26deal1%3D20%2C21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C760%2C761%2C815%2C816%2C817%2C818%2C899%2C919%2C1794%2C2310%2C2339%2C2526%2C2527%2C2763%2C2764%2C2765%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C3919%2C3933%2C4184%2C4185%2C4186%2C4604%2C4605%2C5747%2C6044%2C6293%2C6294%2C6295%2C6983%2C7036%2C7046%2C7605%2C7606%2C7607%2C7608%2C7609%2C7610%2C7611%2C7612%2C7613%2C7614%2C7615%2C7616%2C7617%2C7618%2C7788%2C7790%2C7993%2C7994%2C7995%2C7996%2C7997%2C7998%2C7999%2C8057%2C6772%2C5534%2C7661%2C7713%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%26osb%3DLinux%252FChrome&cust_params=li-module-enabled%3Dt1&adks=1277606936&frm=20&eoidce=1&pbbce=1&td=1&egid=3721&tan=5e3107b9-1e1c-45dc-be13-7701b2f8f588&tdf=2
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511040101/pubads_impl.js?cb=31095648
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c21::9b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
03fb14c2e4fb94c1e4c75c46acd761fb7751469d55ccee1c7e6a62f265916d10
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

content-encoding
dcb
google-lineitem-id
-2
observe-browsing-topics
?1
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sun, 09 Nov 2025 10:53:07 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-2
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
354
x-xss-protection
0
server
cafe
ads
securepubads.g.doubleclick.net/gampad/ 		758 B
373 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4347117103472909&correlator=1902616101201391&eid=31095133%2C31095250%2C31095648%2C83321072&output=ldjh&gdfp_req=1&vrg=202511040101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-edge-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C160x600&fluid=height&ifi=4&didk=2994273263&dids=div-gpt-ad-mediafire_com-edge-&adfs=580935078&sfv=1-0-45&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1762685587441&lmt=1762685587&adxs=0&adys=300&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fzh1io5g5cavqo7l%2FRose%252527s_bot.zip%2Ffile&vis=1&aee=0&topics=9&tps=9&htps=10&a3p=EkYKDGF1ZGlnZW50LmNvbRI0MDAwMXl1bTBlYWJrYmE5OGJjaWFlNmdpYmRkajk2bGRjbGY3ODZraGRhYWJhY2trYzJqbFgBEjYKDGFkc2VydmVyLm9yZxIkYzQ4NWY5ZjYtMmQ3ZS00NjI3LTg5MGQtYTcxYWNkZjY0N2FlWAESUwoNY3J3ZGNudHJsLm5ldBJAZDJlNzViOGU0OTJlNzQzMDA0ZWQwZGJjNmMwNDE4NWNhMDJjYzUxZTRkYTE2NDNiYjA2NDc3NGZiYzk0YjdkYlgBEjQKCnB1YmNpZC5vcmcSJGRlNmQyYWY2LWIwNWEtNGVlOS1hNzdlLWM3MzQwMjZmZjQ5Y1gBEh0KDmVzcC5jcml0ZW8uY29tGL2f_sGmM0gAUgIIZBIUCgVvcGVueBi8n_7BpjNIAFICCGQSGAoJeWFob28uY29tGL2f_sGmM0gAUgIIZBIbCgwzM2Fjcm9zcy5jb20YvJ_-waYzSABSAghkEhcKCHJ0YmhvdXNlGL2f_sGmM0gAUgIIZA..&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1762685584931&idt=2383&ppid=3b25ce83c75aeff52ef9657aec7de9f7&prev_scp=a%3D1%26iid1%3D6821571650405327%26eid%3D6821571650405327%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D0%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252Fzh1io5g5cavqo7l%252FRose%25252527s_bot.zip%252Ffile%26path%3D%252Ffile%252Fzh1io5g5cavqo7l%252FRose%252527s_bot.zip%252Ffile%26ap%3D1101%26sap%3D1101%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D4%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D38%26al%3D1038%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-edge-1%26tap%3Dmediafire_com-edge-1-6821571650405327%26eb_br%3D527e52c10635ac8136a4c84094ee49a8%26eba%3D0%26bv%3D23%26bvm%3D0%26bvr%3D3%26avc%3D24%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D70%26br2%3D34%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D157%2C193%2C207%2C27%2C195%2C25%2C91%2C20%2C71%2C171%2C175%2C0%2C124%2C199%2C901%2C902%2C903%26deal1%3D17%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2688%2C2761%2C2763%2C2764%2C2765%2C3044%2C3045%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4186%2C5747%2C6293%2C6294%2C6295%2C7035%2C7036%2C7330%2C7605%2C7606%2C7607%2C7608%2C7609%2C7610%2C7611%2C7612%2C7613%2C7614%2C7615%2C7616%2C7617%2C7618%2C7788%2C7789%2C7790%2C7993%2C7994%2C7995%2C7996%2C7997%2C7998%2C7999%2C6772%2C5534%2C7661%2C7713%2C7%2C8%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C916%2C915%2C874%2C835%26osb%3DLinux%252FChrome&cust_params=li-module-enabled%3Dt1&adks=3527628052&frm=20&eoidce=1&pbbce=1&td=1&egid=3721&tan=5e3107b9-1e1c-45dc-be13-7701b2f8f589&tdf=2
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511040101/pubads_impl.js?cb=31095648
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c21::9b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
d52e8dac604c9c92b753f7455f0560e4bb0778e57917092d020aa856e1244c5d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

content-encoding
dcb
google-lineitem-id
-2
observe-browsing-topics
?1
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sun, 09 Nov 2025 10:53:07 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-2
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
342
x-xss-protection
0
server
cafe
ads
securepubads.g.doubleclick.net/gampad/ 		765 B
380 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4347117103472909&correlator=2729394124150010&eid=31095133%2C31095250%2C31095648%2C83321072&output=ldjh&gdfp_req=1&vrg=202511040101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-edge-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C160x600&fluid=height&ifi=5&didk=2994425013&dids=div-gpt-ad-mediafire_com-edge-&adfs=982453029&sfv=1-0-45&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1762685587449&lmt=1762685587&adxs=1440&adys=300&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=5&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fzh1io5g5cavqo7l%2FRose%252527s_bot.zip%2Ffile&vis=1&aee=0&topics=9&tps=9&htps=10&a3p=EkYKDGF1ZGlnZW50LmNvbRI0MDAwMXl1bTBlYWJrYmE5OGJjaWFlNmdpYmRkajk2bGRjbGY3ODZraGRhYWJhY2trYzJqbFgBEjYKDGFkc2VydmVyLm9yZxIkYzQ4NWY5ZjYtMmQ3ZS00NjI3LTg5MGQtYTcxYWNkZjY0N2FlWAESUwoNY3J3ZGNudHJsLm5ldBJAZDJlNzViOGU0OTJlNzQzMDA0ZWQwZGJjNmMwNDE4NWNhMDJjYzUxZTRkYTE2NDNiYjA2NDc3NGZiYzk0YjdkYlgBEjQKCnB1YmNpZC5vcmcSJGRlNmQyYWY2LWIwNWEtNGVlOS1hNzdlLWM3MzQwMjZmZjQ5Y1gBEh0KDmVzcC5jcml0ZW8uY29tGL2f_sGmM0gAUgIIZBIUCgVvcGVueBi8n_7BpjNIAFICCGQSGAoJeWFob28uY29tGL2f_sGmM0gAUgIIZBIbCgwzM2Fjcm9zcy5jb20YvJ_-waYzSABSAghkEhcKCHJ0YmhvdXNlGL2f_sGmM0gAUgIIZA..&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1762685584931&idt=2383&ppid=3b25ce83c75aeff52ef9657aec7de9f7&prev_scp=a%3D1%26iid1%3D1562860810369568%26eid%3D1562860810369568%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D0%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252Fzh1io5g5cavqo7l%252FRose%25252527s_bot.zip%252Ffile%26path%3D%252Ffile%252Fzh1io5g5cavqo7l%252FRose%252527s_bot.zip%252Ffile%26ap%3D1102%26sap%3D1102%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D3%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D39%26al%3D1039%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-edge-2%26tap%3Dmediafire_com-edge-2-1562860810369568%26eb_br%3Ddfa60cee6e1053fc0c9e607c8047bd28%26eba%3D0%26bv%3D11%26bvm%3D0%26bvr%3D1%26avc%3D33%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D80%26br2%3D40%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D146%2C168%2C0%2C0%2C0%2C168%2C184%2C20%2C0%2C0%2C192%2C0%2C902%2C903%2C901%2C902%2C903%26deal1%3D17%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2688%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4186%2C5747%2C6293%2C6294%2C6295%2C7035%2C7036%2C7605%2C7606%2C7607%2C7608%2C7609%2C7610%2C7611%2C7612%2C7613%2C7614%2C7615%2C7616%2C7617%2C7618%2C7788%2C7789%2C7790%2C7993%2C7994%2C7995%2C7996%2C7997%2C7998%2C7999%2C6772%2C5534%2C7661%2C7713%2C7%2C8%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C916%2C915%2C874%2C835%26osb%3DLinux%252FChrome&cust_params=li-module-enabled%3Dt1&adks=3081006461&frm=20&eoidce=1&pbbce=1&td=1&egid=3721&tan=5e3107b9-1e1c-45dc-be13-7701b2f8f58a&tdf=2
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511040101/pubads_impl.js?cb=31095648
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c21::9b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9dfd6360a8cbf89773849fba48320042b9ef83d0611b7a0c86f91740889a55f5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

content-encoding
dcb
google-lineitem-id
-2
observe-browsing-topics
?1
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sun, 09 Nov 2025 10:53:07 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-2
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
349
x-xss-protection
0
server
cafe
ads
securepubads.g.doubleclick.net/gampad/ 		929 B
466 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4347117103472909&correlator=3768916550089339&eid=31095133%2C31095250%2C31095648%2C83321072&output=ldjh&gdfp_req=1&vrg=202511040101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=1x1&ifi=6&didk=674410252&dids=gpt_unit_%2F1254144%2C183096492%2Fme&sfv=1-0-45&fas=1&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1762685587456&lmt=1762685587&adxs=-9&adys=-9&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=6&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fzh1io5g5cavqo7l%2FRose%252527s_bot.zip%2Ffile&vis=1&aee=0&topics=9&tps=9&htps=10&a3p=EkYKDGF1ZGlnZW50LmNvbRI0MDAwMXl1bTBlYWJrYmE5OGJjaWFlNmdpYmRkajk2bGRjbGY3ODZraGRhYWJhY2trYzJqbFgBEjYKDGFkc2VydmVyLm9yZxIkYzQ4NWY5ZjYtMmQ3ZS00NjI3LTg5MGQtYTcxYWNkZjY0N2FlWAESUwoNY3J3ZGNudHJsLm5ldBJAZDJlNzViOGU0OTJlNzQzMDA0ZWQwZGJjNmMwNDE4NWNhMDJjYzUxZTRkYTE2NDNiYjA2NDc3NGZiYzk0YjdkYlgBEjQKCnB1YmNpZC5vcmcSJGRlNmQyYWY2LWIwNWEtNGVlOS1hNzdlLWM3MzQwMjZmZjQ5Y1gBEh0KDmVzcC5jcml0ZW8uY29tGL2f_sGmM0gAUgIIZBIUCgVvcGVueBi8n_7BpjNIAFICCGQSGAoJeWFob28uY29tGL2f_sGmM0gAUgIIZBIbCgwzM2Fjcm9zcy5jb20YvJ_-waYzSABSAghkEhcKCHJ0YmhvdXNlGL2f_sGmM0gAUgIIZA..&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1762685584931&idt=2383&ppid=3b25ce83c75aeff52ef9657aec7de9f7&prev_scp=a%3D1%26iid1%3D5496324216408839%26eid%3D5496324216408839%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D0%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252Fzh1io5g5cavqo7l%252FRose%25252527s_bot.zip%252Ffile%26path%3D%252Ffile%252Fzh1io5g5cavqo7l%252FRose%252527s_bot.zip%252Ffile%26ap%3D1100%26sap%3D1100%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D7%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-medrectangle-2%26tap%3Dmediafire_com-medrectangle-2-5496324216408839%26eb_br%3D58ef7bddb438af5e257c4377f32c243a%26eba%3D0%26bv%3D5%26bvm%3D0%26bvr%3D5%26avc%3D57%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D120%26br2%3D60%26ezoic%3D1%26nmau%3D0%26mau%3D0%26ganc%3D1%26cal%3D0%26stl%3D192%2C193%2C0%2C0%2C0%2C193%2C132%2C0%2C0%2C0%2C187%2C0%2C901%2C182%2C901%2C902%2C903%26deal1%3D17%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C760%2C761%2C813%2C815%2C816%2C817%2C818%2C819%2C899%2C917%2C918%2C919%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C3933%2C4184%2C4186%2C4604%2C5747%2C6293%2C6294%2C6295%2C6983%2C7035%2C7036%2C7605%2C7606%2C7607%2C7608%2C7609%2C7610%2C7611%2C7612%2C7613%2C7614%2C7615%2C7616%2C7617%2C7618%2C7788%2C7789%2C7790%2C7993%2C7994%2C7995%2C7996%2C7997%2C7998%2C7999%2C8057%2C6772%2C5534%2C7661%2C7713%2C7%2C8%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C915%2C874%2C835%26osb%3DLinux%252FChrome&cust_params=li-module-enabled%3Dt1&adks=318048222&frm=20&eoidce=1&pbbce=1&td=1&egid=3721&tan=5e3107b9-1e1c-45dc-be13-7701b2f8f58b&tdf=2
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511040101/pubads_impl.js?cb=31095648
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c21::9b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
487f8e40ed25b85028629c70e5da0b18c5e58307226580a9c8a04288e8bd1e93
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

content-encoding
dcb
google-lineitem-id
-2
observe-browsing-topics
?1
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sun, 09 Nov 2025 10:53:07 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-2
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
435
x-xss-protection
0
server
cafe
container.html
322f9f81cfd88b7498cd441174614e0b.safeframe.googlesyndication.com/safeframe/1-0-45/html/ Frame 8D17 		7 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://322f9f81cfd88b7498cd441174614e0b.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511040101/pubads_impl.js?cb=31095648
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c17::84 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f1a68bf826c55985468304f4284a09cb8a68e82503d764166e611a7c58a85a4b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.mediafire.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=300
content-encoding
br
content-length
3121
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Sun, 09 Nov 2025 10:53:07 GMT
expires
Sun, 09 Nov 2025 10:53:07 GMT
last-modified
Thu, 08 May 2025 23:15:48 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
pubads_impl_page_level_ads.js
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511040101/ 		60 KB
19 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511040101/pubads_impl_page_level_ads.js?cb=31095648
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511040101/pubads_impl.js?cb=31095648
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c21::9b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
081f94d2c63723df86834268d381fcb54bbeda3566e1ca95f3c7ea1f7f1dc217
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

content-encoding
br
etag
13914731579438644706
age
59165
x-content-type-options
nosniff
expires
Sun, 08 Nov 2026 18:27:02 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sat, 08 Nov 2025 18:27:02 GMT
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
cache-control
public, immutable, max-age=31536000
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
content-length
19818
x-xss-protection
0
server
cafe
px.gif
ad-delivery.net/ 		43 B
111 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ad-delivery.net/px.gif?ch=2&e=0.46189066732583994
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac42:948c -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

x-goog-metageneration
5
access-control-expose-headers
*, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash
crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status
HIT
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3"
age
499289
x-goog-stored-content-encoding
identity
expires
Mon, 03 Nov 2025 16:44:11 GMT
x-goog-stored-content-length
43
date
Sun, 09 Nov 2025 10:53:07 GMT
content-type
image/gif
last-modified
Wed, 05 May 2021 19:25:32 GMT
vary
accept-encoding
x-guploader-uploadid
AAwnv3LS2q6BRDz0udyMq8SGqsPxAD9_9_o6mzrHaQCRyGk0sZz7XK3QmjtCjxaiR2NTdoeX6-0UZCs
cache-control
public, max-age=86400
x-goog-storage-class
MULTI_REGIONAL
cf-ray
99bcc3ba290e7d0b-EWR
accept-ranges
bytes
access-control-allow-origin
*
x-goog-generation
1620242732037093
content-length
43
server
cloudflare
favicon.ico
ad.doubleclick.net/ 		1 KB
129 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.27404148075930956
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.16.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bl-in-f149.1e100.net
Software
sffe /
Resource Hash
d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

content-encoding
gzip
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options
nosniff
expires
Mon, 10 Nov 2025 10:53:07 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sun, 09 Nov 2025 10:53:07 GMT
content-type
image/x-icon
vary
Accept-Encoding
last-modified
Tue, 08 May 2012 13:08:06 GMT
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
content-length
104
x-xss-protection
0
server
sffe
j
rp4.liadm.com/
Redirect Chain
  • https://rp.liadm.com/j?dtstmp=1762685587515&did=did-006t&se=e30&duid=a738c2fb6c00--01k9m3z368kp41czwphh8wkwmd&tv=10.14.0&pu=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fzh1io5g5cavqo7l%2FRose%252527s_b...
  • https://rp4.liadm.com/j?dtstmp=1762685587515&did=did-006t&se=e30&duid=a738c2fb6c00--01k9m3z368kp41czwphh8wkwmd&tv=10.14.0&pu=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fzh1io5g5cavqo7l%2FRose%252527s_...
13 B
341 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://rp4.liadm.com/j?dtstmp=1762685587515&did=did-006t&se=e30&duid=a738c2fb6c00--01k9m3z368kp41czwphh8wkwmd&tv=10.14.0&pu=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fzh1io5g5cavqo7l%2FRose%252527s_bot.zip%2Ffile&wpn=prebid&gdpr=0&cd=.mediafire.com&i6=MjYwMDo4MDM6YTg4OjMxMzE6OjEzMQ%3D%3D
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H2
Server
34.206.130.144 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-206-130-144.compute-1.amazonaws.com
Software
/
Resource Hash
efabba3678b85fcab831b778ea2ddaad1e2a1e952584d3566bc39b7ccb3429d9

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

x-pixel-event-id
55d14992-0546-41c1-b3ba-321cee3c644b
access-control-max-age
86400
access-control-expose-headers
*
access-control-allow-credentials
true
access-control-allow-methods
GET
access-control-allow-origin
null
content-length
13
date
Sun, 09 Nov 2025 10:53:07 GMT
content-type
application/json

Redirect headers

access-control-max-age
86400
access-control-expose-headers
*
location
https://rp4.liadm.com/j?dtstmp=1762685587515&did=did-006t&se=e30&duid=a738c2fb6c00--01k9m3z368kp41czwphh8wkwmd&tv=10.14.0&pu=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fzh1io5g5cavqo7l%2FRose%252527s_bot.zip%2Ffile&wpn=prebid&gdpr=0&cd=.mediafire.com&i6=MjYwMDo4MDM6YTg4OjMxMzE6OjEzMQ%3D%3D
access-control-allow-credentials
true
access-control-allow-methods
GET
access-control-allow-origin
https://www.mediafire.com
content-length
0
date
Sun, 09 Nov 2025 10:53:07 GMT
bounce
id5-sync.com/ 		30 B
306 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://id5-sync.com/bounce
Requested by
Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.95.33.120 , Germany, ASN16276 (OVH OVH SAS, FR),
Reverse DNS
ns3203256.ip-141-95-33.eu
Software
/
Resource Hash
b04cd869cfd41a48c006458f71969a0eb26f33fec12f3cfe00408f8b73bf3ff8
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
access-control-allow-origin
https://www.mediafire.com
date
Sun, 09 Nov 2025 10:53:07 GMT
content-type
text/plain;charset=utf-8
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
access-control-allow-credentials
true
v1
lbs.eu-1-id5-sync.com/lbs/ 		54 B
161 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://lbs.eu-1-id5-sync.com/lbs/v1
Requested by
Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:41d0:701:1000::20f2 , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS
Software
/
Resource Hash
f0b95af1ea73d8c518e84a22753c979ffb181d4b012d2197e7302982dc5ee097

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

access-control-allow-origin
https://www.mediafire.com
content-length
54
date
Sun, 9 Nov 2025 10:53:08 GMT
content-type
application/json
vary
Origin
v1
lb.eu-1-id5-sync.com/lb/ 		45 B
336 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://lb.eu-1-id5-sync.com/lb/v1
Requested by
Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
162.19.138.82 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),
Reverse DNS
ns31532337.ip-162-19-138.eu
Software
/
Resource Hash
03add086aedf9d191a81747b57d7c46d0395b20c8d79df6581985c18b6bed599
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
access-control-allow-origin
https://www.mediafire.com
content-encoding
gzip
date
Sun, 09 Nov 2025 10:53:07 GMT
content-type
application/json;charset=UTF-8
vary
origin,access-control-request-method,access-control-request-headers,accept-encoding
userId
script-api.ccgateway.net/1/ 		446 B
705 B 		Script
General
Check archive.org
Download Go to
Full URL
https://script-api.ccgateway.net/1/userId
Requested by
Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=www.mediafire.com&parentId=0dae949f4b
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.212.140.196 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-212-140-196.compute-1.amazonaws.com
Software
/
Resource Hash
5feba1ef2c6561994f5991ec885c49c58ebc537e623cb63760fde7cc6254a697

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

cache-control
private,max-age=3156000
content-encoding
gzip
date
Sun, 09 Nov 2025 10:53:07 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
user.js
script-api.ccgateway.net/script/launcher/2/ 		2 KB
677 B 		Script
General
Check archive.org
Download Go to
Full URL
https://script-api.ccgateway.net/script/launcher/2/user.js
Requested by
Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=www.mediafire.com&parentId=0dae949f4b
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.212.140.196 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-212-140-196.compute-1.amazonaws.com
Software
/
Resource Hash
a11d3b4b6f2902037c365146ff80b5bf95923f3176f1a827355e45177314d423

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

cache-control
private,max-age=604800
content-encoding
gzip
date
Sun, 09 Nov 2025 10:53:07 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
customevents.js
script-api.ccgateway.net/script/launcher/1/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://script-api.ccgateway.net/script/launcher/1/customevents.js
Requested by
Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=www.mediafire.com&parentId=0dae949f4b
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.212.140.196 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-212-140-196.compute-1.amazonaws.com
Software
/
Resource Hash
04c94ecaae50f713607dd45d40c5756d0e6a9e58c6398433ac098bc9bee89f5d

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

cache-control
private,max-age=604800
content-encoding
gzip
date
Sun, 09 Nov 2025 10:53:07 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
api.js
script-api.ccgateway.net/script/launcher/6/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://script-api.ccgateway.net/script/launcher/6/api.js
Requested by
Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=www.mediafire.com&parentId=0dae949f4b
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.212.140.196 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-212-140-196.compute-1.amazonaws.com
Software
/
Resource Hash
880444af8f79aca9fdb01d819bb615c7d8ce8fb9327df856784f7027819de58b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

cache-control
private,max-age=604800
content-encoding
gzip
date
Sun, 09 Nov 2025 10:53:07 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
esp
oajs.openx.net/
Redirect Chain
  • https://oajs.openx.net/esp?url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fzh1io5g5cavqo7l%2FRose%252527s_bot.zip%2Ffile&rid=esp
  • https://oajs.openx.net/esp?url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fzh1io5g5cavqo7l%2FRose%252527s_bot.zip%2Ffile&rid=esp&cc=1
85 B
194 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://oajs.openx.net/esp?url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fzh1io5g5cavqo7l%2FRose%252527s_bot.zip%2Ffile&rid=esp&cc=1
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H2
Server
34.120.135.53 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
53.135.120.34.bc.googleusercontent.com
Software
/ Express
Resource Hash
0218a90d0b505563892cec2372285e44ff83ec6b22d1bdc586ca2ff4bbaddb0f

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

etag
W/"55-QpIPfDfZ5GJJ5UHx9Karmxi9yNo"
access-control-allow-credentials
true
via
1.1 google
access-control-allow-origin
https://www.mediafire.com
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
85
date
Sun, 09 Nov 2025 10:53:07 GMT
content-type
application/json; charset=utf-8
x-powered-by
Express
vary
Origin

Redirect headers

location
/esp?url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fzh1io5g5cavqo7l%2FRose%252527s_bot.zip%2Ffile&rid=esp&cc=1
access-control-allow-credentials
true
via
1.1 google
access-control-allow-origin
https://www.mediafire.com
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
date
Sun, 09 Nov 2025 10:53:07 GMT
x-powered-by
Express
vary
Origin
fed
ups.analytics.yahoo.com/ups/58813/ 		0
22 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ups.analytics.yahoo.com/ups/58813/fed?gpp_sid=-1&gdpr=false&gdpr_consent=&v=1&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fzh1io5g5cavqo7l%2FRose%252527s_bot.zip%2Ffile
Requested by
Host: connectid.analytics.yahoo.com
URL: https://connectid.analytics.yahoo.com/connectId-gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4998:14:800::1000 , United States, ASN14777 (YAHOO, US),
Reverse DNS
Software
ATS /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

strict-transport-security
max-age=31536000
age
0
access-control-allow-credentials
true
x-content-type-options
nosniff
referrer-policy
no-referrer-when-downgrade
access-control-allow-origin
https://www.mediafire.com
content-length
0
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date
Sun, 09 Nov 2025 10:53:07 GMT
content-type
application/json
vary
Origin
server
ATS
setUser
script-api.ccgateway.net/ 		0
360 B 		Script
General
Check archive.org
Download Go to
Full URL
https://script-api.ccgateway.net/setUser?parent=0dae949f4b&site=www.mediafire.com&ccuid=2effe826-50c4-4444-b4ce-968a3ec91570&ccsid=ed33fc7e-3730-4a52-8fdb-8c6f02dab56d
Requested by
Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=www.mediafire.com&parentId=0dae949f4b
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.212.140.196 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-212-140-196.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

cache-control
private,max-age=300
content-length
0
date
Sun, 09 Nov 2025 10:53:07 GMT
content-type
text/javascript
bundle
script-api.ccgateway.net/script/ 		9 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://script-api.ccgateway.net/script/bundle?id=www.mediafire.com&parentId=0dae949f4b
Requested by
Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=www.mediafire.com&parentId=0dae949f4b
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.212.140.196 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-212-140-196.compute-1.amazonaws.com
Software
/
Resource Hash
ae5072e36a1daf15ddc62e9f7d105f39df37e3b310761c4a716f18565a826eb4

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

cache-control
public,max-age=1200
content-encoding
gzip
date
Sun, 09 Nov 2025 10:53:07 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
encrypt
esp.rtbhouse.com/ 		285 B
550 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://esp.rtbhouse.com/encrypt
Requested by
Host: invstatic101.creativecdn.com
URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.190.39.111 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
111.39.190.35.bc.googleusercontent.com
Software
Google Frontend /
Resource Hash
012b8fdf4fcc71f19d70696af49aaf45fae20937019aad0205a8eabee2a1e08a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type
text/plain
Referer
https://www.mediafire.com/

Response headers

access-control-allow-credentials
true
access-control-allow-methods
POST
via
1.1 google
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
285
date
Sun, 09 Nov 2025 10:53:07 GMT
content-type
application/json
x-cloud-trace-context
4d815d279e680a32bc9ffa6e7890b16d
server
Google Frontend
access-control-allow-headers
X-Requested-With
syncframe
gum.criteo.com/ Frame 56E4 		15 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=www.mediafire.com&gdpr=0&gdpr_consent=
Requested by
Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.ids.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a00b::3d , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
dac56831476fb5f3f2c40c74e494002b792f5797910296d14c354be48995e136
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://www.mediafire.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

cache-control
private, max-age=3600
content-encoding
gzip
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Sun, 09 Nov 2025 10:53:07 GMT
server
Kestrel
server-processing-duration-in-ticks
239479
strict-transport-security
max-age=31536000; preload;
vary
Accept-Encoding
x-robots-tag
noindex
page_visit
pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/page_visit
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.210.204.30 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-210-204-30.us-west-2.compute.amazonaws.com
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.mediafire.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Content-Type,Content-Length,Accept-Encoding,Authorization,X-Forwarded-For
access-control-allow-methods
GET,POST
access-control-allow-origin
https://www.mediafire.com
access-control-max-age
86400
date
Sun, 09 Nov 2025 10:53:08 GMT
vary
Origin Access-Control-Request-Method Access-Control-Request-Headers
page_visit
pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ 		60 B
336 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/page_visit
Requested by
Host: script-api.ccgateway.net
URL: https://script-api.ccgateway.net/script/bundle?id=www.mediafire.com&parentId=0dae949f4b
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.210.204.30 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-210-204-30.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
715199235705aaa7c6781030dac85b766262d77ec7c07aac6f4928f464d93583

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type
application/json
Referer
https://www.mediafire.com/

Response headers

access-control-allow-origin
https://www.mediafire.com
content-length
60
date
Sun, 09 Nov 2025 10:53:08 GMT
content-type
application/json; charset=utf-8
vary
Origin
access-control-allow-credentials
true
ad_impression
pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ad_impression
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.210.204.30 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-210-204-30.us-west-2.compute.amazonaws.com
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.mediafire.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Content-Type,Content-Length,Accept-Encoding,Authorization,X-Forwarded-For
access-control-allow-methods
GET,POST
access-control-allow-origin
https://www.mediafire.com
access-control-max-age
86400
date
Sun, 09 Nov 2025 10:53:08 GMT
vary
Origin Access-Control-Request-Method Access-Control-Request-Headers
ad_impression
pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ 		60 B
336 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ad_impression
Requested by
Host: script-api.ccgateway.net
URL: https://script-api.ccgateway.net/script/bundle?id=www.mediafire.com&parentId=0dae949f4b
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.210.204.30 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-210-204-30.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
715199235705aaa7c6781030dac85b766262d77ec7c07aac6f4928f464d93583

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type
application/json
Referer
https://www.mediafire.com/

Response headers

access-control-allow-origin
https://www.mediafire.com
content-length
60
date
Sun, 09 Nov 2025 10:53:08 GMT
content-type
application/json; charset=utf-8
vary
Origin
access-control-allow-credentials
true
ad_impression
pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ 		60 B
336 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ad_impression
Requested by
Host: script-api.ccgateway.net
URL: https://script-api.ccgateway.net/script/bundle?id=www.mediafire.com&parentId=0dae949f4b
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.210.204.30 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-210-204-30.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
715199235705aaa7c6781030dac85b766262d77ec7c07aac6f4928f464d93583

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type
application/json
Referer
https://www.mediafire.com/

Response headers

access-control-allow-origin
https://www.mediafire.com
content-length
60
date
Sun, 09 Nov 2025 10:53:08 GMT
content-type
application/json; charset=utf-8
vary
Origin
access-control-allow-credentials
true
ad_impression
pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ad_impression
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.210.204.30 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-210-204-30.us-west-2.compute.amazonaws.com
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.mediafire.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Content-Type,Content-Length,Accept-Encoding,Authorization,X-Forwarded-For
access-control-allow-methods
GET,POST
access-control-allow-origin
https://www.mediafire.com
access-control-max-age
86400
date
Sun, 09 Nov 2025 10:53:08 GMT
vary
Origin Access-Control-Request-Method Access-Control-Request-Headers
ad_impression
pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ad_impression
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.210.204.30 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-210-204-30.us-west-2.compute.amazonaws.com
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.mediafire.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Content-Type,Content-Length,Accept-Encoding,Authorization,X-Forwarded-For
access-control-allow-methods
GET,POST
access-control-allow-origin
https://www.mediafire.com
access-control-max-age
86400
date
Sun, 09 Nov 2025 10:53:08 GMT
vary
Origin Access-Control-Request-Method Access-Control-Request-Headers
ad_impression
pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ 		60 B
336 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ad_impression
Requested by
Host: script-api.ccgateway.net
URL: https://script-api.ccgateway.net/script/bundle?id=www.mediafire.com&parentId=0dae949f4b
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.210.204.30 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-210-204-30.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
715199235705aaa7c6781030dac85b766262d77ec7c07aac6f4928f464d93583

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type
application/json
Referer
https://www.mediafire.com/

Response headers

access-control-allow-origin
https://www.mediafire.com
content-length
60
date
Sun, 09 Nov 2025 10:53:08 GMT
content-type
application/json; charset=utf-8
vary
Origin
access-control-allow-credentials
true
ad_impression
pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ad_impression
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.210.204.30 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-210-204-30.us-west-2.compute.amazonaws.com
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.mediafire.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Content-Type,Content-Length,Accept-Encoding,Authorization,X-Forwarded-For
access-control-allow-methods
GET,POST
access-control-allow-origin
https://www.mediafire.com
access-control-max-age
86400
date
Sun, 09 Nov 2025 10:53:08 GMT
vary
Origin Access-Control-Request-Method Access-Control-Request-Headers
ad_impression
pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ 		60 B
336 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ad_impression
Requested by
Host: script-api.ccgateway.net
URL: https://script-api.ccgateway.net/script/bundle?id=www.mediafire.com&parentId=0dae949f4b
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.210.204.30 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-210-204-30.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
715199235705aaa7c6781030dac85b766262d77ec7c07aac6f4928f464d93583

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type
application/json
Referer
https://www.mediafire.com/

Response headers

access-control-allow-origin
https://www.mediafire.com
content-length
60
date
Sun, 09 Nov 2025 10:53:08 GMT
content-type
application/json; charset=utf-8
vary
Origin
access-control-allow-credentials
true
ad_impression
pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ 		60 B
336 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ad_impression
Requested by
Host: script-api.ccgateway.net
URL: https://script-api.ccgateway.net/script/bundle?id=www.mediafire.com&parentId=0dae949f4b
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.210.204.30 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-210-204-30.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
715199235705aaa7c6781030dac85b766262d77ec7c07aac6f4928f464d93583

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type
application/json
Referer
https://www.mediafire.com/

Response headers

access-control-allow-origin
https://www.mediafire.com
content-length
60
date
Sun, 09 Nov 2025 10:53:08 GMT
content-type
application/json; charset=utf-8
vary
Origin
access-control-allow-credentials
true
ad_impression
pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ad_impression
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.210.204.30 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-210-204-30.us-west-2.compute.amazonaws.com
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.mediafire.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Content-Type,Content-Length,Accept-Encoding,Authorization,X-Forwarded-For
access-control-allow-methods
GET,POST
access-control-allow-origin
https://www.mediafire.com
access-control-max-age
86400
date
Sun, 09 Nov 2025 10:53:08 GMT
vary
Origin Access-Control-Request-Method Access-Control-Request-Headers
sodar
ep1.adtrafficquality.google/getconfig/ 		17 KB
13 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://ep1.adtrafficquality.google/getconfig/sodar?sv=200&tid=gpt&tv=m202511040101&st=env&sjk=4347117103472909
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511040101/pubads_impl.js?cb=31095648
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c19::9d Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0658fb633db8e191f0ba46ccfee48916e99af36793629714f6f445f0306927f7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

timing-allow-origin
*
content-encoding
br
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
13515
date
Sun, 09 Nov 2025 10:53:07 GMT
x-xss-protection
0
content-type
application/json; charset=UTF-8
content-disposition
attachment; filename="f.txt"
server
cafe
sid
mug.criteo.com/ Frame 56E4
Redirect Chain
  • https://gum.criteo.com/sid/json?origin=publishertagids&domain=www.mediafire.com&sn=ChromeSyncframe&so=0&topUrl=www.mediafire.com&topicsavail=1&fledgeavail=1
  • https://mug.criteo.com/sid?cpp=jTjTknw1amNVblBGVVZoNUZJSUhiZEVnSTYvLzFMcEVxNFRDN0JlTnRhcGlIZG1VemFsQWVxQy9xbTMyUFpMRCtDa0Z4eEMyaHY2RWpCRzh2V3crVEFRcVFjK3krQlRaM2NOMm1rRy9EOGNKT09pdStyK3NhWVFUdVlCWE...
433 B
1 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://mug.criteo.com/sid?cpp=jTjTknw1amNVblBGVVZoNUZJSUhiZEVnSTYvLzFMcEVxNFRDN0JlTnRhcGlIZG1VemFsQWVxQy9xbTMyUFpMRCtDa0Z4eEMyaHY2RWpCRzh2V3crVEFRcVFjK3krQlRaM2NOMm1rRy9EOGNKT09pdStyK3NhWVFUdVlCWEZnUTBaeUZ6ekZOWDloWEhhcmRHMlpJT3JlY3A4ZjQxOU9PbUVzUU1Ub1N4Z3plTFdRUC85dlJIemhUeVZ3Qm9UT3Z3ZDdnSzBMNHFSVnVzVUVzRTJmQzc3bGovb1JWSitPd2l2K21MTVlRNzJpNk5tcVlBMitBaThCbk5VUXlBeTYwaXFWazVUR1RKQWlmM0VkVGI2Qm1Kbk9mZ3dhS3V3OHRramhWR3BFcUkvUUR1S0RpMjVqcERHZ1NHek0vMXE0dkJ4S20xL3w&cppv=2
Protocol
H2
Server
74.119.117.62 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
6f856d03aace62468ff8bcfa901def0fb022fd719a49592b462f53f0efa71fbe
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://gum.criteo.com/

Response headers

strict-transport-security
max-age=31536000; preload;
cache-control
no-cache, no-store, must-revalidate
content-encoding
gzip
pragma
no-cache
access-control-allow-credentials
true
access-control-allow-methods
GET
server-processing-duration-in-ticks
1561780
expires
0
access-control-allow-origin
https://gum.criteo.com
date
Sun, 09 Nov 2025 10:53:07 GMT
content-type
application/json; charset=utf-8
vary
Accept-Encoding
server
Kestrel

Redirect headers

strict-transport-security
max-age=31536000; preload;
cache-control
no-cache, no-store, must-revalidate
location
https://mug.criteo.com/sid?cpp=jTjTknw1amNVblBGVVZoNUZJSUhiZEVnSTYvLzFMcEVxNFRDN0JlTnRhcGlIZG1VemFsQWVxQy9xbTMyUFpMRCtDa0Z4eEMyaHY2RWpCRzh2V3crVEFRcVFjK3krQlRaM2NOMm1rRy9EOGNKT09pdStyK3NhWVFUdVlCWEZnUTBaeUZ6ekZOWDloWEhhcmRHMlpJT3JlY3A4ZjQxOU9PbUVzUU1Ub1N4Z3plTFdRUC85dlJIemhUeVZ3Qm9UT3Z3ZDdnSzBMNHFSVnVzVUVzRTJmQzc3bGovb1JWSitPd2l2K21MTVlRNzJpNk5tcVlBMitBaThCbk5VUXlBeTYwaXFWazVUR1RKQWlmM0VkVGI2Qm1Kbk9mZ3dhS3V3OHRramhWR3BFcUkvUUR1S0RpMjVqcERHZ1NHek0vMXE0dkJ4S20xL3w&cppv=2
pragma
no-cache
server-processing-duration-in-ticks
373764
expires
0
content-length
0
date
Sun, 09 Nov 2025 10:53:07 GMT
server
Kestrel
rum
www.mediafire.com/cdn-cgi/ 		0
142 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.mediafire.com/cdn-cgi/rum?
Requested by
Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.148.83 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
content-type
application/json
Referer
https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file

Response headers

access-control-max-age
86400
access-control-allow-credentials
true
access-control-allow-methods
POST,OPTIONS
x-content-type-options
nosniff
cf-ray
99bcc3bc7a075a29-EWR
access-control-allow-origin
https://www.mediafire.com
date
Sun, 09 Nov 2025 10:53:07 GMT
vary
Origin
server
cloudflare
x-frame-options
DENY
favicon.ico
www.mediafire.com/ 		11 KB
2 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://www.mediafire.com/favicon.ico
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.148.83 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cdc78cc8b2994712a041a2a4cb02f488afbab00981771bdd3a8036c2dddf540f

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file

Response headers

content-encoding
gzip
cf-cache-status
HIT
etag
W/"62deda56-2a46"
age
149740
access-control-allow-methods
OPTIONS, POST, GET
expires
Sun, 07 Dec 2025 17:17:25 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
x-mf-env
liveApi
date
Sun, 09 Nov 2025 10:53:07 GMT
content-type
image/x-icon
last-modified
Mon, 25 Jul 2022 18:00:54 GMT
vary
Accept-Encoding
priority
u=1,i
cache-control
max-age=2592000
cf-ray
99bcc3bc7a0d5a29-EWR
x-mf-fe
mf1
access-control-allow-origin
*
server
cloudflare
ad_impression
pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ 		60 B
336 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ad_impression
Requested by
Host: script-api.ccgateway.net
URL: https://script-api.ccgateway.net/script/bundle?id=www.mediafire.com&parentId=0dae949f4b
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.210.204.30 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-210-204-30.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
715199235705aaa7c6781030dac85b766262d77ec7c07aac6f4928f464d93583

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type
application/json
Referer
https://www.mediafire.com/

Response headers

access-control-allow-origin
https://www.mediafire.com
content-length
60
date
Sun, 09 Nov 2025 10:53:08 GMT
content-type
application/json; charset=utf-8
vary
Origin
access-control-allow-credentials
true
ad_impression
pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ad_impression
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.210.204.30 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-210-204-30.us-west-2.compute.amazonaws.com
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.mediafire.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Content-Type,Content-Length,Accept-Encoding,Authorization,X-Forwarded-For
access-control-allow-methods
GET,POST
access-control-allow-origin
https://www.mediafire.com
access-control-max-age
86400
date
Sun, 09 Nov 2025 10:53:08 GMT
vary
Origin Access-Control-Request-Method Access-Control-Request-Headers
pd
google-bidout-d.openx.net/w/1.0/ Frame BA60 		648 B
856 B 		Document
General
Check archive.org
Download Go to
Full URL
https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Requested by
Host: oa.openxcdn.net
URL: https://oa.openxcdn.net/esp.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
/
Resource Hash
5249c73799ce5ee08a0a436f335522b49830d8309424205a0c7167519d166e3a

Request headers

Referer
https://www.mediafire.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=0, no-cache
content-encoding
br
content-length
466
content-type
text/html
date
Sun, 09 Nov 2025 10:53:07 GMT
p3p
CP="CUR ADM OUR NOR STA NID"
pragma
no-cache
vary
Accept, Accept-Encoding
via
1.1 google
x-forwarded-for
206.66.99.131
favicon.ico
ad.doubleclick.net/ 		1 KB
129 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.7414553068439064
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.16.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bl-in-f149.1e100.net
Software
sffe /
Resource Hash
d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

content-encoding
gzip
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options
nosniff
expires
Mon, 10 Nov 2025 10:53:07 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sun, 09 Nov 2025 10:53:07 GMT
content-type
image/x-icon
vary
Accept-Encoding
last-modified
Tue, 08 May 2012 13:08:06 GMT
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
content-length
104
x-xss-protection
0
server
sffe
px.gif
ad-delivery.net/ 		43 B
111 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ad-delivery.net/px.gif?ch=2&e=0.7913765411070445
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac42:948c -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

x-goog-metageneration
5
access-control-expose-headers
*, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash
crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status
HIT
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3"
age
499289
x-goog-stored-content-encoding
identity
expires
Mon, 03 Nov 2025 16:44:11 GMT
x-goog-stored-content-length
43
date
Sun, 09 Nov 2025 10:53:07 GMT
content-type
image/gif
last-modified
Wed, 05 May 2021 19:25:32 GMT
vary
accept-encoding
x-guploader-uploadid
AAwnv3LS2q6BRDz0udyMq8SGqsPxAD9_9_o6mzrHaQCRyGk0sZz7XK3QmjtCjxaiR2NTdoeX6-0UZCs
cache-control
public, max-age=86400
x-goog-storage-class
MULTI_REGIONAL
cf-ray
99bcc3bcea547d0b-EWR
accept-ranges
bytes
access-control-allow-origin
*
x-goog-generation
1620242732037093
content-length
43
server
cloudflare
sodar2.js
ep2.adtrafficquality.google/sodar/ 		20 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ep2.adtrafficquality.google/sodar/sodar2.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511040101/pubads_impl.js?cb=31095648
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c19::84 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a7f65c0446b6cac3175458f6388304d0c23e70d11fa0db20920a619f1bc18623
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

content-encoding
gzip
etag
"1747411493688989"
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
x-content-type-options
nosniff
expires
Sun, 09 Nov 2025 10:53:08 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sun, 09 Nov 2025 10:53:08 GMT
content-type
text/javascript
vary
Accept-Encoding
cache-control
private, max-age=3000
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
content-length
7188
x-xss-protection
0
server
sffe
sd
us-u.openx.net/w/1.0/ Frame BA60
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEPacmDdEEbRZZ4O8u2JbVvQ&google_cver=1
43 B
97 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEPacmDdEEbRZZ4O8u2JbVvQ&google_cver=1
Requested by
Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Protocol
H2
Server
35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
/
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://google-bidout-d.openx.net/

Response headers

cache-control
private, max-age=0, no-cache
pragma
no-cache
x-forwarded-for
206.66.99.131
via
1.1 google
expires
Mon, 26 Jul 1997 05:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
p3p
CP="CUR ADM OUR NOR STA NID"
date
Sun, 09 Nov 2025 10:53:07 GMT
content-type
image/gif
vary
Accept

Redirect headers

cache-control
no-cache, must-revalidate
location
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEPacmDdEEbRZZ4O8u2JbVvQ&google_cver=1
pragma
no-cache
cross-origin-resource-policy
cross-origin
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length
295
date
Sun, 09 Nov 2025 10:53:08 GMT
x-xss-protection
0
content-type
text/html; charset=UTF-8
server
HTTP server (unknown)
pixel
cm.g.doubleclick.net/ Frame BA60 		170 B
243 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=YjhjZjllNGMtYTFjNC0yM2ExLWQzNDAtNTUzZjZiZWE0MmJi
Requested by
Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.179.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
pd-in-f155.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://google-bidout-d.openx.net/

Response headers

cache-control
no-cache, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
date
Sun, 09 Nov 2025 10:53:08 GMT
x-xss-protection
0
content-type
image/png
server
HTTP server (unknown)
sd
us-u.openx.net/w/1.0/ Frame BA60
Redirect Chain
  • https://match.adsrvr.org/track/cmf/openx?oxid=94a04d86-68b3-7d05-c6a0-0f86a1088cdb&gdpr=0
  • https://us-u.openx.net/w/1.0/sd?id=537072971&val=c485f9f6-2d7e-4627-890d-a71acdf647ae&ttd_puid=94a04d86-68b3-7d05-c6a0-0f86a1088cdb&gdpr=0&gdpr_consent=
43 B
136 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072971&val=c485f9f6-2d7e-4627-890d-a71acdf647ae&ttd_puid=94a04d86-68b3-7d05-c6a0-0f86a1088cdb&gdpr=0&gdpr_consent=
Requested by
Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Protocol
H2
Server
35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
/
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://google-bidout-d.openx.net/

Response headers

cache-control
private, max-age=0, no-cache
pragma
no-cache
x-forwarded-for
206.66.99.131
via
1.1 google
expires
Mon, 26 Jul 1997 05:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
p3p
CP="CUR ADM OUR NOR STA NID"
date
Sun, 09 Nov 2025 10:53:08 GMT
content-type
image/gif
vary
Accept

Redirect headers

location
https://us-u.openx.net/w/1.0/sd?id=537072971&val=c485f9f6-2d7e-4627-890d-a71acdf647ae&ttd_puid=94a04d86-68b3-7d05-c6a0-0f86a1088cdb&gdpr=0&gdpr_consent=
content-length
335
date
Sun, 09 Nov 2025 10:53:08 GMT
server
Kestrel
sd
us-u.openx.net/w/1.0/ Frame BA60
Redirect Chain
  • https://pr-bh.ybp.yahoo.com/sync/openx/00672bc2-f81f-ef4c-f777-19735e5f4192?gdpr=0
  • https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-7ZrABcJE2p8tFuHy4aw0gs56wh7TEpXBSew-~A
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-7ZrABcJE2p8tFuHy4aw0gs56wh7TEpXBSew-~A
Requested by
Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Protocol
H3
Server
35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
/
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://google-bidout-d.openx.net/

Response headers

cache-control
private, max-age=0, no-cache
pragma
no-cache
x-forwarded-for
206.66.99.131
via
1.1 google
expires
Mon, 26 Jul 1997 05:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
p3p
CP="CUR ADM OUR NOR STA NID"
date
Sun, 09 Nov 2025 10:53:08 GMT
content-type
image/gif
vary
Accept

Redirect headers

strict-transport-security
max-age=31536000
content-security-policy
sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
location
https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-7ZrABcJE2p8tFuHy4aw0gs56wh7TEpXBSew-~A
age
0
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
content-length
0
date
Sun, 09 Nov 2025 10:53:08 GMT
server
ATS
x-frame-options
DENY
sd
us-u.openx.net/w/1.0/ Frame BA60
Redirect Chain
  • https://ad.turn.com/r/cs?pid=9&gdpr=0
  • https://us-u.openx.net/w/1.0/sd?id=537073061&val=3112035968479487874&gdpr=0&gdpr_consent=&us_privacy=
43 B
97 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537073061&val=3112035968479487874&gdpr=0&gdpr_consent=&us_privacy=
Requested by
Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Protocol
H2
Server
35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
/
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://google-bidout-d.openx.net/

Response headers

cache-control
private, max-age=0, no-cache
pragma
no-cache
x-forwarded-for
206.66.99.131
via
1.1 google
expires
Mon, 26 Jul 1997 05:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
p3p
CP="CUR ADM OUR NOR STA NID"
date
Sun, 09 Nov 2025 10:53:07 GMT
content-type
image/gif
vary
Accept

Redirect headers

cache-control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location
https://us-u.openx.net/w/1.0/sd?id=537073061&val=3112035968479487874&gdpr=0&gdpr_consent=&us_privacy=
p3p
policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length
0
pragma
no-cache
date
Sun, 09 Nov 2025 10:53:06 GMT
runner.html
ep2.adtrafficquality.google/sodar/sodar2/237/ Frame 169D 		13 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ep2.adtrafficquality.google/sodar/sodar2/237/runner.html
Requested by
Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/sodar2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c19::84 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
14b660a511e14a9a481c6fe43c576f36c61b656cfd379728c54f1128e1855966
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.mediafire.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

accept-ranges
bytes
age
440
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=3000
content-encoding
gzip
content-length
5044
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
date
Sun, 09 Nov 2025 10:45:48 GMT
expires
Sun, 09 Nov 2025 11:35:48 GMT
last-modified
Tue, 13 May 2025 23:17:50 GMT
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server
sffe
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
aframe
www.google.com/recaptcha/api2/ Frame 80BE 		829 B
567 B 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/aframe
Requested by
Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/sodar2.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c19::68 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
f04216dbfc1a42aaacde2f68603d28c16bd561605b119c4c46fff440a2a9ed15
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-9S6juWBCXBbx2mdbeyaQcA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.mediafire.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=300
content-encoding
gzip
content-security-policy
script-src 'report-sample' 'nonce-9S6juWBCXBbx2mdbeyaQcA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-opener-policy-report-only
same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
cross-origin-resource-policy
cross-origin
date
Sun, 09 Nov 2025 10:53:08 GMT
expires
Sun, 09 Nov 2025 10:53:08 GMT
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
server
ESF
x-content-type-options
nosniff
x-xss-protection
0
ads
securepubads.g.doubleclick.net/gampad/ 		559 B
282 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4347117103472909&correlator=1802334392540680&eid=31095133%2C31095250%2C31095648%2C83321072&output=ldjh&gdfp_req=1&vrg=202511040101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=1x1&ifi=7&didk=674410252&dids=gpt_unit_%2F1254144%2C183096492%2Fme&sfv=1-0-45&rcs=1&fas=1&eri=1&sc=1&cookie=ID%3D710d595ddee055b4%3AT%3D1762685587%3ART%3D1762685587%3AS%3DALNI_MZJGZDvti4dTz_nkocz4FF59h3kSg&gpic=UID%3D0000130a10d732ad%3AT%3D1762685587%3ART%3D1762685587%3AS%3DALNI_MaUVZBE6m9Fvpz6Zk1r3wnftELu7g&abxe=1&dt=1762685588359&lmt=1762685588&adxs=-9&adys=-9&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=6&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fzh1io5g5cavqo7l%2FRose%252527s_bot.zip%2Ffile&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&topics=3&tps=3&htps=10&a3p=EkYKDGF1ZGlnZW50LmNvbRI0MDAwMXl1bTBlYWJrYmE5OGJjaWFlNmdpYmRkajk2bGRjbGY3ODZraGRhYWJhY2trYzJqbFgBEpMBCgpjcml0ZW8uY29tEoIBMFN0VGhGOUJRV2xGTUhKMloyZFBSekZ0V25aVFdqWlljM1pLYTFWc00wZEZjbUUyVDFGNlpIcHJaV3huVkRNelpIRTBRa1prU0ROTmJVZHhaMjFyTURKQlFtMXdVR1JDUVcweU1XMW5iSE5xY2xsQlozcG9ZVlZMUVNVelJDVXpSQVgBEjYKDGFkc2VydmVyLm9yZxIkYzQ4NWY5ZjYtMmQ3ZS00NjI3LTg5MGQtYTcxYWNkZjY0N2FlWAESNAoKcHViY2lkLm9yZxIkZGU2ZDJhZjYtYjA1YS00ZWU5LWE3N2UtYzczNDAyNmZmNDljWAESWgoNY3J3ZGNudHJsLm5ldBJAZDJlNzViOGU0OTJlNzQzMDA0ZWQwZGJjNmMwNDE4NWNhMDJjYzUxZTRkYTE2NDNiYjA2NDc3NGZiYzk0YjdkYhj6oP7BpjNIABIdCg5lc3AuY3JpdGVvLmNvbRi9n_7BpjNIAFICCGQSGAoJeWFob28uY29tGJyh_sGmM0gAUgIIbxI-CgVvcGVueBIsZXlKcElqb2lVbmQ0ZVRNNFJUQlJka3RqWkhOa2RYaFRLeTlLWnowOUluMD0YwqP-waYzSAASGwoMMzNhY3Jvc3MuY29tGLyf_sGmM0gAUgIIZBKCAgoIcnRiaG91c2US7AFVbk9IMjhrcm5SeW5Rc2o4NDA1WFAxamppWGs4ZnhmMUtzNUlZeVpNTkI3QlZIMGlrVTZ2RUJwQ0hhWHVqdEVxSUtzcEVJU1plaGpQdE5zcSsrQnZqeGRpTU5Wb0ZDQWMrM2tsYS9uQkVmVXphRlR5WlJlbEtMUHp5YXZqb3JtdlRzR1BQWTg4NnFkeVdYQ0FPekl4V29xeWJhbjd3c3lPN2M2ai9LVi9WMjdwSm44Tjh0WXh1M05HYzMrY1BsczBZM2ZKMzZyZEpsRWNyYmdvSElhcHY5ZmpxRHE2WG05SjBIQVdheEM1WjF3PRiyo_7BpjNIAA..&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1762685584931&idt=2383&ppid=3b25ce83c75aeff52ef9657aec7de9f7&prev_scp=a%3D1%26iid1%3D5496324216408839%26eid%3D5496324216408839%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D0%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252Fzh1io5g5cavqo7l%252FRose%25252527s_bot.zip%252Ffile%26path%3D%252Ffile%252Fzh1io5g5cavqo7l%252FRose%252527s_bot.zip%252Ffile%26ap%3D1100%26sap%3D1100%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D7%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-medrectangle-2%26tap%3Dmediafire_com-medrectangle-2-5496324216408839%26eb_br%3Dc352ba581bd3ffd8cea608cf2d55f519%26eba%3D0%26bv%3D5%26bvm%3D0%26bvr%3D5%26avc%3D57%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D60%26br2%3D60%26ezoic%3D1%26nmau%3D0%26mau%3D0%26ganc%3D1%26cal%3D0%26stl%3D192%2C193%2C0%2C0%2C0%2C193%2C132%2C0%2C0%2C0%2C187%2C0%2C901%2C182%2C901%2C902%2C903%26deal1%3D17%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C760%2C761%2C813%2C815%2C816%2C817%2C818%2C819%2C899%2C917%2C918%2C919%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C3933%2C4184%2C4186%2C4604%2C5747%2C6293%2C6294%2C6295%2C6983%2C7035%2C7036%2C7605%2C7606%2C7607%2C7608%2C7609%2C7610%2C7611%2C7612%2C7613%2C7614%2C7615%2C7616%2C7617%2C7618%2C7788%2C7789%2C7790%2C7993%2C7994%2C7995%2C7996%2C7997%2C7998%2C7999%2C8057%2C6772%2C5534%2C7661%2C7713%2C7%2C8%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C915%2C874%2C835%2C19%2C2688%2C3045%2C4276%2C7330%2C916%26osb%3DLinux%252FChrome%26lb%3D120%26reqt%3D1762685587839&cust_params=li-module-enabled%3Dt1&adks=318048222&frm=20&eo_id_str=ID%3Dd758a0372e0d617e%3AT%3D1762685587%3ART%3D1762685587%3AS%3DAA-AfjbrkAa_d6zy1Ty3ihSBvc1X&pbbce=1&td=1&egid=3721&tan=5e3107b9-1e1c-45dc-be13-7701b2f8f58c&tdf=2
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511040101/pubads_impl.js?cb=31095648
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c21::9b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
2c03c98ced5fdb6127e864c884b409b7b7d11085be4b22b1514e14ce21debf91
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

content-encoding
dcb
google-lineitem-id
-2
observe-browsing-topics
?1
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sun, 09 Nov 2025 10:53:08 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-2
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
252
x-xss-protection
0
server
cafe
ads
securepubads.g.doubleclick.net/gampad/ 		386 B
186 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4347117103472909&correlator=587201677842335&eid=31095133%2C31095250%2C31095648%2C83321072&output=ldjh&gdfp_req=1&vrg=202511040101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=8&didk=1697938527&dids=div-gpt-ad-mediafire_com-box-2&adfs=2211965457&sfv=1-0-45&rcs=1&eri=1&sc=1&cookie=ID%3D710d595ddee055b4%3AT%3D1762685587%3ART%3D1762685587%3AS%3DALNI_MZJGZDvti4dTz_nkocz4FF59h3kSg&gpic=UID%3D0000130a10d732ad%3AT%3D1762685587%3ART%3D1762685587%3AS%3DALNI_MaUVZBE6m9Fvpz6Zk1r3wnftELu7g&abxe=1&dt=1762685588370&lmt=1762685588&adxs=552&adys=10&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fzh1io5g5cavqo7l%2FRose%252527s_bot.zip%2Ffile&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGsnagfdyAXD0DPc9AFqju0TqrX000hchSIhrXFo4TbSB3VyZAYN0yY8-1N6Njw&topics=3&tps=3&htps=10&a3p=EkYKDGF1ZGlnZW50LmNvbRI0MDAwMXl1bTBlYWJrYmE5OGJjaWFlNmdpYmRkajk2bGRjbGY3ODZraGRhYWJhY2trYzJqbFgBEpMBCgpjcml0ZW8uY29tEoIBMFN0VGhGOUJRV2xGTUhKMloyZFBSekZ0V25aVFdqWlljM1pLYTFWc00wZEZjbUUyVDFGNlpIcHJaV3huVkRNelpIRTBRa1prU0ROTmJVZHhaMjFyTURKQlFtMXdVR1JDUVcweU1XMW5iSE5xY2xsQlozcG9ZVlZMUVNVelJDVXpSQVgBEjYKDGFkc2VydmVyLm9yZxIkYzQ4NWY5ZjYtMmQ3ZS00NjI3LTg5MGQtYTcxYWNkZjY0N2FlWAESNAoKcHViY2lkLm9yZxIkZGU2ZDJhZjYtYjA1YS00ZWU5LWE3N2UtYzczNDAyNmZmNDljWAESWgoNY3J3ZGNudHJsLm5ldBJAZDJlNzViOGU0OTJlNzQzMDA0ZWQwZGJjNmMwNDE4NWNhMDJjYzUxZTRkYTE2NDNiYjA2NDc3NGZiYzk0YjdkYhj6oP7BpjNIABIdCg5lc3AuY3JpdGVvLmNvbRi9n_7BpjNIAFICCGQSGAoJeWFob28uY29tGJyh_sGmM0gAUgIIbxI-CgVvcGVueBIsZXlKcElqb2lVbmQ0ZVRNNFJUQlJka3RqWkhOa2RYaFRLeTlLWnowOUluMD0YwqP-waYzSAASGwoMMzNhY3Jvc3MuY29tGLyf_sGmM0gAUgIIZBKCAgoIcnRiaG91c2US7AFVbk9IMjhrcm5SeW5Rc2o4NDA1WFAxamppWGs4ZnhmMUtzNUlZeVpNTkI3QlZIMGlrVTZ2RUJwQ0hhWHVqdEVxSUtzcEVJU1plaGpQdE5zcSsrQnZqeGRpTU5Wb0ZDQWMrM2tsYS9uQkVmVXphRlR5WlJlbEtMUHp5YXZqb3JtdlRzR1BQWTg4NnFkeVdYQ0FPekl4V29xeWJhbjd3c3lPN2M2ai9LVi9WMjdwSm44Tjh0WXh1M05HYzMrY1BsczBZM2ZKMzZyZEpsRWNyYmdvSElhcHY5ZmpxRHE2WG05SjBIQVdheEM1WjF3PRiyo_7BpjNIAA..&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1762685584931&idt=2383&ppid=3b25ce83c75aeff52ef9657aec7de9f7&prev_scp=a%3D1%26iid1%3D6146046926352970%26eid%3D6146046926352970%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D0%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252Fzh1io5g5cavqo7l%252FRose%25252527s_bot.zip%252Ffile%26path%3D%252Ffile%252Fzh1io5g5cavqo7l%252FRose%252527s_bot.zip%252Ffile%26ap%3D1103%26sap%3D1103%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-box-2%26tap%3Dmediafire_com-box-2-6146046926352970%26eb_br%3D3530fcb6bcc13dc3c1712eaef7d92700%26eba%3D0%26bv%3D5%26bvm%3D0%26bvr%3D5%26avc%3D115%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D160%26br2%3D160%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D146%2C168%2C0%2C0%2C0%2C168%2C184%2C20%2C0%2C0%2C192%2C0%2C902%2C903%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2764%2C2765%2C3054%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4186%2C5747%2C6293%2C6294%2C6295%2C7036%2C7605%2C7606%2C7607%2C7608%2C7609%2C7610%2C7611%2C7612%2C7613%2C7614%2C7615%2C7616%2C7617%2C7618%2C7788%2C7790%2C7993%2C7994%2C7995%2C7996%2C7997%2C7998%2C7999%2C6772%2C5534%2C7661%2C7713%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C17%2C20%2C2351%2C2526%2C2527%2C2761%2C2763%2C3044%2C3154%2C7789%2C8%2C9%2C874%2C835%26osb%3DLinux%252FChrome%26lb%3D300%26reqt%3D1762685587784&cust_params=li-module-enabled%3Dt1&adks=3106951849&frm=20&eo_id_str=ID%3Dd758a0372e0d617e%3AT%3D1762685587%3ART%3D1762685587%3AS%3DAA-AfjbrkAa_d6zy1Ty3ihSBvc1X&pbbce=1&td=1&egid=3721&tan=5e3107b9-1e1c-45dc-be13-7701b2f8f58d&tdf=2
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511040101/pubads_impl.js?cb=31095648
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c21::9b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
1b3e74c47c57f5a2cb0ae7fe032896407ca8aa9cb3967069806adc7ba89e7652
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

content-encoding
dcb
google-lineitem-id
-2
observe-browsing-topics
?1
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sun, 09 Nov 2025 10:53:08 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-2
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
156
x-xss-protection
0
server
cafe
ads
securepubads.g.doubleclick.net/gampad/ 		388 B
188 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4347117103472909&correlator=3979658526977585&eid=31095133%2C31095250%2C31095648%2C83321072&output=ldjh&gdfp_req=1&vrg=202511040101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-edge-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C160x600&fluid=height&ifi=9&didk=2994425013&dids=div-gpt-ad-mediafire_com-edge-&adfs=982453029&sfv=1-0-45&rcs=1&eri=1&sc=1&cookie=ID%3D710d595ddee055b4%3AT%3D1762685587%3ART%3D1762685587%3AS%3DALNI_MZJGZDvti4dTz_nkocz4FF59h3kSg&gpic=UID%3D0000130a10d732ad%3AT%3D1762685587%3ART%3D1762685587%3AS%3DALNI_MaUVZBE6m9Fvpz6Zk1r3wnftELu7g&abxe=1&dt=1762685588381&lmt=1762685588&adxs=1440&adys=300&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=5&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fzh1io5g5cavqo7l%2FRose%252527s_bot.zip%2Ffile&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGsnagfdyAXD0DPc9AFqju0TqrX000hchSIhrXFo4TbSB3VyZAYN0yY8-1N6Njw&topics=3&tps=3&htps=10&a3p=EkYKDGF1ZGlnZW50LmNvbRI0MDAwMXl1bTBlYWJrYmE5OGJjaWFlNmdpYmRkajk2bGRjbGY3ODZraGRhYWJhY2trYzJqbFgBEpMBCgpjcml0ZW8uY29tEoIBMFN0VGhGOUJRV2xGTUhKMloyZFBSekZ0V25aVFdqWlljM1pLYTFWc00wZEZjbUUyVDFGNlpIcHJaV3huVkRNelpIRTBRa1prU0ROTmJVZHhaMjFyTURKQlFtMXdVR1JDUVcweU1XMW5iSE5xY2xsQlozcG9ZVlZMUVNVelJDVXpSQVgBEjYKDGFkc2VydmVyLm9yZxIkYzQ4NWY5ZjYtMmQ3ZS00NjI3LTg5MGQtYTcxYWNkZjY0N2FlWAESNAoKcHViY2lkLm9yZxIkZGU2ZDJhZjYtYjA1YS00ZWU5LWE3N2UtYzczNDAyNmZmNDljWAESWgoNY3J3ZGNudHJsLm5ldBJAZDJlNzViOGU0OTJlNzQzMDA0ZWQwZGJjNmMwNDE4NWNhMDJjYzUxZTRkYTE2NDNiYjA2NDc3NGZiYzk0YjdkYhj6oP7BpjNIABIdCg5lc3AuY3JpdGVvLmNvbRi9n_7BpjNIAFICCGQSGAoJeWFob28uY29tGJyh_sGmM0gAUgIIbxI-CgVvcGVueBIsZXlKcElqb2lVbmQ0ZVRNNFJUQlJka3RqWkhOa2RYaFRLeTlLWnowOUluMD0YwqP-waYzSAASGwoMMzNhY3Jvc3MuY29tGLyf_sGmM0gAUgIIZBKCAgoIcnRiaG91c2US7AFVbk9IMjhrcm5SeW5Rc2o4NDA1WFAxamppWGs4ZnhmMUtzNUlZeVpNTkI3QlZIMGlrVTZ2RUJwQ0hhWHVqdEVxSUtzcEVJU1plaGpQdE5zcSsrQnZqeGRpTU5Wb0ZDQWMrM2tsYS9uQkVmVXphRlR5WlJlbEtMUHp5YXZqb3JtdlRzR1BQWTg4NnFkeVdYQ0FPekl4V29xeWJhbjd3c3lPN2M2ai9LVi9WMjdwSm44Tjh0WXh1M05HYzMrY1BsczBZM2ZKMzZyZEpsRWNyYmdvSElhcHY5ZmpxRHE2WG05SjBIQVdheEM1WjF3PRiyo_7BpjNIAA..&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1762685584931&idt=2383&ppid=3b25ce83c75aeff52ef9657aec7de9f7&prev_scp=a%3D1%26iid1%3D1562860810369568%26eid%3D1562860810369568%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D0%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252Fzh1io5g5cavqo7l%252FRose%25252527s_bot.zip%252Ffile%26path%3D%252Ffile%252Fzh1io5g5cavqo7l%252FRose%252527s_bot.zip%252Ffile%26ap%3D1102%26sap%3D1102%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D3%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D39%26al%3D1039%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-edge-2%26tap%3Dmediafire_com-edge-2-1562860810369568%26eb_br%3Dee685f77592ce296910ee91457d66ba3%26eba%3D0%26bv%3D11%26bvm%3D0%26bvr%3D1%26avc%3D33%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D40%26br2%3D40%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D146%2C168%2C0%2C0%2C0%2C168%2C184%2C20%2C0%2C0%2C192%2C0%2C902%2C903%2C901%2C902%2C903%26deal1%3D17%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2688%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4186%2C5747%2C6293%2C6294%2C6295%2C7035%2C7036%2C7605%2C7606%2C7607%2C7608%2C7609%2C7610%2C7611%2C7612%2C7613%2C7614%2C7615%2C7616%2C7617%2C7618%2C7788%2C7789%2C7790%2C7993%2C7994%2C7995%2C7996%2C7997%2C7998%2C7999%2C6772%2C5534%2C7661%2C7713%2C7%2C8%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C916%2C915%2C874%2C835%2C2693%2C3045%2C4276%2C7330%26osb%3DLinux%252FChrome%26lb%3D80%26reqt%3D1762685587901&cust_params=li-module-enabled%3Dt1&adks=3081006461&frm=20&eo_id_str=ID%3Dd758a0372e0d617e%3AT%3D1762685587%3ART%3D1762685587%3AS%3DAA-AfjbrkAa_d6zy1Ty3ihSBvc1X&pbbce=1&td=1&egid=3721&tan=5e3107b9-1e1c-45dc-be13-7701b2f8f58e&tdf=2
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511040101/pubads_impl.js?cb=31095648
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c21::9b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
f89239b20e6a4dbae7354cd7677fbfb57c6b517066a94276b43270c078753072
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

content-encoding
dcb
google-lineitem-id
-2
observe-browsing-topics
?1
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sun, 09 Nov 2025 10:53:08 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-2
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
158
x-xss-protection
0
server
cafe
ads
securepubads.g.doubleclick.net/gampad/ 		388 B
188 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4347117103472909&correlator=3180613253143789&eid=31095133%2C31095250%2C31095648%2C83321072&output=ldjh&gdfp_req=1&vrg=202511040101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-edge-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C160x600&fluid=height&ifi=10&didk=2994273263&dids=div-gpt-ad-mediafire_com-edge-&adfs=580935078&sfv=1-0-45&rcs=1&eri=1&sc=1&cookie=ID%3D710d595ddee055b4%3AT%3D1762685587%3ART%3D1762685587%3AS%3DALNI_MZJGZDvti4dTz_nkocz4FF59h3kSg&gpic=UID%3D0000130a10d732ad%3AT%3D1762685587%3ART%3D1762685587%3AS%3DALNI_MaUVZBE6m9Fvpz6Zk1r3wnftELu7g&abxe=1&dt=1762685588395&lmt=1762685588&adxs=0&adys=300&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=4&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fzh1io5g5cavqo7l%2FRose%252527s_bot.zip%2Ffile&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGsnagfdyAXD0DPc9AFqju0TqrX000hchSIhrXFo4TbSB3VyZAYN0yY8-1N6Njw&topics=3&tps=3&htps=10&a3p=EkYKDGF1ZGlnZW50LmNvbRI0MDAwMXl1bTBlYWJrYmE5OGJjaWFlNmdpYmRkajk2bGRjbGY3ODZraGRhYWJhY2trYzJqbFgBEpMBCgpjcml0ZW8uY29tEoIBMFN0VGhGOUJRV2xGTUhKMloyZFBSekZ0V25aVFdqWlljM1pLYTFWc00wZEZjbUUyVDFGNlpIcHJaV3huVkRNelpIRTBRa1prU0ROTmJVZHhaMjFyTURKQlFtMXdVR1JDUVcweU1XMW5iSE5xY2xsQlozcG9ZVlZMUVNVelJDVXpSQVgBEjYKDGFkc2VydmVyLm9yZxIkYzQ4NWY5ZjYtMmQ3ZS00NjI3LTg5MGQtYTcxYWNkZjY0N2FlWAESNAoKcHViY2lkLm9yZxIkZGU2ZDJhZjYtYjA1YS00ZWU5LWE3N2UtYzczNDAyNmZmNDljWAESWgoNY3J3ZGNudHJsLm5ldBJAZDJlNzViOGU0OTJlNzQzMDA0ZWQwZGJjNmMwNDE4NWNhMDJjYzUxZTRkYTE2NDNiYjA2NDc3NGZiYzk0YjdkYhj6oP7BpjNIABIdCg5lc3AuY3JpdGVvLmNvbRi9n_7BpjNIAFICCGQSGAoJeWFob28uY29tGJyh_sGmM0gAUgIIbxI-CgVvcGVueBIsZXlKcElqb2lVbmQ0ZVRNNFJUQlJka3RqWkhOa2RYaFRLeTlLWnowOUluMD0YwqP-waYzSAASGwoMMzNhY3Jvc3MuY29tGLyf_sGmM0gAUgIIZBKCAgoIcnRiaG91c2US7AFVbk9IMjhrcm5SeW5Rc2o4NDA1WFAxamppWGs4ZnhmMUtzNUlZeVpNTkI3QlZIMGlrVTZ2RUJwQ0hhWHVqdEVxSUtzcEVJU1plaGpQdE5zcSsrQnZqeGRpTU5Wb0ZDQWMrM2tsYS9uQkVmVXphRlR5WlJlbEtMUHp5YXZqb3JtdlRzR1BQWTg4NnFkeVdYQ0FPekl4V29xeWJhbjd3c3lPN2M2ai9LVi9WMjdwSm44Tjh0WXh1M05HYzMrY1BsczBZM2ZKMzZyZEpsRWNyYmdvSElhcHY5ZmpxRHE2WG05SjBIQVdheEM1WjF3PRiyo_7BpjNIAA..&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1762685584931&idt=2383&ppid=3b25ce83c75aeff52ef9657aec7de9f7&prev_scp=a%3D1%26iid1%3D6821571650405327%26eid%3D6821571650405327%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D0%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252Fzh1io5g5cavqo7l%252FRose%25252527s_bot.zip%252Ffile%26path%3D%252Ffile%252Fzh1io5g5cavqo7l%252FRose%252527s_bot.zip%252Ffile%26ap%3D1101%26sap%3D1101%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D4%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D38%26al%3D1038%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-edge-1%26tap%3Dmediafire_com-edge-1-6821571650405327%26eb_br%3D8c5ffefb122f59a66a8b7672d4452af2%26eba%3D0%26bv%3D23%26bvm%3D0%26bvr%3D3%26avc%3D24%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D36%26br2%3D34%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D157%2C193%2C207%2C27%2C195%2C25%2C91%2C20%2C71%2C171%2C175%2C0%2C124%2C199%2C901%2C902%2C903%26deal1%3D17%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2688%2C2761%2C2763%2C2764%2C2765%2C3044%2C3045%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4186%2C5747%2C6293%2C6294%2C6295%2C7035%2C7036%2C7330%2C7605%2C7606%2C7607%2C7608%2C7609%2C7610%2C7611%2C7612%2C7613%2C7614%2C7615%2C7616%2C7617%2C7618%2C7788%2C7789%2C7790%2C7993%2C7994%2C7995%2C7996%2C7997%2C7998%2C7999%2C6772%2C5534%2C7661%2C7713%2C7%2C8%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C916%2C915%2C874%2C835%2C2693%2C3053%2C4276%2C7331%26osb%3DLinux%252FChrome%26lb%3D70%26reqt%3D1762685587863&cust_params=li-module-enabled%3Dt1&adks=3527628052&frm=20&eo_id_str=ID%3Dd758a0372e0d617e%3AT%3D1762685587%3ART%3D1762685587%3AS%3DAA-AfjbrkAa_d6zy1Ty3ihSBvc1X&pbbce=1&td=1&egid=3721&tan=5e3107b9-1e1c-45dc-be13-7701b2f8f58f&tdf=2
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511040101/pubads_impl.js?cb=31095648
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c21::9b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
2818bbf85b8c0ab13945d52ef16974f9a36c0808a09455e1692d921e14b0c128
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

content-encoding
dcb
google-lineitem-id
-2
observe-browsing-topics
?1
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sun, 09 Nov 2025 10:53:08 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-2
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
158
x-xss-protection
0
server
cafe
ads
securepubads.g.doubleclick.net/gampad/ 		396 B
193 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4347117103472909&correlator=823359722213631&eid=31095133%2C31095250%2C31095648%2C83321072&output=ldjh&gdfp_req=1&vrg=202511040101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-medrectangle-3&enc_prev_ius=%2F0%2F1&prev_iu_szs=336x280&ifi=11&didk=46179496&dids=div-gpt-ad-mediafire_com-medre&adfs=1911771697&sfv=1-0-45&rcs=1&eri=1&sc=1&cookie=ID%3D710d595ddee055b4%3AT%3D1762685587%3ART%3D1762685587%3AS%3DALNI_MZJGZDvti4dTz_nkocz4FF59h3kSg&gpic=UID%3D0000130a10d732ad%3AT%3D1762685587%3ART%3D1762685587%3AS%3DALNI_MaUVZBE6m9Fvpz6Zk1r3wnftELu7g&abxe=1&dt=1762685588407&lmt=1762685588&adxs=320&adys=120&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=2&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fzh1io5g5cavqo7l%2FRose%252527s_bot.zip%2Ffile&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGsnagfdyAXD0DPc9AFqju0TqrX000hchSIhrXFo4TbSB3VyZAYN0yY8-1N6Njw&topics=3&tps=3&htps=10&a3p=EkYKDGF1ZGlnZW50LmNvbRI0MDAwMXl1bTBlYWJrYmE5OGJjaWFlNmdpYmRkajk2bGRjbGY3ODZraGRhYWJhY2trYzJqbFgBEpMBCgpjcml0ZW8uY29tEoIBMFN0VGhGOUJRV2xGTUhKMloyZFBSekZ0V25aVFdqWlljM1pLYTFWc00wZEZjbUUyVDFGNlpIcHJaV3huVkRNelpIRTBRa1prU0ROTmJVZHhaMjFyTURKQlFtMXdVR1JDUVcweU1XMW5iSE5xY2xsQlozcG9ZVlZMUVNVelJDVXpSQVgBEjYKDGFkc2VydmVyLm9yZxIkYzQ4NWY5ZjYtMmQ3ZS00NjI3LTg5MGQtYTcxYWNkZjY0N2FlWAESNAoKcHViY2lkLm9yZxIkZGU2ZDJhZjYtYjA1YS00ZWU5LWE3N2UtYzczNDAyNmZmNDljWAESWgoNY3J3ZGNudHJsLm5ldBJAZDJlNzViOGU0OTJlNzQzMDA0ZWQwZGJjNmMwNDE4NWNhMDJjYzUxZTRkYTE2NDNiYjA2NDc3NGZiYzk0YjdkYhj6oP7BpjNIABIdCg5lc3AuY3JpdGVvLmNvbRi9n_7BpjNIAFICCGQSGAoJeWFob28uY29tGJyh_sGmM0gAUgIIbxI-CgVvcGVueBIsZXlKcElqb2lVbmQ0ZVRNNFJUQlJka3RqWkhOa2RYaFRLeTlLWnowOUluMD0YwqP-waYzSAASGwoMMzNhY3Jvc3MuY29tGLyf_sGmM0gAUgIIZBKCAgoIcnRiaG91c2US7AFVbk9IMjhrcm5SeW5Rc2o4NDA1WFAxamppWGs4ZnhmMUtzNUlZeVpNTkI3QlZIMGlrVTZ2RUJwQ0hhWHVqdEVxSUtzcEVJU1plaGpQdE5zcSsrQnZqeGRpTU5Wb0ZDQWMrM2tsYS9uQkVmVXphRlR5WlJlbEtMUHp5YXZqb3JtdlRzR1BQWTg4NnFkeVdYQ0FPekl4V29xeWJhbjd3c3lPN2M2ai9LVi9WMjdwSm44Tjh0WXh1M05HYzMrY1BsczBZM2ZKMzZyZEpsRWNyYmdvSElhcHY5ZmpxRHE2WG05SjBIQVdheEM1WjF3PRiyo_7BpjNIAA..&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1762685584931&idt=2383&ppid=3b25ce83c75aeff52ef9657aec7de9f7&prev_scp=a%3D1%26iid1%3D7611442246396448%26eid%3D7611442246396448%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D0%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252Fzh1io5g5cavqo7l%252FRose%25252527s_bot.zip%252Ffile%26path%3D%252Ffile%252Fzh1io5g5cavqo7l%252FRose%252527s_bot.zip%252Ffile%26ap%3D1104%26sap%3D1104%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D5%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D21%26al%3D1021%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-medrectangle-3%26tap%3Dmediafire_com-medrectangle-3-7611442246396448%26eb_br%3D43aa1607a0c08c74b14a9039e7b909b4%26eba%3D0%26bv%3D5%26bvm%3D0%26bvr%3D5%26avc%3D194%26shp%3D3%26ftsn%3D12%26ftsng%3D12%26br1%3D220%26br2%3D240%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D157%2C168%2C0%2C0%2C0%2C168%2C184%2C20%2C0%2C0%2C192%2C0%2C902%2C903%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C760%2C761%2C815%2C816%2C817%2C818%2C893%2C899%2C903%2C919%2C1794%2C2339%2C3054%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3915%2C3919%2C3933%2C4185%2C4186%2C4604%2C4605%2C5747%2C6044%2C6045%2C6293%2C6294%2C6295%2C6983%2C7036%2C7046%2C7144%2C7605%2C7606%2C7607%2C7608%2C7609%2C7610%2C7611%2C7612%2C7613%2C7614%2C7615%2C7616%2C7617%2C7618%2C7788%2C7790%2C7993%2C7994%2C7995%2C7996%2C7997%2C7998%2C7999%2C8057%2C8069%2C6772%2C5534%2C7661%2C7713%2C11%2C12%2C13%2C14%2C15%2C16%2C20%2C2310%2C2526%2C2527%2C2763%2C2764%2C2765%2C3154%2C3684%2C4184%2C9%2C10%26osb%3DLinux%252FChrome%26lb%3D450%26reqt%3D1762685587833&cust_params=li-module-enabled%3Dt1&adks=4079446691&frm=20&eo_id_str=ID%3Dd758a0372e0d617e%3AT%3D1762685587%3ART%3D1762685587%3AS%3DAA-AfjbrkAa_d6zy1Ty3ihSBvc1X&pbbce=1&td=1&egid=3721&tan=5e3107b9-1e1c-45dc-be13-7701b2f8f590&tdf=2
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511040101/pubads_impl.js?cb=31095648
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c21::9b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
bb752c6d8cbeadd39cfd090c1428ad6a5eaa87adcd05f4aff3f071d731aeb31a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

content-encoding
dcb
google-lineitem-id
-2
observe-browsing-topics
?1
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sun, 09 Nov 2025 10:53:08 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-2
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
163
x-xss-protection
0
server
cafe
ads
securepubads.g.doubleclick.net/gampad/ 		396 B
194 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4347117103472909&correlator=4229062914088138&eid=31095133%2C31095250%2C31095648%2C83321072&output=ldjh&gdfp_req=1&vrg=202511040101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-medrectangle-4&enc_prev_ius=%2F0%2F1&prev_iu_szs=336x280%7C300x250&ifi=12&didk=46192883&dids=div-gpt-ad-mediafire_com-medre&adfs=1749122204&sfv=1-0-45&rcs=1&eri=1&sc=1&cookie=ID%3D710d595ddee055b4%3AT%3D1762685587%3ART%3D1762685587%3AS%3DALNI_MZJGZDvti4dTz_nkocz4FF59h3kSg&gpic=UID%3D0000130a10d732ad%3AT%3D1762685587%3ART%3D1762685587%3AS%3DALNI_MaUVZBE6m9Fvpz6Zk1r3wnftELu7g&abxe=1&dt=1762685588417&lmt=1762685588&adxs=320&adys=420&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=3&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fzh1io5g5cavqo7l%2FRose%252527s_bot.zip%2Ffile&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGsnagfdyAXD0DPc9AFqju0TqrX000hchSIhrXFo4TbSB3VyZAYN0yY8-1N6Njw&topics=3&tps=3&htps=10&a3p=EkYKDGF1ZGlnZW50LmNvbRI0MDAwMXl1bTBlYWJrYmE5OGJjaWFlNmdpYmRkajk2bGRjbGY3ODZraGRhYWJhY2trYzJqbFgBEpMBCgpjcml0ZW8uY29tEoIBMFN0VGhGOUJRV2xGTUhKMloyZFBSekZ0V25aVFdqWlljM1pLYTFWc00wZEZjbUUyVDFGNlpIcHJaV3huVkRNelpIRTBRa1prU0ROTmJVZHhaMjFyTURKQlFtMXdVR1JDUVcweU1XMW5iSE5xY2xsQlozcG9ZVlZMUVNVelJDVXpSQVgBEjYKDGFkc2VydmVyLm9yZxIkYzQ4NWY5ZjYtMmQ3ZS00NjI3LTg5MGQtYTcxYWNkZjY0N2FlWAESNAoKcHViY2lkLm9yZxIkZGU2ZDJhZjYtYjA1YS00ZWU5LWE3N2UtYzczNDAyNmZmNDljWAESWgoNY3J3ZGNudHJsLm5ldBJAZDJlNzViOGU0OTJlNzQzMDA0ZWQwZGJjNmMwNDE4NWNhMDJjYzUxZTRkYTE2NDNiYjA2NDc3NGZiYzk0YjdkYhj6oP7BpjNIABIdCg5lc3AuY3JpdGVvLmNvbRi9n_7BpjNIAFICCGQSGAoJeWFob28uY29tGJyh_sGmM0gAUgIIbxI-CgVvcGVueBIsZXlKcElqb2lVbmQ0ZVRNNFJUQlJka3RqWkhOa2RYaFRLeTlLWnowOUluMD0YwqP-waYzSAASGwoMMzNhY3Jvc3MuY29tGLyf_sGmM0gAUgIIZBKCAgoIcnRiaG91c2US7AFVbk9IMjhrcm5SeW5Rc2o4NDA1WFAxamppWGs4ZnhmMUtzNUlZeVpNTkI3QlZIMGlrVTZ2RUJwQ0hhWHVqdEVxSUtzcEVJU1plaGpQdE5zcSsrQnZqeGRpTU5Wb0ZDQWMrM2tsYS9uQkVmVXphRlR5WlJlbEtMUHp5YXZqb3JtdlRzR1BQWTg4NnFkeVdYQ0FPekl4V29xeWJhbjd3c3lPN2M2ai9LVi9WMjdwSm44Tjh0WXh1M05HYzMrY1BsczBZM2ZKMzZyZEpsRWNyYmdvSElhcHY5ZmpxRHE2WG05SjBIQVdheEM1WjF3PRiyo_7BpjNIAA..&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1762685584931&idt=2383&ppid=3b25ce83c75aeff52ef9657aec7de9f7&prev_scp=a%3D1%26iid1%3D6017477134385895%26eid%3D6017477134385895%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D0%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252Fzh1io5g5cavqo7l%252FRose%25252527s_bot.zip%252Ffile%26path%3D%252Ffile%252Fzh1io5g5cavqo7l%252FRose%252527s_bot.zip%252Ffile%26ap%3D1105%26sap%3D1105%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D6%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D22%26al%3D1022%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-medrectangle-4%26tap%3Dmediafire_com-medrectangle-4-6017477134385895%26eb_br%3D58ef7bddb438af5e257c4377f32c243a%26eba%3D0%26bv%3D13%26bvm%3D0%26bvr%3D3%26avc%3D89%26shp%3D3%26ftsn%3D12%26ftsng%3D12%26br1%3D120%26br2%3D120%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D34%2C168%2C0%2C0%2C0%2C168%2C184%2C20%2C0%2C0%2C192%2C0%2C902%2C903%2C901%2C902%2C903%26deal1%3D20%2C21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C760%2C761%2C815%2C816%2C817%2C818%2C899%2C919%2C1794%2C2310%2C2339%2C2526%2C2527%2C2763%2C2764%2C2765%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C3919%2C3933%2C4184%2C4185%2C4186%2C4604%2C4605%2C5747%2C6044%2C6293%2C6294%2C6295%2C6983%2C7036%2C7046%2C7605%2C7606%2C7607%2C7608%2C7609%2C7610%2C7611%2C7612%2C7613%2C7614%2C7615%2C7616%2C7617%2C7618%2C7788%2C7790%2C7993%2C7994%2C7995%2C7996%2C7997%2C7998%2C7999%2C8057%2C6772%2C5534%2C7661%2C7713%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C17%2C2351%2C2610%2C2761%2C3044%2C7035%2C7327%2C7789%2C7%2C8%2C915%2C874%2C835%26osb%3DLinux%252FChrome%26lb%3D240%26reqt%3D1762685587846&cust_params=li-module-enabled%3Dt1&adks=1277606936&frm=20&eo_id_str=ID%3Dd758a0372e0d617e%3AT%3D1762685587%3ART%3D1762685587%3AS%3DAA-AfjbrkAa_d6zy1Ty3ihSBvc1X&pbbce=1&td=1&egid=3721&tan=5e3107b9-1e1c-45dc-be13-7701b2f8f591&tdf=2
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511040101/pubads_impl.js?cb=31095648
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c21::9b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
b96c9ee60e9c70dc8b620d4f90fdda2e76175302540b3c68398a29ae525fd5aa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

content-encoding
dcb
google-lineitem-id
-2
observe-browsing-topics
?1
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sun, 09 Nov 2025 10:53:08 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-2
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
164
x-xss-protection
0
server
cafe
ping
pagead2.googlesyndication.com/pagead/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/ping?e=1
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511040101/pubads_impl.js?cb=31095648
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c21::9d Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8
Referer
https://www.mediafire.com/

Response headers
px.gif
ad-delivery.net/ 		43 B
140 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ad-delivery.net/px.gif?ch=2&e=0.6415925877810054
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac42:948c -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

x-goog-metageneration
5
access-control-expose-headers
*, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash
crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status
HIT
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3"
age
499290
x-goog-stored-content-encoding
identity
expires
Mon, 03 Nov 2025 16:44:11 GMT
x-goog-stored-content-length
43
date
Sun, 09 Nov 2025 10:53:08 GMT
content-type
image/gif
last-modified
Wed, 05 May 2021 19:25:32 GMT
vary
accept-encoding
x-guploader-uploadid
AAwnv3LS2q6BRDz0udyMq8SGqsPxAD9_9_o6mzrHaQCRyGk0sZz7XK3QmjtCjxaiR2NTdoeX6-0UZCs
cache-control
public, max-age=86400
x-goog-storage-class
MULTI_REGIONAL
cf-ray
99bcc3bfcbee7d0b-EWR
accept-ranges
bytes
access-control-allow-origin
*
x-goog-generation
1620242732037093
content-length
43
server
cloudflare
favicon.ico
ad.doubleclick.net/ 		1 KB
129 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.8864807536848286
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.16.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bl-in-f149.1e100.net
Software
sffe /
Resource Hash
d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

content-encoding
gzip
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options
nosniff
expires
Mon, 10 Nov 2025 10:53:08 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sun, 09 Nov 2025 10:53:08 GMT
content-type
image/x-icon
vary
Accept-Encoding
last-modified
Tue, 08 May 2012 13:08:06 GMT
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
content-length
104
x-xss-protection
0
server
sffe
v3
id5-sync.com/gm/ 		2 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://id5-sync.com/gm/v3
Requested by
Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.95.33.120 , Germany, ASN16276 (OVH OVH SAS, FR),
Reverse DNS
ns3203256.ip-141-95-33.eu
Software
/
Resource Hash
d6577a0d1cd3174e43c8889a25c8e7a8b4011332d5ff4064000918a69a607eaf
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type
text/plain
Referer
https://www.mediafire.com/

Response headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
access-control-allow-credentials
true
expires
Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin
https://www.mediafire.com
p3p
CP="CAO PSA OUR"
date
Sun, 09 Nov 2025 10:53:08 GMT
content-type
application/json
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
sodar
pagead2.googlesyndication.com/pagead/ Frame 80BE 		0
17 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=237&li=gpt_m202511040101&jk=4347117103472909&rc=
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c21::9a Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.google.com/

Response headers

timing-allow-origin
*
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Sun, 09 Nov 2025 10:53:08 GMT
x-xss-protection
0
content-type
image/
server
cafe
MV6IKlwdGMQEJvj2J2L6MG1DZM38r2qOinEvsRfQbD0.js
pagead2.googlesyndication.com/bg/ Frame 169D 		52 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/MV6IKlwdGMQEJvj2J2L6MG1DZM38r2qOinEvsRfQbD0.js
Requested by
Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/sodar2/237/runner.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c21::9a Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
315e882a5c1d18c40426f8f62762fa306d4364cdfcaf6a8e8a712fb117d06c3d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://ep2.adtrafficquality.google/

Response headers

content-encoding
br
age
1923
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
x-content-type-options
nosniff
expires
Mon, 09 Nov 2026 10:21:05 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sun, 09 Nov 2025 10:21:05 GMT
last-modified
Mon, 03 Nov 2025 09:48:00 GMT
content-type
text/javascript
vary
Accept-Encoding
cache-control
public, max-age=31536000
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
accept-ranges
bytes
content-length
20416
x-xss-protection
0
server
sffe
9.gif
id5-sync.com/c/457/429/0/
Redirect Chain
  • https://id5-sync.com/i/457/8.gif?o=api&id5id=ID5*L6dcw9uBB7wA4dcBVyE0kiY9PyEflkDWHSk1rzW_3ED__2kQcpRaAAEBCmkQcpMAYKI1FCOKhaz2PqZ0no7AQg&gdpr_consent=&gdpr=false
  • https://ice.360yield.com/match?publisher_dsp_id=313&dsp_callback=1&external_user_id=ID5-4007wBZrSBt2u_VMtlhmPapT1QQBLCIGvllbLiiwtA&r=https%3A%2F%2Fid5-sync.com%2Fcq%2F457%2F124%2F7%2F2.gif%3Fpuid%3...
  • https://ice.360yield.com/ul_cb/match?publisher_dsp_id=313&dsp_callback=1&external_user_id=ID5-4007wBZrSBt2u_VMtlhmPapT1QQBLCIGvllbLiiwtA&r=https%3A%2F%2Fid5-sync.com%2Fcq%2F457%2F124%2F7%2F2.gif%3F...
  • https://id5-sync.com/cq/457/124/7/2.gif?puid=c707a058-2136-4f29-b1c4-083fa08a881b&gdpr=0&gdpr_consent=&gdpr=0&gdpr_consent=
  • https://ib.adnxs.com/getuid?https://id5-sync.com/c/457/2/6/3.gif?puid=$UID&gdpr=0&gdpr_consent=
  • https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fid5-sync.com%2Fc%2F457%2F2%2F6%2F3.gif%3Fpuid%3D%24UID%26gdpr%3D0%26gdpr_consent%3D
  • https://id5-sync.com/c/457/2/6/3.gif?puid=8235546582011012259&gdpr=0&gdpr_consent=
  • https://pixel.tapad.com/idsync/ex/push?partner_id=2922&partner_url=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F108%2F5%2F4.gif%3Fpuid%3D%24%7BTA_DEVICE_ID%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_con...
  • https://id5-sync.com/c/457/108/5/4.gif?puid=902b7e08-fa5e-4445-8e77-e3a6b377c57e&gdpr=0&gdpr_consent=
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=8h9u11h&ttd_tpi=1&gdpr=0&gdpr_consent=
  • https://id5-sync.com/k/264.gif?puid=c485f9f6-2d7e-4627-890d-a71acdf647ae&ttl=%%TTL%%
  • https://dis.eu.criteo.com/dis/usersync.aspx?r=30&p=59&cp=id5&cu=1&url=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F203%2F3%2F6.gif%3Fpuid%3D%40%40CRITEO_USERID%40%40%26gdpr%3D0%26gdpr_consent%3D
  • https://id5-sync.com/c/457/203/3/6.gif?puid=cba929f6-04ca-4b00-a349-fbf3c575ffa3&gdpr=0&gdpr_consent=
  • https://sync.go.sonobi.com/us?loc=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F434%2F2%2F7.gif%3Fpuid%3D%5BUID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&consent=
  • https://id5-sync.com/c/457/434/2/7.gif?puid=01942e64-87c8-403a-b0dd-ae16eb00c547&gdpr=0&gdpr_consent=
  • https://sync.ipredictive.com/d/sync/cookie/generic?partner=id5&cspid=18&cb=&redirect=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F796%2F1%2F8.gif%3Fpuid%3D%24%7BADELPHIC_CUID%7D%26gdpr%3D0%26gdpr_consent...
  • https://id5-sync.com/c/457/796/1/8.gif?puid=aecd7ee1-4168-4d56-868c-6e0a1600cece&gdpr=0&gdpr_consent=
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?p=50935&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&rd=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F429%2F0%2F9.gif%3Fpuid%3D%23PM_USER_ID%26gdpr%3D0...
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?p=50935&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&rd=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F429%2F0%2F9.gif%3Fpuid%3D%23PM_USER_ID%26gdpr%3D0...
  • https://id5-sync.com/c/457/429/0/9.gif?puid=C1860927-6713-47E0-B05B-B74C5C3CA85E&gdpr=0&gdpr_consent=
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://id5-sync.com/c/457/429/0/9.gif?puid=C1860927-6713-47E0-B05B-B74C5C3CA85E&gdpr=0&gdpr_consent=
Protocol
H2
Server
141.95.33.120 , Germany, ASN16276 (OVH OVH SAS, FR),
Reverse DNS
ns3203256.ip-141-95-33.eu
Software
/
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
p3p
CP="CAO PSA OUR"
date
Sun, 09 Nov 2025 10:53:10 GMT
content-type
image/gif;charset=UTF-8
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers

Redirect headers

strict-transport-security
max-age=16070400; includeSubDomains
location
https://id5-sync.com/c/457/429/0/9.gif?puid=C1860927-6713-47E0-B05B-B74C5C3CA85E&gdpr=0&gdpr_consent=
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
0
date
Sun, 09 Nov 2025 10:53:11 GMT
content-type
text/html; charset=UTF-8
v3
id5-sync.com/gm/ 		2 KB
3 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://id5-sync.com/gm/v3
Requested by
Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.95.33.120 , Germany, ASN16276 (OVH OVH SAS, FR),
Reverse DNS
ns3203256.ip-141-95-33.eu
Software
/
Resource Hash
e719dd1add2297d7344ea35e1c8945b9db1902c9915029185a707daa885e91f1
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type
text/plain
Referer
https://www.mediafire.com/

Response headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
access-control-allow-credentials
true
expires
Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin
https://www.mediafire.com
p3p
CP="CAO PSA OUR"
date
Sun, 09 Nov 2025 10:53:08 GMT
content-type
application/json
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
generate_204
ep2.adtrafficquality.google/ Frame 169D 		0
40 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ep2.adtrafficquality.google/generate_204?QqJA0w
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c19::84 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://ep2.adtrafficquality.google/sodar/sodar2/237/runner.html

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
date
Sun, 09 Nov 2025 10:53:08 GMT
cross-origin-resource-policy
cross-origin
9.gif
id5-sync.com/c/457/429/0/
Redirect Chain
  • https://id5-sync.com/i/457/8.gif?o=api&id5id=ID5*gHivrXRe9NKvPiRv-P7H_InizE-wSbO4svbGwZpgLy7__2kQcpRaAAEBCmkQcpMAYKJCBj5pNXu_LKbOgRHVTQ&gdpr_consent=&gdpr=false
  • https://rtb.gumgum.com/getuid/id5?r=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F441%2F7%2F2.gif%3Fpuid%3D%5BUID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=
  • https://id5-sync.com/c/457/441/7/2.gif?puid=u_d05d49cb-e2eb-4f7c-9240-19b8f0fc7950&gdpr=0&gdpr_consent=
  • https://pixel.tapad.com/idsync/ex/push?partner_id=2922&partner_url=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F108%2F6%2F3.gif%3Fpuid%3D%24%7BTA_DEVICE_ID%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_con...
  • https://pixel.tapad.com/idsync/ex/push/check?partner_id=2922&partner_url=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F108%2F6%2F3.gif%3Fpuid%3D%24%7BTA_DEVICE_ID%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gd...
  • https://id5-sync.com/c/457/108/6/3.gif?puid=902b7e08-fa5e-4445-8e77-e3a6b377c57e&gdpr=0&gdpr_consent=
  • https://csync.loopme.me/?redirect=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F821%2F5%2F4.gif%3Fpuid%3D%7Bdevice_id%7D%26gdpr%3D0%26gdpr_consent%3D
  • https://id5-sync.com/c/457/821/5/4.gif?puid=83649b06-be2d-403c-b81d-ec4595791399&gdpr=0&gdpr_consent=
  • https://dis.eu.criteo.com/dis/usersync.aspx?r=30&p=59&cp=id5&cu=1&url=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F203%2F4%2F5.gif%3Fpuid%3D%40%40CRITEO_USERID%40%40%26gdpr%3D0%26gdpr_consent%3D
  • https://id5-sync.com/c/457/203/4/5.gif?puid=cba929f6-04ca-4b00-a349-fbf3c575ffa3&gdpr=0&gdpr_consent=
  • https://sync.ipredictive.com/d/sync/cookie/generic?partner=id5&cspid=18&cb=&redirect=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F796%2F3%2F6.gif%3Fpuid%3D%24%7BADELPHIC_CUID%7D%26gdpr%3D0%26gdpr_consent...
  • https://id5-sync.com/c/457/796/3/6.gif?puid=aecd7ee1-4168-4d56-868c-6e0a1600cece&gdpr=0&gdpr_consent=
  • https://ce.lijit.com/merge?pid=27&3pid=c485f9f6-2d7e-4627-890d-a71acdf647ae&us_privacy=&gdpr=0&gdpr_consent=&location=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F1245%2F2%2F7.gif%3Fpuid%3D%5BSOVRNID%5D%...
  • https://ce.lijit.com/merge?pid=27&3pid=c485f9f6-2d7e-4627-890d-a71acdf647ae&us_privacy=&gdpr=0&gdpr_consent=&location=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F1245%2F2%2F7.gif%3Fpuid%3D%5BSOVRNID%5D%...
  • https://id5-sync.com/c/457/1245/2/7.gif?puid=LpHtARZHbtwqUZ8wRKKKaTbn&gdpr=0&gdpr_consent=
  • https://sync.ipredictive.com/d/sync/cookie/generic?partner=id5&cspid=18&cb=&redirect=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F796%2F1%2F8.gif%3Fpuid%3D%24%7BADELPHIC_CUID%7D%26gdpr%3D0%26gdpr_consent...
  • https://id5-sync.com/c/457/796/1/8.gif?puid=aecd7ee1-4168-4d56-868c-6e0a1600cece&gdpr=0&gdpr_consent=
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?p=50935&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&rd=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F429%2F0%2F9.gif%3Fpuid%3D%23PM_USER_ID%26gdpr%3D0...
  • https://id5-sync.com/c/457/429/0/9.gif?puid=C1860927-6713-47E0-B05B-B74C5C3CA85E&gdpr=0&gdpr_consent=
43 B
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://id5-sync.com/c/457/429/0/9.gif?puid=C1860927-6713-47E0-B05B-B74C5C3CA85E&gdpr=0&gdpr_consent=
Protocol
H2
Server
141.95.33.120 , Germany, ASN16276 (OVH OVH SAS, FR),
Reverse DNS
ns3203256.ip-141-95-33.eu
Software
/
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
p3p
CP="CAO PSA OUR"
date
Sun, 09 Nov 2025 10:53:11 GMT
content-type
image/gif;charset=UTF-8
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers

Redirect headers

strict-transport-security
max-age=16070400; includeSubDomains
location
https://id5-sync.com/c/457/429/0/9.gif?puid=C1860927-6713-47E0-B05B-B74C5C3CA85E&gdpr=0&gdpr_consent=
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
0
date
Sun, 09 Nov 2025 10:53:11 GMT
content-type
text/html; charset=UTF-8
ad_impression
pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ 		60 B
336 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ad_impression
Requested by
Host: script-api.ccgateway.net
URL: https://script-api.ccgateway.net/script/bundle?id=www.mediafire.com&parentId=0dae949f4b
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.210.204.30 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-210-204-30.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
715199235705aaa7c6781030dac85b766262d77ec7c07aac6f4928f464d93583

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type
application/json
Referer
https://www.mediafire.com/

Response headers

access-control-allow-origin
https://www.mediafire.com
content-length
60
date
Sun, 09 Nov 2025 10:53:08 GMT
content-type
application/json; charset=utf-8
vary
Origin
access-control-allow-credentials
true
ad_impression
pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ 		60 B
336 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ad_impression
Requested by
Host: script-api.ccgateway.net
URL: https://script-api.ccgateway.net/script/bundle?id=www.mediafire.com&parentId=0dae949f4b
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.210.204.30 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-210-204-30.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
715199235705aaa7c6781030dac85b766262d77ec7c07aac6f4928f464d93583

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type
application/json
Referer
https://www.mediafire.com/

Response headers

access-control-allow-origin
https://www.mediafire.com
content-length
60
date
Sun, 09 Nov 2025 10:53:08 GMT
content-type
application/json; charset=utf-8
vary
Origin
access-control-allow-credentials
true
ad_impression
pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ 		60 B
336 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ad_impression
Requested by
Host: script-api.ccgateway.net
URL: https://script-api.ccgateway.net/script/bundle?id=www.mediafire.com&parentId=0dae949f4b
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.210.204.30 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-210-204-30.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
715199235705aaa7c6781030dac85b766262d77ec7c07aac6f4928f464d93583

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type
application/json
Referer
https://www.mediafire.com/

Response headers

access-control-allow-origin
https://www.mediafire.com
content-length
60
date
Sun, 09 Nov 2025 10:53:08 GMT
content-type
application/json; charset=utf-8
vary
Origin
access-control-allow-credentials
true
ad_impression
pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ 		60 B
336 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ad_impression
Requested by
Host: script-api.ccgateway.net
URL: https://script-api.ccgateway.net/script/bundle?id=www.mediafire.com&parentId=0dae949f4b
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.210.204.30 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-210-204-30.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
715199235705aaa7c6781030dac85b766262d77ec7c07aac6f4928f464d93583

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type
application/json
Referer
https://www.mediafire.com/

Response headers

access-control-allow-origin
https://www.mediafire.com
content-length
60
date
Sun, 09 Nov 2025 10:53:08 GMT
content-type
application/json; charset=utf-8
vary
Origin
access-control-allow-credentials
true
ad_impression
pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ 		60 B
336 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ad_impression
Requested by
Host: script-api.ccgateway.net
URL: https://script-api.ccgateway.net/script/bundle?id=www.mediafire.com&parentId=0dae949f4b
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.210.204.30 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-210-204-30.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
715199235705aaa7c6781030dac85b766262d77ec7c07aac6f4928f464d93583

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type
application/json
Referer
https://www.mediafire.com/

Response headers

access-control-allow-origin
https://www.mediafire.com
content-length
60
date
Sun, 09 Nov 2025 10:53:09 GMT
content-type
application/json; charset=utf-8
vary
Origin
access-control-allow-credentials
true
json
gum.criteo.com/sid/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.mediafire.com%2F&domain=www.mediafire.com&bundle=l6ilVF9DZ0VsM281Zmp6WVNtMWNra3FxbWJPJTJGa1BNdThpUmtLcXgwRFNTMUwlMkZheVR5dEtWazJLSGxPODQ5bnpiJTJGQUltMDN2S0FrWXNZVXhOeDFpcFUyTEo3VnVDYWhGVm1NMFY3QVFZMFZlNiUyQm9IRVhDbDk1U3JKcFc5cnMlMkJHTHR4RTM&cw=1&pbt=1&lsw=1&gdpr=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a00b::3d , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
GET
Origin
https://www.mediafire.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
content-type
access-control-allow-methods
GET
access-control-allow-origin
https://www.mediafire.com
cache-control
no-cache, no-store, must-revalidate
content-encoding
gzip
content-type
application/json; charset=utf-8
date
Sun, 09 Nov 2025 10:53:08 GMT
expires
0
pragma
no-cache
server
Kestrel
server-processing-duration-in-ticks
237243
strict-transport-security
max-age=31536000; preload;
vary
Accept-Encoding
envelope
lexicon.33across.com/v1/ 		2 KB
2 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://lexicon.33across.com/v1/envelope?pid=0010b00002MpnPqAAJ&gdpr=0&src=pbjs&ver=10.14.0&coppa=0&tp=WC3ui1O71ebRdJWvJEWmpqT4lBQ4s6%2Bdh8HKI6FKWes%3D
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-13-135
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
37.19.206.163 Ashburn, United States, ASN60068 (CDN77 Datacamp Limited, GB),
Reverse DNS
unn-37-19-206-163.datapacket.com
Software
/
Resource Hash
7d4d203faf5eeeb577affb6b9f87497ddd9c8d1bec75da74630fe6402e74c553

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
content-type
text/plain
Referer
https://www.mediafire.com/

Response headers

access-control-allow-origin
https://www.mediafire.com
content-length
1636
content-type
application/json
vary
origin
access-control-allow-credentials
true
set
id.a-mx.com/
Redirect Chain
  • https://id.a-mx.com/sync/?tagId=&ref=null&u=https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file&tl=https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file&nf=0&rt=...
  • https://c3.a-mo.net/b?uid=1776ef42-7a13-465b-8e3b-9082f65aba5b&sh=id.a-mx.com&
  • https://id.a-mx.com/set?oid=1776ef42-7a13-465b-8e3b-9082f65aba5b&uid=1776ef42-7a13-465b-8e3b-9082f65aba5b&
99 B
957 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://id.a-mx.com/set?oid=1776ef42-7a13-465b-8e3b-9082f65aba5b&uid=1776ef42-7a13-465b-8e3b-9082f65aba5b&
Protocol
HTTP/1.1
Server
138.199.41.120 New York, United States, ASN60068 (CDN77 Datacamp Limited, GB),
Reverse DNS
unn-138-199-41-120.datapacket.com
Software
/
Resource Hash
0af95d67b93560269da520b2de788733a368bb8fec764e7d49cef92b468d51ce

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

access-control-allow-origin
null
content-length
99
date
Sun, 9 Nov 2025 10:53:08 GMT
content-type
application/json
access-control-allow-credentials
true

Redirect headers

access-control-allow-origin
null
location
https://id.a-mx.com/set?oid=1776ef42-7a13-465b-8e3b-9082f65aba5b&uid=1776ef42-7a13-465b-8e3b-9082f65aba5b&
content-length
0
date
Sun, 9 Nov 2025 10:53:08 GMT
access-control-allow-credentials
true
sid
mug.criteo.com/
Redirect Chain
  • https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.mediafire.com%2F&domain=www.mediafire.com&bundle=l6ilVF9DZ0VsM281Zmp6WVNtMWNra3FxbWJPJTJGa1BNdThpUmtLcXgwRFNTMUwlMkZheVR5dEtWa...
  • https://mug.criteo.com/sid?cpp=aKnPi3xrRzVXOW5kU1IwK3dMem9ZMzBXUnV1YlZsYy84eEZNTjh3dHI5VVhUS2ZDWEdhYXZjeFpJL0dTejRNWHJUZjVDV1BRRTQ5S1ByN1pPVVFkYWtvVjRGWWZWekhVMzBydzZFZEJuL1JzbHVtd1BrcXVBcFFaa1dlNX...
418 B
1 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://mug.criteo.com/sid?cpp=aKnPi3xrRzVXOW5kU1IwK3dMem9ZMzBXUnV1YlZsYy84eEZNTjh3dHI5VVhUS2ZDWEdhYXZjeFpJL0dTejRNWHJUZjVDV1BRRTQ5S1ByN1pPVVFkYWtvVjRGWWZWekhVMzBydzZFZEJuL1JzbHVtd1BrcXVBcFFaa1dlNXN1T1hZWk51cVBYMW5nU29rdmwveko5NDcxeGdxME9abUMvRFVxbW5GZ2gyVS9jQTZJUXVKVDhXTjRGeTVWZkFmQXlHRzJUWnYwVklLV3JzaDJYenZqbjlYZCtrMis4OFFhdVI3RUE3K2VtbVlHZDFRMzZuNnFGVnNXQzI4SlRMZUF0U0FoZzk2V1Zkb2h3YTJlUXZzWlVmMU5JSHAzR3ltUElLL1U4dmdtRkNUR2pOc3lZNE5CSWoxYUFncTBxa05yQ1l3dlVPMno4UWxRTDcrWHNPWDhjajVoQ0hzZXc9PXw&cppv=2
Protocol
H2
Server
74.119.117.62 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
b23d26bf925467ae815899bd17425dfdb3ea5e0bdc23fc4fbf23b60b8f72ca27
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

strict-transport-security
max-age=31536000; preload;
cache-control
no-cache, no-store, must-revalidate
content-encoding
gzip
pragma
no-cache
access-control-allow-credentials
true
access-control-allow-methods
GET
server-processing-duration-in-ticks
1297068
expires
0
access-control-allow-origin
null
date
Sun, 09 Nov 2025 10:53:08 GMT
content-type
application/json; charset=utf-8
vary
Accept-Encoding
server
Kestrel

Redirect headers

strict-transport-security
max-age=31536000; preload;
cache-control
no-cache, no-store, must-revalidate
location
https://mug.criteo.com/sid?cpp=aKnPi3xrRzVXOW5kU1IwK3dMem9ZMzBXUnV1YlZsYy84eEZNTjh3dHI5VVhUS2ZDWEdhYXZjeFpJL0dTejRNWHJUZjVDV1BRRTQ5S1ByN1pPVVFkYWtvVjRGWWZWekhVMzBydzZFZEJuL1JzbHVtd1BrcXVBcFFaa1dlNXN1T1hZWk51cVBYMW5nU29rdmwveko5NDcxeGdxME9abUMvRFVxbW5GZ2gyVS9jQTZJUXVKVDhXTjRGeTVWZkFmQXlHRzJUWnYwVklLV3JzaDJYenZqbjlYZCtrMis4OFFhdVI3RUE3K2VtbVlHZDFRMzZuNnFGVnNXQzI4SlRMZUF0U0FoZzk2V1Zkb2h3YTJlUXZzWlVmMU5JSHAzR3ltUElLL1U4dmdtRkNUR2pOc3lZNE5CSWoxYUFncTBxa05yQ1l3dlVPMno4UWxRTDcrWHNPWDhjajVoQ0hzZXc9PXw&cppv=2
pragma
no-cache
access-control-allow-credentials
true
access-control-allow-methods
GET
server-processing-duration-in-ticks
419064
expires
0
access-control-allow-origin
https://www.mediafire.com
content-length
0
date
Sun, 09 Nov 2025 10:53:08 GMT
server
Kestrel
pbhid
id.hadron.ad.gt/api/v1/ 		227 B
198 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://id.hadron.ad.gt/api/v1/pbhid?partner_id=524&_it=prebid&t=1&src=id&domain=www.mediafire.com&gdpr=0
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-13-135
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:2396 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7d0d5581c216a6d698f0e57d6f39895da9e8069b49abe21e5311b3f05468d5b6

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
content-type
text/plain
Referer
https://www.mediafire.com/

Response headers

content-encoding
br
access-control-allow-methods
GET, POST, OPTIONS
allow
POST, OPTIONS, GET
cf-ray
99bcc3c33fb6c463-EWR
access-control-allow-origin
*
date
Sun, 09 Nov 2025 10:53:09 GMT
content-type
application/json
vary
accept-encoding
server
cloudflare
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, *
prebid
id5-sync.com/api/config/ 		195 B
466 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://id5-sync.com/api/config/prebid
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-13-135
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.95.33.120 , Germany, ASN16276 (OVH OVH SAS, FR),
Reverse DNS
ns3203256.ip-141-95-33.eu
Software
/
Resource Hash
aa8a5c4a92b78ce2c775274d190dafb720a44b4facce02c94e63f63c90c60a57
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8
Referer
https://www.mediafire.com/

Response headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
access-control-allow-origin
https://www.mediafire.com
content-encoding
gzip
date
Sun, 09 Nov 2025 10:53:09 GMT
content-type
application/json;charset=UTF-8
vary
origin,access-control-request-method,access-control-request-headers,accept-encoding
access-control-allow-credentials
true
any
idx.liadm.com/idex/did-006t/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://idx.liadm.com/idex/did-006t/any?duid=a738c2fb6c00--01k9m3z368kp41czwphh8wkwmd&gdpr=0&did=did-006t&cd=.mediafire.com&pu=https%3A%2F%2Fwww.mediafire.com&resolve=nonId&resolve=uid2&resolve=bidswitch&resolve=medianet&resolve=magnite&resolve=pubmatic&resolve=index&resolve=openx&resolve=thetradedesk&resolve=sovrn&resolve=vidazoo&resolve=sonobi&resolve=sharethrough&resolve=triplelift&resolve=nexxen&resolve=zetassp
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-13-135
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.221.183.211 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-221-183-211.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
content-type
text/plain
Referer
https://www.mediafire.com/

Response headers

cache-control
max-age=3599, private
trace-id
f254af84bb01e65b
request-time
2
access-control-allow-credentials
true
expires
Sun, 09 Nov 2025 11:53:07 GMT
access-control-allow-origin
https://www.mediafire.com
date
Sun, 09 Nov 2025 10:53:07 GMT
vary
Origin
UCookieSetPug
image6.pubmatic.com/AdServer/ 		0
61 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=5&p=156983&publisherId=156983&gdpr=0&gdpr_consent=&src=pbjs_uid&ver=1&coppa=0&us_privacy=&gpp=&gpp_sid=
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-13-135
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
8.28.7.81 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=16070400; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
content-type
text/plain
Referer
https://www.mediafire.com/

Response headers

strict-transport-security
max-age=16070400; includeSubDomains
cache-control
no-cache, no-store, must-revalidate
access-control-allow-origin
https://www.mediafire.com
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date
Sun, 09 Nov 2025 10:53:08 GMT
content-type
text/html; charset=UTF-8
access-control-allow-credentials
true
rid
match.adsrvr.org/track/ 		109 B
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://match.adsrvr.org/track/rid?ttd_pid=muno13d&fmt=json
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-13-135
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.33.220.150 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a12b7a488abeaa9e4.awsglobalaccelerator.com
Software
Kestrel /
Resource Hash
0192b6a72305c64520e6d5a6e07912cf2aff915d4c6279148a7eac5d1e3e6d60

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
content-type
text/plain
Referer
https://www.mediafire.com/

Response headers

cache-control
private
content-encoding
gzip
access-control-allow-credentials
true
expires
Tue, 09 Dec 2025 10:53:07 GMT
access-control-allow-origin
https://www.mediafire.com
date
Sun, 09 Nov 2025 10:53:07 GMT
content-type
application/json
vary
Origin,Accept-Encoding
server
Kestrel
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept, x-integration-type
ad_impression
pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ 		60 B
336 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ad_impression
Requested by
Host: script-api.ccgateway.net
URL: https://script-api.ccgateway.net/script/bundle?id=www.mediafire.com&parentId=0dae949f4b
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.210.204.30 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-210-204-30.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
715199235705aaa7c6781030dac85b766262d77ec7c07aac6f4928f464d93583

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type
application/json
Referer
https://www.mediafire.com/

Response headers

access-control-allow-origin
https://www.mediafire.com
content-length
60
date
Sun, 09 Nov 2025 10:53:09 GMT
content-type
application/json; charset=utf-8
vary
Origin
access-control-allow-credentials
true
px.gif
ad-delivery.net/ 		43 B
134 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ad-delivery.net/px.gif?ch=2&e=0.3873918420794812
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac42:948c -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

x-goog-metageneration
5
access-control-expose-headers
*, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash
crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status
HIT
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3"
age
499290
x-goog-stored-content-encoding
identity
expires
Mon, 03 Nov 2025 16:44:11 GMT
x-goog-stored-content-length
43
date
Sun, 09 Nov 2025 10:53:09 GMT
content-type
image/gif
last-modified
Wed, 05 May 2021 19:25:32 GMT
vary
accept-encoding
x-guploader-uploadid
AAwnv3LS2q6BRDz0udyMq8SGqsPxAD9_9_o6mzrHaQCRyGk0sZz7XK3QmjtCjxaiR2NTdoeX6-0UZCs
cache-control
public, max-age=86400
x-goog-storage-class
MULTI_REGIONAL
cf-ray
99bcc3c34d3f7d0b-EWR
accept-ranges
bytes
access-control-allow-origin
*
x-goog-generation
1620242732037093
content-length
43
server
cloudflare
favicon.ico
ad.doubleclick.net/ 		1 KB
129 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.8487295769894536
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.16.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bl-in-f149.1e100.net
Software
sffe /
Resource Hash
d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

content-encoding
gzip
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options
nosniff
expires
Mon, 10 Nov 2025 10:53:09 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sun, 09 Nov 2025 10:53:09 GMT
content-type
image/x-icon
vary
Accept-Encoding
last-modified
Tue, 08 May 2012 13:08:06 GMT
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
content-length
104
x-xss-protection
0
server
sffe
sid
mug.criteo.com/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://mug.criteo.com/sid?cpp=aKnPi3xrRzVXOW5kU1IwK3dMem9ZMzBXUnV1YlZsYy84eEZNTjh3dHI5VVhUS2ZDWEdhYXZjeFpJL0dTejRNWHJUZjVDV1BRRTQ5S1ByN1pPVVFkYWtvVjRGWWZWekhVMzBydzZFZEJuL1JzbHVtd1BrcXVBcFFaa1dlNXN1T1hZWk51cVBYMW5nU29rdmwveko5NDcxeGdxME9abUMvRFVxbW5GZ2gyVS9jQTZJUXVKVDhXTjRGeTVWZkFmQXlHRzJUWnYwVklLV3JzaDJYenZqbjlYZCtrMis4OFFhdVI3RUE3K2VtbVlHZDFRMzZuNnFGVnNXQzI4SlRMZUF0U0FoZzk2V1Zkb2h3YTJlUXZzWlVmMU5JSHAzR3ltUElLL1U4dmdtRkNUR2pOc3lZNE5CSWoxYUFncTBxa05yQ1l3dlVPMno4UWxRTDcrWHNPWDhjajVoQ0hzZXc9PXw&cppv=2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
74.119.117.62 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
GET
Origin
null
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
content-type
access-control-allow-methods
GET
access-control-allow-origin
null
cache-control
no-cache, no-store, must-revalidate
content-encoding
gzip
content-type
application/json; charset=utf-8
date
Sun, 09 Nov 2025 10:53:08 GMT
expires
0
pragma
no-cache
server
Kestrel
server-processing-duration-in-ticks
218199
strict-transport-security
max-age=31536000; preload;
vary
Accept-Encoding
ads
securepubads.g.doubleclick.net/gampad/ 		559 B
280 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4347117103472909&correlator=273832398336817&eid=31095133%2C31095250%2C31095648%2C83321072&output=ldjh&gdfp_req=1&vrg=202511040101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=1x1&ifi=13&didk=674410252&dids=gpt_unit_%2F1254144%2C183096492%2Fme&sfv=1-0-45&rcs=2&fas=1&eri=1&sc=1&cookie=ID%3D710d595ddee055b4%3AT%3D1762685587%3ART%3D1762685587%3AS%3DALNI_MZJGZDvti4dTz_nkocz4FF59h3kSg&gpic=UID%3D0000130a10d732ad%3AT%3D1762685587%3ART%3D1762685587%3AS%3DALNI_MaUVZBE6m9Fvpz6Zk1r3wnftELu7g&abxe=1&dt=1762685589359&lmt=1762685589&adxs=-9&adys=-9&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=6&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fzh1io5g5cavqo7l%2FRose%252527s_bot.zip%2Ffile&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&topics=3&tps=3&htps=10&a3p=EmwKDGlkNS1zeW5jLmNvbRJaSUQ1Knl0eFFPejc2QzBUbG10djVzbG80YXNOR005bjY3VXd1LUZJNVY5REUwTGpfXzJrUWNwUmFBQUVCQ21rUWNwTUFZS0pqWW1lNVZpVmxtVzB1Z0RUOGtBWAESRgoMYXVkaWdlbnQuY29tEjQwMDAxeXVtMGVhYmtiYTk4YmNpYWU2Z2liZGRqOTZsZGNsZjc4NmtoZGFhYmFja2tjMmpsWAESrQEKCmNyaXRlby5jb20SnAE3RE8xR2w5QlFXbEZNSEoyWjJkUFJ6RnRXblpUV2paWWMzWkthMVZzTTBkRmNtRTJUMUY2WkhwclpXeG5WRE16WkhFMFFrWmtTRE5OYlVkeFoyMXJNREpCUW0xd1dqVm1VMnBXYkZsVmRWbEJNRm8wTlZkck1GbEtWbG8xV21aVlIweEZKVEpHZFZFMVdVRjRhRXBFYmpCekpUTkVYARI2CgxhZHNlcnZlci5vcmcSJGM0ODVmOWY2LTJkN2UtNDYyNy04OTBkLWE3MWFjZGY2NDdhZVgBEjQKCnB1YmNpZC5vcmcSJGRlNmQyYWY2LWIwNWEtNGVlOS1hNzdlLWM3MzQwMjZmZjQ5Y1gBEloKDWNyd2RjbnRybC5uZXQSQGQyZTc1YjhlNDkyZTc0MzAwNGVkMGRiYzZjMDQxODVjYTAyY2M1MWU0ZGExNjQzYmIwNjQ3NzRmYmM5NGI3ZGIY-qD-waYzSAASHQoOZXNwLmNyaXRlby5jb20YvZ_-waYzSABSAghkEhgKCXlhaG9vLmNvbRicof7BpjNIAFICCG8SPgoFb3BlbngSLGV5SnBJam9pVW5kNGVUTTRSVEJSZGt0alpITmtkWGhUS3k5S1p6MDlJbjA9GMKj_sGmM0gAEhsKDDMzYWNyb3NzLmNvbRi8n_7BpjNIAFICCGQSggIKCHJ0YmhvdXNlEuwBVW5PSDI4a3JuUnluUXNqODQwNVhQMWpqaVhrOGZ4ZjFLczVJWXlaTU5CN0JWSDBpa1U2dkVCcENIYVh1anRFcUlLc3BFSVNaZWhqUHROc3ErK0J2anhkaU1OVm9GQ0FjKzNrbGEvbkJFZlV6YUZUeVpSZWxLTFB6eWF2am9ybXZUc0dQUFk4ODZxZHlXWENBT3pJeFdvcXliYW43d3N5TzdjNmovS1YvVjI3cEpuOE44dFl4dTNOR2MzK2NQbHMwWTNmSjM2cmRKbEVjcmJnb0hJYXB2OWZqcURxNlhtOUowSEFXYXhDNVoxdz0YsqP-waYzSAA.&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1762685584931&idt=2383&ppid=3b25ce83c75aeff52ef9657aec7de9f7&prev_scp=a%3D1%26iid1%3D5496324216408839%26eid%3D5496324216408839%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D0%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252Fzh1io5g5cavqo7l%252FRose%25252527s_bot.zip%252Ffile%26path%3D%252Ffile%252Fzh1io5g5cavqo7l%252FRose%252527s_bot.zip%252Ffile%26ap%3D1100%26sap%3D1100%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D7%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-medrectangle-2%26tap%3Dmediafire_com-medrectangle-2-5496324216408839%26eb_br%3Da7a863b24978e69c4cdbb5a49be70d5e%26eba%3D0%26bv%3D5%26bvm%3D0%26bvr%3D5%26avc%3D57%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D34%26br2%3D60%26ezoic%3D1%26nmau%3D0%26mau%3D0%26ganc%3D1%26cal%3D0%26stl%3D192%2C193%2C0%2C0%2C0%2C193%2C132%2C0%2C0%2C0%2C187%2C0%2C901%2C182%2C901%2C902%2C903%26deal1%3D17%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C760%2C761%2C813%2C815%2C816%2C817%2C818%2C819%2C899%2C917%2C918%2C919%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C3933%2C4184%2C4186%2C4604%2C5747%2C6293%2C6294%2C6295%2C6983%2C7035%2C7036%2C7605%2C7606%2C7607%2C7608%2C7609%2C7610%2C7611%2C7612%2C7613%2C7614%2C7615%2C7616%2C7617%2C7618%2C7788%2C7789%2C7790%2C7993%2C7994%2C7995%2C7996%2C7997%2C7998%2C7999%2C8057%2C6772%2C5534%2C7661%2C7713%2C7%2C8%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C915%2C874%2C835%2C19%2C2688%2C3045%2C4276%2C7330%2C916%2C19%2C2688%2C2693%2C3045%2C3053%2C4276%2C7330%2C7331%2C916%26osb%3DLinux%252FChrome%26lb%3D60%26reqt%3D1762685588892&cust_params=li-module-enabled%3Dt1&adks=318048222&frm=20&eo_id_str=ID%3Dd758a0372e0d617e%3AT%3D1762685587%3ART%3D1762685587%3AS%3DAA-AfjbrkAa_d6zy1Ty3ihSBvc1X&pbbce=1&td=1&egid=3721&tan=5e3107b9-1e1c-45dc-be13-7701b2f8f592&tdf=2
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511040101/pubads_impl.js?cb=31095648
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c21::9b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
2cb36c9fcefd08da06a548f7155fe97681df0d659ca31863d6fc60d29bdd09bb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

content-encoding
dcb
google-lineitem-id
-2
observe-browsing-topics
?1
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sun, 09 Nov 2025 10:53:09 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-2
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
250
x-xss-protection
0
server
cafe
ads
securepubads.g.doubleclick.net/gampad/ 		386 B
186 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4347117103472909&correlator=949577245434104&eid=31095133%2C31095250%2C31095648%2C83321072&output=ldjh&gdfp_req=1&vrg=202511040101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=14&didk=1697938527&dids=div-gpt-ad-mediafire_com-box-2&adfs=2211965457&sfv=1-0-45&rcs=2&eri=1&sc=1&cookie=ID%3D710d595ddee055b4%3AT%3D1762685587%3ART%3D1762685587%3AS%3DALNI_MZJGZDvti4dTz_nkocz4FF59h3kSg&gpic=UID%3D0000130a10d732ad%3AT%3D1762685587%3ART%3D1762685587%3AS%3DALNI_MaUVZBE6m9Fvpz6Zk1r3wnftELu7g&abxe=1&dt=1762685589371&lmt=1762685589&adxs=552&adys=10&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fzh1io5g5cavqo7l%2FRose%252527s_bot.zip%2Ffile&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGsk3ut5bf7d_pvK3Ghz6ztftrMGKws5tAfnb2QUE5Mm_4Z3YW0ifBJniWSbrxg&topics=3&tps=3&htps=10&a3p=EmwKDGlkNS1zeW5jLmNvbRJaSUQ1Knl0eFFPejc2QzBUbG10djVzbG80YXNOR005bjY3VXd1LUZJNVY5REUwTGpfXzJrUWNwUmFBQUVCQ21rUWNwTUFZS0pqWW1lNVZpVmxtVzB1Z0RUOGtBWAESRgoMYXVkaWdlbnQuY29tEjQwMDAxeXVtMGVhYmtiYTk4YmNpYWU2Z2liZGRqOTZsZGNsZjc4NmtoZGFhYmFja2tjMmpsWAESrQEKCmNyaXRlby5jb20SnAE3RE8xR2w5QlFXbEZNSEoyWjJkUFJ6RnRXblpUV2paWWMzWkthMVZzTTBkRmNtRTJUMUY2WkhwclpXeG5WRE16WkhFMFFrWmtTRE5OYlVkeFoyMXJNREpCUW0xd1dqVm1VMnBXYkZsVmRWbEJNRm8wTlZkck1GbEtWbG8xV21aVlIweEZKVEpHZFZFMVdVRjRhRXBFYmpCekpUTkVYARI2CgxhZHNlcnZlci5vcmcSJGM0ODVmOWY2LTJkN2UtNDYyNy04OTBkLWE3MWFjZGY2NDdhZVgBEjQKCnB1YmNpZC5vcmcSJGRlNmQyYWY2LWIwNWEtNGVlOS1hNzdlLWM3MzQwMjZmZjQ5Y1gBEloKDWNyd2RjbnRybC5uZXQSQGQyZTc1YjhlNDkyZTc0MzAwNGVkMGRiYzZjMDQxODVjYTAyY2M1MWU0ZGExNjQzYmIwNjQ3NzRmYmM5NGI3ZGIY-qD-waYzSAASHQoOZXNwLmNyaXRlby5jb20YvZ_-waYzSABSAghkEhgKCXlhaG9vLmNvbRicof7BpjNIAFICCG8SPgoFb3BlbngSLGV5SnBJam9pVW5kNGVUTTRSVEJSZGt0alpITmtkWGhUS3k5S1p6MDlJbjA9GMKj_sGmM0gAEhsKDDMzYWNyb3NzLmNvbRi8n_7BpjNIAFICCGQSggIKCHJ0YmhvdXNlEuwBVW5PSDI4a3JuUnluUXNqODQwNVhQMWpqaVhrOGZ4ZjFLczVJWXlaTU5CN0JWSDBpa1U2dkVCcENIYVh1anRFcUlLc3BFSVNaZWhqUHROc3ErK0J2anhkaU1OVm9GQ0FjKzNrbGEvbkJFZlV6YUZUeVpSZWxLTFB6eWF2am9ybXZUc0dQUFk4ODZxZHlXWENBT3pJeFdvcXliYW43d3N5TzdjNmovS1YvVjI3cEpuOE44dFl4dTNOR2MzK2NQbHMwWTNmSjM2cmRKbEVjcmJnb0hJYXB2OWZqcURxNlhtOUowSEFXYXhDNVoxdz0YsqP-waYzSAA.&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1762685584931&idt=2383&ppid=3b25ce83c75aeff52ef9657aec7de9f7&prev_scp=a%3D1%26iid1%3D6146046926352970%26eid%3D6146046926352970%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D0%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252Fzh1io5g5cavqo7l%252FRose%25252527s_bot.zip%252Ffile%26path%3D%252Ffile%252Fzh1io5g5cavqo7l%252FRose%252527s_bot.zip%252Ffile%26ap%3D1103%26sap%3D1103%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-box-2%26tap%3Dmediafire_com-box-2-6146046926352970%26eb_br%3Db355e9227b551c119a30a68852723b62%26eba%3D0%26bv%3D5%26bvm%3D0%26bvr%3D5%26avc%3D115%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D90%26br2%3D160%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D146%2C168%2C0%2C0%2C0%2C168%2C184%2C20%2C0%2C0%2C192%2C0%2C902%2C903%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2764%2C2765%2C3054%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4186%2C5747%2C6293%2C6294%2C6295%2C7036%2C7605%2C7606%2C7607%2C7608%2C7609%2C7610%2C7611%2C7612%2C7613%2C7614%2C7615%2C7616%2C7617%2C7618%2C7788%2C7790%2C7993%2C7994%2C7995%2C7996%2C7997%2C7998%2C7999%2C6772%2C5534%2C7661%2C7713%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C17%2C20%2C2351%2C2526%2C2527%2C2761%2C2763%2C3044%2C3154%2C7789%2C8%2C9%2C874%2C835%2C17%2C19%2C20%2C2351%2C2526%2C2527%2C2610%2C2688%2C2761%2C2763%2C3044%2C3154%2C7035%2C7789%2C7%2C8%2C9%2C916%2C915%2C874%2C835%26osb%3DLinux%252FChrome%26lb%3D160%26reqt%3D1762685588886&cust_params=li-module-enabled%3Dt1&adks=3106951849&frm=20&eo_id_str=ID%3Dd758a0372e0d617e%3AT%3D1762685587%3ART%3D1762685587%3AS%3DAA-AfjbrkAa_d6zy1Ty3ihSBvc1X&pbbce=1&td=1&egid=3721&tan=5e3107b9-1e1c-45dc-be13-7701b2f8f593&tdf=2
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511040101/pubads_impl.js?cb=31095648
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c21::9b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
bf1b99399ebef06add3f8bc7218fcab1705e5b45a6128ef33972eec7733ecbff
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

content-encoding
dcb
google-lineitem-id
-2
observe-browsing-topics
?1
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sun, 09 Nov 2025 10:53:09 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-2
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
156
x-xss-protection
0
server
cafe
ads
securepubads.g.doubleclick.net/gampad/ 		388 B
187 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4347117103472909&correlator=1480072555907507&eid=31095133%2C31095250%2C31095648%2C83321072&output=ldjh&gdfp_req=1&vrg=202511040101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-edge-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C160x600&fluid=height&ifi=15&didk=2994425013&dids=div-gpt-ad-mediafire_com-edge-&adfs=982453029&sfv=1-0-45&rcs=2&eri=1&sc=1&cookie=ID%3D710d595ddee055b4%3AT%3D1762685587%3ART%3D1762685587%3AS%3DALNI_MZJGZDvti4dTz_nkocz4FF59h3kSg&gpic=UID%3D0000130a10d732ad%3AT%3D1762685587%3ART%3D1762685587%3AS%3DALNI_MaUVZBE6m9Fvpz6Zk1r3wnftELu7g&abxe=1&dt=1762685589383&lmt=1762685589&adxs=1440&adys=300&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=5&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fzh1io5g5cavqo7l%2FRose%252527s_bot.zip%2Ffile&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGsk3ut5bf7d_pvK3Ghz6ztftrMGKws5tAfnb2QUE5Mm_4Z3YW0ifBJniWSbrxg&topics=3&tps=3&htps=10&a3p=EmwKDGlkNS1zeW5jLmNvbRJaSUQ1Knl0eFFPejc2QzBUbG10djVzbG80YXNOR005bjY3VXd1LUZJNVY5REUwTGpfXzJrUWNwUmFBQUVCQ21rUWNwTUFZS0pqWW1lNVZpVmxtVzB1Z0RUOGtBWAESRgoMYXVkaWdlbnQuY29tEjQwMDAxeXVtMGVhYmtiYTk4YmNpYWU2Z2liZGRqOTZsZGNsZjc4NmtoZGFhYmFja2tjMmpsWAESrQEKCmNyaXRlby5jb20SnAE3RE8xR2w5QlFXbEZNSEoyWjJkUFJ6RnRXblpUV2paWWMzWkthMVZzTTBkRmNtRTJUMUY2WkhwclpXeG5WRE16WkhFMFFrWmtTRE5OYlVkeFoyMXJNREpCUW0xd1dqVm1VMnBXYkZsVmRWbEJNRm8wTlZkck1GbEtWbG8xV21aVlIweEZKVEpHZFZFMVdVRjRhRXBFYmpCekpUTkVYARI2CgxhZHNlcnZlci5vcmcSJGM0ODVmOWY2LTJkN2UtNDYyNy04OTBkLWE3MWFjZGY2NDdhZVgBEjQKCnB1YmNpZC5vcmcSJGRlNmQyYWY2LWIwNWEtNGVlOS1hNzdlLWM3MzQwMjZmZjQ5Y1gBEloKDWNyd2RjbnRybC5uZXQSQGQyZTc1YjhlNDkyZTc0MzAwNGVkMGRiYzZjMDQxODVjYTAyY2M1MWU0ZGExNjQzYmIwNjQ3NzRmYmM5NGI3ZGIY-qD-waYzSAASHQoOZXNwLmNyaXRlby5jb20YvZ_-waYzSABSAghkEhgKCXlhaG9vLmNvbRicof7BpjNIAFICCG8SPgoFb3BlbngSLGV5SnBJam9pVW5kNGVUTTRSVEJSZGt0alpITmtkWGhUS3k5S1p6MDlJbjA9GMKj_sGmM0gAEhsKDDMzYWNyb3NzLmNvbRi8n_7BpjNIAFICCGQSggIKCHJ0YmhvdXNlEuwBVW5PSDI4a3JuUnluUXNqODQwNVhQMWpqaVhrOGZ4ZjFLczVJWXlaTU5CN0JWSDBpa1U2dkVCcENIYVh1anRFcUlLc3BFSVNaZWhqUHROc3ErK0J2anhkaU1OVm9GQ0FjKzNrbGEvbkJFZlV6YUZUeVpSZWxLTFB6eWF2am9ybXZUc0dQUFk4ODZxZHlXWENBT3pJeFdvcXliYW43d3N5TzdjNmovS1YvVjI3cEpuOE44dFl4dTNOR2MzK2NQbHMwWTNmSjM2cmRKbEVjcmJnb0hJYXB2OWZqcURxNlhtOUowSEFXYXhDNVoxdz0YsqP-waYzSAA.&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1762685584931&idt=2383&ppid=3b25ce83c75aeff52ef9657aec7de9f7&prev_scp=a%3D1%26iid1%3D1562860810369568%26eid%3D1562860810369568%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D0%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252Fzh1io5g5cavqo7l%252FRose%25252527s_bot.zip%252Ffile%26path%3D%252Ffile%252Fzh1io5g5cavqo7l%252FRose%252527s_bot.zip%252Ffile%26ap%3D1102%26sap%3D1102%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D3%26at%3Dbf%26adr%3D399%26ezosn%3D3%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D39%26al%3D1039%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-edge-2%26tap%3Dmediafire_com-edge-2-1562860810369568%26eb_br%3Dzero%26eba%3D0%26bv%3D11%26bvm%3D0%26bvr%3D1%26avc%3D33%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D0%26br2%3D40%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D146%2C168%2C0%2C0%2C0%2C168%2C184%2C20%2C0%2C0%2C192%2C0%2C902%2C903%2C901%2C902%2C903%26deal1%3D17%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2688%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4186%2C5747%2C6293%2C6294%2C6295%2C7035%2C7036%2C7605%2C7606%2C7607%2C7608%2C7609%2C7610%2C7611%2C7612%2C7613%2C7614%2C7615%2C7616%2C7617%2C7618%2C7788%2C7789%2C7790%2C7993%2C7994%2C7995%2C7996%2C7997%2C7998%2C7999%2C6772%2C5534%2C7661%2C7713%2C7%2C8%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C916%2C915%2C874%2C835%2C2693%2C3045%2C4276%2C7330%2C18%2C1428%2C2693%2C3045%2C3052%2C3053%2C3856%2C4276%2C7330%2C7331%26osb%3DLinux%252FChrome%26lb%3D40%26reqt%3D1762685588937%26adxf%3D1%26ss38%3D1%26ss9%3D1&cust_params=li-module-enabled%3Dt1&adks=3081006461&frm=20&eo_id_str=ID%3Dd758a0372e0d617e%3AT%3D1762685587%3ART%3D1762685587%3AS%3DAA-AfjbrkAa_d6zy1Ty3ihSBvc1X&pbbce=1&td=1&egid=3721&tan=5e3107b9-1e1c-45dc-be13-7701b2f8f594&tdf=2
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511040101/pubads_impl.js?cb=31095648
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c21::9b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0889832a605040b3e564c59da0a730bef7e125f4f70719d1afd2ca92899029f8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

content-encoding
dcb
google-lineitem-id
-2
observe-browsing-topics
?1
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sun, 09 Nov 2025 10:53:09 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-2
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
157
x-xss-protection
0
server
cafe
ads
securepubads.g.doubleclick.net/gampad/ 		388 B
187 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4347117103472909&correlator=39779167552968&eid=31095133%2C31095250%2C31095648%2C83321072&output=ldjh&gdfp_req=1&vrg=202511040101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-edge-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C160x600&fluid=height&ifi=16&didk=2994273263&dids=div-gpt-ad-mediafire_com-edge-&adfs=580935078&sfv=1-0-45&rcs=2&eri=1&sc=1&cookie=ID%3D710d595ddee055b4%3AT%3D1762685587%3ART%3D1762685587%3AS%3DALNI_MZJGZDvti4dTz_nkocz4FF59h3kSg&gpic=UID%3D0000130a10d732ad%3AT%3D1762685587%3ART%3D1762685587%3AS%3DALNI_MaUVZBE6m9Fvpz6Zk1r3wnftELu7g&abxe=1&dt=1762685589402&lmt=1762685589&adxs=0&adys=300&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=4&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fzh1io5g5cavqo7l%2FRose%252527s_bot.zip%2Ffile&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGsk3ut5bf7d_pvK3Ghz6ztftrMGKws5tAfnb2QUE5Mm_4Z3YW0ifBJniWSbrxg&topics=3&tps=3&htps=10&a3p=EmwKDGlkNS1zeW5jLmNvbRJaSUQ1Knl0eFFPejc2QzBUbG10djVzbG80YXNOR005bjY3VXd1LUZJNVY5REUwTGpfXzJrUWNwUmFBQUVCQ21rUWNwTUFZS0pqWW1lNVZpVmxtVzB1Z0RUOGtBWAESRgoMYXVkaWdlbnQuY29tEjQwMDAxeXVtMGVhYmtiYTk4YmNpYWU2Z2liZGRqOTZsZGNsZjc4NmtoZGFhYmFja2tjMmpsWAESrQEKCmNyaXRlby5jb20SnAE3RE8xR2w5QlFXbEZNSEoyWjJkUFJ6RnRXblpUV2paWWMzWkthMVZzTTBkRmNtRTJUMUY2WkhwclpXeG5WRE16WkhFMFFrWmtTRE5OYlVkeFoyMXJNREpCUW0xd1dqVm1VMnBXYkZsVmRWbEJNRm8wTlZkck1GbEtWbG8xV21aVlIweEZKVEpHZFZFMVdVRjRhRXBFYmpCekpUTkVYARI2CgxhZHNlcnZlci5vcmcSJGM0ODVmOWY2LTJkN2UtNDYyNy04OTBkLWE3MWFjZGY2NDdhZVgBEjQKCnB1YmNpZC5vcmcSJGRlNmQyYWY2LWIwNWEtNGVlOS1hNzdlLWM3MzQwMjZmZjQ5Y1gBEloKDWNyd2RjbnRybC5uZXQSQGQyZTc1YjhlNDkyZTc0MzAwNGVkMGRiYzZjMDQxODVjYTAyY2M1MWU0ZGExNjQzYmIwNjQ3NzRmYmM5NGI3ZGIY-qD-waYzSAASHQoOZXNwLmNyaXRlby5jb20YvZ_-waYzSABSAghkEhgKCXlhaG9vLmNvbRicof7BpjNIAFICCG8SPgoFb3BlbngSLGV5SnBJam9pVW5kNGVUTTRSVEJSZGt0alpITmtkWGhUS3k5S1p6MDlJbjA9GMKj_sGmM0gAEhsKDDMzYWNyb3NzLmNvbRi8n_7BpjNIAFICCGQSggIKCHJ0YmhvdXNlEuwBVW5PSDI4a3JuUnluUXNqODQwNVhQMWpqaVhrOGZ4ZjFLczVJWXlaTU5CN0JWSDBpa1U2dkVCcENIYVh1anRFcUlLc3BFSVNaZWhqUHROc3ErK0J2anhkaU1OVm9GQ0FjKzNrbGEvbkJFZlV6YUZUeVpSZWxLTFB6eWF2am9ybXZUc0dQUFk4ODZxZHlXWENBT3pJeFdvcXliYW43d3N5TzdjNmovS1YvVjI3cEpuOE44dFl4dTNOR2MzK2NQbHMwWTNmSjM2cmRKbEVjcmJnb0hJYXB2OWZqcURxNlhtOUowSEFXYXhDNVoxdz0YsqP-waYzSAA.&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1762685584931&idt=2383&ppid=3b25ce83c75aeff52ef9657aec7de9f7&prev_scp=a%3D1%26iid1%3D6821571650405327%26eid%3D6821571650405327%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D0%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252Fzh1io5g5cavqo7l%252FRose%25252527s_bot.zip%252Ffile%26path%3D%252Ffile%252Fzh1io5g5cavqo7l%252FRose%252527s_bot.zip%252Ffile%26ap%3D1101%26sap%3D1101%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D4%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D38%26al%3D1038%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-edge-1%26tap%3Dmediafire_com-edge-1-6821571650405327%26eb_br%3Dad0061a38dd7c6f7bcb692aee88dfda4%26eba%3D0%26bv%3D23%26bvm%3D0%26bvr%3D3%26avc%3D24%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D14%26br2%3D34%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D157%2C193%2C207%2C27%2C195%2C25%2C91%2C20%2C71%2C171%2C175%2C0%2C124%2C199%2C901%2C902%2C903%26deal1%3D17%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2688%2C2761%2C2763%2C2764%2C2765%2C3044%2C3045%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4186%2C5747%2C6293%2C6294%2C6295%2C7035%2C7036%2C7330%2C7605%2C7606%2C7607%2C7608%2C7609%2C7610%2C7611%2C7612%2C7613%2C7614%2C7615%2C7616%2C7617%2C7618%2C7788%2C7789%2C7790%2C7993%2C7994%2C7995%2C7996%2C7997%2C7998%2C7999%2C6772%2C5534%2C7661%2C7713%2C7%2C8%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C916%2C915%2C874%2C835%2C2693%2C3053%2C4276%2C7331%2C18%2C1428%2C2693%2C3052%2C3053%2C3856%2C4276%2C7331%26osb%3DLinux%252FChrome%26lb%3D36%26reqt%3D1762685588983&cust_params=li-module-enabled%3Dt1&adks=3527628052&frm=20&eo_id_str=ID%3Dd758a0372e0d617e%3AT%3D1762685587%3ART%3D1762685587%3AS%3DAA-AfjbrkAa_d6zy1Ty3ihSBvc1X&pbbce=1&td=1&egid=3721&tan=5e3107b9-1e1c-45dc-be13-7701b2f8f595&tdf=2
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511040101/pubads_impl.js?cb=31095648
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c21::9b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9ec25b6605089e0ee62ccbae28fadf5be117bc43c3ce513b3e56c17a64ad3a8f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

content-encoding
dcb
google-lineitem-id
-2
observe-browsing-topics
?1
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sun, 09 Nov 2025 10:53:09 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-2
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
157
x-xss-protection
0
server
cafe
ads
securepubads.g.doubleclick.net/gampad/ 		396 B
193 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4347117103472909&correlator=3040095686402577&eid=31095133%2C31095250%2C31095648%2C83321072&output=ldjh&gdfp_req=1&vrg=202511040101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-medrectangle-3&enc_prev_ius=%2F0%2F1&prev_iu_szs=336x280&ifi=17&didk=46179496&dids=div-gpt-ad-mediafire_com-medre&adfs=1911771697&sfv=1-0-45&rcs=2&eri=1&sc=1&cookie=ID%3D710d595ddee055b4%3AT%3D1762685587%3ART%3D1762685587%3AS%3DALNI_MZJGZDvti4dTz_nkocz4FF59h3kSg&gpic=UID%3D0000130a10d732ad%3AT%3D1762685587%3ART%3D1762685587%3AS%3DALNI_MaUVZBE6m9Fvpz6Zk1r3wnftELu7g&abxe=1&dt=1762685589416&lmt=1762685589&adxs=320&adys=120&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=2&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fzh1io5g5cavqo7l%2FRose%252527s_bot.zip%2Ffile&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGsk3ut5bf7d_pvK3Ghz6ztftrMGKws5tAfnb2QUE5Mm_4Z3YW0ifBJniWSbrxg&topics=3&tps=3&htps=10&a3p=EmwKDGlkNS1zeW5jLmNvbRJaSUQ1Knl0eFFPejc2QzBUbG10djVzbG80YXNOR005bjY3VXd1LUZJNVY5REUwTGpfXzJrUWNwUmFBQUVCQ21rUWNwTUFZS0pqWW1lNVZpVmxtVzB1Z0RUOGtBWAESRgoMYXVkaWdlbnQuY29tEjQwMDAxeXVtMGVhYmtiYTk4YmNpYWU2Z2liZGRqOTZsZGNsZjc4NmtoZGFhYmFja2tjMmpsWAESrQEKCmNyaXRlby5jb20SnAE3RE8xR2w5QlFXbEZNSEoyWjJkUFJ6RnRXblpUV2paWWMzWkthMVZzTTBkRmNtRTJUMUY2WkhwclpXeG5WRE16WkhFMFFrWmtTRE5OYlVkeFoyMXJNREpCUW0xd1dqVm1VMnBXYkZsVmRWbEJNRm8wTlZkck1GbEtWbG8xV21aVlIweEZKVEpHZFZFMVdVRjRhRXBFYmpCekpUTkVYARI2CgxhZHNlcnZlci5vcmcSJGM0ODVmOWY2LTJkN2UtNDYyNy04OTBkLWE3MWFjZGY2NDdhZVgBEjQKCnB1YmNpZC5vcmcSJGRlNmQyYWY2LWIwNWEtNGVlOS1hNzdlLWM3MzQwMjZmZjQ5Y1gBEloKDWNyd2RjbnRybC5uZXQSQGQyZTc1YjhlNDkyZTc0MzAwNGVkMGRiYzZjMDQxODVjYTAyY2M1MWU0ZGExNjQzYmIwNjQ3NzRmYmM5NGI3ZGIY-qD-waYzSAASHQoOZXNwLmNyaXRlby5jb20YvZ_-waYzSABSAghkEhgKCXlhaG9vLmNvbRicof7BpjNIAFICCG8SPgoFb3BlbngSLGV5SnBJam9pVW5kNGVUTTRSVEJSZGt0alpITmtkWGhUS3k5S1p6MDlJbjA9GMKj_sGmM0gAEhsKDDMzYWNyb3NzLmNvbRi8n_7BpjNIAFICCGQSggIKCHJ0YmhvdXNlEuwBVW5PSDI4a3JuUnluUXNqODQwNVhQMWpqaVhrOGZ4ZjFLczVJWXlaTU5CN0JWSDBpa1U2dkVCcENIYVh1anRFcUlLc3BFSVNaZWhqUHROc3ErK0J2anhkaU1OVm9GQ0FjKzNrbGEvbkJFZlV6YUZUeVpSZWxLTFB6eWF2am9ybXZUc0dQUFk4ODZxZHlXWENBT3pJeFdvcXliYW43d3N5TzdjNmovS1YvVjI3cEpuOE44dFl4dTNOR2MzK2NQbHMwWTNmSjM2cmRKbEVjcmJnb0hJYXB2OWZqcURxNlhtOUowSEFXYXhDNVoxdz0YsqP-waYzSAA.&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1762685584931&idt=2383&ppid=3b25ce83c75aeff52ef9657aec7de9f7&prev_scp=a%3D1%26iid1%3D7611442246396448%26eid%3D7611442246396448%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D0%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252Fzh1io5g5cavqo7l%252FRose%25252527s_bot.zip%252Ffile%26path%3D%252Ffile%252Fzh1io5g5cavqo7l%252FRose%252527s_bot.zip%252Ffile%26ap%3D1104%26sap%3D1104%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D5%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D21%26al%3D1021%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-medrectangle-3%26tap%3Dmediafire_com-medrectangle-3-7611442246396448%26eb_br%3D58ef7bddb438af5e257c4377f32c243a%26eba%3D0%26bv%3D5%26bvm%3D0%26bvr%3D5%26avc%3D194%26shp%3D3%26ftsn%3D12%26ftsng%3D12%26br1%3D120%26br2%3D240%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D157%2C168%2C0%2C0%2C0%2C168%2C184%2C20%2C0%2C0%2C192%2C0%2C902%2C903%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C760%2C761%2C815%2C816%2C817%2C818%2C893%2C899%2C903%2C919%2C1794%2C2339%2C3054%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3915%2C3919%2C3933%2C4185%2C4186%2C4604%2C4605%2C5747%2C6044%2C6045%2C6293%2C6294%2C6295%2C6983%2C7036%2C7046%2C7144%2C7605%2C7606%2C7607%2C7608%2C7609%2C7610%2C7611%2C7612%2C7613%2C7614%2C7615%2C7616%2C7617%2C7618%2C7788%2C7790%2C7993%2C7994%2C7995%2C7996%2C7997%2C7998%2C7999%2C8057%2C8069%2C6772%2C5534%2C7661%2C7713%2C11%2C12%2C13%2C14%2C15%2C16%2C20%2C2310%2C2526%2C2527%2C2763%2C2764%2C2765%2C3154%2C3684%2C4184%2C9%2C10%2C17%2C20%2C2310%2C2351%2C2526%2C2527%2C2761%2C2763%2C2764%2C2765%2C3044%2C3154%2C3684%2C4184%2C7035%2C7327%2C7789%2C7%2C8%2C9%2C10%2C915%2C874%2C835%26osb%3DLinux%252FChrome%26lb%3D220%26reqt%3D1762685588888&cust_params=li-module-enabled%3Dt1&adks=4079446691&frm=20&eo_id_str=ID%3Dd758a0372e0d617e%3AT%3D1762685587%3ART%3D1762685587%3AS%3DAA-AfjbrkAa_d6zy1Ty3ihSBvc1X&pbbce=1&td=1&egid=3721&tan=5e3107b9-1e1c-45dc-be13-7701b2f8f596&tdf=2
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511040101/pubads_impl.js?cb=31095648
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c21::9b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
b944de338f1cb0407c7f286a22047ad4879a3a4e6d3f97c097d59bf1260697a6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

content-encoding
dcb
google-lineitem-id
-2
observe-browsing-topics
?1
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sun, 09 Nov 2025 10:53:09 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-2
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
163
x-xss-protection
0
server
cafe
sodar
ep1.adtrafficquality.google/pagead/ 		0
17 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ep1.adtrafficquality.google/pagead/sodar?id=sodar2&v=237&t=2&li=gpt_m202511040101&jk=4347117103472909&bg=!r6ylrOPNAAaIPp6FqD47ADQBe5WfOAkiKSCTd6BIzGxytreuv8i323n2_BQ4_B7HBHa01BPp5H194JqSXs5m9p6tPX3aAgAAAI5SAAAABGgBB34AN3nRm0BpYPRdMe5OVCwgMM9d4sGzYgrvyY33m5vvTaBeoIlqUYEVPkkY3XvNRk00FXPI0DGOUTkKAG5NbY8PfZxBRKFeAKUKrbGBoz8B879rIzTWFwgpKzBUw6zlrQzlV5NpptXKRV8bDPaUwwSSaskNzhCqB0Vy7Gx9hSAAOUr6i4QtXcryatGRp790oGqj1dyiO369g8sqW6Kg-rX438ZmqLdRbnlS-ZkCVR0u3GS3j1y2WeQ_K7emwMPi-3zX3O8xpVeXDHCKWKZQ1mZGGw_JchnCxTkH30TcPsAgyDbwNBFOCjK57QSeXh0UXxYdEquNHnghLRG59mKj1zx20qr6vWbsPyw6Y7eHOxLEF2513XBqhvT02Sttb3o2fQNZ5D06HSN4wj7KWTJ3gX3idCbb8Av7dsUswFAhcjfN6JF0d9u1TtVulYvNUGQ3vxhTwYB1TQ7cTUnXrN2EJ4zx2sHzWwmDwsctOaca2ANFW4q3jmFv_NScic7OTcVAEAJ8mLj0CRZmiiWZTbx1nO94qQB1R3UNqwj_dlxKNDUCVseGuj12WQ3U5BIdhrX5a-DAtRUW-7U9tNFJTk6JpxjuteNYSKQ3JbCruuA5zY5NGHBJr96iTSLxW3Pr1ftu8S1v4I-OX6fAOTmtJH5Rc4v6tS0pwRZ5S0DtE3YhmM_yK6SSxJE1o_eFfW_Q1IaC91c9aG7iPdX8NdZ2mu6BjaNPihD9A_hBtTAcYBV4FdePzY7-ZHxYdOcJuz-vDWC0pM3ncctadESLD-_1Q_KrGlCyTAtcqFcWog7ApQHmPMhCc74HVS8xU8fB-wXX3daeOrlgbrtYiMUK9UNu-Lx4REvwX9YnTvEfvt-OtiUub6prHb5x6N6UCeNTTGEfoiHVmdMRFnXDi7glP6nToYes7MpcXTyIGPy2qV-60aYK8Itv5W6_uWCNZyavLNw6of33D1V3JrZdtr62asG-U3JAo_6xC2dQ2cW0ZrgsYpz0oOQPNgyfSc_jlwcz0DAzmzSuWXOWDA
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c19::9d Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

timing-allow-origin
*
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Sun, 09 Nov 2025 10:53:09 GMT
x-xss-protection
0
content-type
image/
server
cafe
ads
securepubads.g.doubleclick.net/gampad/ 		396 B
193 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4347117103472909&correlator=832685955908988&eid=31095133%2C31095250%2C31095648%2C83321072&output=ldjh&gdfp_req=1&vrg=202511040101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-medrectangle-4&enc_prev_ius=%2F0%2F1&prev_iu_szs=336x280%7C300x250&ifi=18&didk=46192883&dids=div-gpt-ad-mediafire_com-medre&adfs=1749122204&sfv=1-0-45&rcs=2&eri=1&sc=1&cookie=ID%3D710d595ddee055b4%3AT%3D1762685587%3ART%3D1762685587%3AS%3DALNI_MZJGZDvti4dTz_nkocz4FF59h3kSg&gpic=UID%3D0000130a10d732ad%3AT%3D1762685587%3ART%3D1762685587%3AS%3DALNI_MaUVZBE6m9Fvpz6Zk1r3wnftELu7g&abxe=1&dt=1762685589433&lmt=1762685589&adxs=320&adys=420&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=3&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fzh1io5g5cavqo7l%2FRose%252527s_bot.zip%2Ffile&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGsk3ut5bf7d_pvK3Ghz6ztftrMGKws5tAfnb2QUE5Mm_4Z3YW0ifBJniWSbrxg&topics=3&tps=3&htps=10&a3p=EmwKDGlkNS1zeW5jLmNvbRJaSUQ1Knl0eFFPejc2QzBUbG10djVzbG80YXNOR005bjY3VXd1LUZJNVY5REUwTGpfXzJrUWNwUmFBQUVCQ21rUWNwTUFZS0pqWW1lNVZpVmxtVzB1Z0RUOGtBWAESRgoMYXVkaWdlbnQuY29tEjQwMDAxeXVtMGVhYmtiYTk4YmNpYWU2Z2liZGRqOTZsZGNsZjc4NmtoZGFhYmFja2tjMmpsWAESrQEKCmNyaXRlby5jb20SnAE3RE8xR2w5QlFXbEZNSEoyWjJkUFJ6RnRXblpUV2paWWMzWkthMVZzTTBkRmNtRTJUMUY2WkhwclpXeG5WRE16WkhFMFFrWmtTRE5OYlVkeFoyMXJNREpCUW0xd1dqVm1VMnBXYkZsVmRWbEJNRm8wTlZkck1GbEtWbG8xV21aVlIweEZKVEpHZFZFMVdVRjRhRXBFYmpCekpUTkVYARI2CgxhZHNlcnZlci5vcmcSJGM0ODVmOWY2LTJkN2UtNDYyNy04OTBkLWE3MWFjZGY2NDdhZVgBEjQKCnB1YmNpZC5vcmcSJGRlNmQyYWY2LWIwNWEtNGVlOS1hNzdlLWM3MzQwMjZmZjQ5Y1gBEloKDWNyd2RjbnRybC5uZXQSQGQyZTc1YjhlNDkyZTc0MzAwNGVkMGRiYzZjMDQxODVjYTAyY2M1MWU0ZGExNjQzYmIwNjQ3NzRmYmM5NGI3ZGIY-qD-waYzSAASHQoOZXNwLmNyaXRlby5jb20YvZ_-waYzSABSAghkEhgKCXlhaG9vLmNvbRicof7BpjNIAFICCG8SPgoFb3BlbngSLGV5SnBJam9pVW5kNGVUTTRSVEJSZGt0alpITmtkWGhUS3k5S1p6MDlJbjA9GMKj_sGmM0gAEhsKDDMzYWNyb3NzLmNvbRi8n_7BpjNIAFICCGQSggIKCHJ0YmhvdXNlEuwBVW5PSDI4a3JuUnluUXNqODQwNVhQMWpqaVhrOGZ4ZjFLczVJWXlaTU5CN0JWSDBpa1U2dkVCcENIYVh1anRFcUlLc3BFSVNaZWhqUHROc3ErK0J2anhkaU1OVm9GQ0FjKzNrbGEvbkJFZlV6YUZUeVpSZWxLTFB6eWF2am9ybXZUc0dQUFk4ODZxZHlXWENBT3pJeFdvcXliYW43d3N5TzdjNmovS1YvVjI3cEpuOE44dFl4dTNOR2MzK2NQbHMwWTNmSjM2cmRKbEVjcmJnb0hJYXB2OWZqcURxNlhtOUowSEFXYXhDNVoxdz0YsqP-waYzSAA.&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1762685584931&idt=2383&ppid=3b25ce83c75aeff52ef9657aec7de9f7&prev_scp=a%3D1%26iid1%3D6017477134385895%26eid%3D6017477134385895%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D0%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252Fzh1io5g5cavqo7l%252FRose%25252527s_bot.zip%252Ffile%26path%3D%252Ffile%252Fzh1io5g5cavqo7l%252FRose%252527s_bot.zip%252Ffile%26ap%3D1105%26sap%3D1105%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D6%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D22%26al%3D1022%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-medrectangle-4%26tap%3Dmediafire_com-medrectangle-4-6017477134385895%26eb_br%3Da928cf2c3ad36f5e9ed2d90f655c1dc9%26eba%3D0%26bv%3D13%26bvm%3D0%26bvr%3D3%26avc%3D89%26shp%3D3%26ftsn%3D12%26ftsng%3D12%26br1%3D44%26br2%3D120%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D34%2C168%2C0%2C0%2C0%2C168%2C184%2C20%2C0%2C0%2C192%2C0%2C902%2C903%2C901%2C902%2C903%26deal1%3D20%2C21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C760%2C761%2C815%2C816%2C817%2C818%2C899%2C919%2C1794%2C2310%2C2339%2C2526%2C2527%2C2763%2C2764%2C2765%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C3919%2C3933%2C4184%2C4185%2C4186%2C4604%2C4605%2C5747%2C6044%2C6293%2C6294%2C6295%2C6983%2C7036%2C7046%2C7605%2C7606%2C7607%2C7608%2C7609%2C7610%2C7611%2C7612%2C7613%2C7614%2C7615%2C7616%2C7617%2C7618%2C7788%2C7790%2C7993%2C7994%2C7995%2C7996%2C7997%2C7998%2C7999%2C8057%2C6772%2C5534%2C7661%2C7713%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C17%2C2351%2C2610%2C2761%2C3044%2C7035%2C7327%2C7789%2C7%2C8%2C915%2C874%2C835%2C17%2C19%2C2351%2C2610%2C2688%2C2693%2C2761%2C3044%2C3045%2C4276%2C7035%2C7327%2C7330%2C7789%2C7%2C8%2C916%2C915%2C874%2C835%26osb%3DLinux%252FChrome%26lb%3D120%26reqt%3D1762685588945&cust_params=li-module-enabled%3Dt1&adks=1277606936&frm=20&eo_id_str=ID%3Dd758a0372e0d617e%3AT%3D1762685587%3ART%3D1762685587%3AS%3DAA-AfjbrkAa_d6zy1Ty3ihSBvc1X&pbbce=1&td=1&egid=3721&tan=5e3107b9-1e1c-45dc-be13-7701b2f8f597&tdf=2
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511040101/pubads_impl.js?cb=31095648
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c21::9b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
8988bd4c4030609759c75a6d233755e397c96dc3481d936391cacc160e363f7f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

content-encoding
dcb
google-lineitem-id
-2
observe-browsing-topics
?1
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sun, 09 Nov 2025 10:53:09 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-2
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
163
x-xss-protection
0
server
cafe
country
api.btloader.com/ 		37 B
153 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://api.btloader.com/country?o=5678961798414336
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
130.211.23.194 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
194.23.211.130.bc.googleusercontent.com
Software
/
Resource Hash
b8f0ca68362cf245f891fc09ddfa50806d195e78e196cf96ac5d9cf72be2577a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

cache-control
private, max-age=300, stale-while-revalidate=600, stale-if-error=600
via
1.1 google
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
37
date
Sun, 09 Nov 2025 10:53:09 GMT
content-type
application/json
vary
Origin
pv
api.btloader.com/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://api.btloader.com/pv?nlf=false&tid=ldqO3n1I-KCDjvyRuZN-9a683f8824&sid=IZ3al3p4-6v2EyAqHYq-9a683f8824&cv=2.1.167&upapi=true
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
130.211.23.194 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
194.23.211.130.bc.googleusercontent.com
Software
/
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

via
1.1 google
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sun, 09 Nov 2025 10:53:09 GMT
vary
Origin
ad_impression
pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ 		60 B
336 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ad_impression
Requested by
Host: script-api.ccgateway.net
URL: https://script-api.ccgateway.net/script/bundle?id=www.mediafire.com&parentId=0dae949f4b
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.210.204.30 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-210-204-30.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
715199235705aaa7c6781030dac85b766262d77ec7c07aac6f4928f464d93583

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type
application/json
Referer
https://www.mediafire.com/

Response headers

access-control-allow-origin
https://www.mediafire.com
content-length
60
date
Sun, 09 Nov 2025 10:53:09 GMT
content-type
application/json; charset=utf-8
vary
Origin
access-control-allow-credentials
true
ad_impression
pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ 		60 B
336 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ad_impression
Requested by
Host: script-api.ccgateway.net
URL: https://script-api.ccgateway.net/script/bundle?id=www.mediafire.com&parentId=0dae949f4b
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.210.204.30 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-210-204-30.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
715199235705aaa7c6781030dac85b766262d77ec7c07aac6f4928f464d93583

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type
application/json
Referer
https://www.mediafire.com/

Response headers

access-control-allow-origin
https://www.mediafire.com
content-length
60
date
Sun, 09 Nov 2025 10:53:09 GMT
content-type
application/json; charset=utf-8
vary
Origin
access-control-allow-credentials
true
ad_impression
pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ 		60 B
336 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ad_impression
Requested by
Host: script-api.ccgateway.net
URL: https://script-api.ccgateway.net/script/bundle?id=www.mediafire.com&parentId=0dae949f4b
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.210.204.30 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-210-204-30.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
715199235705aaa7c6781030dac85b766262d77ec7c07aac6f4928f464d93583

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type
application/json
Referer
https://www.mediafire.com/

Response headers

access-control-allow-origin
https://www.mediafire.com
content-length
60
date
Sun, 09 Nov 2025 10:53:09 GMT
content-type
application/json; charset=utf-8
vary
Origin
access-control-allow-credentials
true
ad_impression
pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ 		60 B
336 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ad_impression
Requested by
Host: script-api.ccgateway.net
URL: https://script-api.ccgateway.net/script/bundle?id=www.mediafire.com&parentId=0dae949f4b
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.210.204.30 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-210-204-30.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
715199235705aaa7c6781030dac85b766262d77ec7c07aac6f4928f464d93583

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type
application/json
Referer
https://www.mediafire.com/

Response headers

access-control-allow-origin
https://www.mediafire.com
content-length
60
date
Sun, 09 Nov 2025 10:53:09 GMT
content-type
application/json; charset=utf-8
vary
Origin
access-control-allow-credentials
true
ad_impression
pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ 		60 B
336 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ad_impression
Requested by
Host: script-api.ccgateway.net
URL: https://script-api.ccgateway.net/script/bundle?id=www.mediafire.com&parentId=0dae949f4b
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.210.204.30 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-210-204-30.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
715199235705aaa7c6781030dac85b766262d77ec7c07aac6f4928f464d93583

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type
application/json
Referer
https://www.mediafire.com/

Response headers

access-control-allow-origin
https://www.mediafire.com
content-length
60
date
Sun, 09 Nov 2025 10:53:09 GMT
content-type
application/json; charset=utf-8
vary
Origin
access-control-allow-credentials
true
ad_impression
pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ 		60 B
336 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ad_impression
Requested by
Host: script-api.ccgateway.net
URL: https://script-api.ccgateway.net/script/bundle?id=www.mediafire.com&parentId=0dae949f4b
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.210.204.30 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-210-204-30.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
715199235705aaa7c6781030dac85b766262d77ec7c07aac6f4928f464d93583

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type
application/json
Referer
https://www.mediafire.com/

Response headers

access-control-allow-origin
https://www.mediafire.com
content-length
60
date
Sun, 09 Nov 2025 10:53:09 GMT
content-type
application/json; charset=utf-8
vary
Origin
access-control-allow-credentials
true
ads
securepubads.g.doubleclick.net/gampad/ 		560 B
280 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4347117103472909&correlator=1342624101272654&eid=31095133%2C31095250%2C31095648%2C83321072&output=ldjh&gdfp_req=1&vrg=202511040101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=1x1&ifi=19&didk=674410252&dids=gpt_unit_%2F1254144%2C183096492%2Fme&sfv=1-0-45&rcs=3&fas=1&eri=1&sc=1&cookie=ID%3D710d595ddee055b4%3AT%3D1762685587%3ART%3D1762685587%3AS%3DALNI_MZJGZDvti4dTz_nkocz4FF59h3kSg&gpic=UID%3D0000130a10d732ad%3AT%3D1762685587%3ART%3D1762685587%3AS%3DALNI_MaUVZBE6m9Fvpz6Zk1r3wnftELu7g&abxe=1&dt=1762685590357&lmt=1762685590&adxs=-9&adys=-9&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=6&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fzh1io5g5cavqo7l%2FRose%252527s_bot.zip%2Ffile&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&topics=3&tps=3&htps=10&a3p=EmwKDGlkNS1zeW5jLmNvbRJaSUQ1Knl0eFFPejc2QzBUbG10djVzbG80YXNOR005bjY3VXd1LUZJNVY5REUwTGpfXzJrUWNwUmFBQUVCQ21rUWNwTUFZS0pqWW1lNVZpVmxtVzB1Z0RUOGtBWAESRgoMYXVkaWdlbnQuY29tEjQwMDAxeXVtMGVhYmtiYTk4YmNpYWU2Z2liZGRqOTZsZGNsZjc4NmtoZGFhYmFja2tjMmpsWAESrQEKCmNyaXRlby5jb20SnAE3RE8xR2w5QlFXbEZNSEoyWjJkUFJ6RnRXblpUV2paWWMzWkthMVZzTTBkRmNtRTJUMUY2WkhwclpXeG5WRE16WkhFMFFrWmtTRE5OYlVkeFoyMXJNREpCUW0xd1dqVm1VMnBXYkZsVmRWbEJNRm8wTlZkck1GbEtWbG8xV21aVlIweEZKVEpHZFZFMVdVRjRhRXBFYmpCekpUTkVYARI2CgxhZHNlcnZlci5vcmcSJGM0ODVmOWY2LTJkN2UtNDYyNy04OTBkLWE3MWFjZGY2NDdhZVgBEjQKCnB1YmNpZC5vcmcSJGRlNmQyYWY2LWIwNWEtNGVlOS1hNzdlLWM3MzQwMjZmZjQ5Y1gBEloKDWNyd2RjbnRybC5uZXQSQGQyZTc1YjhlNDkyZTc0MzAwNGVkMGRiYzZjMDQxODVjYTAyY2M1MWU0ZGExNjQzYmIwNjQ3NzRmYmM5NGI3ZGIY-qD-waYzSAASHQoOZXNwLmNyaXRlby5jb20YvZ_-waYzSABSAghkEhgKCXlhaG9vLmNvbRicof7BpjNIAFICCG8SPgoFb3BlbngSLGV5SnBJam9pVW5kNGVUTTRSVEJSZGt0alpITmtkWGhUS3k5S1p6MDlJbjA9GMKj_sGmM0gAEhsKDDMzYWNyb3NzLmNvbRi8n_7BpjNIAFICCGQSggIKCHJ0YmhvdXNlEuwBVW5PSDI4a3JuUnluUXNqODQwNVhQMWpqaVhrOGZ4ZjFLczVJWXlaTU5CN0JWSDBpa1U2dkVCcENIYVh1anRFcUlLc3BFSVNaZWhqUHROc3ErK0J2anhkaU1OVm9GQ0FjKzNrbGEvbkJFZlV6YUZUeVpSZWxLTFB6eWF2am9ybXZUc0dQUFk4ODZxZHlXWENBT3pJeFdvcXliYW43d3N5TzdjNmovS1YvVjI3cEpuOE44dFl4dTNOR2MzK2NQbHMwWTNmSjM2cmRKbEVjcmJnb0hJYXB2OWZqcURxNlhtOUowSEFXYXhDNVoxdz0YsqP-waYzSAA.&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1762685584931&idt=2383&ppid=3b25ce83c75aeff52ef9657aec7de9f7&prev_scp=a%3D1%26iid1%3D5496324216408839%26eid%3D5496324216408839%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D0%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252Fzh1io5g5cavqo7l%252FRose%25252527s_bot.zip%252Ffile%26path%3D%252Ffile%252Fzh1io5g5cavqo7l%252FRose%252527s_bot.zip%252Ffile%26ap%3D1100%26sap%3D1100%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D4%26at%3Dmbf%26adr%3D399%26ezosn%3D7%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-medrectangle-2%26tap%3Dmediafire_com-medrectangle-2-5496324216408839%26eb_br%3Dad0061a38dd7c6f7bcb692aee88dfda4%26eba%3D0%26bv%3D5%26bvm%3D0%26bvr%3D5%26avc%3D57%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D14%26br2%3D60%26ezoic%3D1%26nmau%3D0%26mau%3D0%26ganc%3D1%26cal%3D0%26stl%3D192%2C193%2C0%2C0%2C0%2C193%2C132%2C0%2C0%2C0%2C187%2C0%2C901%2C182%2C901%2C902%2C903%26deal1%3D17%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C760%2C761%2C813%2C815%2C816%2C817%2C818%2C819%2C899%2C917%2C918%2C919%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C3933%2C4184%2C4186%2C4604%2C5747%2C6293%2C6294%2C6295%2C6983%2C7035%2C7036%2C7605%2C7606%2C7607%2C7608%2C7609%2C7610%2C7611%2C7612%2C7613%2C7614%2C7615%2C7616%2C7617%2C7618%2C7788%2C7789%2C7790%2C7993%2C7994%2C7995%2C7996%2C7997%2C7998%2C7999%2C8057%2C6772%2C5534%2C7661%2C7713%2C7%2C8%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C915%2C874%2C835%2C19%2C2688%2C3045%2C4276%2C7330%2C916%2C19%2C2688%2C2693%2C3045%2C3053%2C4276%2C7330%2C7331%2C916%2C18%2C19%2C1428%2C2688%2C2693%2C3045%2C3052%2C3053%2C3856%2C4276%2C7330%2C7331%2C916%26osb%3DLinux%252FChrome%26lb%3D34%26reqt%3D1762685589707&cust_params=li-module-enabled%3Dt1&adks=318048222&frm=20&eo_id_str=ID%3Dd758a0372e0d617e%3AT%3D1762685587%3ART%3D1762685587%3AS%3DAA-AfjbrkAa_d6zy1Ty3ihSBvc1X&pbbce=1&td=1&egid=3721&tan=5e3107b9-1e1c-45dc-be13-7701b2f8f598&tdf=2
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511040101/pubads_impl.js?cb=31095648
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c21::9b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ca7307172a9db317510157b44914bf28976af4545e1acce6664c41b98a2826f9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

content-encoding
dcb
google-lineitem-id
-2
observe-browsing-topics
?1
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sun, 09 Nov 2025 10:53:10 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-2
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
250
x-xss-protection
0
server
cafe
ads
securepubads.g.doubleclick.net/gampad/ 		386 B
185 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4347117103472909&correlator=1968417330492319&eid=31095133%2C31095250%2C31095648%2C83321072&output=ldjh&gdfp_req=1&vrg=202511040101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=20&didk=1697938527&dids=div-gpt-ad-mediafire_com-box-2&adfs=2211965457&sfv=1-0-45&rcs=3&eri=1&sc=1&cookie=ID%3D710d595ddee055b4%3AT%3D1762685587%3ART%3D1762685587%3AS%3DALNI_MZJGZDvti4dTz_nkocz4FF59h3kSg&gpic=UID%3D0000130a10d732ad%3AT%3D1762685587%3ART%3D1762685587%3AS%3DALNI_MaUVZBE6m9Fvpz6Zk1r3wnftELu7g&abxe=1&dt=1762685590371&lmt=1762685590&adxs=552&adys=10&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fzh1io5g5cavqo7l%2FRose%252527s_bot.zip%2Ffile&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGsnKBe6A8UeYaKvGJbCyFiTriK8dsF6Jl1znEMiqAHO7Wqyzicw5d5yVUmK2fA&topics=3&tps=3&htps=10&a3p=EmwKDGlkNS1zeW5jLmNvbRJaSUQ1Knl0eFFPejc2QzBUbG10djVzbG80YXNOR005bjY3VXd1LUZJNVY5REUwTGpfXzJrUWNwUmFBQUVCQ21rUWNwTUFZS0pqWW1lNVZpVmxtVzB1Z0RUOGtBWAESRgoMYXVkaWdlbnQuY29tEjQwMDAxeXVtMGVhYmtiYTk4YmNpYWU2Z2liZGRqOTZsZGNsZjc4NmtoZGFhYmFja2tjMmpsWAESrQEKCmNyaXRlby5jb20SnAE3RE8xR2w5QlFXbEZNSEoyWjJkUFJ6RnRXblpUV2paWWMzWkthMVZzTTBkRmNtRTJUMUY2WkhwclpXeG5WRE16WkhFMFFrWmtTRE5OYlVkeFoyMXJNREpCUW0xd1dqVm1VMnBXYkZsVmRWbEJNRm8wTlZkck1GbEtWbG8xV21aVlIweEZKVEpHZFZFMVdVRjRhRXBFYmpCekpUTkVYARI2CgxhZHNlcnZlci5vcmcSJGM0ODVmOWY2LTJkN2UtNDYyNy04OTBkLWE3MWFjZGY2NDdhZVgBEjQKCnB1YmNpZC5vcmcSJGRlNmQyYWY2LWIwNWEtNGVlOS1hNzdlLWM3MzQwMjZmZjQ5Y1gBEloKDWNyd2RjbnRybC5uZXQSQGQyZTc1YjhlNDkyZTc0MzAwNGVkMGRiYzZjMDQxODVjYTAyY2M1MWU0ZGExNjQzYmIwNjQ3NzRmYmM5NGI3ZGIY-qD-waYzSAASHQoOZXNwLmNyaXRlby5jb20YvZ_-waYzSABSAghkEhgKCXlhaG9vLmNvbRicof7BpjNIAFICCG8SPgoFb3BlbngSLGV5SnBJam9pVW5kNGVUTTRSVEJSZGt0alpITmtkWGhUS3k5S1p6MDlJbjA9GMKj_sGmM0gAEhsKDDMzYWNyb3NzLmNvbRi8n_7BpjNIAFICCGQSggIKCHJ0YmhvdXNlEuwBVW5PSDI4a3JuUnluUXNqODQwNVhQMWpqaVhrOGZ4ZjFLczVJWXlaTU5CN0JWSDBpa1U2dkVCcENIYVh1anRFcUlLc3BFSVNaZWhqUHROc3ErK0J2anhkaU1OVm9GQ0FjKzNrbGEvbkJFZlV6YUZUeVpSZWxLTFB6eWF2am9ybXZUc0dQUFk4ODZxZHlXWENBT3pJeFdvcXliYW43d3N5TzdjNmovS1YvVjI3cEpuOE44dFl4dTNOR2MzK2NQbHMwWTNmSjM2cmRKbEVjcmJnb0hJYXB2OWZqcURxNlhtOUowSEFXYXhDNVoxdz0YsqP-waYzSAA.&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1762685584931&idt=2383&ppid=3b25ce83c75aeff52ef9657aec7de9f7&prev_scp=a%3D1%26iid1%3D6146046926352970%26eid%3D6146046926352970%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D0%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252Fzh1io5g5cavqo7l%252FRose%25252527s_bot.zip%252Ffile%26path%3D%252Ffile%252Fzh1io5g5cavqo7l%252FRose%252527s_bot.zip%252Ffile%26ap%3D1103%26sap%3D1103%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D4%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-box-2%26tap%3Dmediafire_com-box-2-6146046926352970%26eb_br%3D23b5ca1d9de2587e6a4ecfd33d61b709%26eba%3D0%26bv%3D5%26bvm%3D0%26bvr%3D5%26avc%3D115%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D38%26br2%3D160%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D146%2C168%2C0%2C0%2C0%2C168%2C184%2C20%2C0%2C0%2C192%2C0%2C902%2C903%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2764%2C2765%2C3054%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4186%2C5747%2C6293%2C6294%2C6295%2C7036%2C7605%2C7606%2C7607%2C7608%2C7609%2C7610%2C7611%2C7612%2C7613%2C7614%2C7615%2C7616%2C7617%2C7618%2C7788%2C7790%2C7993%2C7994%2C7995%2C7996%2C7997%2C7998%2C7999%2C6772%2C5534%2C7661%2C7713%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C17%2C20%2C2351%2C2526%2C2527%2C2761%2C2763%2C3044%2C3154%2C7789%2C8%2C9%2C874%2C835%2C17%2C19%2C20%2C2351%2C2526%2C2527%2C2610%2C2688%2C2761%2C2763%2C3044%2C3154%2C7035%2C7789%2C7%2C8%2C9%2C916%2C915%2C874%2C835%2C17%2C19%2C20%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C3044%2C3045%2C3154%2C4276%2C7035%2C7330%2C7331%2C7789%2C7%2C8%2C9%2C916%2C915%2C874%2C835%26osb%3DLinux%252FChrome%26lb%3D90%26reqt%3D1762685589728&cust_params=li-module-enabled%3Dt1&adks=3106951849&frm=20&eo_id_str=ID%3Dd758a0372e0d617e%3AT%3D1762685587%3ART%3D1762685587%3AS%3DAA-AfjbrkAa_d6zy1Ty3ihSBvc1X&pbbce=1&td=1&egid=3721&tan=5e3107b9-1e1c-45dc-be13-7701b2f8f599&tdf=2
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511040101/pubads_impl.js?cb=31095648
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c21::9b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
35ba9ff40ec80c9b7e526ec5053b286500533de4ba39efbd2b7b715952054b51
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

content-encoding
dcb
google-lineitem-id
-2
observe-browsing-topics
?1
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sun, 09 Nov 2025 10:53:10 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-2
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
155
x-xss-protection
0
server
cafe
ads
securepubads.g.doubleclick.net/gampad/ 		388 B
188 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4347117103472909&correlator=1976770916085760&eid=31095133%2C31095250%2C31095648%2C83321072&output=ldjh&gdfp_req=1&vrg=202511040101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-edge-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C160x600&fluid=height&ifi=21&didk=2994425013&dids=div-gpt-ad-mediafire_com-edge-&adfs=982453029&sfv=1-0-45&rcs=3&eri=1&sc=1&cookie=ID%3D710d595ddee055b4%3AT%3D1762685587%3ART%3D1762685587%3AS%3DALNI_MZJGZDvti4dTz_nkocz4FF59h3kSg&gpic=UID%3D0000130a10d732ad%3AT%3D1762685587%3ART%3D1762685587%3AS%3DALNI_MaUVZBE6m9Fvpz6Zk1r3wnftELu7g&abxe=1&dt=1762685590382&lmt=1762685590&adxs=1440&adys=300&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=5&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fzh1io5g5cavqo7l%2FRose%252527s_bot.zip%2Ffile&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGsnKBe6A8UeYaKvGJbCyFiTriK8dsF6Jl1znEMiqAHO7Wqyzicw5d5yVUmK2fA&topics=3&tps=3&htps=10&a3p=EmwKDGlkNS1zeW5jLmNvbRJaSUQ1Knl0eFFPejc2QzBUbG10djVzbG80YXNOR005bjY3VXd1LUZJNVY5REUwTGpfXzJrUWNwUmFBQUVCQ21rUWNwTUFZS0pqWW1lNVZpVmxtVzB1Z0RUOGtBWAESRgoMYXVkaWdlbnQuY29tEjQwMDAxeXVtMGVhYmtiYTk4YmNpYWU2Z2liZGRqOTZsZGNsZjc4NmtoZGFhYmFja2tjMmpsWAESrQEKCmNyaXRlby5jb20SnAE3RE8xR2w5QlFXbEZNSEoyWjJkUFJ6RnRXblpUV2paWWMzWkthMVZzTTBkRmNtRTJUMUY2WkhwclpXeG5WRE16WkhFMFFrWmtTRE5OYlVkeFoyMXJNREpCUW0xd1dqVm1VMnBXYkZsVmRWbEJNRm8wTlZkck1GbEtWbG8xV21aVlIweEZKVEpHZFZFMVdVRjRhRXBFYmpCekpUTkVYARI2CgxhZHNlcnZlci5vcmcSJGM0ODVmOWY2LTJkN2UtNDYyNy04OTBkLWE3MWFjZGY2NDdhZVgBEjQKCnB1YmNpZC5vcmcSJGRlNmQyYWY2LWIwNWEtNGVlOS1hNzdlLWM3MzQwMjZmZjQ5Y1gBEloKDWNyd2RjbnRybC5uZXQSQGQyZTc1YjhlNDkyZTc0MzAwNGVkMGRiYzZjMDQxODVjYTAyY2M1MWU0ZGExNjQzYmIwNjQ3NzRmYmM5NGI3ZGIY-qD-waYzSAASHQoOZXNwLmNyaXRlby5jb20YvZ_-waYzSABSAghkEhgKCXlhaG9vLmNvbRicof7BpjNIAFICCG8SPgoFb3BlbngSLGV5SnBJam9pVW5kNGVUTTRSVEJSZGt0alpITmtkWGhUS3k5S1p6MDlJbjA9GMKj_sGmM0gAEhsKDDMzYWNyb3NzLmNvbRi8n_7BpjNIAFICCGQSggIKCHJ0YmhvdXNlEuwBVW5PSDI4a3JuUnluUXNqODQwNVhQMWpqaVhrOGZ4ZjFLczVJWXlaTU5CN0JWSDBpa1U2dkVCcENIYVh1anRFcUlLc3BFSVNaZWhqUHROc3ErK0J2anhkaU1OVm9GQ0FjKzNrbGEvbkJFZlV6YUZUeVpSZWxLTFB6eWF2am9ybXZUc0dQUFk4ODZxZHlXWENBT3pJeFdvcXliYW43d3N5TzdjNmovS1YvVjI3cEpuOE44dFl4dTNOR2MzK2NQbHMwWTNmSjM2cmRKbEVjcmJnb0hJYXB2OWZqcURxNlhtOUowSEFXYXhDNVoxdz0YsqP-waYzSAA.&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1762685584931&idt=2383&ppid=3b25ce83c75aeff52ef9657aec7de9f7&prev_scp=a%3D1%26iid1%3D1562860810369568%26eid%3D1562860810369568%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D0%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252Fzh1io5g5cavqo7l%252FRose%25252527s_bot.zip%252Ffile%26path%3D%252Ffile%252Fzh1io5g5cavqo7l%252FRose%252527s_bot.zip%252Ffile%26ap%3D1102%26sap%3D1102%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D4%26at%3Dbf%26adr%3D399%26ezosn%3D3%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D39%26al%3D1039%26compid%3D1%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-edge-2%26tap%3Dmediafire_com-edge-2-1562860810369568%26eb_br%3Dzero%26eba%3D0%26bv%3D11%26bvm%3D0%26bvr%3D1%26avc%3D33%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D0%26br2%3D40%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D146%2C168%2C0%2C0%2C0%2C168%2C184%2C20%2C0%2C0%2C192%2C0%2C902%2C903%2C901%2C902%2C903%26deal1%3D17%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2688%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4186%2C5747%2C6293%2C6294%2C6295%2C7035%2C7036%2C7605%2C7606%2C7607%2C7608%2C7609%2C7610%2C7611%2C7612%2C7613%2C7614%2C7615%2C7616%2C7617%2C7618%2C7788%2C7789%2C7790%2C7993%2C7994%2C7995%2C7996%2C7997%2C7998%2C7999%2C6772%2C5534%2C7661%2C7713%2C7%2C8%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C916%2C915%2C874%2C835%2C2693%2C3045%2C4276%2C7330%2C18%2C1428%2C2693%2C3045%2C3052%2C3053%2C3856%2C4276%2C7330%2C7331%2C18%2C1428%2C2693%2C3045%2C3052%2C3053%2C3856%2C4276%2C7330%2C7331%26osb%3DLinux%252FChrome%26lb%3D0%26reqt%3D1762685589747%26adxf%3D1%26ss38%3D1%26ss9%3D1%26nocompoverride%3D1&cust_params=li-module-enabled%3Dt1&adks=3081006461&frm=20&eo_id_str=ID%3Dd758a0372e0d617e%3AT%3D1762685587%3ART%3D1762685587%3AS%3DAA-AfjbrkAa_d6zy1Ty3ihSBvc1X&pbbce=1&td=1&egid=3721&tan=5e3107b9-1e1c-45dc-be13-7701b2f8f59a&tdf=2
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511040101/pubads_impl.js?cb=31095648
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c21::9b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e55d84fd54f9f7e4894c88240c3dd7208a0af714193d38911d2500fbaebae74d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

content-encoding
dcb
google-lineitem-id
-2
observe-browsing-topics
?1
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sun, 09 Nov 2025 10:53:10 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-2
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
158
x-xss-protection
0
server
cafe
ads
securepubads.g.doubleclick.net/gampad/ 		388 B
187 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4347117103472909&correlator=3900116269549412&eid=31095133%2C31095250%2C31095648%2C83321072&output=ldjh&gdfp_req=1&vrg=202511040101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-edge-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C160x600&fluid=height&ifi=22&didk=2994273263&dids=div-gpt-ad-mediafire_com-edge-&adfs=580935078&sfv=1-0-45&rcs=3&eri=1&sc=1&cookie=ID%3D710d595ddee055b4%3AT%3D1762685587%3ART%3D1762685587%3AS%3DALNI_MZJGZDvti4dTz_nkocz4FF59h3kSg&gpic=UID%3D0000130a10d732ad%3AT%3D1762685587%3ART%3D1762685587%3AS%3DALNI_MaUVZBE6m9Fvpz6Zk1r3wnftELu7g&abxe=1&dt=1762685590401&lmt=1762685590&adxs=0&adys=300&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=4&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fzh1io5g5cavqo7l%2FRose%252527s_bot.zip%2Ffile&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGsnKBe6A8UeYaKvGJbCyFiTriK8dsF6Jl1znEMiqAHO7Wqyzicw5d5yVUmK2fA&topics=3&tps=3&htps=10&a3p=EmwKDGlkNS1zeW5jLmNvbRJaSUQ1Knl0eFFPejc2QzBUbG10djVzbG80YXNOR005bjY3VXd1LUZJNVY5REUwTGpfXzJrUWNwUmFBQUVCQ21rUWNwTUFZS0pqWW1lNVZpVmxtVzB1Z0RUOGtBWAESRgoMYXVkaWdlbnQuY29tEjQwMDAxeXVtMGVhYmtiYTk4YmNpYWU2Z2liZGRqOTZsZGNsZjc4NmtoZGFhYmFja2tjMmpsWAESrQEKCmNyaXRlby5jb20SnAE3RE8xR2w5QlFXbEZNSEoyWjJkUFJ6RnRXblpUV2paWWMzWkthMVZzTTBkRmNtRTJUMUY2WkhwclpXeG5WRE16WkhFMFFrWmtTRE5OYlVkeFoyMXJNREpCUW0xd1dqVm1VMnBXYkZsVmRWbEJNRm8wTlZkck1GbEtWbG8xV21aVlIweEZKVEpHZFZFMVdVRjRhRXBFYmpCekpUTkVYARI2CgxhZHNlcnZlci5vcmcSJGM0ODVmOWY2LTJkN2UtNDYyNy04OTBkLWE3MWFjZGY2NDdhZVgBEjQKCnB1YmNpZC5vcmcSJGRlNmQyYWY2LWIwNWEtNGVlOS1hNzdlLWM3MzQwMjZmZjQ5Y1gBEloKDWNyd2RjbnRybC5uZXQSQGQyZTc1YjhlNDkyZTc0MzAwNGVkMGRiYzZjMDQxODVjYTAyY2M1MWU0ZGExNjQzYmIwNjQ3NzRmYmM5NGI3ZGIY-qD-waYzSAASHQoOZXNwLmNyaXRlby5jb20YvZ_-waYzSABSAghkEhgKCXlhaG9vLmNvbRicof7BpjNIAFICCG8SPgoFb3BlbngSLGV5SnBJam9pVW5kNGVUTTRSVEJSZGt0alpITmtkWGhUS3k5S1p6MDlJbjA9GMKj_sGmM0gAEhsKDDMzYWNyb3NzLmNvbRi8n_7BpjNIAFICCGQSggIKCHJ0YmhvdXNlEuwBVW5PSDI4a3JuUnluUXNqODQwNVhQMWpqaVhrOGZ4ZjFLczVJWXlaTU5CN0JWSDBpa1U2dkVCcENIYVh1anRFcUlLc3BFSVNaZWhqUHROc3ErK0J2anhkaU1OVm9GQ0FjKzNrbGEvbkJFZlV6YUZUeVpSZWxLTFB6eWF2am9ybXZUc0dQUFk4ODZxZHlXWENBT3pJeFdvcXliYW43d3N5TzdjNmovS1YvVjI3cEpuOE44dFl4dTNOR2MzK2NQbHMwWTNmSjM2cmRKbEVjcmJnb0hJYXB2OWZqcURxNlhtOUowSEFXYXhDNVoxdz0YsqP-waYzSAA.&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1762685584931&idt=2383&ppid=3b25ce83c75aeff52ef9657aec7de9f7&prev_scp=a%3D1%26iid1%3D6821571650405327%26eid%3D6821571650405327%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D0%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252Fzh1io5g5cavqo7l%252FRose%25252527s_bot.zip%252Ffile%26path%3D%252Ffile%252Fzh1io5g5cavqo7l%252FRose%252527s_bot.zip%252Ffile%26ap%3D1101%26sap%3D1101%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D4%26at%3Dmbf%26adr%3D399%26ezosn%3D4%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D38%26al%3D1038%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-edge-1%26tap%3Dmediafire_com-edge-1-6821571650405327%26eb_br%3Db6c98a8bb15764f1c4ee331dcb724178%26eba%3D0%26bv%3D23%26bvm%3D0%26bvr%3D3%26avc%3D24%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D2%26br2%3D34%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D157%2C193%2C207%2C27%2C195%2C25%2C91%2C20%2C71%2C171%2C175%2C0%2C124%2C199%2C901%2C902%2C903%26deal1%3D17%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2688%2C2761%2C2763%2C2764%2C2765%2C3044%2C3045%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4186%2C5747%2C6293%2C6294%2C6295%2C7035%2C7036%2C7330%2C7605%2C7606%2C7607%2C7608%2C7609%2C7610%2C7611%2C7612%2C7613%2C7614%2C7615%2C7616%2C7617%2C7618%2C7788%2C7789%2C7790%2C7993%2C7994%2C7995%2C7996%2C7997%2C7998%2C7999%2C6772%2C5534%2C7661%2C7713%2C7%2C8%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C916%2C915%2C874%2C835%2C2693%2C3053%2C4276%2C7331%2C18%2C1428%2C2693%2C3052%2C3053%2C3856%2C4276%2C7331%2C18%2C1428%2C2693%2C3052%2C3053%2C3856%2C4276%2C7331%26osb%3DLinux%252FChrome%26lb%3D14%26reqt%3D1762685589722&cust_params=li-module-enabled%3Dt1&adks=3527628052&frm=20&eo_id_str=ID%3Dd758a0372e0d617e%3AT%3D1762685587%3ART%3D1762685587%3AS%3DAA-AfjbrkAa_d6zy1Ty3ihSBvc1X&pbbce=1&td=1&egid=3721&tan=5e3107b9-1e1c-45dc-be13-7701b2f8f59b&tdf=2
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511040101/pubads_impl.js?cb=31095648
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c21::9b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
6cc7f9ef62074d75725d8ad7663dafa69bc0e51e3ba247db03a78ec3161f19c6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

content-encoding
dcb
google-lineitem-id
-2
observe-browsing-topics
?1
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sun, 09 Nov 2025 10:53:10 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-2
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
157
x-xss-protection
0
server
cafe
ads
securepubads.g.doubleclick.net/gampad/ 		396 B
191 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4347117103472909&correlator=2116848937974126&eid=31095133%2C31095250%2C31095648%2C83321072&output=ldjh&gdfp_req=1&vrg=202511040101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-medrectangle-3&enc_prev_ius=%2F0%2F1&prev_iu_szs=336x280&ifi=23&didk=46179496&dids=div-gpt-ad-mediafire_com-medre&adfs=1911771697&sfv=1-0-45&rcs=3&eri=1&sc=1&cookie=ID%3D710d595ddee055b4%3AT%3D1762685587%3ART%3D1762685587%3AS%3DALNI_MZJGZDvti4dTz_nkocz4FF59h3kSg&gpic=UID%3D0000130a10d732ad%3AT%3D1762685587%3ART%3D1762685587%3AS%3DALNI_MaUVZBE6m9Fvpz6Zk1r3wnftELu7g&abxe=1&dt=1762685590416&lmt=1762685590&adxs=320&adys=120&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=2&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fzh1io5g5cavqo7l%2FRose%252527s_bot.zip%2Ffile&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGsnKBe6A8UeYaKvGJbCyFiTriK8dsF6Jl1znEMiqAHO7Wqyzicw5d5yVUmK2fA&topics=3&tps=3&htps=10&a3p=EmwKDGlkNS1zeW5jLmNvbRJaSUQ1Knl0eFFPejc2QzBUbG10djVzbG80YXNOR005bjY3VXd1LUZJNVY5REUwTGpfXzJrUWNwUmFBQUVCQ21rUWNwTUFZS0pqWW1lNVZpVmxtVzB1Z0RUOGtBWAESRgoMYXVkaWdlbnQuY29tEjQwMDAxeXVtMGVhYmtiYTk4YmNpYWU2Z2liZGRqOTZsZGNsZjc4NmtoZGFhYmFja2tjMmpsWAESrQEKCmNyaXRlby5jb20SnAE3RE8xR2w5QlFXbEZNSEoyWjJkUFJ6RnRXblpUV2paWWMzWkthMVZzTTBkRmNtRTJUMUY2WkhwclpXeG5WRE16WkhFMFFrWmtTRE5OYlVkeFoyMXJNREpCUW0xd1dqVm1VMnBXYkZsVmRWbEJNRm8wTlZkck1GbEtWbG8xV21aVlIweEZKVEpHZFZFMVdVRjRhRXBFYmpCekpUTkVYARI2CgxhZHNlcnZlci5vcmcSJGM0ODVmOWY2LTJkN2UtNDYyNy04OTBkLWE3MWFjZGY2NDdhZVgBEjQKCnB1YmNpZC5vcmcSJGRlNmQyYWY2LWIwNWEtNGVlOS1hNzdlLWM3MzQwMjZmZjQ5Y1gBEloKDWNyd2RjbnRybC5uZXQSQGQyZTc1YjhlNDkyZTc0MzAwNGVkMGRiYzZjMDQxODVjYTAyY2M1MWU0ZGExNjQzYmIwNjQ3NzRmYmM5NGI3ZGIY-qD-waYzSAASHQoOZXNwLmNyaXRlby5jb20YvZ_-waYzSABSAghkEhgKCXlhaG9vLmNvbRicof7BpjNIAFICCG8SPgoFb3BlbngSLGV5SnBJam9pVW5kNGVUTTRSVEJSZGt0alpITmtkWGhUS3k5S1p6MDlJbjA9GMKj_sGmM0gAEhsKDDMzYWNyb3NzLmNvbRi8n_7BpjNIAFICCGQSggIKCHJ0YmhvdXNlEuwBVW5PSDI4a3JuUnluUXNqODQwNVhQMWpqaVhrOGZ4ZjFLczVJWXlaTU5CN0JWSDBpa1U2dkVCcENIYVh1anRFcUlLc3BFSVNaZWhqUHROc3ErK0J2anhkaU1OVm9GQ0FjKzNrbGEvbkJFZlV6YUZUeVpSZWxLTFB6eWF2am9ybXZUc0dQUFk4ODZxZHlXWENBT3pJeFdvcXliYW43d3N5TzdjNmovS1YvVjI3cEpuOE44dFl4dTNOR2MzK2NQbHMwWTNmSjM2cmRKbEVjcmJnb0hJYXB2OWZqcURxNlhtOUowSEFXYXhDNVoxdz0YsqP-waYzSAA.&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1762685584931&idt=2383&ppid=3b25ce83c75aeff52ef9657aec7de9f7&prev_scp=a%3D1%26iid1%3D7611442246396448%26eid%3D7611442246396448%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D0%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252Fzh1io5g5cavqo7l%252FRose%25252527s_bot.zip%252Ffile%26path%3D%252Ffile%252Fzh1io5g5cavqo7l%252FRose%252527s_bot.zip%252Ffile%26ap%3D1104%26sap%3D1104%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D4%26at%3Dmbf%26adr%3D399%26ezosn%3D5%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D21%26al%3D1021%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-medrectangle-3%26tap%3Dmediafire_com-medrectangle-3-7611442246396448%26eb_br%3D3ba982fc4238dd4197b1d51b345478dc%26eba%3D0%26bv%3D5%26bvm%3D0%26bvr%3D5%26avc%3D194%26shp%3D3%26ftsn%3D12%26ftsng%3D12%26br1%3D50%26br2%3D240%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D157%2C168%2C0%2C0%2C0%2C168%2C184%2C20%2C0%2C0%2C192%2C0%2C902%2C903%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C760%2C761%2C815%2C816%2C817%2C818%2C893%2C899%2C903%2C919%2C1794%2C2339%2C3054%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3915%2C3919%2C3933%2C4185%2C4186%2C4604%2C4605%2C5747%2C6044%2C6045%2C6293%2C6294%2C6295%2C6983%2C7036%2C7046%2C7144%2C7605%2C7606%2C7607%2C7608%2C7609%2C7610%2C7611%2C7612%2C7613%2C7614%2C7615%2C7616%2C7617%2C7618%2C7788%2C7790%2C7993%2C7994%2C7995%2C7996%2C7997%2C7998%2C7999%2C8057%2C8069%2C6772%2C5534%2C7661%2C7713%2C11%2C12%2C13%2C14%2C15%2C16%2C20%2C2310%2C2526%2C2527%2C2763%2C2764%2C2765%2C3154%2C3684%2C4184%2C9%2C10%2C17%2C20%2C2310%2C2351%2C2526%2C2527%2C2761%2C2763%2C2764%2C2765%2C3044%2C3154%2C3684%2C4184%2C7035%2C7327%2C7789%2C7%2C8%2C9%2C10%2C915%2C874%2C835%2C17%2C19%2C20%2C2310%2C2351%2C2526%2C2527%2C2610%2C2688%2C2761%2C2763%2C2764%2C2765%2C3044%2C3045%2C3154%2C3684%2C4184%2C4276%2C7035%2C7327%2C7330%2C7789%2C7%2C8%2C9%2C10%2C916%2C915%2C874%2C835%26osb%3DLinux%252FChrome%26lb%3D120%26reqt%3D1762685589752&cust_params=li-module-enabled%3Dt1&adks=4079446691&frm=20&eo_id_str=ID%3Dd758a0372e0d617e%3AT%3D1762685587%3ART%3D1762685587%3AS%3DAA-AfjbrkAa_d6zy1Ty3ihSBvc1X&pbbce=1&td=1&egid=3721&tan=5e3107b9-1e1c-45dc-be13-7701b2f8f59c&tdf=2
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511040101/pubads_impl.js?cb=31095648
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c21::9b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
3dfff187419bdcc94fa384049f212371c42bd391315f5c19464980ee9d759549
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

content-encoding
dcb
google-lineitem-id
-2
observe-browsing-topics
?1
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sun, 09 Nov 2025 10:53:10 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-2
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
161
x-xss-protection
0
server
cafe
ads
securepubads.g.doubleclick.net/gampad/ 		396 B
192 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4347117103472909&correlator=2002615730406196&eid=31095133%2C31095250%2C31095648%2C83321072&output=ldjh&gdfp_req=1&vrg=202511040101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-medrectangle-4&enc_prev_ius=%2F0%2F1&prev_iu_szs=336x280%7C300x250&ifi=24&didk=46192883&dids=div-gpt-ad-mediafire_com-medre&adfs=1749122204&sfv=1-0-45&rcs=3&eri=1&sc=1&cookie=ID%3D710d595ddee055b4%3AT%3D1762685587%3ART%3D1762685587%3AS%3DALNI_MZJGZDvti4dTz_nkocz4FF59h3kSg&gpic=UID%3D0000130a10d732ad%3AT%3D1762685587%3ART%3D1762685587%3AS%3DALNI_MaUVZBE6m9Fvpz6Zk1r3wnftELu7g&abxe=1&dt=1762685590432&lmt=1762685590&adxs=320&adys=420&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=3&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fzh1io5g5cavqo7l%2FRose%252527s_bot.zip%2Ffile&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGsnKBe6A8UeYaKvGJbCyFiTriK8dsF6Jl1znEMiqAHO7Wqyzicw5d5yVUmK2fA&topics=3&tps=3&htps=10&a3p=EmwKDGlkNS1zeW5jLmNvbRJaSUQ1Knl0eFFPejc2QzBUbG10djVzbG80YXNOR005bjY3VXd1LUZJNVY5REUwTGpfXzJrUWNwUmFBQUVCQ21rUWNwTUFZS0pqWW1lNVZpVmxtVzB1Z0RUOGtBWAESRgoMYXVkaWdlbnQuY29tEjQwMDAxeXVtMGVhYmtiYTk4YmNpYWU2Z2liZGRqOTZsZGNsZjc4NmtoZGFhYmFja2tjMmpsWAESrQEKCmNyaXRlby5jb20SnAE3RE8xR2w5QlFXbEZNSEoyWjJkUFJ6RnRXblpUV2paWWMzWkthMVZzTTBkRmNtRTJUMUY2WkhwclpXeG5WRE16WkhFMFFrWmtTRE5OYlVkeFoyMXJNREpCUW0xd1dqVm1VMnBXYkZsVmRWbEJNRm8wTlZkck1GbEtWbG8xV21aVlIweEZKVEpHZFZFMVdVRjRhRXBFYmpCekpUTkVYARI2CgxhZHNlcnZlci5vcmcSJGM0ODVmOWY2LTJkN2UtNDYyNy04OTBkLWE3MWFjZGY2NDdhZVgBEjQKCnB1YmNpZC5vcmcSJGRlNmQyYWY2LWIwNWEtNGVlOS1hNzdlLWM3MzQwMjZmZjQ5Y1gBEloKDWNyd2RjbnRybC5uZXQSQGQyZTc1YjhlNDkyZTc0MzAwNGVkMGRiYzZjMDQxODVjYTAyY2M1MWU0ZGExNjQzYmIwNjQ3NzRmYmM5NGI3ZGIY-qD-waYzSAASHQoOZXNwLmNyaXRlby5jb20YvZ_-waYzSABSAghkEhgKCXlhaG9vLmNvbRicof7BpjNIAFICCG8SPgoFb3BlbngSLGV5SnBJam9pVW5kNGVUTTRSVEJSZGt0alpITmtkWGhUS3k5S1p6MDlJbjA9GMKj_sGmM0gAEhsKDDMzYWNyb3NzLmNvbRi8n_7BpjNIAFICCGQSggIKCHJ0YmhvdXNlEuwBVW5PSDI4a3JuUnluUXNqODQwNVhQMWpqaVhrOGZ4ZjFLczVJWXlaTU5CN0JWSDBpa1U2dkVCcENIYVh1anRFcUlLc3BFSVNaZWhqUHROc3ErK0J2anhkaU1OVm9GQ0FjKzNrbGEvbkJFZlV6YUZUeVpSZWxLTFB6eWF2am9ybXZUc0dQUFk4ODZxZHlXWENBT3pJeFdvcXliYW43d3N5TzdjNmovS1YvVjI3cEpuOE44dFl4dTNOR2MzK2NQbHMwWTNmSjM2cmRKbEVjcmJnb0hJYXB2OWZqcURxNlhtOUowSEFXYXhDNVoxdz0YsqP-waYzSAA.&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1762685584931&idt=2383&ppid=3b25ce83c75aeff52ef9657aec7de9f7&prev_scp=a%3D1%26iid1%3D6017477134385895%26eid%3D6017477134385895%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D0%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252Fzh1io5g5cavqo7l%252FRose%25252527s_bot.zip%252Ffile%26path%3D%252Ffile%252Fzh1io5g5cavqo7l%252FRose%252527s_bot.zip%252Ffile%26ap%3D1105%26sap%3D1105%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D4%26at%3Dmbf%26adr%3D399%26ezosn%3D6%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D22%26al%3D1022%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-medrectangle-4%26tap%3Dmediafire_com-medrectangle-4-6017477134385895%26eb_br%3D9c3e4ee8eae7f1433cb2fe69b1326605%26eba%3D0%26bv%3D13%26bvm%3D0%26bvr%3D3%26avc%3D89%26shp%3D3%26ftsn%3D12%26ftsng%3D12%26br1%3D4%26br2%3D120%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D34%2C168%2C0%2C0%2C0%2C168%2C184%2C20%2C0%2C0%2C192%2C0%2C902%2C903%2C901%2C902%2C903%26deal1%3D20%2C21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C760%2C761%2C815%2C816%2C817%2C818%2C899%2C919%2C1794%2C2310%2C2339%2C2526%2C2527%2C2763%2C2764%2C2765%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C3919%2C3933%2C4184%2C4185%2C4186%2C4604%2C4605%2C5747%2C6044%2C6293%2C6294%2C6295%2C6983%2C7036%2C7046%2C7605%2C7606%2C7607%2C7608%2C7609%2C7610%2C7611%2C7612%2C7613%2C7614%2C7615%2C7616%2C7617%2C7618%2C7788%2C7790%2C7993%2C7994%2C7995%2C7996%2C7997%2C7998%2C7999%2C8057%2C6772%2C5534%2C7661%2C7713%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C17%2C2351%2C2610%2C2761%2C3044%2C7035%2C7327%2C7789%2C7%2C8%2C915%2C874%2C835%2C17%2C19%2C2351%2C2610%2C2688%2C2693%2C2761%2C3044%2C3045%2C4276%2C7035%2C7327%2C7330%2C7789%2C7%2C8%2C916%2C915%2C874%2C835%2C17%2C18%2C19%2C1428%2C2351%2C2610%2C2688%2C2693%2C2761%2C3044%2C3045%2C3052%2C3053%2C3856%2C4276%2C7035%2C7327%2C7330%2C7331%2C7789%2C7%2C8%2C916%2C915%2C874%2C835%26osb%3DLinux%252FChrome%26lb%3D44%26reqt%3D1762685589828&cust_params=li-module-enabled%3Dt1&adks=1277606936&frm=20&eo_id_str=ID%3Dd758a0372e0d617e%3AT%3D1762685587%3ART%3D1762685587%3AS%3DAA-AfjbrkAa_d6zy1Ty3ihSBvc1X&pbbce=1&td=1&egid=3721&tan=5e3107b9-1e1c-45dc-be13-7701b2f8f59d&tdf=2
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511040101/pubads_impl.js?cb=31095648
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c21::9b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
93a010187522c5e6ef85ab3c24b346b668eb0dce2a6221bfeaa246b76798c570
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

content-encoding
dcb
google-lineitem-id
-2
observe-browsing-topics
?1
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sun, 09 Nov 2025 10:53:10 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-2
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
162
x-xss-protection
0
server
cafe
ad_impression
pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ 		60 B
336 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ad_impression
Requested by
Host: script-api.ccgateway.net
URL: https://script-api.ccgateway.net/script/bundle?id=www.mediafire.com&parentId=0dae949f4b
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.210.204.30 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-210-204-30.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
715199235705aaa7c6781030dac85b766262d77ec7c07aac6f4928f464d93583

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type
application/json
Referer
https://www.mediafire.com/

Response headers

access-control-allow-origin
https://www.mediafire.com
content-length
60
date
Sun, 09 Nov 2025 10:53:10 GMT
content-type
application/json; charset=utf-8
vary
Origin
access-control-allow-credentials
true
ad_impression
pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ 		60 B
336 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ad_impression
Requested by
Host: script-api.ccgateway.net
URL: https://script-api.ccgateway.net/script/bundle?id=www.mediafire.com&parentId=0dae949f4b
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.210.204.30 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-210-204-30.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
715199235705aaa7c6781030dac85b766262d77ec7c07aac6f4928f464d93583

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type
application/json
Referer
https://www.mediafire.com/

Response headers

access-control-allow-origin
https://www.mediafire.com
content-length
60
date
Sun, 09 Nov 2025 10:53:10 GMT
content-type
application/json; charset=utf-8
vary
Origin
access-control-allow-credentials
true
ad_impression
pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ 		60 B
336 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ad_impression
Requested by
Host: script-api.ccgateway.net
URL: https://script-api.ccgateway.net/script/bundle?id=www.mediafire.com&parentId=0dae949f4b
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.210.204.30 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-210-204-30.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
715199235705aaa7c6781030dac85b766262d77ec7c07aac6f4928f464d93583

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type
application/json
Referer
https://www.mediafire.com/

Response headers

access-control-allow-origin
https://www.mediafire.com
content-length
60
date
Sun, 09 Nov 2025 10:53:10 GMT
content-type
application/json; charset=utf-8
vary
Origin
access-control-allow-credentials
true
ad_impression
pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ 		60 B
336 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ad_impression
Requested by
Host: script-api.ccgateway.net
URL: https://script-api.ccgateway.net/script/bundle?id=www.mediafire.com&parentId=0dae949f4b
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.210.204.30 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-210-204-30.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
715199235705aaa7c6781030dac85b766262d77ec7c07aac6f4928f464d93583

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type
application/json
Referer
https://www.mediafire.com/

Response headers

access-control-allow-origin
https://www.mediafire.com
content-length
60
date
Sun, 09 Nov 2025 10:53:10 GMT
content-type
application/json; charset=utf-8
vary
Origin
access-control-allow-credentials
true
ad_impression
pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ 		60 B
336 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ad_impression
Requested by
Host: script-api.ccgateway.net
URL: https://script-api.ccgateway.net/script/bundle?id=www.mediafire.com&parentId=0dae949f4b
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.210.204.30 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-210-204-30.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
715199235705aaa7c6781030dac85b766262d77ec7c07aac6f4928f464d93583

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type
application/json
Referer
https://www.mediafire.com/

Response headers

access-control-allow-origin
https://www.mediafire.com
content-length
60
date
Sun, 09 Nov 2025 10:53:10 GMT
content-type
application/json; charset=utf-8
vary
Origin
access-control-allow-credentials
true
ad_impression
pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ 		60 B
336 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ad_impression
Requested by
Host: script-api.ccgateway.net
URL: https://script-api.ccgateway.net/script/bundle?id=www.mediafire.com&parentId=0dae949f4b
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.210.204.30 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-210-204-30.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
715199235705aaa7c6781030dac85b766262d77ec7c07aac6f4928f464d93583

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type
application/json
Referer
https://www.mediafire.com/

Response headers

access-control-allow-origin
https://www.mediafire.com
content-length
60
date
Sun, 09 Nov 2025 10:53:10 GMT
content-type
application/json; charset=utf-8
vary
Origin
access-control-allow-credentials
true
ads
securepubads.g.doubleclick.net/gampad/ 		559 B
283 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4347117103472909&correlator=3423143030804626&eid=31095133%2C31095250%2C31095648%2C83321072&output=ldjh&gdfp_req=1&vrg=202511040101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=1x1&ifi=25&didk=674410252&dids=gpt_unit_%2F1254144%2C183096492%2Fme&sfv=1-0-45&rcs=4&fas=1&eri=1&sc=1&cookie=ID%3D710d595ddee055b4%3AT%3D1762685587%3ART%3D1762685587%3AS%3DALNI_MZJGZDvti4dTz_nkocz4FF59h3kSg&gpic=UID%3D0000130a10d732ad%3AT%3D1762685587%3ART%3D1762685587%3AS%3DALNI_MaUVZBE6m9Fvpz6Zk1r3wnftELu7g&abxe=1&dt=1762685591358&lmt=1762685591&adxs=-9&adys=-9&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=6&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fzh1io5g5cavqo7l%2FRose%252527s_bot.zip%2Ffile&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&topics=3&tps=3&htps=10&a3p=EmwKDGlkNS1zeW5jLmNvbRJaSUQ1Knl0eFFPejc2QzBUbG10djVzbG80YXNOR005bjY3VXd1LUZJNVY5REUwTGpfXzJrUWNwUmFBQUVCQ21rUWNwTUFZS0pqWW1lNVZpVmxtVzB1Z0RUOGtBWAESRgoMYXVkaWdlbnQuY29tEjQwMDAxeXVtMGVhYmtiYTk4YmNpYWU2Z2liZGRqOTZsZGNsZjc4NmtoZGFhYmFja2tjMmpsWAESrQEKCmNyaXRlby5jb20SnAE3RE8xR2w5QlFXbEZNSEoyWjJkUFJ6RnRXblpUV2paWWMzWkthMVZzTTBkRmNtRTJUMUY2WkhwclpXeG5WRE16WkhFMFFrWmtTRE5OYlVkeFoyMXJNREpCUW0xd1dqVm1VMnBXYkZsVmRWbEJNRm8wTlZkck1GbEtWbG8xV21aVlIweEZKVEpHZFZFMVdVRjRhRXBFYmpCekpUTkVYARI2CgxhZHNlcnZlci5vcmcSJGM0ODVmOWY2LTJkN2UtNDYyNy04OTBkLWE3MWFjZGY2NDdhZVgBEjQKCnB1YmNpZC5vcmcSJGRlNmQyYWY2LWIwNWEtNGVlOS1hNzdlLWM3MzQwMjZmZjQ5Y1gBEloKDWNyd2RjbnRybC5uZXQSQGQyZTc1YjhlNDkyZTc0MzAwNGVkMGRiYzZjMDQxODVjYTAyY2M1MWU0ZGExNjQzYmIwNjQ3NzRmYmM5NGI3ZGIY-qD-waYzSAASHQoOZXNwLmNyaXRlby5jb20YvZ_-waYzSABSAghkEhgKCXlhaG9vLmNvbRicof7BpjNIAFICCG8SPgoFb3BlbngSLGV5SnBJam9pVW5kNGVUTTRSVEJSZGt0alpITmtkWGhUS3k5S1p6MDlJbjA9GMKj_sGmM0gAEhsKDDMzYWNyb3NzLmNvbRi8n_7BpjNIAFICCGQSggIKCHJ0YmhvdXNlEuwBVW5PSDI4a3JuUnluUXNqODQwNVhQMWpqaVhrOGZ4ZjFLczVJWXlaTU5CN0JWSDBpa1U2dkVCcENIYVh1anRFcUlLc3BFSVNaZWhqUHROc3ErK0J2anhkaU1OVm9GQ0FjKzNrbGEvbkJFZlV6YUZUeVpSZWxLTFB6eWF2am9ybXZUc0dQUFk4ODZxZHlXWENBT3pJeFdvcXliYW43d3N5TzdjNmovS1YvVjI3cEpuOE44dFl4dTNOR2MzK2NQbHMwWTNmSjM2cmRKbEVjcmJnb0hJYXB2OWZqcURxNlhtOUowSEFXYXhDNVoxdz0YsqP-waYzSAA.&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1762685584931&idt=2383&ppid=3b25ce83c75aeff52ef9657aec7de9f7&prev_scp=a%3D1%26iid1%3D5496324216408839%26eid%3D5496324216408839%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D0%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252Fzh1io5g5cavqo7l%252FRose%25252527s_bot.zip%252Ffile%26path%3D%252Ffile%252Fzh1io5g5cavqo7l%252FRose%252527s_bot.zip%252Ffile%26ap%3D1100%26sap%3D1100%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D5%26at%3Dmbf%26adr%3D399%26ezosn%3D7%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-medrectangle-2%26tap%3Dmediafire_com-medrectangle-2-5496324216408839%26eb_br%3D9c3e4ee8eae7f1433cb2fe69b1326605%26eba%3D0%26bv%3D5%26bvm%3D0%26bvr%3D5%26avc%3D57%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D4%26br2%3D60%26ezoic%3D1%26nmau%3D0%26mau%3D0%26ganc%3D1%26cal%3D0%26stl%3D192%2C193%2C0%2C0%2C0%2C193%2C132%2C0%2C0%2C0%2C187%2C0%2C901%2C182%2C901%2C902%2C903%26deal1%3D17%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C760%2C761%2C813%2C815%2C816%2C817%2C818%2C819%2C899%2C917%2C918%2C919%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C3933%2C4184%2C4186%2C4604%2C5747%2C6293%2C6294%2C6295%2C6983%2C7035%2C7036%2C7605%2C7606%2C7607%2C7608%2C7609%2C7610%2C7611%2C7612%2C7613%2C7614%2C7615%2C7616%2C7617%2C7618%2C7788%2C7789%2C7790%2C7993%2C7994%2C7995%2C7996%2C7997%2C7998%2C7999%2C8057%2C6772%2C5534%2C7661%2C7713%2C7%2C8%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C915%2C874%2C835%2C19%2C2688%2C3045%2C4276%2C7330%2C916%2C19%2C2688%2C2693%2C3045%2C3053%2C4276%2C7330%2C7331%2C916%2C18%2C19%2C1428%2C2688%2C2693%2C3045%2C3052%2C3053%2C3856%2C4276%2C7330%2C7331%2C916%2C18%2C19%2C1428%2C2688%2C2693%2C3045%2C3052%2C3053%2C3856%2C4276%2C7330%2C7331%2C916%26osb%3DLinux%252FChrome%26lb%3D14%26reqt%3D1762685590707&cust_params=li-module-enabled%3Dt1&adks=318048222&frm=20&eo_id_str=ID%3Dd758a0372e0d617e%3AT%3D1762685587%3ART%3D1762685587%3AS%3DAA-AfjbrkAa_d6zy1Ty3ihSBvc1X&pbbce=1&td=1&egid=3721&tan=5e3107b9-1e1c-45dc-be13-7701b2f8f59e&tdf=2
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511040101/pubads_impl.js?cb=31095648
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c21::9b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
17bc52415eda19b946f9ec4de84cdd8e8774fb8b8971daa1895b651532a6f709
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

content-encoding
dcb
google-lineitem-id
-2
observe-browsing-topics
?1
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sun, 09 Nov 2025 10:53:11 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-2
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
253
x-xss-protection
0
server
cafe
ads
securepubads.g.doubleclick.net/gampad/ 		100 KB
39 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4347117103472909&correlator=1608591400966877&eid=31095133%2C31095250%2C31095648%2C83321072&output=ldjh&gdfp_req=1&vrg=202511040101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=26&didk=1697938527&dids=div-gpt-ad-mediafire_com-box-2&adfs=2211965457&sfv=1-0-45&rcs=4&eri=1&sc=1&cookie=ID%3D710d595ddee055b4%3AT%3D1762685587%3ART%3D1762685587%3AS%3DALNI_MZJGZDvti4dTz_nkocz4FF59h3kSg&gpic=UID%3D0000130a10d732ad%3AT%3D1762685587%3ART%3D1762685587%3AS%3DALNI_MaUVZBE6m9Fvpz6Zk1r3wnftELu7g&abxe=1&dt=1762685591371&lmt=1762685591&adxs=552&adys=10&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fzh1io5g5cavqo7l%2FRose%252527s_bot.zip%2Ffile&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGsla0tbXlkSeQMLRAtOHZVs76TkzldIs0yWynZqn4w50xep5UcIZKK50-IdrxD0&topics=3&tps=3&htps=10&a3p=EmwKDGlkNS1zeW5jLmNvbRJaSUQ1Knl0eFFPejc2QzBUbG10djVzbG80YXNOR005bjY3VXd1LUZJNVY5REUwTGpfXzJrUWNwUmFBQUVCQ21rUWNwTUFZS0pqWW1lNVZpVmxtVzB1Z0RUOGtBWAESRgoMYXVkaWdlbnQuY29tEjQwMDAxeXVtMGVhYmtiYTk4YmNpYWU2Z2liZGRqOTZsZGNsZjc4NmtoZGFhYmFja2tjMmpsWAESrQEKCmNyaXRlby5jb20SnAE3RE8xR2w5QlFXbEZNSEoyWjJkUFJ6RnRXblpUV2paWWMzWkthMVZzTTBkRmNtRTJUMUY2WkhwclpXeG5WRE16WkhFMFFrWmtTRE5OYlVkeFoyMXJNREpCUW0xd1dqVm1VMnBXYkZsVmRWbEJNRm8wTlZkck1GbEtWbG8xV21aVlIweEZKVEpHZFZFMVdVRjRhRXBFYmpCekpUTkVYARI2CgxhZHNlcnZlci5vcmcSJGM0ODVmOWY2LTJkN2UtNDYyNy04OTBkLWE3MWFjZGY2NDdhZVgBEjQKCnB1YmNpZC5vcmcSJGRlNmQyYWY2LWIwNWEtNGVlOS1hNzdlLWM3MzQwMjZmZjQ5Y1gBEloKDWNyd2RjbnRybC5uZXQSQGQyZTc1YjhlNDkyZTc0MzAwNGVkMGRiYzZjMDQxODVjYTAyY2M1MWU0ZGExNjQzYmIwNjQ3NzRmYmM5NGI3ZGIY-qD-waYzSAASHQoOZXNwLmNyaXRlby5jb20YvZ_-waYzSABSAghkEhgKCXlhaG9vLmNvbRicof7BpjNIAFICCG8SPgoFb3BlbngSLGV5SnBJam9pVW5kNGVUTTRSVEJSZGt0alpITmtkWGhUS3k5S1p6MDlJbjA9GMKj_sGmM0gAEhsKDDMzYWNyb3NzLmNvbRi8n_7BpjNIAFICCGQSggIKCHJ0YmhvdXNlEuwBVW5PSDI4a3JuUnluUXNqODQwNVhQMWpqaVhrOGZ4ZjFLczVJWXlaTU5CN0JWSDBpa1U2dkVCcENIYVh1anRFcUlLc3BFSVNaZWhqUHROc3ErK0J2anhkaU1OVm9GQ0FjKzNrbGEvbkJFZlV6YUZUeVpSZWxLTFB6eWF2am9ybXZUc0dQUFk4ODZxZHlXWENBT3pJeFdvcXliYW43d3N5TzdjNmovS1YvVjI3cEpuOE44dFl4dTNOR2MzK2NQbHMwWTNmSjM2cmRKbEVjcmJnb0hJYXB2OWZqcURxNlhtOUowSEFXYXhDNVoxdz0YsqP-waYzSAA.&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1762685584931&idt=2383&ppid=3b25ce83c75aeff52ef9657aec7de9f7&prev_scp=a%3D1%26iid1%3D6146046926352970%26eid%3D6146046926352970%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D0%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252Fzh1io5g5cavqo7l%252FRose%25252527s_bot.zip%252Ffile%26path%3D%252Ffile%252Fzh1io5g5cavqo7l%252FRose%252527s_bot.zip%252Ffile%26ap%3D1103%26sap%3D1103%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D5%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-box-2%26tap%3Dmediafire_com-box-2-6146046926352970%26eb_br%3D291d27313eb66c50243129b23df8a579%26eba%3D0%26bv%3D5%26bvm%3D0%26bvr%3D5%26avc%3D115%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D10%26br2%3D160%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D146%2C168%2C0%2C0%2C0%2C168%2C184%2C20%2C0%2C0%2C192%2C0%2C902%2C903%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2764%2C2765%2C3054%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4186%2C5747%2C6293%2C6294%2C6295%2C7036%2C7605%2C7606%2C7607%2C7608%2C7609%2C7610%2C7611%2C7612%2C7613%2C7614%2C7615%2C7616%2C7617%2C7618%2C7788%2C7790%2C7993%2C7994%2C7995%2C7996%2C7997%2C7998%2C7999%2C6772%2C5534%2C7661%2C7713%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C17%2C20%2C2351%2C2526%2C2527%2C2761%2C2763%2C3044%2C3154%2C7789%2C8%2C9%2C874%2C835%2C17%2C19%2C20%2C2351%2C2526%2C2527%2C2610%2C2688%2C2761%2C2763%2C3044%2C3154%2C7035%2C7789%2C7%2C8%2C9%2C916%2C915%2C874%2C835%2C17%2C19%2C20%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C3044%2C3045%2C3154%2C4276%2C7035%2C7330%2C7331%2C7789%2C7%2C8%2C9%2C916%2C915%2C874%2C835%2C17%2C18%2C19%2C20%2C1428%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C3044%2C3045%2C3052%2C3053%2C3154%2C3856%2C4276%2C7035%2C7330%2C7331%2C7789%2C7%2C8%2C9%2C916%2C915%2C874%2C835%26osb%3DLinux%252FChrome%26lb%3D38%26reqt%3D1762685590649&cust_params=li-module-enabled%3Dt1&adks=3106951849&frm=20&eo_id_str=ID%3Dd758a0372e0d617e%3AT%3D1762685587%3ART%3D1762685587%3AS%3DAA-AfjbrkAa_d6zy1Ty3ihSBvc1X&pbbce=1&td=1&egid=3721&tan=5e3107b9-1e1c-45dc-be13-7701b2f8f59f&tdf=2
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511040101/pubads_impl.js?cb=31095648
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c21::9b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
05260ec904c40508dd3c78adde4ddac1771fff34e708d489a3caa07467c88962
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

content-encoding
dcb
google-lineitem-id
-1
observe-browsing-topics
?1
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sun, 09 Nov 2025 10:53:11 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-1
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
40314
x-xss-protection
0
server
cafe
ads
securepubads.g.doubleclick.net/gampad/ 		388 B
187 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4347117103472909&correlator=2605527779320714&eid=31095133%2C31095250%2C31095648%2C83321072&output=ldjh&gdfp_req=1&vrg=202511040101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-edge-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C160x600&fluid=height&ifi=27&didk=2994273263&dids=div-gpt-ad-mediafire_com-edge-&adfs=580935078&sfv=1-0-45&rcs=4&eri=1&sc=1&cookie=ID%3D710d595ddee055b4%3AT%3D1762685587%3ART%3D1762685587%3AS%3DALNI_MZJGZDvti4dTz_nkocz4FF59h3kSg&gpic=UID%3D0000130a10d732ad%3AT%3D1762685587%3ART%3D1762685587%3AS%3DALNI_MaUVZBE6m9Fvpz6Zk1r3wnftELu7g&abxe=1&dt=1762685591402&lmt=1762685591&adxs=0&adys=300&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=4&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fzh1io5g5cavqo7l%2FRose%252527s_bot.zip%2Ffile&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGsla0tbXlkSeQMLRAtOHZVs76TkzldIs0yWynZqn4w50xep5UcIZKK50-IdrxD0&topics=3&tps=3&htps=10&a3p=EmwKDGlkNS1zeW5jLmNvbRJaSUQ1Knl0eFFPejc2QzBUbG10djVzbG80YXNOR005bjY3VXd1LUZJNVY5REUwTGpfXzJrUWNwUmFBQUVCQ21rUWNwTUFZS0pqWW1lNVZpVmxtVzB1Z0RUOGtBWAESRgoMYXVkaWdlbnQuY29tEjQwMDAxeXVtMGVhYmtiYTk4YmNpYWU2Z2liZGRqOTZsZGNsZjc4NmtoZGFhYmFja2tjMmpsWAESrQEKCmNyaXRlby5jb20SnAE3RE8xR2w5QlFXbEZNSEoyWjJkUFJ6RnRXblpUV2paWWMzWkthMVZzTTBkRmNtRTJUMUY2WkhwclpXeG5WRE16WkhFMFFrWmtTRE5OYlVkeFoyMXJNREpCUW0xd1dqVm1VMnBXYkZsVmRWbEJNRm8wTlZkck1GbEtWbG8xV21aVlIweEZKVEpHZFZFMVdVRjRhRXBFYmpCekpUTkVYARI2CgxhZHNlcnZlci5vcmcSJGM0ODVmOWY2LTJkN2UtNDYyNy04OTBkLWE3MWFjZGY2NDdhZVgBEjQKCnB1YmNpZC5vcmcSJGRlNmQyYWY2LWIwNWEtNGVlOS1hNzdlLWM3MzQwMjZmZjQ5Y1gBEloKDWNyd2RjbnRybC5uZXQSQGQyZTc1YjhlNDkyZTc0MzAwNGVkMGRiYzZjMDQxODVjYTAyY2M1MWU0ZGExNjQzYmIwNjQ3NzRmYmM5NGI3ZGIY-qD-waYzSAASHQoOZXNwLmNyaXRlby5jb20YvZ_-waYzSABSAghkEhgKCXlhaG9vLmNvbRicof7BpjNIAFICCG8SPgoFb3BlbngSLGV5SnBJam9pVW5kNGVUTTRSVEJSZGt0alpITmtkWGhUS3k5S1p6MDlJbjA9GMKj_sGmM0gAEhsKDDMzYWNyb3NzLmNvbRi8n_7BpjNIAFICCGQSggIKCHJ0YmhvdXNlEuwBVW5PSDI4a3JuUnluUXNqODQwNVhQMWpqaVhrOGZ4ZjFLczVJWXlaTU5CN0JWSDBpa1U2dkVCcENIYVh1anRFcUlLc3BFSVNaZWhqUHROc3ErK0J2anhkaU1OVm9GQ0FjKzNrbGEvbkJFZlV6YUZUeVpSZWxLTFB6eWF2am9ybXZUc0dQUFk4ODZxZHlXWENBT3pJeFdvcXliYW43d3N5TzdjNmovS1YvVjI3cEpuOE44dFl4dTNOR2MzK2NQbHMwWTNmSjM2cmRKbEVjcmJnb0hJYXB2OWZqcURxNlhtOUowSEFXYXhDNVoxdz0YsqP-waYzSAA.&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1762685584931&idt=2383&ppid=3b25ce83c75aeff52ef9657aec7de9f7&prev_scp=a%3D1%26iid1%3D6821571650405327%26eid%3D6821571650405327%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D0%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252Fzh1io5g5cavqo7l%252FRose%25252527s_bot.zip%252Ffile%26path%3D%252Ffile%252Fzh1io5g5cavqo7l%252FRose%252527s_bot.zip%252Ffile%26ap%3D1101%26sap%3D1101%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D5%26at%3Dbf%26adr%3D399%26ezosn%3D4%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D38%26al%3D1038%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-edge-1%26tap%3Dmediafire_com-edge-1-6821571650405327%26eb_br%3Dzero%26eba%3D0%26bv%3D23%26bvm%3D0%26bvr%3D3%26avc%3D24%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D0%26br2%3D34%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D157%2C193%2C207%2C27%2C195%2C25%2C91%2C20%2C71%2C171%2C175%2C0%2C124%2C199%2C901%2C902%2C903%26deal1%3D17%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2688%2C2761%2C2763%2C2764%2C2765%2C3044%2C3045%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4186%2C5747%2C6293%2C6294%2C6295%2C7035%2C7036%2C7330%2C7605%2C7606%2C7607%2C7608%2C7609%2C7610%2C7611%2C7612%2C7613%2C7614%2C7615%2C7616%2C7617%2C7618%2C7788%2C7789%2C7790%2C7993%2C7994%2C7995%2C7996%2C7997%2C7998%2C7999%2C6772%2C5534%2C7661%2C7713%2C7%2C8%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C916%2C915%2C874%2C835%2C2693%2C3053%2C4276%2C7331%2C18%2C1428%2C2693%2C3052%2C3053%2C3856%2C4276%2C7331%2C18%2C1428%2C2693%2C3052%2C3053%2C3856%2C4276%2C7331%2C18%2C1428%2C2693%2C3052%2C3053%2C3856%2C4276%2C7331%26osb%3DLinux%252FChrome%26lb%3D2%26reqt%3D1762685590770%26adxf%3D1%26ss38%3D1%26ss9%3D1&cust_params=li-module-enabled%3Dt1&adks=3527628052&frm=20&eo_id_str=ID%3Dd758a0372e0d617e%3AT%3D1762685587%3ART%3D1762685587%3AS%3DAA-AfjbrkAa_d6zy1Ty3ihSBvc1X&pbbce=1&td=1&egid=3721&tan=5e3107b9-1e1c-45dc-be13-7701b2f8f5a0&tdf=2
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511040101/pubads_impl.js?cb=31095648
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c21::9b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
d9cf8cfc12bc0343503657e99a507a824aa4549c0a34d158e357ba4dacb00773
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

content-encoding
dcb
google-lineitem-id
-2
observe-browsing-topics
?1
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sun, 09 Nov 2025 10:53:11 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-2
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
157
x-xss-protection
0
server
cafe
ads
securepubads.g.doubleclick.net/gampad/ 		396 B
192 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4347117103472909&correlator=2483798421447379&eid=31095133%2C31095250%2C31095648%2C83321072&output=ldjh&gdfp_req=1&vrg=202511040101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-medrectangle-3&enc_prev_ius=%2F0%2F1&prev_iu_szs=336x280&ifi=28&didk=46179496&dids=div-gpt-ad-mediafire_com-medre&adfs=1911771697&sfv=1-0-45&rcs=4&eri=1&sc=1&cookie=ID%3D710d595ddee055b4%3AT%3D1762685587%3ART%3D1762685587%3AS%3DALNI_MZJGZDvti4dTz_nkocz4FF59h3kSg&gpic=UID%3D0000130a10d732ad%3AT%3D1762685587%3ART%3D1762685587%3AS%3DALNI_MaUVZBE6m9Fvpz6Zk1r3wnftELu7g&abxe=1&dt=1762685591419&lmt=1762685591&adxs=320&adys=120&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=2&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fzh1io5g5cavqo7l%2FRose%252527s_bot.zip%2Ffile&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGsla0tbXlkSeQMLRAtOHZVs76TkzldIs0yWynZqn4w50xep5UcIZKK50-IdrxD0&topics=3&tps=3&htps=10&a3p=EmwKDGlkNS1zeW5jLmNvbRJaSUQ1Knl0eFFPejc2QzBUbG10djVzbG80YXNOR005bjY3VXd1LUZJNVY5REUwTGpfXzJrUWNwUmFBQUVCQ21rUWNwTUFZS0pqWW1lNVZpVmxtVzB1Z0RUOGtBWAESRgoMYXVkaWdlbnQuY29tEjQwMDAxeXVtMGVhYmtiYTk4YmNpYWU2Z2liZGRqOTZsZGNsZjc4NmtoZGFhYmFja2tjMmpsWAESrQEKCmNyaXRlby5jb20SnAE3RE8xR2w5QlFXbEZNSEoyWjJkUFJ6RnRXblpUV2paWWMzWkthMVZzTTBkRmNtRTJUMUY2WkhwclpXeG5WRE16WkhFMFFrWmtTRE5OYlVkeFoyMXJNREpCUW0xd1dqVm1VMnBXYkZsVmRWbEJNRm8wTlZkck1GbEtWbG8xV21aVlIweEZKVEpHZFZFMVdVRjRhRXBFYmpCekpUTkVYARI2CgxhZHNlcnZlci5vcmcSJGM0ODVmOWY2LTJkN2UtNDYyNy04OTBkLWE3MWFjZGY2NDdhZVgBEjQKCnB1YmNpZC5vcmcSJGRlNmQyYWY2LWIwNWEtNGVlOS1hNzdlLWM3MzQwMjZmZjQ5Y1gBEloKDWNyd2RjbnRybC5uZXQSQGQyZTc1YjhlNDkyZTc0MzAwNGVkMGRiYzZjMDQxODVjYTAyY2M1MWU0ZGExNjQzYmIwNjQ3NzRmYmM5NGI3ZGIY-qD-waYzSAASHQoOZXNwLmNyaXRlby5jb20YvZ_-waYzSABSAghkEhgKCXlhaG9vLmNvbRicof7BpjNIAFICCG8SPgoFb3BlbngSLGV5SnBJam9pVW5kNGVUTTRSVEJSZGt0alpITmtkWGhUS3k5S1p6MDlJbjA9GMKj_sGmM0gAEhsKDDMzYWNyb3NzLmNvbRi8n_7BpjNIAFICCGQSggIKCHJ0YmhvdXNlEuwBVW5PSDI4a3JuUnluUXNqODQwNVhQMWpqaVhrOGZ4ZjFLczVJWXlaTU5CN0JWSDBpa1U2dkVCcENIYVh1anRFcUlLc3BFSVNaZWhqUHROc3ErK0J2anhkaU1OVm9GQ0FjKzNrbGEvbkJFZlV6YUZUeVpSZWxLTFB6eWF2am9ybXZUc0dQUFk4ODZxZHlXWENBT3pJeFdvcXliYW43d3N5TzdjNmovS1YvVjI3cEpuOE44dFl4dTNOR2MzK2NQbHMwWTNmSjM2cmRKbEVjcmJnb0hJYXB2OWZqcURxNlhtOUowSEFXYXhDNVoxdz0YsqP-waYzSAA.&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1762685584931&idt=2383&ppid=3b25ce83c75aeff52ef9657aec7de9f7&prev_scp=a%3D1%26iid1%3D7611442246396448%26eid%3D7611442246396448%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D0%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252Fzh1io5g5cavqo7l%252FRose%25252527s_bot.zip%252Ffile%26path%3D%252Ffile%252Fzh1io5g5cavqo7l%252FRose%252527s_bot.zip%252Ffile%26ap%3D1104%26sap%3D1104%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D5%26at%3Dmbf%26adr%3D399%26ezosn%3D5%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D21%26al%3D1021%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-medrectangle-3%26tap%3Dmediafire_com-medrectangle-3-7611442246396448%26eb_br%3D14e8a85d4c42ff1db8790cbef9e33493%26eba%3D0%26bv%3D5%26bvm%3D0%26bvr%3D5%26avc%3D194%26shp%3D3%26ftsn%3D12%26ftsng%3D12%26br1%3D12%26br2%3D240%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D157%2C168%2C0%2C0%2C0%2C168%2C184%2C20%2C0%2C0%2C192%2C0%2C902%2C903%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C760%2C761%2C815%2C816%2C817%2C818%2C893%2C899%2C903%2C919%2C1794%2C2339%2C3054%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3915%2C3919%2C3933%2C4185%2C4186%2C4604%2C4605%2C5747%2C6044%2C6045%2C6293%2C6294%2C6295%2C6983%2C7036%2C7046%2C7144%2C7605%2C7606%2C7607%2C7608%2C7609%2C7610%2C7611%2C7612%2C7613%2C7614%2C7615%2C7616%2C7617%2C7618%2C7788%2C7790%2C7993%2C7994%2C7995%2C7996%2C7997%2C7998%2C7999%2C8057%2C8069%2C6772%2C5534%2C7661%2C7713%2C11%2C12%2C13%2C14%2C15%2C16%2C20%2C2310%2C2526%2C2527%2C2763%2C2764%2C2765%2C3154%2C3684%2C4184%2C9%2C10%2C17%2C20%2C2310%2C2351%2C2526%2C2527%2C2761%2C2763%2C2764%2C2765%2C3044%2C3154%2C3684%2C4184%2C7035%2C7327%2C7789%2C7%2C8%2C9%2C10%2C915%2C874%2C835%2C17%2C19%2C20%2C2310%2C2351%2C2526%2C2527%2C2610%2C2688%2C2761%2C2763%2C2764%2C2765%2C3044%2C3045%2C3154%2C3684%2C4184%2C4276%2C7035%2C7327%2C7330%2C7789%2C7%2C8%2C9%2C10%2C916%2C915%2C874%2C835%2C17%2C18%2C19%2C20%2C1428%2C2310%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C2764%2C2765%2C3044%2C3045%2C3052%2C3053%2C3154%2C3684%2C3856%2C4184%2C4276%2C7035%2C7327%2C7330%2C7331%2C7789%2C7%2C8%2C9%2C10%2C916%2C915%2C874%2C835%26osb%3DLinux%252FChrome%26lb%3D50%26reqt%3D1762685590730&cust_params=li-module-enabled%3Dt1&adks=4079446691&frm=20&eo_id_str=ID%3Dd758a0372e0d617e%3AT%3D1762685587%3ART%3D1762685587%3AS%3DAA-AfjbrkAa_d6zy1Ty3ihSBvc1X&pbbce=1&td=1&egid=3721&tan=5e3107b9-1e1c-45dc-be13-7701b2f8f5a1&tdf=2
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511040101/pubads_impl.js?cb=31095648
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c21::9b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
2f8389626ed9aeb14014eb57d8b59eb81437019c330a41d955fddf6d664152d9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

content-encoding
dcb
google-lineitem-id
-2
observe-browsing-topics
?1
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sun, 09 Nov 2025 10:53:11 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-2
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
162
x-xss-protection
0
server
cafe
ads
securepubads.g.doubleclick.net/gampad/ 		396 B
192 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4347117103472909&correlator=3179954584740021&eid=31095133%2C31095250%2C31095648%2C83321072&output=ldjh&gdfp_req=1&vrg=202511040101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-medrectangle-4&enc_prev_ius=%2F0%2F1&prev_iu_szs=336x280%7C300x250&ifi=29&didk=46192883&dids=div-gpt-ad-mediafire_com-medre&adfs=1749122204&sfv=1-0-45&rcs=4&eri=1&sc=1&cookie=ID%3D710d595ddee055b4%3AT%3D1762685587%3ART%3D1762685587%3AS%3DALNI_MZJGZDvti4dTz_nkocz4FF59h3kSg&gpic=UID%3D0000130a10d732ad%3AT%3D1762685587%3ART%3D1762685587%3AS%3DALNI_MaUVZBE6m9Fvpz6Zk1r3wnftELu7g&abxe=1&dt=1762685591436&lmt=1762685591&adxs=320&adys=420&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=3&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fzh1io5g5cavqo7l%2FRose%252527s_bot.zip%2Ffile&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGsla0tbXlkSeQMLRAtOHZVs76TkzldIs0yWynZqn4w50xep5UcIZKK50-IdrxD0&topics=3&tps=3&htps=10&a3p=EmwKDGlkNS1zeW5jLmNvbRJaSUQ1Knl0eFFPejc2QzBUbG10djVzbG80YXNOR005bjY3VXd1LUZJNVY5REUwTGpfXzJrUWNwUmFBQUVCQ21rUWNwTUFZS0pqWW1lNVZpVmxtVzB1Z0RUOGtBWAESRgoMYXVkaWdlbnQuY29tEjQwMDAxeXVtMGVhYmtiYTk4YmNpYWU2Z2liZGRqOTZsZGNsZjc4NmtoZGFhYmFja2tjMmpsWAESrQEKCmNyaXRlby5jb20SnAE3RE8xR2w5QlFXbEZNSEoyWjJkUFJ6RnRXblpUV2paWWMzWkthMVZzTTBkRmNtRTJUMUY2WkhwclpXeG5WRE16WkhFMFFrWmtTRE5OYlVkeFoyMXJNREpCUW0xd1dqVm1VMnBXYkZsVmRWbEJNRm8wTlZkck1GbEtWbG8xV21aVlIweEZKVEpHZFZFMVdVRjRhRXBFYmpCekpUTkVYARI2CgxhZHNlcnZlci5vcmcSJGM0ODVmOWY2LTJkN2UtNDYyNy04OTBkLWE3MWFjZGY2NDdhZVgBEjQKCnB1YmNpZC5vcmcSJGRlNmQyYWY2LWIwNWEtNGVlOS1hNzdlLWM3MzQwMjZmZjQ5Y1gBEloKDWNyd2RjbnRybC5uZXQSQGQyZTc1YjhlNDkyZTc0MzAwNGVkMGRiYzZjMDQxODVjYTAyY2M1MWU0ZGExNjQzYmIwNjQ3NzRmYmM5NGI3ZGIY-qD-waYzSAASHQoOZXNwLmNyaXRlby5jb20YvZ_-waYzSABSAghkEhgKCXlhaG9vLmNvbRicof7BpjNIAFICCG8SPgoFb3BlbngSLGV5SnBJam9pVW5kNGVUTTRSVEJSZGt0alpITmtkWGhUS3k5S1p6MDlJbjA9GMKj_sGmM0gAEhsKDDMzYWNyb3NzLmNvbRi8n_7BpjNIAFICCGQSggIKCHJ0YmhvdXNlEuwBVW5PSDI4a3JuUnluUXNqODQwNVhQMWpqaVhrOGZ4ZjFLczVJWXlaTU5CN0JWSDBpa1U2dkVCcENIYVh1anRFcUlLc3BFSVNaZWhqUHROc3ErK0J2anhkaU1OVm9GQ0FjKzNrbGEvbkJFZlV6YUZUeVpSZWxLTFB6eWF2am9ybXZUc0dQUFk4ODZxZHlXWENBT3pJeFdvcXliYW43d3N5TzdjNmovS1YvVjI3cEpuOE44dFl4dTNOR2MzK2NQbHMwWTNmSjM2cmRKbEVjcmJnb0hJYXB2OWZqcURxNlhtOUowSEFXYXhDNVoxdz0YsqP-waYzSAA.&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1762685584931&idt=2383&ppid=3b25ce83c75aeff52ef9657aec7de9f7&prev_scp=a%3D1%26iid1%3D6017477134385895%26eid%3D6017477134385895%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D0%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252Fzh1io5g5cavqo7l%252FRose%25252527s_bot.zip%252Ffile%26path%3D%252Ffile%252Fzh1io5g5cavqo7l%252FRose%252527s_bot.zip%252Ffile%26ap%3D1105%26sap%3D1105%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D5%26at%3Dbf%26adr%3D399%26ezosn%3D6%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D22%26al%3D1022%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-medrectangle-4%26tap%3Dmediafire_com-medrectangle-4-6017477134385895%26eb_br%3Dzero%26eba%3D0%26bv%3D13%26bvm%3D0%26bvr%3D3%26avc%3D89%26shp%3D3%26ftsn%3D12%26ftsng%3D12%26br1%3D0%26br2%3D120%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D34%2C168%2C0%2C0%2C0%2C168%2C184%2C20%2C0%2C0%2C192%2C0%2C902%2C903%2C901%2C902%2C903%26deal1%3D20%2C21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C760%2C761%2C815%2C816%2C817%2C818%2C899%2C919%2C1794%2C2310%2C2339%2C2526%2C2527%2C2763%2C2764%2C2765%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C3919%2C3933%2C4184%2C4185%2C4186%2C4604%2C4605%2C5747%2C6044%2C6293%2C6294%2C6295%2C6983%2C7036%2C7046%2C7605%2C7606%2C7607%2C7608%2C7609%2C7610%2C7611%2C7612%2C7613%2C7614%2C7615%2C7616%2C7617%2C7618%2C7788%2C7790%2C7993%2C7994%2C7995%2C7996%2C7997%2C7998%2C7999%2C8057%2C6772%2C5534%2C7661%2C7713%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C17%2C2351%2C2610%2C2761%2C3044%2C7035%2C7327%2C7789%2C7%2C8%2C915%2C874%2C835%2C17%2C19%2C2351%2C2610%2C2688%2C2693%2C2761%2C3044%2C3045%2C4276%2C7035%2C7327%2C7330%2C7789%2C7%2C8%2C916%2C915%2C874%2C835%2C17%2C18%2C19%2C1428%2C2351%2C2610%2C2688%2C2693%2C2761%2C3044%2C3045%2C3052%2C3053%2C3856%2C4276%2C7035%2C7327%2C7330%2C7331%2C7789%2C7%2C8%2C916%2C915%2C874%2C835%2C17%2C18%2C19%2C1428%2C2351%2C2610%2C2688%2C2693%2C2761%2C3044%2C3045%2C3052%2C3053%2C3856%2C4276%2C7035%2C7327%2C7330%2C7331%2C7789%2C7%2C8%2C916%2C915%2C874%2C835%26osb%3DLinux%252FChrome%26lb%3D4%26reqt%3D1762685590761%26adxf%3D1%26ss38%3D1%26ss9%3D1&cust_params=li-module-enabled%3Dt1&adks=1277606936&frm=20&eo_id_str=ID%3Dd758a0372e0d617e%3AT%3D1762685587%3ART%3D1762685587%3AS%3DAA-AfjbrkAa_d6zy1Ty3ihSBvc1X&pbbce=1&td=1&egid=3721&tan=5e3107b9-1e1c-45dc-be13-7701b2f8f5a2&tdf=2
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511040101/pubads_impl.js?cb=31095648
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c21::9b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
2b70873d57bd99dd87a2ba237063c73410e67de1d630fd303622c940bb027ff5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

content-encoding
dcb
google-lineitem-id
-2
observe-browsing-topics
?1
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sun, 09 Nov 2025 10:53:11 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-2
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
162
x-xss-protection
0
server
cafe
ad_impression
pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ 		60 B
336 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ad_impression
Requested by
Host: script-api.ccgateway.net
URL: https://script-api.ccgateway.net/script/bundle?id=www.mediafire.com&parentId=0dae949f4b
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.210.204.30 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-210-204-30.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
715199235705aaa7c6781030dac85b766262d77ec7c07aac6f4928f464d93583

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type
application/json
Referer
https://www.mediafire.com/

Response headers

access-control-allow-origin
https://www.mediafire.com
content-length
60
date
Sun, 09 Nov 2025 10:53:11 GMT
content-type
application/json; charset=utf-8
vary
Origin
access-control-allow-credentials
true
ad_impression
pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ 		60 B
336 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ad_impression
Requested by
Host: script-api.ccgateway.net
URL: https://script-api.ccgateway.net/script/bundle?id=www.mediafire.com&parentId=0dae949f4b
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.210.204.30 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-210-204-30.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
715199235705aaa7c6781030dac85b766262d77ec7c07aac6f4928f464d93583

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type
application/json
Referer
https://www.mediafire.com/

Response headers

access-control-allow-origin
https://www.mediafire.com
content-length
60
date
Sun, 09 Nov 2025 10:53:11 GMT
content-type
application/json; charset=utf-8
vary
Origin
access-control-allow-credentials
true
container.html
322f9f81cfd88b7498cd441174614e0b.safeframe.googlesyndication.com/safeframe/1-0-45/html/ Frame 2B49 		7 KB
0 		Document
General
Check archive.org
Download Go to
Full URL
https://322f9f81cfd88b7498cd441174614e0b.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511040101/pubads_impl.js?cb=31095648
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c17::84 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f1a68bf826c55985468304f4284a09cb8a68e82503d764166e611a7c58a85a4b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.mediafire.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=300
content-encoding
br
content-length
3121
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Sun, 09 Nov 2025 10:53:07 GMT
expires
Sun, 09 Nov 2025 10:53:07 GMT
last-modified
Thu, 08 May 2025 23:15:48 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
ezadfilled.js
go.ezodn.com/porpoiseant/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://go.ezodn.com/porpoiseant/ezadfilled.js?gcb=195-13&cb=808
Requested by
Host:
URL: ez-standalone.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3037::6815:574f -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2180adfc4b8cdfd2ea48e647e3bb17e531b2b3e2dd99f0277b044387fc929cbe

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

x-robots-tag
noindex, follow
content-encoding
br
cf-cache-status
HIT
age
125041
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=ob0GVzvhGkhN0fR5sZLnwfyTztDHEO4uonl3U4MxrE2Nh0oaMRBJQbGBdqjpP6QvT0z2V2fvGyUXUQaOwLIIqROP%2Fvx7yTARF%2Fr7ZTSy%2B2fuzxTll15Qkg%3D%3D"}]}
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sun, 09 Nov 2025 10:53:11 GMT
x-middleton-display
sol-js
content-type
application/javascript
vary
Accept-Encoding
last-modified
Sat, 08 Nov 2025 00:09:09 GMT
priority
u=3,i=?0
cache-control
public, max-age=31536000
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray
99bcc3d448424693-EWR
server
cloudflare
ad_impression
pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ 		60 B
336 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ad_impression
Requested by
Host: script-api.ccgateway.net
URL: https://script-api.ccgateway.net/script/bundle?id=www.mediafire.com&parentId=0dae949f4b
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.210.204.30 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-210-204-30.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
715199235705aaa7c6781030dac85b766262d77ec7c07aac6f4928f464d93583

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type
application/json
Referer
https://www.mediafire.com/

Response headers

access-control-allow-origin
https://www.mediafire.com
content-length
60
date
Sun, 09 Nov 2025 10:53:11 GMT
content-type
application/json; charset=utf-8
vary
Origin
access-control-allow-credentials
true
collect
analytics.google.com/g/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://analytics.google.com/g/collect?v=2&tid=G-K68XP6D85D&gtm=45je5b50v887485693za200zb6304663zd6304663&_p=1762685585140&_gaz=1&gcs=G111&gcd=13n3n3l3l5l1&npa=0&dma=0&tcfd=10000&cid=1178700374.1762685586&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=AEIAAAQ&_s=2&tag_exp=101509157~103116026~103200004~103233427~104527907~104528500~104684208~104684211~104948813~105391252~115480710~115583767~115938466~115938469~116217636~116217638&sid=1762685586&sct=1&seg=0&dl=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fzh1io5g5cavqo7l%2FRose%2527s_bot.zip%2Ffile&dt=Rose%27s%20bot&en=ad_impression&ep.query_id=CMDlnsTz5JADFfMWigMd-lwbvw&_et=5558&tfd=7061
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-K68XP6D85D&cx=c&gtm=4e5b50
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:32::181 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:164:0
report-to
{"group":"ascnsrsggc:164:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:164:0"}],}
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
https://www.mediafire.com
cross-origin-opener-policy-report-only
same-origin; report-to=ascnsrsggc:164:0
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sun, 09 Nov 2025 10:53:11 GMT
content-type
text/plain
server
Golfe2
pixel
googleads.g.doubleclick.net/xbbe/ Frame A025 		652 B
254 B 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/xbbe/pixel?d=CN7otKoDEIqmprYDGPya3rUCMAE&v=APEucNWKrdmZanr6IotHoe5Ya3Mb-jZHH1EqeABcH3Rw_sYPC5xPRYo4xzvTYRq2vN_zNHM3PdcoL5IknvQJPfWSt7rYTKB6cKOOefLTMBOeYoMyQ4JfREU
Requested by
Host: 322f9f81cfd88b7498cd441174614e0b.safeframe.googlesyndication.com
URL: https://322f9f81cfd88b7498cd441174614e0b.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c07::9b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
8c04e118bdd5757192be2a1eb360786f9fa1c4b398806430b7f41f203f64d8e6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://322f9f81cfd88b7498cd441174614e0b.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding
br
content-length
234
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Sun, 09 Nov 2025 10:53:11 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
abg_lite_fy2021.js
pagead2.googlesyndication.com/pagead/js/r20251106/r20110914/ Frame 2B49 		21 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20251106/r20110914/abg_lite_fy2021.js
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c21::9a Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
d84ccd933e0ca4f34a93445eb9390ed32540ca67dec0a7a00cf8b65a54e59a85
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://322f9f81cfd88b7498cd441174614e0b.safeframe.googlesyndication.com/

Response headers

content-encoding
br
etag
7620285204421265707
age
3774
x-content-type-options
nosniff
expires
Sun, 23 Nov 2025 09:50:17 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date
Sun, 09 Nov 2025 09:50:17 GMT
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
cache-control
public, max-age=1209600
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
content-length
8505
x-xss-protection
0
server
cafe
omrhp_fy2021.js
pagead2.googlesyndication.com/pagead/js/r20251106/r20110914/elements/html/ Frame 2B49 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20251106/r20110914/elements/html/omrhp_fy2021.js
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c21::9a Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
d4441ece945f2f14f46d1c462345ee2ba1c2e028e13137da40824116ee90b0f5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://322f9f81cfd88b7498cd441174614e0b.safeframe.googlesyndication.com/

Response headers

content-encoding
br
etag
14517498748587259827
age
1278
x-content-type-options
nosniff
expires
Sun, 23 Nov 2025 10:31:53 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date
Sun, 09 Nov 2025 10:31:53 GMT
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
cache-control
public, max-age=1209600
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
content-length
3198
x-xss-protection
0
server
cafe
view
ad.doubleclick.net/pcs/ Frame 2B49 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ad.doubleclick.net/pcs/view?xai=AKAOjss-O1bi00D5T46EliAj3JsbWr1Rv0eKgZFo7hYfFHKWDgp_F7ySA1i7IyoBCpkZcxkksoOVrtFO2MeOl9l9yJMJxmn0yomImw9hySpmMv3h6cNw7MvyAmdjJC-jmTuNMZ80dO2BPuXTKYOmjCEsgdtcHYnJGmaSywDV8t_A7eJ9GQN5yMvzaViBrMptCTjpSi9cACw6cwKjhAMTEsz54CoV-hV05bu4gIs_ahJpCis_JiDKAhE1t-JBJ5_z5UFtK2CPJTQjxMiWTotzZhbZSKFoj3KjPtcm6VeqWbGld56o4gdiL55TWl5cAEu31XaTkuNWAEjgWLAOtzxzfG1D6XVKTtAbTzMikYBXzCGoMZIAhlbpdHsrI8eKoz_Kueg-koex2HRY151kKceQHcXO-p1o9e4QvyJKGUyUF_teAMJlgSpIrlw-VVKpHJPk-7Ym1IDEmXCJqpZJoaFo-98ssP9-aWVF_0vdEgZCZQxs8GWuwmlELIfH1YLQUkOZ4FNcs311NIbLfZse_ki_LKYgRzyX7khdm5UgL6MZAEFDRuCWqMr23-uPn3g5mJcXiO2dpy5Wpb5I7vhefvizY2uizXHnkwhp4kGZNaPCKBcDh7goau8sN5XXk45YMBvRSIyCElVxs4cHuFDdFDwJprSd9EPmcYKKqTBEmImJbVNv-3tEZH_QKuFMyrwuHkCfyhtDzMHAZtWZGPuTpM3XxKIzY9ew-JbodMf97fotjVAIh7NUIhTmRe9-LEzgJduAKTcR8rnBYoYUssxb96lO33GKBhDvdaguBF6UMYGogHXnMyumj3mPYpcKl4PsjwekfgsnKCJTKd9_DrN7rMhZW_m-_tVMUPSePKAkXAou9K9rchn_yKOaaBIgcj7uw9a4jNEFo3fbD78d4x5Ud6cXnFfUhQLni9rqCQn8zDE__M1QwsbNkB43m8c8bI9aha7oWRLxmGRs80PvrPh0Pi6_O8oztfiOmSAmSOyK1YPAhX4Or54qcB0gv08uVLYseJNTtANVKtE5YqySsvb6rG_JSBIXIsGY4X8s7FgHGYrEhzk7BLYILPGykOqLpAeBZw56ibn2MD94u4Fg5FvvrF4MHfmGm27vQCVjr0Ny9jwMXrRYWFIXpG_8D7IoUYJAd8QZkjUrdmpsX0nNX685i_aYxl2yktjB1XDZ4vfYa0uxgRfRUNeOs-jz51P-T6fndI_VJMXnBPuoAlJbXC6-FdO92iL_TGwDaqCcojNLu6EwNQpQF0RmvoZ6CRmRGSac7MfhgE_a1lkRPEvgcNGOUUGynqqI3PP_H4wytlc0gVVet8mQTK1SE-kQ3tGa6svclVQbY06dipOvu2dWUMEGZBUJkGeL64oZAWY3DX2Bnw_Ej2ytUpymDBG3wswX9oUp40OoXh6Qks7Kiqs3FDKQCcM0ZLh7G49qCXntaH14TRTIOAxDb4YR6hrra6rYXW-6EE5GcpyJRJ6zu8wwT3IK7LNqGuWqAoFoQo2Ywgl8VnlR1u60n7s6WPSSqbAN2znlL655ZbKl6c8lPaQIFrve5x3IHssn9VbwLAIYF62WrJu6TwShg29r_RbO847uACnjhZoIVUe-6VcggiGBkozJxKZUWS8CM3DV7VzojIR6p90oKR3byIX24JOeuBx_FxRN8WB9Fai5mDLgZwiveuQaHfEKxPZ1RdYmHrK1QoKiKM7WWJwGacYj0eFzKGV_c9oBoGsqRgSk6Z5mMuq3AbDCWmWR93ppICIQeKaSgJql68k&sai=AMfl-YREp0FI9m-z5O9N-Y-4KRAVOyQKoG0kc8TVBJw-VvV0w4CkHkJCMY2A3SJRwOBxsyz4YPQE8LUqL0ka4voPHeEYg-C4TA-bm5rudu3UMBvuAv6YKeSTp4K9Uq8mBGRsi4flpnPC9VUcDeSJgOas77lq6v4J1fRbmExKmklrD0qxLnh_t8ap_jIToflSFGIF5zxrx4cX_Jznru6Lxjew6QqZPNrVlUkhH-wV6DlQnZGKlUshTiNRG8wl2Ua08pkAXm6HA5MZ1QK1lTUUXkd8M8_KT610QO8ImTaCacdhixoDi6zH5gB2R0AEYVpVKOn2UOC9VjkpkmGxU57qh5rmh4vu70ozlX-KBsR_8j5yReFXkIvM42ddhZrRsvow_Op7V7A0vxZU6ICI9QlicquWVnFkJWpDPMqdJqf4krhs9rl5k6IwM0ZvdYOilhOtoQRK9YbpEEMOYBqiVMsvKGdE0nyEVpLT9G-ZGuiy15emKcbqBJxERj6M1-N0vObYixJHU8O0-1sRNT60jlkv8YyTPYwcgHIUtNeggduQfllwqdfqTL2WTM4yCMTODsRaALp6F5PnBZxNNT1VURdwslyF5mV3pkftIYC-4k7agxHQIsh5-3OLbKa4Ry-DxpZaBAariZjrsN0fgOaOnvM7wm-NuuQil1FhJgHd9Ko-sSLGF0hx-eYig84gHqHwBwOK_NLmppv_AGGzGPn4CelaOLNlynmHvZ0TQCbq_lRKNnrHXMEoR4qpq1sauWmo6RVVKzU9cil8CRpaMfccm3iYJG9Kd5tQwg5Yygn-yy_DnGFg6SUdcPvbZ4BX2ajfzwpNHRE-wk3OWmaBQJeNAltK2GkvriMRxNuhN3DD2Wt7e4ldLtNlv_9u_vedP9pHp82DMkmajUyzeu0T_BnKfCi0pQFwaltvYVXcgYKTXfLzx6bq4RaQ0ExF1CuFpKSAZk0CHlnQdlk6jFkPLOonBl9Ft5GwuXXCS4_736mKDLnuz_c9DOuLnyOKfqv4V4-wdcjh7ZHEfqE_nGLp4cPkX6EA8BbpYZJWy-5LHcxxL_tQC6nJg0k7Wt3dnFmfQWRU3A&sig=Cg0ArKJSzCk-VrOiHPZMEAE&uach_m=%5BUACH%5D&crd=aHR0cHM6Ly9icm90aGVyLXVzYS5jb20&pr=missingexchangepricemacro&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=2&cbvp=1&cstd=0&cisv=r20251106.77491&arae=1&ftch=1&adurl=
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.16.148 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bl-in-f148.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://322f9f81cfd88b7498cd441174614e0b.safeframe.googlesyndication.com/

Response headers

x-content-type-options
nosniff
expires
Sun, 09 Nov 2025 10:53:11 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sun, 09 Nov 2025 10:53:11 GMT
content-type
image/png
content-security-policy
script-src 'none'; object-src 'none'
cache-control
private
timing-allow-origin
*
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
*
content-length
0
x-xss-protection
0
attribution-reporting-register-source
{"aggregation_keys":{"908928212":"0xadd42a5090842fe00000000000000000","908928213":"0x1bfd252312273faa0000000000000000","908928214":"0x1b5f3285481505f70000000000000000"},"debug_key":"16734254829103019944","debug_reporting":true,"destination":["https://brother-usa.com"],"event_report_windows":{"end_times":[86400,345600]},"expiry":"1296000","filter_data":{"14":["12741769"],"21":[],"23":[],"24":[],"25":[],"26":[],"27":[],"28":[],"29":[],"8":["11995011"]},"max_event_level_reports":2,"priority":"0","source_event_id":"12533693141971920323"}
server
cafe
VFc2VJAc.js
ep2.adtrafficquality.google/sodar/ Frame 2B49 		43 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ep2.adtrafficquality.google/sodar/VFc2VJAc.js
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c19::84 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
54573654901c495ecf67cc8ffd30108dd6f3a3c7332fd4dba41ab13877b75b8d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://322f9f81cfd88b7498cd441174614e0b.safeframe.googlesyndication.com/

Response headers

content-encoding
br
age
1332
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
x-content-type-options
nosniff
expires
Sun, 09 Nov 2025 11:20:59 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sun, 09 Nov 2025 10:30:59 GMT
last-modified
Thu, 13 Mar 2025 04:28:00 GMT
content-type
text/javascript
vary
Accept-Encoding
cache-control
public, max-age=3000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
content-length
14328
x-xss-protection
0
server
sffe
window_focus_fy2021.js
tpc.googlesyndication.com/pagead/js/r20251106/r20110914/client/ Frame 2B49 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20251106/r20110914/client/window_focus_fy2021.js
Requested by
Host: 322f9f81cfd88b7498cd441174614e0b.safeframe.googlesyndication.com
URL: https://322f9f81cfd88b7498cd441174614e0b.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c07::84 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
fec5a361dec923efe92848ca27b02b158b164380a9eaf6cc1625e08e0d9c101e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://322f9f81cfd88b7498cd441174614e0b.safeframe.googlesyndication.com/

Response headers

content-encoding
br
etag
6020003950853699975
age
1941
x-content-type-options
nosniff
expires
Sun, 23 Nov 2025 10:20:50 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date
Sun, 09 Nov 2025 10:20:50 GMT
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
cache-control
public, max-age=1209600
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
content-length
1241
x-xss-protection
0
server
cafe
cookie_push_onload.html
pagead2.googlesyndication.com/pagead/s/ Frame F7F9 		1 KB
837 B 		Document
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Requested by
Host: 322f9f81cfd88b7498cd441174614e0b.safeframe.googlesyndication.com
URL: https://322f9f81cfd88b7498cd441174614e0b.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c21::9a Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
bea1c5ab168f662fc9eb5bda3474e5b1bbd0d3ecc1d9c68e2a753f613c2ae0c2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://322f9f81cfd88b7498cd441174614e0b.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

age
24461
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=86400
content-encoding
br
content-length
812
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Sun, 09 Nov 2025 04:05:30 GMT
etag
9725182468138058862
expires
Mon, 10 Nov 2025 04:05:30 GMT
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server
cafe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
qs_click_protection_fy2021.js
tpc.googlesyndication.com/pagead/js/r20251106/r20110914/client/ Frame 2B49 		20 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20251106/r20110914/client/qs_click_protection_fy2021.js
Requested by
Host: 322f9f81cfd88b7498cd441174614e0b.safeframe.googlesyndication.com
URL: https://322f9f81cfd88b7498cd441174614e0b.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c07::84 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
d1d42955e69aae005efd7d5a24d10ffc36dabebd9867cca1e5b8dbb998e273a4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://322f9f81cfd88b7498cd441174614e0b.safeframe.googlesyndication.com/

Response headers

content-encoding
br
etag
11924741404489600640
age
12892
x-content-type-options
nosniff
expires
Sun, 23 Nov 2025 07:18:19 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date
Sun, 09 Nov 2025 07:18:19 GMT
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
cache-control
public, max-age=1209600
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
content-length
8624
x-xss-protection
0
server
cafe
gen_204
pagead2.googlesyndication.com/pagead/ Frame 2B49 		42 B
63 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CNnCsbTEZYTrm_barP8UnHro5bI0txAhl1aZury6KzWjccLlaOT3qwPF5wfKs_qeMa8Lr3yqkddDGKYcVFcAm4qAxP7WiLlJBG221eaDG0X3FkdSU
Requested by
Host: 322f9f81cfd88b7498cd441174614e0b.safeframe.googlesyndication.com
URL: https://322f9f81cfd88b7498cd441174614e0b.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c21::9a Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://322f9f81cfd88b7498cd441174614e0b.safeframe.googlesyndication.com/

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
42
date
Sun, 09 Nov 2025 10:53:11 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
l
www.google.com/ads/measurement/ Frame 2B49 		0
0
ufs_web_display.js
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 2B49 		223 KB
69 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js
Requested by
Host: 322f9f81cfd88b7498cd441174614e0b.safeframe.googlesyndication.com
URL: https://322f9f81cfd88b7498cd441174614e0b.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c21::9a Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
1ca0d5744e4f39ea464be06f38e214eabd97b2ca934e919a3673f0a62f76368c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://322f9f81cfd88b7498cd441174614e0b.safeframe.googlesyndication.com/

Response headers

content-encoding
br
etag
11779502037942753168
age
1663
x-content-type-options
nosniff
expires
Sun, 09 Nov 2025 11:25:28 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date
Sun, 09 Nov 2025 10:25:28 GMT
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
cache-control
public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-length
70282
x-xss-protection
0
server
cafe
17014623582792419000
s0.2mdn.net/simgad/ Frame 2B49 		40 KB
41 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/simgad/17014623582792419000
Requested by
Host: 322f9f81cfd88b7498cd441174614e0b.safeframe.googlesyndication.com
URL: https://322f9f81cfd88b7498cd441174614e0b.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c08::95 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7bfa95afa4fa36ed14b3401fea068d25cb346e21ddac11c4bd0319c0cfacb435
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://322f9f81cfd88b7498cd441174614e0b.safeframe.googlesyndication.com/

Response headers

age
21187
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options
nosniff
expires
Mon, 09 Nov 2026 05:00:04 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons
true
date
Sun, 09 Nov 2025 05:00:04 GMT
last-modified
Tue, 30 Sep 2025 17:45:41 GMT
content-type
image/jpeg
cache-control
public, max-age=31536000
timing-allow-origin
*
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
content-length
41108
x-xss-protection
0
server
sffe
ad_impression
pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ 		60 B
336 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ad_impression
Requested by
Host: script-api.ccgateway.net
URL: https://script-api.ccgateway.net/script/bundle?id=www.mediafire.com&parentId=0dae949f4b
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.210.204.30 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-210-204-30.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
715199235705aaa7c6781030dac85b766262d77ec7c07aac6f4928f464d93583

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type
application/json
Referer
https://www.mediafire.com/

Response headers

access-control-allow-origin
https://www.mediafire.com
content-length
60
date
Sun, 09 Nov 2025 10:53:11 GMT
content-type
application/json; charset=utf-8
vary
Origin
access-control-allow-credentials
true
ad_impression
pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ 		60 B
336 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ad_impression
Requested by
Host: script-api.ccgateway.net
URL: https://script-api.ccgateway.net/script/bundle?id=www.mediafire.com&parentId=0dae949f4b
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.210.204.30 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-210-204-30.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
715199235705aaa7c6781030dac85b766262d77ec7c07aac6f4928f464d93583

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type
application/json
Referer
https://www.mediafire.com/

Response headers

access-control-allow-origin
https://www.mediafire.com
content-length
60
date
Sun, 09 Nov 2025 10:53:11 GMT
content-type
application/json; charset=utf-8
vary
Origin
access-control-allow-credentials
true
Klz6NWr5.html
ep2.adtrafficquality.google/sodar/ Frame FE95 		35 KB
12 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ep2.adtrafficquality.google/sodar/Klz6NWr5.html
Requested by
Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/VFc2VJAc.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c19::84 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
2a5cfa356af90e4dc14d89477463deb2c098c826ebc6d74c1577eb3d5973cac9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://322f9f81cfd88b7498cd441174614e0b.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

accept-ranges
bytes
age
2466
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=3000
content-encoding
br
content-length
12007
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
date
Sun, 09 Nov 2025 10:12:05 GMT
expires
Sun, 09 Nov 2025 11:02:05 GMT
last-modified
Thu, 13 Mar 2025 04:28:00 GMT
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
pixel
cm.g.doubleclick.net/ Frame F7F9
Redirect Chain
  • https://px.ads.linkedin.com/setuid?partner=googleadxdb&google_gid=CAESEPen78XN-VRiJzvle6IuKBM&google_cver=1&google_push=AXcoOmRgOIsV09jWaKj_Cm1-HuDVqiU2MbB_bBKQyvcTbGzQ6BJE7lHH45FXDpsCh6ykMedQI9nsZ...
  • https://cm.g.doubleclick.net/pixel?google_nid=linkedin&google_push=AXcoOmRgOIsV09jWaKj_Cm1-HuDVqiU2MbB_bBKQyvcTbGzQ6BJE7lHH45FXDpsCh6ykMedQI9nsZ88DP0DHi0UQm9A4k1wbU7E5AjSWF9sdKbF_1a6lrut0dKR2ooXeve...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=linkedin&google_push=AXcoOmRgOIsV09jWaKj_Cm1-HuDVqiU2MbB_bBKQyvcTbGzQ6BJE7lHH45FXDpsCh6ykMedQI9nsZ88DP0DHi0UQm9A4k1wbU7E5AjSWF9sdKbF_1a6lrut0dKR2ooXeveTXScTHY-JXsp8QBnyzJX8m4Aw
Requested by
Host: 322f9f81cfd88b7498cd441174614e0b.safeframe.googlesyndication.com
URL: https://322f9f81cfd88b7498cd441174614e0b.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html
Protocol
H3
Server
142.251.179.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
pd-in-f155.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://pagead2.googlesyndication.com/

Response headers

cache-control
no-cache, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
date
Sun, 09 Nov 2025 10:53:12 GMT
x-xss-protection
0
content-type
image/png
server
HTTP server (unknown)

Redirect headers

linkedin-action
1
x-li-pop
afd-prod-ltx1-x
location
https://cm.g.doubleclick.net/pixel?google_nid=linkedin&google_push=AXcoOmRgOIsV09jWaKj_Cm1-HuDVqiU2MbB_bBKQyvcTbGzQ6BJE7lHH45FXDpsCh6ykMedQI9nsZ88DP0DHi0UQm9A4k1wbU7E5AjSWF9sdKbF_1a6lrut0dKR2ooXeveTXScTHY-JXsp8QBnyzJX8m4Aw
x-msedge-ref
Ref A: 7A8FB05359B14A538878FAB940AF191D Ref B: PHL30EDGE0210 Ref C: 2025-11-09T10:53:12Z
x-li-fabric
prod-ltx1
x-li-uuid
AAZDJziQeUiQNd1f9C7+bQ==
x-li-proto
http/2
alt-svc
h3=":443"; ma=86400
x-cache
CONFIG_NOCACHE
content-length
0
date
Sun, 09 Nov 2025 10:53:11 GMT
pixel
cm.g.doubleclick.net/ Frame F7F9
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEJqe1KCjMklTsbjh8BZqcAI&google_cver=1&google_push=AXcoOmQMyJ3Vmi6FPOjRuu0EsbOcaWtYIWRMekiv06TEqnGOdTLJolNBJ8JcEUtjhNuRvxYTfpASUDuz37FQQTMdJcsY...
  • https://x.bidswitch.net/ul_cb/sync?ssp=google&google_gid=CAESEJqe1KCjMklTsbjh8BZqcAI&google_cver=1&google_push=AXcoOmQMyJ3Vmi6FPOjRuu0EsbOcaWtYIWRMekiv06TEqnGOdTLJolNBJ8JcEUtjhNuRvxYTfpASUDuz37FQQT...
  • https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AXcoOmQMyJ3Vmi6FPOjRuu0EsbOcaWtYIWRMekiv06TEqnGOdTLJolNBJ8JcEUtjhNuRvxYTfpASUDuz37FQQTMdJcsYFaGzZ7fWQ_bjh22r9SQCStU84fy-PKiKA9WjiZVaLK...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AXcoOmQMyJ3Vmi6FPOjRuu0EsbOcaWtYIWRMekiv06TEqnGOdTLJolNBJ8JcEUtjhNuRvxYTfpASUDuz37FQQTMdJcsYFaGzZ7fWQ_bjh22r9SQCStU84fy-PKiKA9WjiZVaLKExUngHeahRBAdO4Zxg5A&google_hm=OHviUSYvSHO6tFTQxmWbzw==&gdpr=&gdpr_consent=
Requested by
Host: 322f9f81cfd88b7498cd441174614e0b.safeframe.googlesyndication.com
URL: https://322f9f81cfd88b7498cd441174614e0b.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html
Protocol
H3
Server
142.251.179.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
pd-in-f155.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://pagead2.googlesyndication.com/

Response headers

cache-control
no-cache, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
date
Sun, 09 Nov 2025 10:53:12 GMT
x-xss-protection
0
content-type
image/png
server
HTTP server (unknown)

Redirect headers

via
1.1 google
cache-control
no-cache, no-store, must-revalidate
location
//cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AXcoOmQMyJ3Vmi6FPOjRuu0EsbOcaWtYIWRMekiv06TEqnGOdTLJolNBJ8JcEUtjhNuRvxYTfpASUDuz37FQQTMdJcsYFaGzZ7fWQ_bjh22r9SQCStU84fy-PKiKA9WjiZVaLKExUngHeahRBAdO4Zxg5A&google_hm=OHviUSYvSHO6tFTQxmWbzw==&gdpr=&gdpr_consent=
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sun, 09 Nov 2025 10:53:12 GMT
pixel
cm.g.doubleclick.net/ Frame F7F9
Redirect Chain
  • https://dis.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DAXcoOmRX3t...
  • https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_hm=ay0tYWItcFdkdkl5U0lZTTUxSGxJaGxtSk56bldKRE9IMHIyb2JBZw&google_push=AXcoOmRX3tMVSQ1QzW14joFLJ_jMzwcQdA5nMIFN3Io9-ycQB2VFynoZu03g2spAm0a6fL...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_hm=ay0tYWItcFdkdkl5U0lZTTUxSGxJaGxtSk56bldKRE9IMHIyb2JBZw&google_push=AXcoOmRX3tMVSQ1QzW14joFLJ_jMzwcQdA5nMIFN3Io9-ycQB2VFynoZu03g2spAm0a6fLEg0P6ERTyPA-YGC9argHTbYDPMltwAhXpUm4w6bmwkZOuehbKlaRGa7c0tpxyVVwmzJSUPfdERlVGpQ6bPb_8
Requested by
Host: 322f9f81cfd88b7498cd441174614e0b.safeframe.googlesyndication.com
URL: https://322f9f81cfd88b7498cd441174614e0b.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html
Protocol
H3
Server
142.251.179.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
pd-in-f155.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://pagead2.googlesyndication.com/

Response headers

cache-control
no-cache, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
date
Sun, 09 Nov 2025 10:53:12 GMT
x-xss-protection
0
content-type
image/png
server
HTTP server (unknown)

Redirect headers

strict-transport-security
max-age=31536000; preload;
cache-control
no-cache
location
https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_hm=ay0tYWItcFdkdkl5U0lZTTUxSGxJaGxtSk56bldKRE9IMHIyb2JBZw&google_push=AXcoOmRX3tMVSQ1QzW14joFLJ_jMzwcQdA5nMIFN3Io9-ycQB2VFynoZu03g2spAm0a6fLEg0P6ERTyPA-YGC9argHTbYDPMltwAhXpUm4w6bmwkZOuehbKlaRGa7c0tpxyVVwmzJSUPfdERlVGpQ6bPb_8
pragma
no-cache
cross-origin-resource-policy
cross-origin
server-processing-duration-in-ticks
953016
expires
Sun, 09 Nov 2025 00:00:00 GMT
x-errorlevel
0
content-length
0
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
date
Sun, 09 Nov 2025 10:53:11 GMT
server
Kestrel
pixel
cm.g.doubleclick.net/ Frame F7F9
Redirect Chain
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESENxhoYKpy0GX2m8wWPVGaLY&google_cver=1&googl...
  • https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESENxhoYKpy0GX2m8wWPVGaLY&google_push=AX...
  • https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESENxhoYKpy0GX2m8wWPVGaLY&google_hm=aRBymNHM56cAFDx0BU9sQQAAFjYAAAAB&google_nid=index&google_push=AXcoOmTPGQyAYkYBT97DZEGlNjgLeARa6iL9F...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESENxhoYKpy0GX2m8wWPVGaLY&google_hm=aRBymNHM56cAFDx0BU9sQQAAFjYAAAAB&google_nid=index&google_push=AXcoOmTPGQyAYkYBT97DZEGlNjgLeARa6iL9Fr00324Q2UQGPijlb73jSymI3ZQFJ-chwkrdN5zYax2_1k9uKIQLmQJoSIUeZ3N0a4WN6XYNcUiFZ5rL9WbPd6LBc4QMVa4IdCliKCgE3cbROjP02iuCaGU
Requested by
Host: 322f9f81cfd88b7498cd441174614e0b.safeframe.googlesyndication.com
URL: https://322f9f81cfd88b7498cd441174614e0b.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html
Protocol
H3
Server
142.251.179.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
pd-in-f155.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://pagead2.googlesyndication.com/

Response headers

cache-control
no-cache, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
date
Sun, 09 Nov 2025 10:53:12 GMT
x-xss-protection
0
content-type
image/png
server
HTTP server (unknown)

Redirect headers

cf-cache-status
DYNAMIC
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=pZctSWoJhlakYpC5wIm99baTmtVg%2FdtTGrAHMhUjogj%2FATIOmo%2F%2BuwBR3SzM8vyrm%2FO8GRPQEklGi%2BSag%2BCGG7zQotV7ZIy6RLN5jnQGyJYN92JHUN8P"}]}
expires
0
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date
Sun, 09 Nov 2025 10:53:12 GMT
vary
accept-encoding
priority
u=3,i
cache-control
no-cache
location
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESENxhoYKpy0GX2m8wWPVGaLY&google_hm=aRBymNHM56cAFDx0BU9sQQAAFjYAAAAB&google_nid=index&google_push=AXcoOmTPGQyAYkYBT97DZEGlNjgLeARa6iL9Fr00324Q2UQGPijlb73jSymI3ZQFJ-chwkrdN5zYax2_1k9uKIQLmQJoSIUeZ3N0a4WN6XYNcUiFZ5rL9WbPd6LBc4QMVa4IdCliKCgE3cbROjP02iuCaGU
nel
{"report_to":"cf-nel","success_fraction":0.01,"max_age":604800}
pragma
no-cache
cf-ray
99bcc3d68e2dad1b-EWR
content-length
0
server
cloudflare
pixel
cm.g.doubleclick.net/ Frame F7F9
Redirect Chain
  • https://ads.yieldmo.com/exptsync?google_gid=CAESELARk8zS-t1989Ff1M8EsXE&google_cver=1&google_push=AXcoOmSfK0v30jEuyI0WZdyzusYWFmPeiCwALpL7o5wXHNpjPQCMV2j3xVbwaZptRAcJiDDs0jb3lKpYP9HWuxCo_xyogjLybsz...
  • https://cm.g.doubleclick.net/pixel?process_consent=T&google_nid=yieldmo&google_push=AXcoOmSfK0v30jEuyI0WZdyzusYWFmPeiCwALpL7o5wXHNpjPQCMV2j3xVbwaZptRAcJiDDs0jb3lKpYP9HWuxCo_xyogjLybszKoDvbiGN2L0CrN...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?process_consent=T&google_nid=yieldmo&google_push=AXcoOmSfK0v30jEuyI0WZdyzusYWFmPeiCwALpL7o5wXHNpjPQCMV2j3xVbwaZptRAcJiDDs0jb3lKpYP9HWuxCo_xyogjLybszKoDvbiGN2L0CrN0oE_Hqn97580uoXYem3ZauUkLCf2mqHqTcez2IYCy4&google_hm=eEZSSnd6elR5SnpmemlKOElZclg=
Requested by
Host: 322f9f81cfd88b7498cd441174614e0b.safeframe.googlesyndication.com
URL: https://322f9f81cfd88b7498cd441174614e0b.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html
Protocol
H3
Server
142.251.179.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
pd-in-f155.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://pagead2.googlesyndication.com/

Response headers

cache-control
no-cache, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
date
Sun, 09 Nov 2025 10:53:12 GMT
x-xss-protection
0
content-type
image/png
server
HTTP server (unknown)

Redirect headers

location
https://cm.g.doubleclick.net/pixel?process_consent=T&google_nid=yieldmo&google_push=AXcoOmSfK0v30jEuyI0WZdyzusYWFmPeiCwALpL7o5wXHNpjPQCMV2j3xVbwaZptRAcJiDDs0jb3lKpYP9HWuxCo_xyogjLybszKoDvbiGN2L0CrN0oE_Hqn97580uoXYem3ZauUkLCf2mqHqTcez2IYCy4&google_hm=eEZSSnd6elR5SnpmemlKOElZclg=
pragma
no-cache
accept-ch
Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods
POST, GET, OPTIONS
access-control-allow-origin
*
content-length
0
date
Sun, 09 Nov 2025 10:53:12 GMT
content-type
application/json;charset=utf-8
access-control-allow-headers
Cache-Control, Pragma, *
pixel
cm.g.doubleclick.net/ Frame F7F9
Redirect Chain
  • https://bh.contextweb.com/bh/rtset?pid=559960&gp=1&google_gid=CAESEFQc3rKmeOSiWMR4HpR9XdQ&google_cver=1&google_push=AXcoOmThH1PShYm4DZ91gPs0mlM3-XWYaP1fZ4pgByh7bZIDvMpaeFbXdUk5iPqC44Q7_hyM1fN5oW8mF...
  • https://cm.g.doubleclick.net/pixel?google_nid=pulsepoint_inc_&google_push=AXcoOmThH1PShYm4DZ91gPs0mlM3-XWYaP1fZ4pgByh7bZIDvMpaeFbXdUk5iPqC44Q7_hyM1fN5oW8mFBrURw-EMHH65oQUgXL85OC51P8e-AJst4Ijts8OBEV...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=pulsepoint_inc_&google_push=AXcoOmThH1PShYm4DZ91gPs0mlM3-XWYaP1fZ4pgByh7bZIDvMpaeFbXdUk5iPqC44Q7_hyM1fN5oW8mFBrURw-EMHH65oQUgXL85OC51P8e-AJst4Ijts8OBEVe45VUufPnpJbkIH4kagd65JvBDKO0PP0&google_hm=TFE3NVdzUjZld3lp
Requested by
Host: 322f9f81cfd88b7498cd441174614e0b.safeframe.googlesyndication.com
URL: https://322f9f81cfd88b7498cd441174614e0b.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html
Protocol
H3
Server
142.251.179.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
pd-in-f155.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://pagead2.googlesyndication.com/

Response headers

cache-control
no-cache, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
date
Sun, 09 Nov 2025 10:53:12 GMT
x-xss-protection
0
content-type
image/png
server
HTTP server (unknown)

Redirect headers

cache-control
private, max-age=0, no-cache, no-store
location
https://cm.g.doubleclick.net/pixel?google_nid=pulsepoint_inc_&google_push=AXcoOmThH1PShYm4DZ91gPs0mlM3-XWYaP1fZ4pgByh7bZIDvMpaeFbXdUk5iPqC44Q7_hyM1fN5oW8mFBrURw-EMHH65oQUgXL85OC51P8e-AJst4Ijts8OBEVe45VUufPnpJbkIH4kagd65JvBDKO0PP0&google_hm=TFE3NVdzUjZld3lp
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
cw-server
bh-deployment-6b657886bf-kfpq5
expires
-1
p3p
policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
content-language
en-US
server
Jetty(12.0.22)
pixel
cm.g.doubleclick.net/ Frame F7F9
Redirect Chain
  • https://sync.inmobi.com/gob?google_gid=CAESEC5pjWuQCXA7_Bx0uP3zlKM&google_cver=1&google_push=AXcoOmT0WGabffjw0Y6uUymWY6pIyle3W1MD7ABWtwGpin8OX2vZIg6Wm2k9maWkLDN202NJZw9UAwfRlXxROnQVfk68t1A9zw1FL_l5...
  • https://sync.inmobi.com/sync?redirect=&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=3&google_push=AXcoOmT0WGabffjw0Y6uUymWY6pIyle3W1MD7ABWtwGpin8OX2vZIg6Wm2k9maWkLDN202NJZw9UAwfRlXxROnQVfk68t1A9...
  • https://sync.inmobi.com/sync?redirect=&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=3&google_push=AXcoOmT0WGabffjw0Y6uUymWY6pIyle3W1MD7ABWtwGpin8OX2vZIg6Wm2k9maWkLDN202NJZw9UAwfRlXxROnQVfk68t1A9...
  • https://cm.g.doubleclick.net/pixel?google_hm=tyluxNoB4Yke6tEAVfJL&google_push=AXcoOmT0WGabffjw0Y6uUymWY6pIyle3W1MD7ABWtwGpin8OX2vZIg6Wm2k9maWkLDN202NJZw9UAwfRlXxROnQVfk68t1A9zw1FL_l5MJLES3omQj__o10...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_hm=tyluxNoB4Yke6tEAVfJL&google_push=AXcoOmT0WGabffjw0Y6uUymWY6pIyle3W1MD7ABWtwGpin8OX2vZIg6Wm2k9maWkLDN202NJZw9UAwfRlXxROnQVfk68t1A9zw1FL_l5MJLES3omQj__o10SEmOyaVzLxO867deJr28EtmP4a2W1ZLskCbM&google_nid=inmobi_new_eb
Requested by
Host: 322f9f81cfd88b7498cd441174614e0b.safeframe.googlesyndication.com
URL: https://322f9f81cfd88b7498cd441174614e0b.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html
Protocol
H3
Server
142.251.179.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
pd-in-f155.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://pagead2.googlesyndication.com/

Response headers

cache-control
no-cache, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
date
Sun, 09 Nov 2025 10:53:12 GMT
x-xss-protection
0
content-type
image/png
server
HTTP server (unknown)

Redirect headers

via
1.1 google
location
https://cm.g.doubleclick.net/pixel?google_hm=tyluxNoB4Yke6tEAVfJL&google_push=AXcoOmT0WGabffjw0Y6uUymWY6pIyle3W1MD7ABWtwGpin8OX2vZIg6Wm2k9maWkLDN202NJZw9UAwfRlXxROnQVfk68t1A9zw1FL_l5MJLES3omQj__o10SEmOyaVzLxO867deJr28EtmP4a2W1ZLskCbM&google_nid=inmobi_new_eb
content-length
0
date
Sun, 09 Nov 2025 10:53:11 GMT
vary
Origin,Access-Control-Request-Method,Access-Control-Request-Headers
attr
cm.g.doubleclick.net/pixel/ Frame F7F9 		0
59 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JQ2uApSSD2TEXX_4KSDbQHQ4lpXeAENDRIYFVs9HRCrK4DzjKeXAeKoLMcZjVAxaYc3fThTVc
Requested by
Host: 322f9f81cfd88b7498cd441174614e0b.safeframe.googlesyndication.com
URL: https://322f9f81cfd88b7498cd441174614e0b.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.179.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
pd-in-f155.1e100.net
Software
HTTP server (unknown) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://pagead2.googlesyndication.com/

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
date
Sun, 09 Nov 2025 10:53:11 GMT
x-xss-protection
0
content-type
text/html
server
HTTP server (unknown)
MV6IKlwdGMQEJvj2J2L6MG1DZM38r2qOinEvsRfQbD0.js
ep1.adtrafficquality.google/bg/ Frame FE95 		52 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ep1.adtrafficquality.google/bg/MV6IKlwdGMQEJvj2J2L6MG1DZM38r2qOinEvsRfQbD0.js
Requested by
Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/Klz6NWr5.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c19::9c Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
315e882a5c1d18c40426f8f62762fa306d4364cdfcaf6a8e8a712fb117d06c3d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://ep2.adtrafficquality.google/

Response headers

content-encoding
br
age
73392
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
x-content-type-options
nosniff
expires
Sun, 08 Nov 2026 14:30:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 08 Nov 2025 14:30:00 GMT
last-modified
Mon, 03 Nov 2025 09:48:00 GMT
content-type
text/javascript
vary
Accept-Encoding
cache-control
public, max-age=31536000
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
accept-ranges
bytes
content-length
20416
x-xss-protection
0
server
sffe
rum
dsum-sec.casalemedia.com/ Frame A025
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm&gdpr=0
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJCFYz_tsR1OmH7dQ8IaljU&google_cver=1&gdpr=0
43 B
717 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJCFYz_tsR1OmH7dQ8IaljU&google_cver=1&gdpr=0
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN7otKoDEIqmprYDGPya3rUCMAE&v=APEucNWKrdmZanr6IotHoe5Ya3Mb-jZHH1EqeABcH3Rw_sYPC5xPRYo4xzvTYRq2vN_zNHM3PdcoL5IknvQJPfWSt7rYTKB6cKOOefLTMBOeYoMyQ4JfREU
Protocol
H3
Server
104.18.27.193 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://googleads.g.doubleclick.net/

Response headers

cf-cache-status
DYNAMIC
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=Bsmnk53C4Pr0Jnd30%2BojB4qBQjSdzbe%2Bh5%2BeKnGC3ZEGD9rr2yRwIQfPhqt%2BeYYkPhiuIbDhFPX3Uhkn8C%2BpPyWYTIXAv0R6vlQeXal2lTfRY5i5zshx"}]}
expires
0
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date
Sun, 09 Nov 2025 10:53:12 GMT
content-type
image/gif
vary
accept-encoding
priority
u=2,i
cache-control
no-cache
nel
{"report_to":"cf-nel","success_fraction":0.01,"max_age":604800}
pragma
no-cache
cf-ray
99bcc3d68e2fad1b-EWR
content-length
43
server
cloudflare

Redirect headers

cache-control
no-cache, must-revalidate
location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJCFYz_tsR1OmH7dQ8IaljU&google_cver=1&gdpr=0
pragma
no-cache
cross-origin-resource-policy
cross-origin
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length
324
date
Sun, 09 Nov 2025 10:53:12 GMT
x-xss-protection
0
content-type
text/html; charset=UTF-8
server
HTTP server (unknown)
rum
dsum-sec.casalemedia.com/ Frame A025
Redirect Chain
  • https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&gdpr=0&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
  • https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&gdpr=0&ixi=0&C=1
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=aRBymNHM56cAFDx0BU9sQQAA
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJCFYz_tsR1OmH7dQ8IaljU&google_cver=1
43 B
712 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJCFYz_tsR1OmH7dQ8IaljU&google_cver=1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN7otKoDEIqmprYDGPya3rUCMAE&v=APEucNWKrdmZanr6IotHoe5Ya3Mb-jZHH1EqeABcH3Rw_sYPC5xPRYo4xzvTYRq2vN_zNHM3PdcoL5IknvQJPfWSt7rYTKB6cKOOefLTMBOeYoMyQ4JfREU
Protocol
H3
Server
104.18.27.193 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://googleads.g.doubleclick.net/

Response headers

cf-cache-status
DYNAMIC
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=0BrrZtxEbBiqUrUKrV0137F0L8zShbKmDHGPG4vL15ehbfN6zYbM4%2FwFL1xoIWq6YWccsXBOiuHaqwR6XO1zf4gRmaoDSh5sFnzEUeeVkJRX9ZMzhFS0"}]}
expires
0
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date
Sun, 09 Nov 2025 10:53:12 GMT
content-type
image/gif
vary
accept-encoding
priority
u=2,i
cache-control
no-cache
nel
{"report_to":"cf-nel","success_fraction":0.01,"max_age":604800}
pragma
no-cache
cf-ray
99bcc3d71eb9ad1b-EWR
content-length
43
server
cloudflare

Redirect headers

cache-control
no-cache, must-revalidate
location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJCFYz_tsR1OmH7dQ8IaljU&google_cver=1
pragma
no-cache
cross-origin-resource-policy
cross-origin
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length
313
date
Sun, 09 Nov 2025 10:53:12 GMT
x-xss-protection
0
content-type
text/html; charset=UTF-8
server
HTTP server (unknown)
setuid
ib.adnxs.com/ Frame A025
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm&gdpr=0
  • https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEKMrQDP0G8SjqVUVjTVYoXs&google_cver=1
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEKMrQDP0G8SjqVUVjTVYoXs&google_cver=1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN7otKoDEIqmprYDGPya3rUCMAE&v=APEucNWKrdmZanr6IotHoe5Ya3Mb-jZHH1EqeABcH3Rw_sYPC5xPRYo4xzvTYRq2vN_zNHM3PdcoL5IknvQJPfWSt7rYTKB6cKOOefLTMBOeYoMyQ4JfREU
Protocol
H2
Server
68.67.160.186 Brooklyn, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.25.5 /
Resource Hash
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
Security Headers
Name Value
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://googleads.g.doubleclick.net/

Response headers

cache-control
no-store, no-cache, private
pragma
no-cache
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin
206.66.99.131; 206.66.99.131; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires
Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid
a85a0537-0c14-43c8-9aff-955cc2d7c800
content-length
43
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date
Sun, 09 Nov 2025 10:53:12 GMT
x-xss-protection
0
content-type
image/gif
server
nginx/1.25.5

Redirect headers

cache-control
no-cache, must-revalidate
location
https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEKMrQDP0G8SjqVUVjTVYoXs&google_cver=1
pragma
no-cache
cross-origin-resource-policy
cross-origin
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length
301
date
Sun, 09 Nov 2025 10:53:12 GMT
x-xss-protection
0
content-type
text/html; charset=UTF-8
server
HTTP server (unknown)
pixel
cm.g.doubleclick.net/ Frame A025
Redirect Chain
  • https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}&gdpr=0
  • https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODIzNTU0NjU4MjAxMTAxMjI1OQ%3D%3D&gdpr=0
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODIzNTU0NjU4MjAxMTAxMjI1OQ%3D%3D&gdpr=0
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN7otKoDEIqmprYDGPya3rUCMAE&v=APEucNWKrdmZanr6IotHoe5Ya3Mb-jZHH1EqeABcH3Rw_sYPC5xPRYo4xzvTYRq2vN_zNHM3PdcoL5IknvQJPfWSt7rYTKB6cKOOefLTMBOeYoMyQ4JfREU
Protocol
H3
Server
142.251.179.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
pd-in-f155.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://googleads.g.doubleclick.net/

Response headers

cache-control
no-cache, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
date
Sun, 09 Nov 2025 10:53:12 GMT
x-xss-protection
0
content-type
image/png
server
HTTP server (unknown)

Redirect headers

cache-control
no-store, no-cache, private
location
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODIzNTU0NjU4MjAxMTAxMjI1OQ%3D%3D&gdpr=0
pragma
no-cache
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials
true
x-proxy-origin
206.66.99.131; 206.66.99.131; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires
Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin
*
an-x-request-uuid
3c94ba73-3ea1-4776-a674-0d9f7648d075
content-length
0
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date
Sun, 09 Nov 2025 10:53:12 GMT
x-xss-protection
0
content-type
text/html; charset=utf-8
server
nginx/1.25.5
gen_204
pagead2.googlesyndication.com/pagead/ Frame 2B49 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=fle-fetch-start2
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c21::9a Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://322f9f81cfd88b7498cd441174614e0b.safeframe.googlesyndication.com/

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Sun, 09 Nov 2025 10:53:12 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
gen_204
pagead2.googlesyndication.com/pagead/ Frame 2B49 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c21::9a Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://322f9f81cfd88b7498cd441174614e0b.safeframe.googlesyndication.com/

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Sun, 09 Nov 2025 10:53:12 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
truncated
/ Frame 2B49 		217 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b0efccd6b766be217e0bc275a1902a148a4f68635b9e88f5e73d9f61015b5df7

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/png
gen_204
pagead2.googlesyndication.com/pagead/ Frame 2B49 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c21::9a Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://322f9f81cfd88b7498cd441174614e0b.safeframe.googlesyndication.com/

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Sun, 09 Nov 2025 10:53:12 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
view
ad.doubleclick.net/pcs/ Frame 2B49 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ad.doubleclick.net/pcs/view?xai=AKAOjss-O1bi00D5T46EliAj3JsbWr1Rv0eKgZFo7hYfFHKWDgp_F7ySA1i7IyoBCpkZcxkksoOVrtFO2MeOl9l9yJMJxmn0yomImw9hySpmMv3h6cNw7MvyAmdjJC-jmTuNMZ80dO2BPuXTKYOmjCEsgdtcHYnJGmaSywDV8t_A7eJ9GQN5yMvzaViBrMptCTjpSi9cACw6cwKjhAMTEsz54CoV-hV05bu4gIs_ahJpCis_JiDKAhE1t-JBJ5_z5UFtK2CPJTQjxMiWTotzZhbZSKFoj3KjPtcm6VeqWbGld56o4gdiL55TWl5cAEu31XaTkuNWAEjgWLAOtzxzfG1D6XVKTtAbTzMikYBXzCGoMZIAhlbpdHsrI8eKoz_Kueg-koex2HRY151kKceQHcXO-p1o9e4QvyJKGUyUF_teAMJlgSpIrlw-VVKpHJPk-7Ym1IDEmXCJqpZJoaFo-98ssP9-aWVF_0vdEgZCZQxs8GWuwmlELIfH1YLQUkOZ4FNcs311NIbLfZse_ki_LKYgRzyX7khdm5UgL6MZAEFDRuCWqMr23-uPn3g5mJcXiO2dpy5Wpb5I7vhefvizY2uizXHnkwhp4kGZNaPCKBcDh7goau8sN5XXk45YMBvRSIyCElVxs4cHuFDdFDwJprSd9EPmcYKKqTBEmImJbVNv-3tEZH_QKuFMyrwuHkCfyhtDzMHAZtWZGPuTpM3XxKIzY9ew-JbodMf97fotjVAIh7NUIhTmRe9-LEzgJduAKTcR8rnBYoYUssxb96lO33GKBhDvdaguBF6UMYGogHXnMyumj3mPYpcKl4PsjwekfgsnKCJTKd9_DrN7rMhZW_m-_tVMUPSePKAkXAou9K9rchn_yKOaaBIgcj7uw9a4jNEFo3fbD78d4x5Ud6cXnFfUhQLni9rqCQn8zDE__M1QwsbNkB43m8c8bI9aha7oWRLxmGRs80PvrPh0Pi6_O8oztfiOmSAmSOyK1YPAhX4Or54qcB0gv08uVLYseJNTtANVKtE5YqySsvb6rG_JSBIXIsGY4X8s7FgHGYrEhzk7BLYILPGykOqLpAeBZw56ibn2MD94u4Fg5FvvrF4MHfmGm27vQCVjr0Ny9jwMXrRYWFIXpG_8D7IoUYJAd8QZkjUrdmpsX0nNX685i_aYxl2yktjB1XDZ4vfYa0uxgRfRUNeOs-jz51P-T6fndI_VJMXnBPuoAlJbXC6-FdO92iL_TGwDaqCcojNLu6EwNQpQF0RmvoZ6CRmRGSac7MfhgE_a1lkRPEvgcNGOUUGynqqI3PP_H4wytlc0gVVet8mQTK1SE-kQ3tGa6svclVQbY06dipOvu2dWUMEGZBUJkGeL64oZAWY3DX2Bnw_Ej2ytUpymDBG3wswX9oUp40OoXh6Qks7Kiqs3FDKQCcM0ZLh7G49qCXntaH14TRTIOAxDb4YR6hrra6rYXW-6EE5GcpyJRJ6zu8wwT3IK7LNqGuWqAoFoQo2Ywgl8VnlR1u60n7s6WPSSqbAN2znlL655ZbKl6c8lPaQIFrve5x3IHssn9VbwLAIYF62WrJu6TwShg29r_RbO847uACnjhZoIVUe-6VcggiGBkozJxKZUWS8CM3DV7VzojIR6p90oKR3byIX24JOeuBx_FxRN8WB9Fai5mDLgZwiveuQaHfEKxPZ1RdYmHrK1QoKiKM7WWJwGacYj0eFzKGV_c9oBoGsqRgSk6Z5mMuq3AbDCWmWR93ppICIQeKaSgJql68k&sai=AMfl-YREp0FI9m-z5O9N-Y-4KRAVOyQKoG0kc8TVBJw-VvV0w4CkHkJCMY2A3SJRwOBxsyz4YPQE8LUqL0ka4voPHeEYg-C4TA-bm5rudu3UMBvuAv6YKeSTp4K9Uq8mBGRsi4flpnPC9VUcDeSJgOas77lq6v4J1fRbmExKmklrD0qxLnh_t8ap_jIToflSFGIF5zxrx4cX_Jznru6Lxjew6QqZPNrVlUkhH-wV6DlQnZGKlUshTiNRG8wl2Ua08pkAXm6HA5MZ1QK1lTUUXkd8M8_KT610QO8ImTaCacdhixoDi6zH5gB2R0AEYVpVKOn2UOC9VjkpkmGxU57qh5rmh4vu70ozlX-KBsR_8j5yReFXkIvM42ddhZrRsvow_Op7V7A0vxZU6ICI9QlicquWVnFkJWpDPMqdJqf4krhs9rl5k6IwM0ZvdYOilhOtoQRK9YbpEEMOYBqiVMsvKGdE0nyEVpLT9G-ZGuiy15emKcbqBJxERj6M1-N0vObYixJHU8O0-1sRNT60jlkv8YyTPYwcgHIUtNeggduQfllwqdfqTL2WTM4yCMTODsRaALp6F5PnBZxNNT1VURdwslyF5mV3pkftIYC-4k7agxHQIsh5-3OLbKa4Ry-DxpZaBAariZjrsN0fgOaOnvM7wm-NuuQil1FhJgHd9Ko-sSLGF0hx-eYig84gHqHwBwOK_NLmppv_AGGzGPn4CelaOLNlynmHvZ0TQCbq_lRKNnrHXMEoR4qpq1sauWmo6RVVKzU9cil8CRpaMfccm3iYJG9Kd5tQwg5Yygn-yy_DnGFg6SUdcPvbZ4BX2ajfzwpNHRE-wk3OWmaBQJeNAltK2GkvriMRxNuhN3DD2Wt7e4ldLtNlv_9u_vedP9pHp82DMkmajUyzeu0T_BnKfCi0pQFwaltvYVXcgYKTXfLzx6bq4RaQ0ExF1CuFpKSAZk0CHlnQdlk6jFkPLOonBl9Ft5GwuXXCS4_736mKDLnuz_c9DOuLnyOKfqv4V4-wdcjh7ZHEfqE_nGLp4cPkX6EA8BbpYZJWy-5LHcxxL_tQC6nJg0k7Wt3dnFmfQWRU3A&sig=Cg0ArKJSzCk-VrOiHPZMEAE&uach_m=%5BUACH%5D&crd=aHR0cHM6Ly9icm90aGVyLXVzYS5jb20&pr=missingexchangepricemacro&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=287&vt=11&dtpt=285&dett=2&cstd=0&cisv=r20251106.77491&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=1&ftch=1&adurl=
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.16.148 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bl-in-f148.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://322f9f81cfd88b7498cd441174614e0b.safeframe.googlesyndication.com/

Response headers

cache-control
private
timing-allow-origin
*
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Sun, 09 Nov 2025 10:53:12 GMT
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length
0
date
Sun, 09 Nov 2025 10:53:12 GMT
x-xss-protection
0
content-type
image/png
attribution-reporting-register-source
{"aggregation_keys":{"908928212":"0xadd42a5090842fe00000000000000000","908928213":"0x1bfd252312273faa0000000000000000","908928214":"0x1b5f3285481505f70000000000000000"},"debug_key":"4025899107136825999","debug_reporting":true,"destination":["https://brother-usa.com"],"event_report_windows":{"end_times":[86400,345600]},"expiry":"1296000","filter_data":{"14":["12741769"],"21":[],"23":[],"24":[],"25":[],"26":[],"27":[],"28":[],"29":[],"8":["11995011"]},"max_event_level_reports":2,"priority":"0","source_event_id":"13169875604383313916"}
server
cafe
gen_204
ep1.adtrafficquality.google/pagead/ Frame FE95 		0
20 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ep1.adtrafficquality.google/pagead/gen_204?id=sodar&v=46&t=2&bgai=BhCxsl3IQaYC-HPOtqMwP-rnt-AsAAAAAOAHgBAI&bg=!JSalJmnNAAaIPp6FqD47ADQBe5WfOKmGbZ1ArbZScWzzikXFbOmaGUgiwPUT2mFSP7HJwxF5XhhtsD6bL91Y9dC8OckYAgAAAIRSAAAACWgBB34ANU6Ji6_O-5FedQtFs8TWQGzC8ZYhHt1vpm-BPmijHjDUF5iXrg1WijgsQ5wtpgZn79OXrIIymQKspn0NfRfxIV_wHYc2wRS0haKq5qYTfsIZ9MxW_kH0wixzk0PxB99t20D8rh9n-n3DOuQxyPoeHf_bT9Zn9EiQbPqWZP8SJJjUQxwgsT2XyHvOTUW3t2-V25lkAmr5NzMcQ4ag3cSo6MBiFNjCOuMcQ0r69XvxemQCcqZwSL5z9i8Gs3PYCno2sFYmp98uNuPEVgxulayVdrOpvrtYS-Gga3CGP2aYT4fj9_HzJR6eFS8YyiGuTS7qaHpBliCn5f-167BI-cQKUUNjekjBNMNikP3TSAprTBLY0VR_nvb4E8BYl8c3hdjv7KYWRIdf5X0m7XxbtlDO88Hdem57GgsYGlw4eSuNIzSJvr_1GV0SE9GGAkqFIJ398pJq_Xw1xfnaA0KJYGBnIpsmuRsZzYfB3goVpFW2SjArY5qiSg7dGwyJC6IJ6zEw_lG7roGFClSfsXzubpLCTvB2b1_3NUiZiWg2x8TQhukvMIUIhC3bh91Sxu-98PUN9U7-ACMm1xEweCevyrj-yHDDMga62u83d1mfWbOeXVWGhLX1wffW8juimW7_BokRiyV_NREPfy7g84h7t31o2BoqwSL_D7l6XXSufmH8I_1zx6zUK7ynzpP-Fn45Ma9XwP2OJi_JucsB5C18LJfGzofiQ59eNzfscpPzSBGyKYay5F2KN0SBee1xH-YTpApuMH4ZGFeQMrdIMmi5dpWV7-h4uSI69CcxMW92KGeJLYkEHe3HiAv3uIZFH4yKUN0eT5i_vOehj5WGg5K7tLPCg6Uo64V8aYqHz8sSs6S_k6kPJ3P_yeOrhHCUPlSEZeR-MbkJct0rDtc22dkPi6_0Jvd2wTNFMZq1ej6bvrRGIvEdT0kMvhyRhJ4pxeFN-ZiQ93652-s--Oy1bDd8O5bvfV_Uq72h
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c19::9c Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://ep2.adtrafficquality.google/

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Sun, 09 Nov 2025 10:53:12 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
ads
securepubads.g.doubleclick.net/gampad/ 		560 B
280 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4347117103472909&correlator=3218819283454484&eid=31095133%2C31095250%2C31095648%2C83321072&output=ldjh&gdfp_req=1&vrg=202511040101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=1x1&ifi=30&didk=674410252&dids=gpt_unit_%2F1254144%2C183096492%2Fme&sfv=1-0-45&rcs=5&fas=1&eri=1&sc=1&cookie=ID%3D710d595ddee055b4%3AT%3D1762685587%3ART%3D1762685587%3AS%3DALNI_MZJGZDvti4dTz_nkocz4FF59h3kSg&gpic=UID%3D0000130a10d732ad%3AT%3D1762685587%3ART%3D1762685587%3AS%3DALNI_MaUVZBE6m9Fvpz6Zk1r3wnftELu7g&abxe=1&dt=1762685592359&lmt=1762685592&adxs=-9&adys=-9&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=6&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fzh1io5g5cavqo7l%2FRose%252527s_bot.zip%2Ffile&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&topics=3&tps=3&htps=10&a3p=EmwKDGlkNS1zeW5jLmNvbRJaSUQ1Knl0eFFPejc2QzBUbG10djVzbG80YXNOR005bjY3VXd1LUZJNVY5REUwTGpfXzJrUWNwUmFBQUVCQ21rUWNwTUFZS0pqWW1lNVZpVmxtVzB1Z0RUOGtBWAESRgoMYXVkaWdlbnQuY29tEjQwMDAxeXVtMGVhYmtiYTk4YmNpYWU2Z2liZGRqOTZsZGNsZjc4NmtoZGFhYmFja2tjMmpsWAESrQEKCmNyaXRlby5jb20SnAE3RE8xR2w5QlFXbEZNSEoyWjJkUFJ6RnRXblpUV2paWWMzWkthMVZzTTBkRmNtRTJUMUY2WkhwclpXeG5WRE16WkhFMFFrWmtTRE5OYlVkeFoyMXJNREpCUW0xd1dqVm1VMnBXYkZsVmRWbEJNRm8wTlZkck1GbEtWbG8xV21aVlIweEZKVEpHZFZFMVdVRjRhRXBFYmpCekpUTkVYARI2CgxhZHNlcnZlci5vcmcSJGM0ODVmOWY2LTJkN2UtNDYyNy04OTBkLWE3MWFjZGY2NDdhZVgBEjQKCnB1YmNpZC5vcmcSJGRlNmQyYWY2LWIwNWEtNGVlOS1hNzdlLWM3MzQwMjZmZjQ5Y1gBEloKDWNyd2RjbnRybC5uZXQSQGQyZTc1YjhlNDkyZTc0MzAwNGVkMGRiYzZjMDQxODVjYTAyY2M1MWU0ZGExNjQzYmIwNjQ3NzRmYmM5NGI3ZGIY-qD-waYzSAASHQoOZXNwLmNyaXRlby5jb20YvZ_-waYzSABSAghkEhgKCXlhaG9vLmNvbRicof7BpjNIAFICCG8SPgoFb3BlbngSLGV5SnBJam9pVW5kNGVUTTRSVEJSZGt0alpITmtkWGhUS3k5S1p6MDlJbjA9GMKj_sGmM0gAEhsKDDMzYWNyb3NzLmNvbRi8n_7BpjNIAFICCGQSggIKCHJ0YmhvdXNlEuwBVW5PSDI4a3JuUnluUXNqODQwNVhQMWpqaVhrOGZ4ZjFLczVJWXlaTU5CN0JWSDBpa1U2dkVCcENIYVh1anRFcUlLc3BFSVNaZWhqUHROc3ErK0J2anhkaU1OVm9GQ0FjKzNrbGEvbkJFZlV6YUZUeVpSZWxLTFB6eWF2am9ybXZUc0dQUFk4ODZxZHlXWENBT3pJeFdvcXliYW43d3N5TzdjNmovS1YvVjI3cEpuOE44dFl4dTNOR2MzK2NQbHMwWTNmSjM2cmRKbEVjcmJnb0hJYXB2OWZqcURxNlhtOUowSEFXYXhDNVoxdz0YsqP-waYzSAA.&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1762685584931&idt=2383&ppid=3b25ce83c75aeff52ef9657aec7de9f7&prev_scp=a%3D1%26iid1%3D5496324216408839%26eid%3D5496324216408839%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D0%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252Fzh1io5g5cavqo7l%252FRose%25252527s_bot.zip%252Ffile%26path%3D%252Ffile%252Fzh1io5g5cavqo7l%252FRose%252527s_bot.zip%252Ffile%26ap%3D1100%26sap%3D1100%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D6%26at%3Dbf%26adr%3D399%26ezosn%3D7%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-medrectangle-2%26tap%3Dmediafire_com-medrectangle-2-5496324216408839%26eb_br%3Dzero%26eba%3D0%26bv%3D5%26bvm%3D0%26bvr%3D5%26avc%3D57%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D0%26br2%3D60%26ezoic%3D1%26nmau%3D0%26mau%3D0%26ganc%3D1%26cal%3D0%26stl%3D192%2C193%2C0%2C0%2C0%2C193%2C132%2C0%2C0%2C0%2C187%2C0%2C901%2C182%2C901%2C902%2C903%26deal1%3D17%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C760%2C761%2C813%2C815%2C816%2C817%2C818%2C819%2C899%2C917%2C918%2C919%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C3933%2C4184%2C4186%2C4604%2C5747%2C6293%2C6294%2C6295%2C6983%2C7035%2C7036%2C7605%2C7606%2C7607%2C7608%2C7609%2C7610%2C7611%2C7612%2C7613%2C7614%2C7615%2C7616%2C7617%2C7618%2C7788%2C7789%2C7790%2C7993%2C7994%2C7995%2C7996%2C7997%2C7998%2C7999%2C8057%2C6772%2C5534%2C7661%2C7713%2C7%2C8%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C915%2C874%2C835%2C19%2C2688%2C3045%2C4276%2C7330%2C916%2C19%2C2688%2C2693%2C3045%2C3053%2C4276%2C7330%2C7331%2C916%2C18%2C19%2C1428%2C2688%2C2693%2C3045%2C3052%2C3053%2C3856%2C4276%2C7330%2C7331%2C916%2C18%2C19%2C1428%2C2688%2C2693%2C3045%2C3052%2C3053%2C3856%2C4276%2C7330%2C7331%2C916%2C18%2C19%2C1428%2C2688%2C2693%2C3045%2C3052%2C3053%2C3856%2C4276%2C7330%2C7331%2C916%26osb%3DLinux%252FChrome%26lb%3D4%26reqt%3D1762685591646%26ss38%3D1%26ss9%3D1&cust_params=li-module-enabled%3Dt1&adks=318048222&frm=20&eo_id_str=ID%3Dd758a0372e0d617e%3AT%3D1762685587%3ART%3D1762685587%3AS%3DAA-AfjbrkAa_d6zy1Ty3ihSBvc1X&pbbce=1&td=1&egid=3721&tan=5e3107b9-1e1c-45dc-be13-7701b2f8f5a3&tdf=2
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511040101/pubads_impl.js?cb=31095648
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c21::9b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0859bb184539a42f82b91e127e6b478d3489daac9c6c3822b0b84674260085c3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

content-encoding
dcb
google-lineitem-id
-2
observe-browsing-topics
?1
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sun, 09 Nov 2025 10:53:12 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-2
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
249
x-xss-protection
0
server
cafe
ads
securepubads.g.doubleclick.net/gampad/ 		388 B
187 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4347117103472909&correlator=2634235973035441&eid=31095133%2C31095250%2C31095648%2C83321072&output=ldjh&gdfp_req=1&vrg=202511040101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-edge-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C160x600&fluid=height&ifi=31&didk=2994273263&dids=div-gpt-ad-mediafire_com-edge-&adfs=580935078&sfv=1-0-45&rcs=5&eri=1&sc=1&cookie=ID%3D710d595ddee055b4%3AT%3D1762685587%3ART%3D1762685587%3AS%3DALNI_MZJGZDvti4dTz_nkocz4FF59h3kSg&gpic=UID%3D0000130a10d732ad%3AT%3D1762685587%3ART%3D1762685587%3AS%3DALNI_MaUVZBE6m9Fvpz6Zk1r3wnftELu7g&abxe=1&dt=1762685592403&lmt=1762685592&adxs=0&adys=300&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=4&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fzh1io5g5cavqo7l%2FRose%252527s_bot.zip%2Ffile&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGsmFMWSallS-isNSI3vTP05mongQR3LeNhfsq_U1He74s_r7pXkfVjPwbyenUg&topics=3&tps=3&htps=10&a3p=EmwKDGlkNS1zeW5jLmNvbRJaSUQ1Knl0eFFPejc2QzBUbG10djVzbG80YXNOR005bjY3VXd1LUZJNVY5REUwTGpfXzJrUWNwUmFBQUVCQ21rUWNwTUFZS0pqWW1lNVZpVmxtVzB1Z0RUOGtBWAESRgoMYXVkaWdlbnQuY29tEjQwMDAxeXVtMGVhYmtiYTk4YmNpYWU2Z2liZGRqOTZsZGNsZjc4NmtoZGFhYmFja2tjMmpsWAESrQEKCmNyaXRlby5jb20SnAE3RE8xR2w5QlFXbEZNSEoyWjJkUFJ6RnRXblpUV2paWWMzWkthMVZzTTBkRmNtRTJUMUY2WkhwclpXeG5WRE16WkhFMFFrWmtTRE5OYlVkeFoyMXJNREpCUW0xd1dqVm1VMnBXYkZsVmRWbEJNRm8wTlZkck1GbEtWbG8xV21aVlIweEZKVEpHZFZFMVdVRjRhRXBFYmpCekpUTkVYARI2CgxhZHNlcnZlci5vcmcSJGM0ODVmOWY2LTJkN2UtNDYyNy04OTBkLWE3MWFjZGY2NDdhZVgBEjQKCnB1YmNpZC5vcmcSJGRlNmQyYWY2LWIwNWEtNGVlOS1hNzdlLWM3MzQwMjZmZjQ5Y1gBEloKDWNyd2RjbnRybC5uZXQSQGQyZTc1YjhlNDkyZTc0MzAwNGVkMGRiYzZjMDQxODVjYTAyY2M1MWU0ZGExNjQzYmIwNjQ3NzRmYmM5NGI3ZGIY-qD-waYzSAASHQoOZXNwLmNyaXRlby5jb20YvZ_-waYzSABSAghkEhgKCXlhaG9vLmNvbRicof7BpjNIAFICCG8SPgoFb3BlbngSLGV5SnBJam9pVW5kNGVUTTRSVEJSZGt0alpITmtkWGhUS3k5S1p6MDlJbjA9GMKj_sGmM0gAEhsKDDMzYWNyb3NzLmNvbRi8n_7BpjNIAFICCGQSggIKCHJ0YmhvdXNlEuwBVW5PSDI4a3JuUnluUXNqODQwNVhQMWpqaVhrOGZ4ZjFLczVJWXlaTU5CN0JWSDBpa1U2dkVCcENIYVh1anRFcUlLc3BFSVNaZWhqUHROc3ErK0J2anhkaU1OVm9GQ0FjKzNrbGEvbkJFZlV6YUZUeVpSZWxLTFB6eWF2am9ybXZUc0dQUFk4ODZxZHlXWENBT3pJeFdvcXliYW43d3N5TzdjNmovS1YvVjI3cEpuOE44dFl4dTNOR2MzK2NQbHMwWTNmSjM2cmRKbEVjcmJnb0hJYXB2OWZqcURxNlhtOUowSEFXYXhDNVoxdz0YsqP-waYzSAA.&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1762685584931&idt=2383&ppid=3b25ce83c75aeff52ef9657aec7de9f7&prev_scp=a%3D1%26iid1%3D6821571650405327%26eid%3D6821571650405327%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D0%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252Fzh1io5g5cavqo7l%252FRose%25252527s_bot.zip%252Ffile%26path%3D%252Ffile%252Fzh1io5g5cavqo7l%252FRose%252527s_bot.zip%252Ffile%26ap%3D1101%26sap%3D1101%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D6%26at%3Dbf%26adr%3D399%26ezosn%3D4%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D38%26al%3D1038%26compid%3D1%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-edge-1%26tap%3Dmediafire_com-edge-1-6821571650405327%26eb_br%3Dzero%26eba%3D0%26bv%3D23%26bvm%3D0%26bvr%3D3%26avc%3D24%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D0%26br2%3D34%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D157%2C193%2C207%2C27%2C195%2C25%2C91%2C20%2C71%2C171%2C175%2C0%2C124%2C199%2C901%2C902%2C903%26deal1%3D17%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2688%2C2761%2C2763%2C2764%2C2765%2C3044%2C3045%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4186%2C5747%2C6293%2C6294%2C6295%2C7035%2C7036%2C7330%2C7605%2C7606%2C7607%2C7608%2C7609%2C7610%2C7611%2C7612%2C7613%2C7614%2C7615%2C7616%2C7617%2C7618%2C7788%2C7789%2C7790%2C7993%2C7994%2C7995%2C7996%2C7997%2C7998%2C7999%2C6772%2C5534%2C7661%2C7713%2C7%2C8%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C916%2C915%2C874%2C835%2C2693%2C3053%2C4276%2C7331%2C18%2C1428%2C2693%2C3052%2C3053%2C3856%2C4276%2C7331%2C18%2C1428%2C2693%2C3052%2C3053%2C3856%2C4276%2C7331%2C18%2C1428%2C2693%2C3052%2C3053%2C3856%2C4276%2C7331%2C18%2C1428%2C2693%2C3052%2C3053%2C3856%2C4276%2C7331%26osb%3DLinux%252FChrome%26lb%3D0%26reqt%3D1762685591650%26adxf%3D1%26ss38%3D1%26ss9%3D1%26nocompoverride%3D1&cust_params=li-module-enabled%3Dt1&adks=3527628052&frm=20&eo_id_str=ID%3Dd758a0372e0d617e%3AT%3D1762685587%3ART%3D1762685587%3AS%3DAA-AfjbrkAa_d6zy1Ty3ihSBvc1X&pbbce=1&td=1&egid=3721&tan=5e3107b9-1e1c-45dc-be13-7701b2f8f5a4&tdf=2
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511040101/pubads_impl.js?cb=31095648
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c21::9b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a220fbb101547e4fc86885312289c285b9b523b8f4073ea5041ce9ed859cbdcb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

content-encoding
dcb
google-lineitem-id
-2
observe-browsing-topics
?1
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sun, 09 Nov 2025 10:53:12 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-2
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
157
x-xss-protection
0
server
cafe
ads
securepubads.g.doubleclick.net/gampad/ 		396 B
191 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4347117103472909&correlator=2108171605643085&eid=31095133%2C31095250%2C31095648%2C83321072&output=ldjh&gdfp_req=1&vrg=202511040101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-medrectangle-3&enc_prev_ius=%2F0%2F1&prev_iu_szs=336x280&ifi=32&didk=46179496&dids=div-gpt-ad-mediafire_com-medre&adfs=1911771697&sfv=1-0-45&rcs=5&eri=1&sc=1&cookie=ID%3D710d595ddee055b4%3AT%3D1762685587%3ART%3D1762685587%3AS%3DALNI_MZJGZDvti4dTz_nkocz4FF59h3kSg&gpic=UID%3D0000130a10d732ad%3AT%3D1762685587%3ART%3D1762685587%3AS%3DALNI_MaUVZBE6m9Fvpz6Zk1r3wnftELu7g&abxe=1&dt=1762685592417&lmt=1762685592&adxs=320&adys=120&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=2&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fzh1io5g5cavqo7l%2FRose%252527s_bot.zip%2Ffile&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGsmFMWSallS-isNSI3vTP05mongQR3LeNhfsq_U1He74s_r7pXkfVjPwbyenUg&topics=3&tps=3&htps=10&a3p=EmwKDGlkNS1zeW5jLmNvbRJaSUQ1Knl0eFFPejc2QzBUbG10djVzbG80YXNOR005bjY3VXd1LUZJNVY5REUwTGpfXzJrUWNwUmFBQUVCQ21rUWNwTUFZS0pqWW1lNVZpVmxtVzB1Z0RUOGtBWAESRgoMYXVkaWdlbnQuY29tEjQwMDAxeXVtMGVhYmtiYTk4YmNpYWU2Z2liZGRqOTZsZGNsZjc4NmtoZGFhYmFja2tjMmpsWAESrQEKCmNyaXRlby5jb20SnAE3RE8xR2w5QlFXbEZNSEoyWjJkUFJ6RnRXblpUV2paWWMzWkthMVZzTTBkRmNtRTJUMUY2WkhwclpXeG5WRE16WkhFMFFrWmtTRE5OYlVkeFoyMXJNREpCUW0xd1dqVm1VMnBXYkZsVmRWbEJNRm8wTlZkck1GbEtWbG8xV21aVlIweEZKVEpHZFZFMVdVRjRhRXBFYmpCekpUTkVYARI2CgxhZHNlcnZlci5vcmcSJGM0ODVmOWY2LTJkN2UtNDYyNy04OTBkLWE3MWFjZGY2NDdhZVgBEjQKCnB1YmNpZC5vcmcSJGRlNmQyYWY2LWIwNWEtNGVlOS1hNzdlLWM3MzQwMjZmZjQ5Y1gBEloKDWNyd2RjbnRybC5uZXQSQGQyZTc1YjhlNDkyZTc0MzAwNGVkMGRiYzZjMDQxODVjYTAyY2M1MWU0ZGExNjQzYmIwNjQ3NzRmYmM5NGI3ZGIY-qD-waYzSAASHQoOZXNwLmNyaXRlby5jb20YvZ_-waYzSABSAghkEhgKCXlhaG9vLmNvbRicof7BpjNIAFICCG8SPgoFb3BlbngSLGV5SnBJam9pVW5kNGVUTTRSVEJSZGt0alpITmtkWGhUS3k5S1p6MDlJbjA9GMKj_sGmM0gAEhsKDDMzYWNyb3NzLmNvbRi8n_7BpjNIAFICCGQSggIKCHJ0YmhvdXNlEuwBVW5PSDI4a3JuUnluUXNqODQwNVhQMWpqaVhrOGZ4ZjFLczVJWXlaTU5CN0JWSDBpa1U2dkVCcENIYVh1anRFcUlLc3BFSVNaZWhqUHROc3ErK0J2anhkaU1OVm9GQ0FjKzNrbGEvbkJFZlV6YUZUeVpSZWxLTFB6eWF2am9ybXZUc0dQUFk4ODZxZHlXWENBT3pJeFdvcXliYW43d3N5TzdjNmovS1YvVjI3cEpuOE44dFl4dTNOR2MzK2NQbHMwWTNmSjM2cmRKbEVjcmJnb0hJYXB2OWZqcURxNlhtOUowSEFXYXhDNVoxdz0YsqP-waYzSAA.&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1762685584931&idt=2383&ppid=3b25ce83c75aeff52ef9657aec7de9f7&prev_scp=a%3D1%26iid1%3D7611442246396448%26eid%3D7611442246396448%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D0%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252Fzh1io5g5cavqo7l%252FRose%25252527s_bot.zip%252Ffile%26path%3D%252Ffile%252Fzh1io5g5cavqo7l%252FRose%252527s_bot.zip%252Ffile%26ap%3D1104%26sap%3D1104%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D6%26at%3Dmbf%26adr%3D399%26ezosn%3D5%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D21%26al%3D1021%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-medrectangle-3%26tap%3Dmediafire_com-medrectangle-3-7611442246396448%26eb_br%3Db6c98a8bb15764f1c4ee331dcb724178%26eba%3D0%26bv%3D5%26bvm%3D0%26bvr%3D5%26avc%3D194%26shp%3D3%26ftsn%3D12%26ftsng%3D12%26br1%3D2%26br2%3D240%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D157%2C168%2C0%2C0%2C0%2C168%2C184%2C20%2C0%2C0%2C192%2C0%2C902%2C903%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C760%2C761%2C815%2C816%2C817%2C818%2C893%2C899%2C903%2C919%2C1794%2C2339%2C3054%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3915%2C3919%2C3933%2C4185%2C4186%2C4604%2C4605%2C5747%2C6044%2C6045%2C6293%2C6294%2C6295%2C6983%2C7036%2C7046%2C7144%2C7605%2C7606%2C7607%2C7608%2C7609%2C7610%2C7611%2C7612%2C7613%2C7614%2C7615%2C7616%2C7617%2C7618%2C7788%2C7790%2C7993%2C7994%2C7995%2C7996%2C7997%2C7998%2C7999%2C8057%2C8069%2C6772%2C5534%2C7661%2C7713%2C11%2C12%2C13%2C14%2C15%2C16%2C20%2C2310%2C2526%2C2527%2C2763%2C2764%2C2765%2C3154%2C3684%2C4184%2C9%2C10%2C17%2C20%2C2310%2C2351%2C2526%2C2527%2C2761%2C2763%2C2764%2C2765%2C3044%2C3154%2C3684%2C4184%2C7035%2C7327%2C7789%2C7%2C8%2C9%2C10%2C915%2C874%2C835%2C17%2C19%2C20%2C2310%2C2351%2C2526%2C2527%2C2610%2C2688%2C2761%2C2763%2C2764%2C2765%2C3044%2C3045%2C3154%2C3684%2C4184%2C4276%2C7035%2C7327%2C7330%2C7789%2C7%2C8%2C9%2C10%2C916%2C915%2C874%2C835%2C17%2C18%2C19%2C20%2C1428%2C2310%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C2764%2C2765%2C3044%2C3045%2C3052%2C3053%2C3154%2C3684%2C3856%2C4184%2C4276%2C7035%2C7327%2C7330%2C7331%2C7789%2C7%2C8%2C9%2C10%2C916%2C915%2C874%2C835%2C17%2C18%2C19%2C20%2C1428%2C2310%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C2764%2C2765%2C3044%2C3045%2C3052%2C3053%2C3154%2C3684%2C3856%2C4184%2C4276%2C7035%2C7327%2C7330%2C7331%2C7789%2C7%2C8%2C9%2C10%2C916%2C915%2C874%2C835%26osb%3DLinux%252FChrome%26lb%3D12%26reqt%3D1762685591808&cust_params=li-module-enabled%3Dt1&adks=4079446691&frm=20&eo_id_str=ID%3Dd758a0372e0d617e%3AT%3D1762685587%3ART%3D1762685587%3AS%3DAA-AfjbrkAa_d6zy1Ty3ihSBvc1X&pbbce=1&td=1&egid=3721&tan=5e3107b9-1e1c-45dc-be13-7701b2f8f5a5&tdf=2
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511040101/pubads_impl.js?cb=31095648
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c21::9b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
55578770bf148bc4bc8ea7b540dff4ce6819cad696de7a9c3d38d36b56081cf6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

content-encoding
dcb
google-lineitem-id
-2
observe-browsing-topics
?1
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sun, 09 Nov 2025 10:53:12 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-2
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
161
x-xss-protection
0
server
cafe
ads
securepubads.g.doubleclick.net/gampad/ 		396 B
193 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4347117103472909&correlator=508410196307220&eid=31095133%2C31095250%2C31095648%2C83321072&output=ldjh&gdfp_req=1&vrg=202511040101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-medrectangle-4&enc_prev_ius=%2F0%2F1&prev_iu_szs=336x280%7C300x250&ifi=33&didk=46192883&dids=div-gpt-ad-mediafire_com-medre&adfs=1749122204&sfv=1-0-45&rcs=5&eri=1&sc=1&cookie=ID%3D710d595ddee055b4%3AT%3D1762685587%3ART%3D1762685587%3AS%3DALNI_MZJGZDvti4dTz_nkocz4FF59h3kSg&gpic=UID%3D0000130a10d732ad%3AT%3D1762685587%3ART%3D1762685587%3AS%3DALNI_MaUVZBE6m9Fvpz6Zk1r3wnftELu7g&abxe=1&dt=1762685592436&lmt=1762685592&adxs=320&adys=420&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=3&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fzh1io5g5cavqo7l%2FRose%252527s_bot.zip%2Ffile&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGsmFMWSallS-isNSI3vTP05mongQR3LeNhfsq_U1He74s_r7pXkfVjPwbyenUg&topics=3&tps=3&htps=10&a3p=EmwKDGlkNS1zeW5jLmNvbRJaSUQ1Knl0eFFPejc2QzBUbG10djVzbG80YXNOR005bjY3VXd1LUZJNVY5REUwTGpfXzJrUWNwUmFBQUVCQ21rUWNwTUFZS0pqWW1lNVZpVmxtVzB1Z0RUOGtBWAESRgoMYXVkaWdlbnQuY29tEjQwMDAxeXVtMGVhYmtiYTk4YmNpYWU2Z2liZGRqOTZsZGNsZjc4NmtoZGFhYmFja2tjMmpsWAESrQEKCmNyaXRlby5jb20SnAE3RE8xR2w5QlFXbEZNSEoyWjJkUFJ6RnRXblpUV2paWWMzWkthMVZzTTBkRmNtRTJUMUY2WkhwclpXeG5WRE16WkhFMFFrWmtTRE5OYlVkeFoyMXJNREpCUW0xd1dqVm1VMnBXYkZsVmRWbEJNRm8wTlZkck1GbEtWbG8xV21aVlIweEZKVEpHZFZFMVdVRjRhRXBFYmpCekpUTkVYARI2CgxhZHNlcnZlci5vcmcSJGM0ODVmOWY2LTJkN2UtNDYyNy04OTBkLWE3MWFjZGY2NDdhZVgBEjQKCnB1YmNpZC5vcmcSJGRlNmQyYWY2LWIwNWEtNGVlOS1hNzdlLWM3MzQwMjZmZjQ5Y1gBEloKDWNyd2RjbnRybC5uZXQSQGQyZTc1YjhlNDkyZTc0MzAwNGVkMGRiYzZjMDQxODVjYTAyY2M1MWU0ZGExNjQzYmIwNjQ3NzRmYmM5NGI3ZGIY-qD-waYzSAASHQoOZXNwLmNyaXRlby5jb20YvZ_-waYzSABSAghkEhgKCXlhaG9vLmNvbRicof7BpjNIAFICCG8SPgoFb3BlbngSLGV5SnBJam9pVW5kNGVUTTRSVEJSZGt0alpITmtkWGhUS3k5S1p6MDlJbjA9GMKj_sGmM0gAEhsKDDMzYWNyb3NzLmNvbRi8n_7BpjNIAFICCGQSggIKCHJ0YmhvdXNlEuwBVW5PSDI4a3JuUnluUXNqODQwNVhQMWpqaVhrOGZ4ZjFLczVJWXlaTU5CN0JWSDBpa1U2dkVCcENIYVh1anRFcUlLc3BFSVNaZWhqUHROc3ErK0J2anhkaU1OVm9GQ0FjKzNrbGEvbkJFZlV6YUZUeVpSZWxLTFB6eWF2am9ybXZUc0dQUFk4ODZxZHlXWENBT3pJeFdvcXliYW43d3N5TzdjNmovS1YvVjI3cEpuOE44dFl4dTNOR2MzK2NQbHMwWTNmSjM2cmRKbEVjcmJnb0hJYXB2OWZqcURxNlhtOUowSEFXYXhDNVoxdz0YsqP-waYzSAA.&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1762685584931&idt=2383&ppid=3b25ce83c75aeff52ef9657aec7de9f7&prev_scp=a%3D1%26iid1%3D6017477134385895%26eid%3D6017477134385895%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D0%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252Fzh1io5g5cavqo7l%252FRose%25252527s_bot.zip%252Ffile%26path%3D%252Ffile%252Fzh1io5g5cavqo7l%252FRose%252527s_bot.zip%252Ffile%26ap%3D1105%26sap%3D1105%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D6%26at%3Dbf%26adr%3D399%26ezosn%3D6%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D22%26al%3D1022%26compid%3D1%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-medrectangle-4%26tap%3Dmediafire_com-medrectangle-4-6017477134385895%26eb_br%3Dzero%26eba%3D0%26bv%3D13%26bvm%3D0%26bvr%3D3%26avc%3D89%26shp%3D3%26ftsn%3D12%26ftsng%3D12%26br1%3D0%26br2%3D120%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D34%2C168%2C0%2C0%2C0%2C168%2C184%2C20%2C0%2C0%2C192%2C0%2C902%2C903%2C901%2C902%2C903%26deal1%3D20%2C21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C760%2C761%2C815%2C816%2C817%2C818%2C899%2C919%2C1794%2C2310%2C2339%2C2526%2C2527%2C2763%2C2764%2C2765%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C3919%2C3933%2C4184%2C4185%2C4186%2C4604%2C4605%2C5747%2C6044%2C6293%2C6294%2C6295%2C6983%2C7036%2C7046%2C7605%2C7606%2C7607%2C7608%2C7609%2C7610%2C7611%2C7612%2C7613%2C7614%2C7615%2C7616%2C7617%2C7618%2C7788%2C7790%2C7993%2C7994%2C7995%2C7996%2C7997%2C7998%2C7999%2C8057%2C6772%2C5534%2C7661%2C7713%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C17%2C2351%2C2610%2C2761%2C3044%2C7035%2C7327%2C7789%2C7%2C8%2C915%2C874%2C835%2C17%2C19%2C2351%2C2610%2C2688%2C2693%2C2761%2C3044%2C3045%2C4276%2C7035%2C7327%2C7330%2C7789%2C7%2C8%2C916%2C915%2C874%2C835%2C17%2C18%2C19%2C1428%2C2351%2C2610%2C2688%2C2693%2C2761%2C3044%2C3045%2C3052%2C3053%2C3856%2C4276%2C7035%2C7327%2C7330%2C7331%2C7789%2C7%2C8%2C916%2C915%2C874%2C835%2C17%2C18%2C19%2C1428%2C2351%2C2610%2C2688%2C2693%2C2761%2C3044%2C3045%2C3052%2C3053%2C3856%2C4276%2C7035%2C7327%2C7330%2C7331%2C7789%2C7%2C8%2C916%2C915%2C874%2C835%2C17%2C18%2C19%2C1428%2C2351%2C2610%2C2688%2C2693%2C2761%2C3044%2C3045%2C3052%2C3053%2C3856%2C4276%2C7035%2C7327%2C7330%2C7331%2C7789%2C7%2C8%2C916%2C915%2C874%2C835%26osb%3DLinux%252FChrome%26lb%3D0%26reqt%3D1762685591810%26adxf%3D1%26ss38%3D1%26ss9%3D1%26nocompoverride%3D1&cust_params=li-module-enabled%3Dt1&adks=1277606936&frm=20&eo_id_str=ID%3Dd758a0372e0d617e%3AT%3D1762685587%3ART%3D1762685587%3AS%3DAA-AfjbrkAa_d6zy1Ty3ihSBvc1X&pbbce=1&td=1&egid=3721&tan=5e3107b9-1e1c-45dc-be13-7701b2f8f5a6&tdf=2
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511040101/pubads_impl.js?cb=31095648
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c21::9b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
6358c3605c13b5928e94e641e8935dc812c7be724c395e9a66ea820809825efc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

content-encoding
dcb
google-lineitem-id
-2
observe-browsing-topics
?1
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sun, 09 Nov 2025 10:53:12 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-2
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
163
x-xss-protection
0
server
cafe
ad_impression
pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ 		60 B
336 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ad_impression
Requested by
Host: script-api.ccgateway.net
URL: https://script-api.ccgateway.net/script/bundle?id=www.mediafire.com&parentId=0dae949f4b
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.210.204.30 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-210-204-30.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
715199235705aaa7c6781030dac85b766262d77ec7c07aac6f4928f464d93583

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type
application/json
Referer
https://www.mediafire.com/

Response headers

access-control-allow-origin
https://www.mediafire.com
content-length
60
date
Sun, 09 Nov 2025 10:53:12 GMT
content-type
application/json; charset=utf-8
vary
Origin
access-control-allow-credentials
true
ad_impression
pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ 		60 B
336 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ad_impression
Requested by
Host: script-api.ccgateway.net
URL: https://script-api.ccgateway.net/script/bundle?id=www.mediafire.com&parentId=0dae949f4b
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.210.204.30 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-210-204-30.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
715199235705aaa7c6781030dac85b766262d77ec7c07aac6f4928f464d93583

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type
application/json
Referer
https://www.mediafire.com/

Response headers

access-control-allow-origin
https://www.mediafire.com
content-length
60
date
Sun, 09 Nov 2025 10:53:12 GMT
content-type
application/json; charset=utf-8
vary
Origin
access-control-allow-credentials
true
ad_impression
pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ 		60 B
336 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ad_impression
Requested by
Host: script-api.ccgateway.net
URL: https://script-api.ccgateway.net/script/bundle?id=www.mediafire.com&parentId=0dae949f4b
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.210.204.30 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-210-204-30.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
715199235705aaa7c6781030dac85b766262d77ec7c07aac6f4928f464d93583

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type
application/json
Referer
https://www.mediafire.com/

Response headers

access-control-allow-origin
https://www.mediafire.com
content-length
60
date
Sun, 09 Nov 2025 10:53:12 GMT
content-type
application/json; charset=utf-8
vary
Origin
access-control-allow-credentials
true
ad_impression
pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ 		60 B
336 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ad_impression
Requested by
Host: script-api.ccgateway.net
URL: https://script-api.ccgateway.net/script/bundle?id=www.mediafire.com&parentId=0dae949f4b
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.210.204.30 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-210-204-30.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
715199235705aaa7c6781030dac85b766262d77ec7c07aac6f4928f464d93583

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type
application/json
Referer
https://www.mediafire.com/

Response headers

access-control-allow-origin
https://www.mediafire.com
content-length
60
date
Sun, 09 Nov 2025 10:53:12 GMT
content-type
application/json; charset=utf-8
vary
Origin
access-control-allow-credentials
true
audins.js
go.ezodn.com/detroitchicago/ 		516 B
766 B 		Script
General
Check archive.org
Download Go to
Full URL
https://go.ezodn.com/detroitchicago/audins.js?cb=3
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3037::6815:574f -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bcf7993523efcd42f5599e1c210b6433e35a39de688c9e5ae90829741937df71

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

x-robots-tag
noindex, follow
content-encoding
br
cf-cache-status
HIT
age
1034911
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=hS3wlhyK18TQa2KZlnov8uxlmBCEH0KbNYWHr1PN6ZE%2FrxlA1Kh9cTOUgobg%2B4ZnWhpUCbZ5rZL0O7MBLn2ITjr0q85QJMeB0aZjoykPQDXJO064pg1Zyg%3D%3D"}]}
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sun, 09 Nov 2025 10:53:12 GMT
x-middleton-display
sol-js
content-type
application/javascript
vary
Accept-Encoding
last-modified
Sun, 05 Oct 2025 08:03:21 GMT
priority
u=3,i=?0
cache-control
public, max-age=31536000
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray
99bcc3db98cf4693-EWR
content-length
275
server
cloudflare
quant.js
secure.quantserve.com/ 		32 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://secure.quantserve.com/quant.js
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/audins.js?cb=3
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:116:800b:21:c1e8:5385:5098:6bf0 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
e1477e459968a08904795c6c229d876e4c339599d1a876cdbda25001cf6c3f48

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

cache-control
private, max-age=86400
content-encoding
gzip
etag
"2qTUJ/VRynLq5kB6xH78Cw=="
expires
Mon, 10 Nov 2025 10:53:13 GMT
accept-ranges
bytes
date
Sun, 09 Nov 2025 10:53:13 GMT
content-type
application/javascript
vary
Accept-Encoding
activeview
pagead2.googlesyndication.com/pcs/ Frame 2B49 		42 B
65 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssqgrCkt4xVWb2jsQxGOszbbLwiKR7QegAwEe2OaHIuupY53fbsUHwi1bDhBpgHDZDm4reKkke2vu5tKp699tw8Ft98TiQWCKcqd_ToLfs6My9jdixNIw_uxEGOFiIgjXi-XStqi9Ym_nRJkbgUBRJKJuwzDfuVNKJPYzXk3pjPCuI5_jwtfp_I7shgqPfFG8Sl1uN46btbTrT9YZv0&sai=AMfl-YQNkAu54uhPaQcLhkglUKOuYXor124CQ2PjkyaDT3AH3CjKyP4ccHsWjJjQr97HaJWn97o4PfMHwUwUQkAIkUTk3tuLs1DRTIi0JtBRD7hpaVTPDTcfB6oKSuPtdZlAyr_IFJMzI0tpS2rNMxJ4pR2MHwT-e4p1Yo1iM-OeXDFt-f5hDikH5m1NU3SrqGfp9lPWmQ-jGN4JUb8oKuVJDES4rWi8pOT5BJpjlGbFMvm-Wq6AhBsikYmWly9xh_f0Bqcwftl6DIVdIv64lE_l_CAkKhWrmTABoFCMX8KGhSY_DQ&sig=Cg0ArKJSzJ8y0nIuHqNREAE&cid=CAQSvQEAwksa0dnl-qITmaGaX6iYrKEYVGe-tXFWgwSOxKM4ekI0gXdjdVamnJR8rE2Py6PQtbMtNEzUA7Gv3pU-3dQXukJIhze3RJuEKNf_Fxzqe61bppw9Q1jFHcnissQd8NveKEpGL-7okFQ9GXXOSeaX4h1qBIOih3pK9dpet-cZ5xBYc1PmsoQxDbijzfOSd64Xpf3l1p7j2qM8ApJekhG_7S7Vvz8hpPaCl4E1K5ppzoFjlmNVsyq8vl5hjxkYAQ&id=lidar2&mcvt=1000&p=10,552,100,1280&tm=1017.3999977111816&tu=17.599998474121094&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20251105&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=3106951849&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=5861839200&rst=1762685591703&rpt=353&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&fle=0&vae=0&spb=0&sfl=0&ffslot=0&reach=8&io2=0
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c21::9a Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://322f9f81cfd88b7498cd441174614e0b.safeframe.googlesyndication.com/

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
42
date
Sun, 09 Nov 2025 10:53:13 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
rules-p-31iz6hfFutd16.js
rules.quantcount.com/ 		160 B
632 B 		Script
General
Check archive.org
Download Go to
Full URL
https://rules.quantcount.com/rules-p-31iz6hfFutd16.js
Requested by
Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:26a0:b800:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
4718dd9f68e969d1cb5e1b6172206b7150ad1d8cd5c5c1fe5812dd0e1646d426

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

etag
"af15ecfe46737cb2a37226fd060f23a6"
age
841
access-control-allow-methods
GET
x-cache
Hit from cloudfront
x-amz-cf-id
UaVukd0XJk2OyelrGArcTPS2eH7uwelnDDInkOIRXgKjcnLGNq-wPw==
date
Sun, 09 Nov 2025 10:39:13 GMT
content-type
application/javascript
vary
Accept-Encoding
last-modified
Fri, 14 Oct 2022 00:41:49 GMT
cache-control
max-age=3600
cross-origin-resource-policy
cross-origin
via
1.1 a7adea6a626ffc779dc26bac2782f042.cloudfront.net (CloudFront)
accept-ranges
bytes
access-control-allow-origin
*
content-length
160
x-amz-cf-pop
YUL62-P2
server
AmazonS3
x-amz-server-side-encryption
AES256
cs
pixel.quantserve.com/
Redirect Chain
  • https://pixel.quantserve.com/cs?a=p-31iz6hfFutd16&gdpr=0
  • https://pixel.quantserve.com/cs?a=p-31iz6hfFutd16&gdpr=0&__qcmcs=1
118 B
337 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pixel.quantserve.com/cs?a=p-31iz6hfFutd16&gdpr=0&__qcmcs=1
Protocol
H2
Server
2620:116:800b:21:c1e8:5385:5098:6bf0 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
0f3ac3cb7d10e9decc27c3a2939e4b81dda2c2125dd3e96bc2793f129f25286d

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

access-control-allow-origin
https://www.mediafire.com
content-length
118
date
Sun, 09 Nov 2025 10:53:13 GMT
content-type
application/json
vary
Origin
access-control-allow-credentials
true

Redirect headers

strict-transport-security
max-age=86400
cache-control
private, no-store, proxy-revalidate
location
https://pixel.quantserve.com/cs?a=p-31iz6hfFutd16&gdpr=0&__qcmcs=1
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
0
date
Sun, 09 Nov 2025 10:53:13 GMT
vary
Origin
db_sync
px.ads.linkedin.com/
Redirect Chain
  • https://idsync.rlcdn.com/380609.gif?gdpr=0&partner_uid=mugsUJvjJFmB4ylYmrUwUpjoeAOBtH5TmeE6z_db
  • https://idsync.rlcdn.com/1000.gif?memo=CMGdFxIzCi8IARCfOBoobXVnc1VKdmpKRm1CNHlsWW1yVXdVcGpvZUFPQnRINVRtZUU2el9kYhAAGg0ImeXByAYSBQjoBxAAQgBKAA
  • https://pippio.com/api/sync?pid=5324&it=1&iv=00053993b4a47158ab73734d1c15023d57239e4de99b021025e3262f438692a2791426b5417dce21&_=2
  • https://px.ads.linkedin.com/db_sync?pid=10339&puuid=00053993b4a47158ab73734d1c15023d57239e4de99b021025e3262f438692a2791426b5417dce21&rand=06753740
  • https://px.ads.linkedin.com/db_sync?pid=10339&puuid=00053993b4a47158ab73734d1c15023d57239e4de99b021025e3262f438692a2791426b5417dce21&rand=06753740&expected_cookie=9e57638b-1807-48ad-8c18-9b1a5c744ebf
0
144 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.ads.linkedin.com/db_sync?pid=10339&puuid=00053993b4a47158ab73734d1c15023d57239e4de99b021025e3262f438692a2791426b5417dce21&rand=06753740&expected_cookie=9e57638b-1807-48ad-8c18-9b1a5c744ebf
Protocol
H2
Server
2620:1ec:50::12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

linkedin-action
1
x-li-pop
afd-prod-ltx1-x
x-msedge-ref
Ref A: EAC82CFF2A0342228F0F8AA03E5F3C4D Ref B: PHL30EDGE0208 Ref C: 2025-11-09T10:53:13Z
x-li-fabric
prod-ltx1
x-li-uuid
AAZDJzis4tdieKuwD5/+jg==
x-li-proto
http/2
alt-svc
h3=":443"; ma=86400
x-cache
CONFIG_NOCACHE
content-length
0
date
Sun, 09 Nov 2025 10:53:12 GMT

Redirect headers

linkedin-action
1
x-li-pop
afd-prod-ltx1-x
location
/db_sync?pid=10339&puuid=00053993b4a47158ab73734d1c15023d57239e4de99b021025e3262f438692a2791426b5417dce21&rand=06753740&expected_cookie=9e57638b-1807-48ad-8c18-9b1a5c744ebf
x-msedge-ref
Ref A: CB118073E9FA40E4AEA0950B421ACF45 Ref B: PHL30EDGE0208 Ref C: 2025-11-09T10:53:13Z
x-li-fabric
prod-ltx1
x-li-uuid
AAZDJzirgYaI+3xay1qzCQ==
x-li-proto
http/2
alt-svc
h3=":443"; ma=86400
x-cache
CONFIG_NOCACHE
content-length
0
date
Sun, 09 Nov 2025 10:53:12 GMT
pixel;r=689577461;labels=Domain.mediafire_com%2CDomainId.484470;rf=0;a=p-31iz6hfFutd16;url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fzh1io5g5cavqo7l%2FRose%252527s_bot.zip%2Ffile;ns=0;ce=1;qjs=1;qv=...
pixel.quantserve.com/ 		35 B
365 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.quantserve.com/pixel;r=689577461;labels=Domain.mediafire_com%2CDomainId.484470;rf=0;a=p-31iz6hfFutd16;url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fzh1io5g5cavqo7l%2FRose%252527s_bot.zip%2Ffile;ns=0;ce=1;qjs=1;qv=eed76d27-20251007131428;ref=;dst=0;et=1762685593302;tzo=600;ogl=type.website%2Csite_name.MediaFire%2Clocale.en_US%2Curl.https%3A%2F%2Fwww%252Emediafire%252Ecom%2Ffile%2Fzh1io5g5cavqo7l%2FRose%252527s_bot%252Ezip%2Ffile%2Ctitle.Rose's%20bot%2Cimage.https%3A%2F%2Fstatic%252Emediafire%252Ecom%2Fimages%2Ffiletype%2Fdownload%2Fzip%252Ejpg%2Cdescription.;d=mediafire.com;uht=2;fpan=1;fpa=P1-eeff3a0b-14d9-4358-9897-24ace771433a;pbc=;_ses=b0789683-ef30-4a60-812a-2a05abd8050a;_seg=0;_ss=1;gdpr=0;mdl=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:116:800b:21:c1e8:5385:5098:6bf0 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

strict-transport-security
max-age=86400
cache-control
private, no-store, proxy-revalidate
content-length
35
date
Sun, 09 Nov 2025 10:53:13 GMT
attribution-reporting-register-trigger
{"event_trigger_data":[{"filters":[{"label":["6e+AtxtWU3CNp/2cNXg4+Q=="],"pcode":["p-31iz6hfFutd16"]},{"label":["FjIc1aX0EePJWzFDO9X5/g=="],"pcode":["p-31iz6hfFutd16"]}],"trigger_data":"1"}]}
content-type
image/gif
ads
securepubads.g.doubleclick.net/gampad/ 		396 B
192 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4347117103472909&correlator=428234226893906&eid=31095133%2C31095250%2C31095648%2C83321072&output=ldjh&gdfp_req=1&vrg=202511040101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-medrectangle-3&enc_prev_ius=%2F0%2F1&prev_iu_szs=336x280&ifi=34&didk=46179496&dids=div-gpt-ad-mediafire_com-medre&adfs=1911771697&sfv=1-0-45&rcs=6&eri=1&sc=1&cookie=ID%3D710d595ddee055b4%3AT%3D1762685587%3ART%3D1762685587%3AS%3DALNI_MZJGZDvti4dTz_nkocz4FF59h3kSg&gpic=UID%3D0000130a10d732ad%3AT%3D1762685587%3ART%3D1762685587%3AS%3DALNI_MaUVZBE6m9Fvpz6Zk1r3wnftELu7g&abxe=1&dt=1762685593423&lmt=1762685593&adxs=320&adys=120&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=2&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fzh1io5g5cavqo7l%2FRose%252527s_bot.zip%2Ffile&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGskc08zRiBapaVkewLy6TvDmhAqaSKsOglH6pUEo1oYIvCAns-mEpc52AmoJfxY&topics=3&tps=3&htps=10&a3p=EmwKDGlkNS1zeW5jLmNvbRJaSUQ1Knl0eFFPejc2QzBUbG10djVzbG80YXNOR005bjY3VXd1LUZJNVY5REUwTGpfXzJrUWNwUmFBQUVCQ21rUWNwTUFZS0pqWW1lNVZpVmxtVzB1Z0RUOGtBWAESRgoMYXVkaWdlbnQuY29tEjQwMDAxeXVtMGVhYmtiYTk4YmNpYWU2Z2liZGRqOTZsZGNsZjc4NmtoZGFhYmFja2tjMmpsWAESrQEKCmNyaXRlby5jb20SnAE3RE8xR2w5QlFXbEZNSEoyWjJkUFJ6RnRXblpUV2paWWMzWkthMVZzTTBkRmNtRTJUMUY2WkhwclpXeG5WRE16WkhFMFFrWmtTRE5OYlVkeFoyMXJNREpCUW0xd1dqVm1VMnBXYkZsVmRWbEJNRm8wTlZkck1GbEtWbG8xV21aVlIweEZKVEpHZFZFMVdVRjRhRXBFYmpCekpUTkVYARI2CgxhZHNlcnZlci5vcmcSJGM0ODVmOWY2LTJkN2UtNDYyNy04OTBkLWE3MWFjZGY2NDdhZVgBEjQKCnB1YmNpZC5vcmcSJGRlNmQyYWY2LWIwNWEtNGVlOS1hNzdlLWM3MzQwMjZmZjQ5Y1gBEloKDWNyd2RjbnRybC5uZXQSQGQyZTc1YjhlNDkyZTc0MzAwNGVkMGRiYzZjMDQxODVjYTAyY2M1MWU0ZGExNjQzYmIwNjQ3NzRmYmM5NGI3ZGIY-qD-waYzSAASHQoOZXNwLmNyaXRlby5jb20YvZ_-waYzSABSAghkEhgKCXlhaG9vLmNvbRicof7BpjNIAFICCG8SPgoFb3BlbngSLGV5SnBJam9pVW5kNGVUTTRSVEJSZGt0alpITmtkWGhUS3k5S1p6MDlJbjA9GMKj_sGmM0gAEhsKDDMzYWNyb3NzLmNvbRi8n_7BpjNIAFICCGQSggIKCHJ0YmhvdXNlEuwBVW5PSDI4a3JuUnluUXNqODQwNVhQMWpqaVhrOGZ4ZjFLczVJWXlaTU5CN0JWSDBpa1U2dkVCcENIYVh1anRFcUlLc3BFSVNaZWhqUHROc3ErK0J2anhkaU1OVm9GQ0FjKzNrbGEvbkJFZlV6YUZUeVpSZWxLTFB6eWF2am9ybXZUc0dQUFk4ODZxZHlXWENBT3pJeFdvcXliYW43d3N5TzdjNmovS1YvVjI3cEpuOE44dFl4dTNOR2MzK2NQbHMwWTNmSjM2cmRKbEVjcmJnb0hJYXB2OWZqcURxNlhtOUowSEFXYXhDNVoxdz0YsqP-waYzSAA.&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1762685584931&idt=2383&ppid=3b25ce83c75aeff52ef9657aec7de9f7&prev_scp=a%3D1%26iid1%3D7611442246396448%26eid%3D7611442246396448%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D0%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252Fzh1io5g5cavqo7l%252FRose%25252527s_bot.zip%252Ffile%26path%3D%252Ffile%252Fzh1io5g5cavqo7l%252FRose%252527s_bot.zip%252Ffile%26ap%3D1104%26sap%3D1104%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D7%26at%3Dbf%26adr%3D399%26ezosn%3D5%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D21%26al%3D1021%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-medrectangle-3%26tap%3Dmediafire_com-medrectangle-3-7611442246396448%26eb_br%3Dzero%26eba%3D0%26bv%3D5%26bvm%3D0%26bvr%3D5%26avc%3D194%26shp%3D3%26ftsn%3D12%26ftsng%3D12%26br1%3D0%26br2%3D240%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D157%2C168%2C0%2C0%2C0%2C168%2C184%2C20%2C0%2C0%2C192%2C0%2C902%2C903%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C760%2C761%2C815%2C816%2C817%2C818%2C893%2C899%2C903%2C919%2C1794%2C2339%2C3054%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3915%2C3919%2C3933%2C4185%2C4186%2C4604%2C4605%2C5747%2C6044%2C6045%2C6293%2C6294%2C6295%2C6983%2C7036%2C7046%2C7144%2C7605%2C7606%2C7607%2C7608%2C7609%2C7610%2C7611%2C7612%2C7613%2C7614%2C7615%2C7616%2C7617%2C7618%2C7788%2C7790%2C7993%2C7994%2C7995%2C7996%2C7997%2C7998%2C7999%2C8057%2C8069%2C6772%2C5534%2C7661%2C7713%2C11%2C12%2C13%2C14%2C15%2C16%2C20%2C2310%2C2526%2C2527%2C2763%2C2764%2C2765%2C3154%2C3684%2C4184%2C9%2C10%2C17%2C20%2C2310%2C2351%2C2526%2C2527%2C2761%2C2763%2C2764%2C2765%2C3044%2C3154%2C3684%2C4184%2C7035%2C7327%2C7789%2C7%2C8%2C9%2C10%2C915%2C874%2C835%2C17%2C19%2C20%2C2310%2C2351%2C2526%2C2527%2C2610%2C2688%2C2761%2C2763%2C2764%2C2765%2C3044%2C3045%2C3154%2C3684%2C4184%2C4276%2C7035%2C7327%2C7330%2C7789%2C7%2C8%2C9%2C10%2C916%2C915%2C874%2C835%2C17%2C18%2C19%2C20%2C1428%2C2310%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C2764%2C2765%2C3044%2C3045%2C3052%2C3053%2C3154%2C3684%2C3856%2C4184%2C4276%2C7035%2C7327%2C7330%2C7331%2C7789%2C7%2C8%2C9%2C10%2C916%2C915%2C874%2C835%2C17%2C18%2C19%2C20%2C1428%2C2310%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C2764%2C2765%2C3044%2C3045%2C3052%2C3053%2C3154%2C3684%2C3856%2C4184%2C4276%2C7035%2C7327%2C7330%2C7331%2C7789%2C7%2C8%2C9%2C10%2C916%2C915%2C874%2C835%2C17%2C18%2C19%2C20%2C1428%2C2310%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C2764%2C2765%2C3044%2C3045%2C3052%2C3053%2C3154%2C3684%2C3856%2C4184%2C4276%2C7035%2C7327%2C7330%2C7331%2C7789%2C7%2C8%2C9%2C10%2C916%2C915%2C874%2C835%26osb%3DLinux%252FChrome%26lb%3D2%26reqt%3D1762685592672%26adxf%3D1%26ss38%3D1%26ss9%3D1&cust_params=li-module-enabled%3Dt1&adks=4079446691&frm=20&eo_id_str=ID%3Dd758a0372e0d617e%3AT%3D1762685587%3ART%3D1762685587%3AS%3DAA-AfjbrkAa_d6zy1Ty3ihSBvc1X&pbbce=1&td=1&egid=3721&tan=5e3107b9-1e1c-45dc-be13-7701b2f8f5a7&tdf=2
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511040101/pubads_impl.js?cb=31095648
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c21::9b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
b046a6c62812c45b02c69f67f0916771708bd9e5750f5777d1f6dc819f0e8165
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

content-encoding
dcb
google-lineitem-id
-2
observe-browsing-topics
?1
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sun, 09 Nov 2025 10:53:13 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-2
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
160
x-xss-protection
0
server
cafe
ad_impression
pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ 		60 B
336 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ad_impression
Requested by
Host: script-api.ccgateway.net
URL: https://script-api.ccgateway.net/script/bundle?id=www.mediafire.com&parentId=0dae949f4b
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.210.204.30 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-210-204-30.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
715199235705aaa7c6781030dac85b766262d77ec7c07aac6f4928f464d93583

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type
application/json
Referer
https://www.mediafire.com/

Response headers

access-control-allow-origin
https://www.mediafire.com
content-length
60
date
Sun, 09 Nov 2025 10:53:13 GMT
content-type
application/json; charset=utf-8
vary
Origin
access-control-allow-credentials
true
ads
securepubads.g.doubleclick.net/gampad/ 		396 B
193 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4347117103472909&correlator=1396176224920577&eid=31095133%2C31095250%2C31095648%2C83321072&output=ldjh&gdfp_req=1&vrg=202511040101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-medrectangle-3&enc_prev_ius=%2F0%2F1&prev_iu_szs=336x280&ifi=35&didk=46179496&dids=div-gpt-ad-mediafire_com-medre&adfs=1911771697&sfv=1-0-45&rcs=7&eri=1&sc=1&cookie=ID%3D710d595ddee055b4%3AT%3D1762685587%3ART%3D1762685587%3AS%3DALNI_MZJGZDvti4dTz_nkocz4FF59h3kSg&gpic=UID%3D0000130a10d732ad%3AT%3D1762685587%3ART%3D1762685587%3AS%3DALNI_MaUVZBE6m9Fvpz6Zk1r3wnftELu7g&abxe=1&dt=1762685594419&lmt=1762685594&adxs=320&adys=120&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=2&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fzh1io5g5cavqo7l%2FRose%252527s_bot.zip%2Ffile&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGskc08zRiBapaVkewLy6TvDmhAqaSKsOglH6pUEo1oYIvCAns-mEpc52AmoJfxY&topics=3&tps=3&htps=10&a3p=EmwKDGlkNS1zeW5jLmNvbRJaSUQ1Knl0eFFPejc2QzBUbG10djVzbG80YXNOR005bjY3VXd1LUZJNVY5REUwTGpfXzJrUWNwUmFBQUVCQ21rUWNwTUFZS0pqWW1lNVZpVmxtVzB1Z0RUOGtBWAESRgoMYXVkaWdlbnQuY29tEjQwMDAxeXVtMGVhYmtiYTk4YmNpYWU2Z2liZGRqOTZsZGNsZjc4NmtoZGFhYmFja2tjMmpsWAESrQEKCmNyaXRlby5jb20SnAE3RE8xR2w5QlFXbEZNSEoyWjJkUFJ6RnRXblpUV2paWWMzWkthMVZzTTBkRmNtRTJUMUY2WkhwclpXeG5WRE16WkhFMFFrWmtTRE5OYlVkeFoyMXJNREpCUW0xd1dqVm1VMnBXYkZsVmRWbEJNRm8wTlZkck1GbEtWbG8xV21aVlIweEZKVEpHZFZFMVdVRjRhRXBFYmpCekpUTkVYARI2CgxhZHNlcnZlci5vcmcSJGM0ODVmOWY2LTJkN2UtNDYyNy04OTBkLWE3MWFjZGY2NDdhZVgBEjQKCnB1YmNpZC5vcmcSJGRlNmQyYWY2LWIwNWEtNGVlOS1hNzdlLWM3MzQwMjZmZjQ5Y1gBEloKDWNyd2RjbnRybC5uZXQSQGQyZTc1YjhlNDkyZTc0MzAwNGVkMGRiYzZjMDQxODVjYTAyY2M1MWU0ZGExNjQzYmIwNjQ3NzRmYmM5NGI3ZGIY-qD-waYzSAASHQoOZXNwLmNyaXRlby5jb20YvZ_-waYzSABSAghkEhgKCXlhaG9vLmNvbRicof7BpjNIAFICCG8SPgoFb3BlbngSLGV5SnBJam9pVW5kNGVUTTRSVEJSZGt0alpITmtkWGhUS3k5S1p6MDlJbjA9GMKj_sGmM0gAEhsKDDMzYWNyb3NzLmNvbRi8n_7BpjNIAFICCGQSggIKCHJ0YmhvdXNlEuwBVW5PSDI4a3JuUnluUXNqODQwNVhQMWpqaVhrOGZ4ZjFLczVJWXlaTU5CN0JWSDBpa1U2dkVCcENIYVh1anRFcUlLc3BFSVNaZWhqUHROc3ErK0J2anhkaU1OVm9GQ0FjKzNrbGEvbkJFZlV6YUZUeVpSZWxLTFB6eWF2am9ybXZUc0dQUFk4ODZxZHlXWENBT3pJeFdvcXliYW43d3N5TzdjNmovS1YvVjI3cEpuOE44dFl4dTNOR2MzK2NQbHMwWTNmSjM2cmRKbEVjcmJnb0hJYXB2OWZqcURxNlhtOUowSEFXYXhDNVoxdz0YsqP-waYzSAA.&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1762685584931&idt=2383&ppid=3b25ce83c75aeff52ef9657aec7de9f7&prev_scp=a%3D1%26iid1%3D7611442246396448%26eid%3D7611442246396448%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D0%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252Fzh1io5g5cavqo7l%252FRose%25252527s_bot.zip%252Ffile%26path%3D%252Ffile%252Fzh1io5g5cavqo7l%252FRose%252527s_bot.zip%252Ffile%26ap%3D1104%26sap%3D1104%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D8%26at%3Dbf%26adr%3D399%26ezosn%3D5%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D21%26al%3D1021%26compid%3D1%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-medrectangle-3%26tap%3Dmediafire_com-medrectangle-3-7611442246396448%26eb_br%3Dzero%26eba%3D0%26bv%3D5%26bvm%3D0%26bvr%3D5%26avc%3D194%26shp%3D3%26ftsn%3D12%26ftsng%3D12%26br1%3D0%26br2%3D240%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D157%2C168%2C0%2C0%2C0%2C168%2C184%2C20%2C0%2C0%2C192%2C0%2C902%2C903%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C760%2C761%2C815%2C816%2C817%2C818%2C893%2C899%2C903%2C919%2C1794%2C2339%2C3054%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3915%2C3919%2C3933%2C4185%2C4186%2C4604%2C4605%2C5747%2C6044%2C6045%2C6293%2C6294%2C6295%2C6983%2C7036%2C7046%2C7144%2C7605%2C7606%2C7607%2C7608%2C7609%2C7610%2C7611%2C7612%2C7613%2C7614%2C7615%2C7616%2C7617%2C7618%2C7788%2C7790%2C7993%2C7994%2C7995%2C7996%2C7997%2C7998%2C7999%2C8057%2C8069%2C6772%2C5534%2C7661%2C7713%2C11%2C12%2C13%2C14%2C15%2C16%2C20%2C2310%2C2526%2C2527%2C2763%2C2764%2C2765%2C3154%2C3684%2C4184%2C9%2C10%2C17%2C20%2C2310%2C2351%2C2526%2C2527%2C2761%2C2763%2C2764%2C2765%2C3044%2C3154%2C3684%2C4184%2C7035%2C7327%2C7789%2C7%2C8%2C9%2C10%2C915%2C874%2C835%2C17%2C19%2C20%2C2310%2C2351%2C2526%2C2527%2C2610%2C2688%2C2761%2C2763%2C2764%2C2765%2C3044%2C3045%2C3154%2C3684%2C4184%2C4276%2C7035%2C7327%2C7330%2C7789%2C7%2C8%2C9%2C10%2C916%2C915%2C874%2C835%2C17%2C18%2C19%2C20%2C1428%2C2310%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C2764%2C2765%2C3044%2C3045%2C3052%2C3053%2C3154%2C3684%2C3856%2C4184%2C4276%2C7035%2C7327%2C7330%2C7331%2C7789%2C7%2C8%2C9%2C10%2C916%2C915%2C874%2C835%2C17%2C18%2C19%2C20%2C1428%2C2310%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C2764%2C2765%2C3044%2C3045%2C3052%2C3053%2C3154%2C3684%2C3856%2C4184%2C4276%2C7035%2C7327%2C7330%2C7331%2C7789%2C7%2C8%2C9%2C10%2C916%2C915%2C874%2C835%2C17%2C18%2C19%2C20%2C1428%2C2310%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C2764%2C2765%2C3044%2C3045%2C3052%2C3053%2C3154%2C3684%2C3856%2C4184%2C4276%2C7035%2C7327%2C7330%2C7331%2C7789%2C7%2C8%2C9%2C10%2C916%2C915%2C874%2C835%2C17%2C18%2C19%2C20%2C1428%2C2310%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C2764%2C2765%2C3044%2C3045%2C3052%2C3053%2C3154%2C3684%2C3856%2C4184%2C4276%2C7035%2C7327%2C7330%2C7331%2C7789%2C7%2C8%2C9%2C10%2C916%2C915%2C874%2C835%26osb%3DLinux%252FChrome%26lb%3D0%26reqt%3D1762685593698%26adxf%3D1%26ss38%3D1%26ss9%3D1%26nocompoverride%3D1&cust_params=li-module-enabled%3Dt1&adks=4079446691&frm=20&eo_id_str=ID%3Dd758a0372e0d617e%3AT%3D1762685587%3ART%3D1762685587%3AS%3DAA-AfjbrkAa_d6zy1Ty3ihSBvc1X&pbbce=1&td=1&egid=3721&tan=5e3107b9-1e1c-45dc-be13-7701b2f8f5a8&tdf=2
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511040101/pubads_impl.js?cb=31095648
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c21::9b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
840942a33374ee42434666e7dafe625d2702b4c0cc23f901f48c31b9db39c953
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

content-encoding
dcb
google-lineitem-id
-2
observe-browsing-topics
?1
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sun, 09 Nov 2025 10:53:14 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-2
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
161
x-xss-protection
0
server
cafe
ad_impression
pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ 		60 B
336 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ad_impression
Requested by
Host: script-api.ccgateway.net
URL: https://script-api.ccgateway.net/script/bundle?id=www.mediafire.com&parentId=0dae949f4b
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.210.204.30 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-210-204-30.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
715199235705aaa7c6781030dac85b766262d77ec7c07aac6f4928f464d93583

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type
application/json
Referer
https://www.mediafire.com/

Response headers

access-control-allow-origin
https://www.mediafire.com
content-length
60
date
Sun, 09 Nov 2025 10:53:14 GMT
content-type
application/json; charset=utf-8
vary
Origin
access-control-allow-credentials
true
log
translate.googleapis.com/element/ 		131 B
151 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://translate.googleapis.com/element/log?format=json&hasfast=true&authuser=0
Requested by
Host: translate.googleapis.com
URL: https://translate.googleapis.com/_/translate_http/_/js/k=translate_http.tr.en_US.xPuPSiyNUy0.O/am=AAAQ/d=1/exm=el_conf/ed=1/rs=AN8SPfodCXDLj_Grv-NAABawhDfbD7sLJg/m=el_main
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c21::5f Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Playlog /
Resource Hash
502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.mediafire.com/
Content-Encoding
gzip
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type
application/binary
X-Goog-AuthUser
0

Response headers

x-frame-options
SAMEORIGIN
content-encoding
gzip
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
131
date
Sun, 09 Nov 2025 10:53:16 GMT
x-xss-protection
0
content-type
text/plain; charset=UTF-8
server
Playlog
access-control-allow-headers
X-Playlog-Web
log
translate.googleapis.com/element/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://translate.googleapis.com/element/log?format=json&hasfast=true&authuser=0
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c21::5f Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Playlog /
Resource Hash
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept
*/*
Access-Control-Request-Headers
content-encoding,content-type,x-goog-authuser
Access-Control-Request-Method
POST
Origin
https://www.mediafire.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
X-Playlog-Web,authorization,content-encoding,content-type,x-goog-authuser,origin
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
https://www.mediafire.com
access-control-max-age
86400
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
content-type
text/plain; charset=UTF-8
date
Sun, 09 Nov 2025 10:53:16 GMT
server
Playlog
x-frame-options
SAMEORIGIN
x-xss-protection
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
www.google.com
URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaSb1ePKsIroe1snM0KSDda7yWkzDXlSevFrpsIRUfTkvCGwcicVe61BWYYhlmyxak_pe2focDuIoCHQIuV8qBPssNEWHg

Verdicts & Comments Add Verdict or Comment

512 JavaScript Window variables

These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| 6 object| 7 object| 8 object| 9 object| 10 object| 11 boolean| displayAds function| __tcfapi object| ezTcfConsent object| ezCMPQueue function| __setCMPv2RequestData function| __getCMPv2InitialSelectedLanguage function| setupEzTcfApi function| _emitEzConsentEvent object| _CMPv2RequestData object| ezstandalone object| googletag string| sAdSupplier string| sStartSrc object| adLazyLoadQueue function| fLoadGoogleAds function| checkEzoicSplitResult function| gtag object| dataLayer object| amp object| amplitude function| initDownload function| countDown function| upgradeToUltra object| sticky object| compatSelect object| compat object| nonCompat function| googFooterTranslate function| isInRect function| getDownloadUrl object| allowed object| el function| rAb function| InfCustomFPSTAMobileFunc function| InfCustomSTAMobileFunc function| InfCustomFPSTAFunc function| InfCustomerCallback function| InfPreFastPopAttachCallback function| InfSkipBindDocumentClick function| InfMediafireMobileFunc number| iAdCountInterval function| acceptCookieFooter function| reloadPage function| noop function| ClearStatusMessages function| setCookieSeconds function| Re function| aU function| setCookie function| getCookie function| loadHotjar function| registerGoogleLang function| trackDownloadEvent function| closeStatusMessage function| showStatusMessage object| upgradeWidget function| downloadOptIn function| showTDOptInDialog function| closeMobileTD function| trackTurboDownload function| showDesktopDownloadArrow function| hideDesktopDownloadArrow function| onLegacyCopyLink function| openShareDialog function| saveToMyfiles function| copyShareLink function| startLazyLoad function| InfPreInterstitialProcessCallback function| InfClickEventCallback function| InfCustomerPopLoadedCallback function| MfUpdateCheckoutSource object| storedData object| __cfBeacon object| __AMPLITUDE__ object| __bt_edge_data object| __bt object| __bt_intrnl boolean| __bt_already_invoked object| __bt_tag_d function| _DumpException object| default_tr object| _F_toggles_default_tr string| MSG_TRANSLATE string| MSG_CANCEL string| MSG_CLOSE function| MSGFUNC_PAGE_TRANSLATED_TO function| MSGFUNC_TRANSLATED_TO string| MSG_GENERAL_ERROR string| MSG_LEARN_MORE function| MSGFUNC_POWERED_BY string| MSG_TRANSLATE_PRODUCT_NAME string| MSG_TRANSLATION_IN_PROGRESS function| MSGFUNC_TRANSLATE_PAGE_TO function| MSGFUNC_VIEW_PAGE_IN string| MSG_RESTORE string| MSG_SSL_INFO_LOCAL_FILE string| MSG_SSL_INFO_SECURE_PAGE string| MSG_SSL_INFO_INTRANET_PAGE string| MSG_SELECT_LANGUAGE function| MSGFUNC_TURN_OFF_TRANSLATION function| MSGFUNC_TURN_OFF_FOR string| MSG_ALWAYS_HIDE_AUTO_POPUP_BANNER string| MSG_ORIGINAL_TEXT string| MSG_FILL_SUGGESTION string| MSG_SUBMIT_SUGGESTION string| MSG_SHOW_TRANSLATE_ALL string| MSG_SHOW_RESTORE_ALL string| MSG_SHOW_CANCEL_ALL string| MSG_TRANSLATE_TO_MY_LANGUAGE function| MSGFUNC_TRANSLATE_EVERYTHING_TO string| MSG_SHOW_ORIGINAL_LANGUAGES string| MSG_OPTIONS string| MSG_TURN_OFF_TRANSLATION_FOR_THIS_SITE string| MSG_ALT_SUGGESTION string| MSG_ALT_ACTIVITY_HELPER_TEXT string| MSG_USE_ALTERNATIVES string| MSG_DRAG_TIP string| MSG_CLICK_FOR_ALT string| MSG_DRAG_INSTUCTIONS string| MSG_SUGGESTION_SUBMITTED string| MSG_MANAGE_TRANSLATION_FOR_THIS_SITE string| MSG_ALT_AND_CONTRIBUTE_ACTIVITY_HELPER_TEXT string| MSG_ORIGINAL_TEXT_NO_COLON string| MSG_LANGUAGE_UNSUPPORTED string| MSG_LANGUAGE_TRANSLATE_WIDGET string| MSG_RATE_THIS_TRANSLATION string| MSG_FEEDBACK_USAGE_FOR_IMPROVEMENT string| MSG_FEEDBACK_SATISFIED_LABEL string| MSG_FEEDBACK_DISSATISFIED_LABEL string| MSG_TRANSLATION_NO_COLON function| _exportVersion function| _getCallbackFunction function| _exportMessages function| _loadJs function| _loadCss function| _isNS function| _setupNS object| google object| google_tag_manager object| google_tag_data string| GoogleAnalyticsObject function| ga object| regeneratorRuntime object| _ez boolean| _ez_sa string| ezAnalyticsDefine string| ezStandaloneCookies object| __ez object| _ezaq number| did string| ezoTemplate function| create_ezolpl function| attach_ezolpl string| __ezScriptHost string| ezdomain boolean| userInEzoicSample boolean| bEzoicSelected object| g367CB268B1094004A3689751E7AC568F function| UAParser function| onYouTubeIframeAPIReady object| gaGlobal object| closure_lm_786589 function| ezUnion string| ezStandaloneDefine string| ezStandaloneDisplay object| ezSelectedPlaceholders object| ezSelectedPlaceholdersMap number| ezDisplayAdMax string| __sellerid string| __ez_nid string| __ez_gcb object| ez_ad_units object| ezslots object| ezrpos object| ezsrqt boolean| __ez_fad_haspo boolean| __ez_fad_hascp object| __ez_fad_po function| __ez_fad_position function| ezSetTargetingFromMap function| ezSetSlotTargeting function| ezGetSlotById function| __ez_close_anchor function| __ez_hb_render function| ezjsps object| epbjs object| __s2sbidders object| __s2sinstreambidders object| __s2soutstreambidders object| __allBidders object| __allSiteApprovedBidders object| __ezExtraAuctionExcludedBidders string| ez__id5pd string| ez__uIdHash string| ez__sspDomain object| __advertiserRule function| ezLiveIntentQueuedFunc object| ezoibfh object| ezaxmns object| ezaucmns object| __ez_fad_floating function| __ez_init_slot object| ezslot_8_raw object| ezslot_0_raw object| ezslot_4_raw object| ezslot_3_raw object| ezslot_7_raw object| ezslot_5_raw object| ezslot_6_raw object| ezslot_1_raw object| ezslot_2_raw object| ezasVars object| divNode object| __banger_pmp_deals object| _ezim_d object| ezS number| __ez_edge_mw string| __ez_edge_v string| __ez_edge_h object| ezslots_raw object| ezslotdivs boolean| ezhbopt function| __ez_get_largest_ad_size object| __ezLiveIntent function| ezogetbrkey string| gamAnchorPosition string| ezoadxnc string| ezoadhb function| handleResponsiveAdsense object| google_reactive_ads_global_state boolean| ezasLoaded function| ezasBuild function| ezasvEvent function| ezaslEvent function| ezoAdBackFill object| ezaslWatch object| ezoSTPixels function| ezoSTPixelAdd function| ezoGetSlotById function| ezoGetSlotNum function| ezoSTPixelFire object| __ezAdRewardTranslations object| gaplugins object| gaData object| ezoicIdentity object| __ezAmazonPublisherAudience object| __ezOptable object| __ezDataCollector boolean| liModuleEnabled function| __ezDotData function| visbilityChangeFunc object| EzoicQubit object| __ezct object| ezdent object| ezDenty function| ez_attachEvent function| ez_attachEventWithCapture function| ez_detachEvent function| ez_getQueryString object| _ezfd function| sidebarWall function| __ez_close_rail function| __ez_handle_rail_loaded object| __ezsbwcmd function| ezoChar function| ezoCharIsEmpty function| ezoCharSize object| PrebidImpressionController function| PrebidImpression string| ezoScriptHost object| IL11ILILIIlLLLILILLLLIILLLIIL11111LLILiiLIliLlILlLiiLLIiILL number| ezobv function| ezoSyncToDfp function| ezoGetDFPSlot object| ezomash boolean| ezowwinit function| ezbanger function| ezvt function| ezvb function| ezsr function| ezosethbbid function| ezosetowbids function| ezosethbbids function| ezGetSlotViewedTime function| isEzoicAccount function| isEzoicAccountSet function| formatBid function| formatBidTen function| fetchezoibfh function| adjustHbValues object| ezGAMRefreshQueue function| ezorefgsl object| magnite object| ezoptbid function| getSlotForhb function| epbjsRequestAdUnits function| epbjsBidRequest function| epbjsApplyResponsiveSizes function| epbjsRefreshSlot function| setAuctionActive function| setAuctionFinished function| isValid256Hash function| __ez_fad_pb object| featureMap object| liQd object| liQHub object| liQd_did_006t object| __id5_finalization_registry object| ID5 object| ezoic_mash object| epbjsChunk object| _pbjsGlobals object| mnet object| D9v object| D9r object| liQ_instances object| id5_pbjs_et object| pbjs function| getEzConsentData string| _audins_dom number| _audins_did function| _setEzCookies function| addEzCookies object| ezCookieQueue object| _ccScriptSettings object| _ccLauncherSettings object| ccao object| cca object| _ccReady object| _ccApiReady object| carbonApi object| carbon object| ggeac object| google_js_reporting_queue object| id5Prebid function| reportEzError function| reportEzReqError object| ezoicEvent function| initEzux object| riveted object| ezux object| metricNameMap function| ezlogVital object| webVitals string| send object| d9PendingXDR object| firedEvents object| ezslot_0 object| ezslot_5 object| ezslot_6 object| ezslot_4 object| ezslot_3 object| ezslot_7 object| google_tag_topics_state number| google_unique_id function| privacyCallback object| ox_esp function| lotameIsCompatible function| sync16589_aa function| sync16589_c function| sync16589_f object| sync16589_h function| sync16589_ca function| sync16589_j function| sync16589_da object| sync16589_ object| sync16589_ka object| sync16589_la object| sync16589_q object| sync16589_ya function| sync16589_a function| sync16589_b function| sync16589_g function| sync16589_i function| sync16589_k function| sync16589_l function| sync16589_ea function| sync16589_m function| sync16589_fa function| sync16589_n function| sync16589_o function| sync16589_p function| sync16589_ha function| sync16589_ga function| sync16589_ia function| sync16589_ja function| sync16589_r function| sync16589_t function| sync16589_u function| sync16589_v function| sync16589_ma function| sync16589_na function| sync16589_w function| sync16589_oa function| sync16589_x function| sync16589_y function| sync16589_s function| sync16589_A function| sync16589_pa function| sync16589_qa function| sync16589_ra function| sync16589_B function| sync16589_C function| sync16589_D function| sync16589_sa function| sync16589_E function| sync16589_F function| sync16589_G function| sync16589_I function| sync16589_K function| sync16589_J function| sync16589_L function| sync16589_M function| sync16589_H function| sync16589_ta function| sync16589_ua function| sync16589_va function| sync16589_wa function| sync16589_xa function| sync16589_N function| sync16589_O function| sync16589_za function| sync16589_P function| sync16589_Aa function| sync16589_Ba function| sync16589_Ca function| sync16589_Q function| sync16589_Da function| sync16589_Ea function| sync16589_Fa function| sync16589_Ga function| sync16589_R function| sync16589_Ha function| sync16589_S function| sync16589_T function| sync16589_U function| sync16589_V function| sync16589_Ia function| sync16589_W function| sync16589_X function| sync16589_Y function| sync16589_Z function| sync16589__ function| sync16589_0 function| sync16589_1 function| sync16589_Ja function| sync16589_2 function| sync16589_La function| sync16589_Ka function| sync16589_3 function| sync16589_Na function| sync16589_Oa function| sync16589_Ma function| sync16589_Pa function| sync16589_Sa function| sync16589_Ra function| sync16589_Qa function| sync16589_Ua function| sync16589_Wa function| sync16589_Ta function| sync16589_5 function| sync16589_Va function| sync16589_Za function| sync16589_Ya function| sync16589_Xa function| sync16589_6 function| sync16589_4 function| sync16589_7 function| sync16589_8 function| sync16589__a function| sync16589_0a function| sync16589_1a function| sync16589_2a function| sync16589_9 function| sync16589_3a function| sync16589_$ function| sync16589_4a function| sync16589_5a function| sync16589_6a object| lotame_sync_16589 object| carbonReady string| _carbonUID object| carbonUIDCache object| signal_decrypted object| criteo_syncframe_state object| criteo_pubtag object| criteo_identitytag_163 object| Criteo object| Criteo_identitytag_163 object| _ccSettings object| ccRefresh function| slotElementAttachClick function| buildGtmEventData object| ezRewardedAds object| perf_vals object| GoogleGcLKhOms object| google_image_requests object| _qevents function| quantserve function| __qc

164 Cookies

Domain/Path Name / Value
www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip Name: g36FastPopSessionRequestNumber
Value: 1
www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip Name: ezux_lpl_484470
Value: 1762685587883|8283df6b-f4c3-4705-4669-ae069d51c62b|false
i.liadm.com/s Name: _li_ss
Value: CgA
.ccgateway.net/1 Name: ccuid
Value: 2effe826-50c4-4444-b4ce-968a3ec91570
.ccgateway.net/1 Name: ccsid
Value: ed33fc7e-3730-4a52-8fdb-8c6f02dab56d
.liadm.com/j Name: lidid
Value: 77db64e2-6619-438d-a94c-4b8b1a154743
.mediafire.com/ Name: ukey
Value: z60vtdahz6c52mbxmg45r1iwcgwmbrq9
.mediafire.com/ Name: zhef
Value: 1
.mediafire.com/ Name: conv_tracking_data-2
Value: %7B%22mf_source%22%3A%22regular_download-59%22%2C%22mf_content%22%3A%22Free%22%2C%22mf_medium%22%3A%22linux%5C%2FChrome%22%2C%22mf_campaign%22%3A%22zh1io5g5cavqo7l%22%2C%22mf_term%22%3A%22706889a766a2be0bb3f96eec13971f40%22%7D
.mediafire.com/ Name: __cf_bm
Value: VcSHjQl1zroSmYjeBbGxl3KipKk5qtRksIwKxsm8tg0-1762685584-1.0.1.1-GfZjyC10.RjXOBBDfBPNxZNtVDTMbInQmmhPe2gj.O70L_64vM3iPDzGZZmx8WlmxPFOT5EJpSgICSMpAfML3cLveHNMs6tSwEIp67LcFgg
www.mediafire.com/ Name: chkout_src
Value: eyJ0ZW1wbGF0ZUlkIjoiNTkifQ%3D%3D
.mediafire.com/ Name: amp_28916b
Value: c_aBGoEDDtr6qUEdsMxInb...1j9k3v1tp.1j9k3v1tr.0.1.1
.mediafire.com/ Name: cf_clearance
Value: CvJXX39pk3_O5Y.3WyTAdKaprkgHdyd4JXVWhHQCgAA-1762685585-1.2.1.1-SUHSXvcRRSbjPzoN2.pN9hL6xYX11HnYGpmDOaBqYzv7veRg04Zfp4ZLh.NFwbERBbPhoO7BU2F9WaEu0Le6AjVle1ovLumwq4fTKxXG6gzX6f__MCx2gKeKBri5NtkK9hzMgqWMfSE8326AsTG6U17hCgK6s9jnRhEyYUQA4XIOQ.F0fZVsV5isjDNWrecf90gm7z1ZhFZlh46oNhP5ZA3I9KB2iDKMN.sDpjsgKb0
.mediafire.com/ Name: ezovuuidtime_484470
Value: 1762685585
.mediafire.com/ Name: ezovuuid_484470
Value: edd4dfa8-0e02-45c2-7a14-b54dac8ee071
.mediafire.com/ Name: ezoref_484470
Value:
www.mediafire.com/ Name: ezstandaloneuser
Value: true
econventa.com/ Name: IKSR
Value: %7B%7D
econventa.com/ Name: INF_DFL8
Value: false
econventa.com/ Name: IUID
Value: 0371a208-538d-430e-b5eb-4582e657dd9c
econventa.com/ Name: ISSH
Value: 7F40ED
econventa.com/ Name: VMI
Value:
econventa.com/ Name: IPLH
Value: %23%7B%7D
econventa.com/ Name: IPLH_Q
Value: %23%5B%5D
econventa.com/ Name: CHN
Value: %23%5B%5D
econventa.com/ Name: MSSH
Value: %23%7B%7D
econventa.com/ Name: MSRH
Value: %23%7B%7D
econventa.com/ Name: ILP
Value: null
econventa.com/ Name: ILPLU
Value: %2301%2F01%2F0001%2000%3A00%3A00
econventa.com/ Name: ILEALC
Value: %2301%2F01%2F0001%2000%3A00%3A00
econventa.com/ Name: ILMPF
Value: %23False
econventa.com/ Name: IPMPLU
Value: %2301%2F01%2F0001%2000%3A00%3A00
econventa.com/ Name: IPMUID
Value: %23
econventa.com/ Name: BSWUID
Value: %23
econventa.com/ Name: IBL
Value: %23%5B%5D
econventa.com/ Name: IOPT
Value: %23%5B%5D
econventa.com/ Name: IPLSH
Value: %23%7B%7D
econventa.com/ Name: IPLSH_Q
Value: %23%5B%5D
econventa.com/ Name: IZH
Value: %23%7B%7D
econventa.com/ Name: IZH_Q
Value: %23%5B%5D
econventa.com/ Name: IMCH
Value: %23%7B%7D
econventa.com/ Name: IMCH_Q
Value: %23%5B%5D
econventa.com/ Name: IMH
Value: %23%7B%7D
econventa.com/ Name: IMH_Q
Value: %23%5B%5D
econventa.com/ Name: ISH
Value: %23%7B%22101%22%3A%5B%7B%22SId%22%3A%227F40ED%22%2C%22D%22%3A%2225%2F11%2F9T10%3A53%3A6%22%7D%5D%7D
econventa.com/ Name: ISH_Q
Value: %23%5B101%5D
econventa.com/ Name: ISPH
Value: %23%7B%7D
econventa.com/ Name: ISPH_Q
Value: %23%5B%5D
econventa.com/ Name: ICH
Value: %23%7B%7D
econventa.com/ Name: ICH_Q
Value: %23%5B%5D
.mediafire.com/ Name: active_template::484470
Value: pub_site.1762685586
.mediafire.com/ Name: ezopvc_484470
Value: 2
.mediafire.com/ Name: _ga
Value: GA1.2.1178700374.1762685586
.mediafire.com/ Name: _gid
Value: GA1.2.1880632345.1762685586
.mediafire.com/ Name: _gat_gtag_UA_829541_1
Value: 1
www.mediafire.com/ Name: _li_opt_cntrl_split
Value: liveintent
www.mediafire.com/ Name: _ezli_enabled
Value: true
.mediafire.com/ Name: _li_dcdm_c
Value: .mediafire.com
.mediafire.com/ Name: _lc2_fpi
Value: a738c2fb6c00--01k9m3z368kp41czwphh8wkwmd
.mediafire.com/ Name: _lc2_fpi_js
Value: a738c2fb6c00--01k9m3z368kp41czwphh8wkwmd
.mediafire.com/ Name: _sharedid
Value: de6d2af6-b05a-4ee9-a77e-c734026ff49c
.mediafire.com/ Name: _sharedid_cst
Value: SBp4Zg%3D%3D
www.mediafire.com/ Name: _lr_retry_request
Value: true
www.mediafire.com/ Name: _lr_env_src_ats
Value: false
.mediafire.com/ Name: _lc2_fpi_meta
Value: %7B%22w%22%3A1762685586958%7D
.mediafire.com/ Name: lp_484470
Value: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%27s_bot.zip/file
www.mediafire.com/ Name: ezds
Value: ffid%3D1%2Cw%3D1600%2Ch%3D1200
www.mediafire.com/ Name: ezohw
Value: w%3D1600%2Ch%3D1200
.a-mx.com/ Name: amdt_t
Value: g::1762685587076
.a-mx.com/ Name: amuid2
Value: 1776ef42-7a13-465b-8e3b-9082f65aba5b
.a-mx.com/ Name: pamdt_t
Value: g::1762685587076
.a-mx.com/ Name: pamuid2
Value: 1776ef42-7a13-465b-8e3b-9082f65aba5b
.adsrvr.org/ Name: TDID
Value: c485f9f6-2d7e-4627-890d-a71acdf647ae
.yahoo.com/ Name: A3
Value: d=AQABBJNyEGkCEH4GEM7Y6XMsyU5X0f6NQwMFEgEBAQHEEWkaadxH0iMA_eMCAA&S=AQAAAjq0DxXWD6lo10RJqURl1NQ
.mediafire.com/ Name: 33acrossId_cst
Value: SBp4Zg%3D%3D
www.mediafire.com/ Name: pbjs-unifiedid
Value: %7B%22TDID%22%3A%22c485f9f6-2d7e-4627-890d-a71acdf647ae%22%2C%22TDID_LOOKUP%22%3A%22FALSE%22%2C%22TDID_CREATED_AT%22%3A%222025-11-09T10%3A53%3A07%22%7D
www.mediafire.com/ Name: pbjs-unifiedid_cst
Value: SBp4Zg%3D%3D
.crwdcntrl.net/ Name: _cc_dc
Value: 0
.crwdcntrl.net/ Name: _cc_id
Value: de86b760d8c7659bcb1857fdb55b79eb
.crwdcntrl.net/ Name: _cc_cc
Value: "ACZ4nGNQSEm1MEsyNzNIsUg2NzO1TEpOMrQwNU9LSTI1TTK3TE1iAIJMgaLJDAgAAGA3Cto%3D"
.crwdcntrl.net/ Name: _cc_aud
Value: "ABR4nGNgYGDIFCiazAAHABJJAX8%3D"
.mediafire.com/ Name: panoramaId_expiry
Value: 1763290387102
.mediafire.com/ Name: _cc_id
Value: de86b760d8c7659bcb1857fdb55b79eb
.mediafire.com/ Name: panoramaId
Value: d2e75b8e492e743004ed0dbc6c04185ca02cc51e4da1643bb064774fbc94b7db
.liadm.com/ Name: lidid
Value: 77db64e2-6619-438d-a94c-4b8b1a154743
www.mediafire.com/ Name: pbjs_li_nonid
Value: %7B%7D
www.mediafire.com/ Name: pbjs_li_nonid_cst
Value: SBp4Zg%3D%3D
.mediafire.com/ Name: _li_ss
Value: CgA
.flashtalking.com/ Name: _D9J
Value: 4778d4a877e44015b9ab3e4f6ff409c7
www.mediafire.com/ Name: ezppid_ck
Value: 3b25ce83c75aeff52ef9657aec7de9f7
.a-mo.net/ Name: amdt_t
Value: p::1762685587331
.a-mo.net/ Name: amuid2
Value: 1776ef42-7a13-465b-8e3b-9082f65aba5b
.a-mo.net/ Name: pamdt_t
Value: p::1762685587331
.a-mo.net/ Name: pamuid2
Value: 1776ef42-7a13-465b-8e3b-9082f65aba5b
.ccgateway.net/ Name: ccuid
Value: 2effe826-50c4-4444-b4ce-968a3ec91570
.ccgateway.net/ Name: ccsid
Value: ed33fc7e-3730-4a52-8fdb-8c6f02dab56d
.openx.net/ Name: i
Value: 470c72df-c134-42f2-9c76-c76ec52fbf26|1762685587
.criteo.com/ Name: uid
Value: cba929f6-04ca-4b00-a349-fbf3c575ffa3
.mediafire.com/ Name: __gads
Value: ID=710d595ddee055b4:T=1762685587:RT=1762685587:S=ALNI_MZJGZDvti4dTz_nkocz4FF59h3kSg
.mediafire.com/ Name: __gpi
Value: UID=0000130a10d732ad:T=1762685587:RT=1762685587:S=ALNI_MaUVZBE6m9Fvpz6Zk1r3wnftELu7g
.mediafire.com/ Name: __eoi
Value: ID=d758a0372e0d617e:T=1762685587:RT=1762685587:S=AA-AfjbrkAa_d6zy1Ty3ihSBvc1X
.openx.net/ Name: pd
Value: v2|1762685588|gyvMkWgahE
.turn.com/ Name: uid
Value: 3112035968479487874
.doubleclick.net/ Name: IDE
Value: AHWqTUmwvBbDQdRnMHS-0dXXeOKl2R6T4pCWLJld-6toiII2bRNjdc5Muh8XUnSjt2E
.mediafire.com/ Name: connectId
Value: %7B%22ttl%22%3A86400000%2C%22lastUsed%22%3A1762685588959%2C%22lastSynced%22%3A1762685587668%7D
.id5-sync.com/ Name: id5
Value: 07f10cb4-1880-73a7-9250-2078c4de3117#1762685587360#4
.mediafire.com/ Name: 33acrossIdTp
Value: r48pYusSkiZU7Z4wmjtU%2FlqlgI7GUyl56G2Le%2FTCVGE%3D
.mediafire.com/ Name: 33acrossId
Value: v1.0010b00002MpnPqAAJ.1047.Flhg4cDCIxBOAb9MutOYlutvavtrU414Pr5xwvEoGL90zE0JlUiuf8pTyWc%2FHU%2FTS2ZRpI6JDig7CCg2cLeTjIkW6ZDbGh38VDKrO8Ea5tpdPdcbfkkGJ27JkLR%2BQenurk%2BRSgxVOWkhlJraTZFkZkyiZxbZjelERbEJYZ5Ia1Vgvf%2BLEHzLZyR%2B5qSdueIBogMhkIPegGUcRJtw3u7IGG5KMOdcbf10vSxCo83QMJx6FUTgpzBU0zaqJYTzy0AksHMb7jDxt9U2DnIbtNZeQl4%2FQcTXGC%2FN5XOClASWJuUDTouv8lFEpnliOLHQjmIZFoha1hhYnuYlOsyWDY3y7viXExcsOd%2FWd9Cng1YtMduGNhzdwWfeWkeZvXaaxGe5R4NfPg1dcTRyQIXCPR1MjjKSViX23I0qiQhvS6TWkem%2B4xIE1nuPpf3mtVwzR9G6A8dE2Ue8IWvE7xABDu9SZ0aZEM6z3t4kMFPjLalk33fJMbv6pytvs4G29jP6bLgmo5OdOC3n8hgakDsUaOzwovMW6o7Bky7ltvvPTYVDJewkJcTtU0w3909LRF7IkzduJ5ZXYo%2BoQQmuc3OuoUi2MGz6vh9bxv%2FyzfoOlK5gE4wgcfnX7WOTftC%2F7XW%2F1RotyjaDUsDUcBT45648eOeZX7aWn1wrzow3f0G2%2BGk0MGY8YrmByC81DXJXbPbwZ8cJom2doNPZOYNv9yfsUxmjUdLF5L47hJn8d6FIjK0%2B02yEZK%2FlXE0XpIH60wm6Xk05Nv4c97bMPXYvhnY9JTP6hfO3gpVUJ6nwejZcKXnrI7aXONwBMc%2B4nS6hmokAFWMHN3SXVKUQK%2FZ3yxdAYt2n4uAIfyhFe%2FJuMiy2QXyfahcxib90IVP0m5LWGOpjkvi%2Bq%2B61hNfSfuhv4UqTT%2FIRRfHe6bUh1iVbamGpG4eeF%2BJCGEm5KUM7wffbedIQ6%2BLlvLZX4lAzO%2FPOuhZEl8JlL3kI5Id9VZkkMRzGxnh%2Boylt%2ByYzhPB76w%2BJwK0HJU9WNmAeHwSVCMOrJncZs4E%2FebPVhEnbvjM4Rut5UtZhK4kWjqJwbYgXnMEpknF8K0Wm7mNxBuwwa%2F3gbTPYGfLw8BT9rkdhsOWTqAgtqf4INgrVTaW7d%2BGBNK7NYxL75EGmC1OAguz4epV9qHbLs2XY5%2B44Jl%2Bf2Vj%2FuOSn1GVcjzB2mtctXi%2BbMfHxPTzAxA2fcY5Fq%2FYIb3FXbX5DYWiI1xX%2B%2FhinyTEGcwvo7Z9X9hJj6onWDySg0sRBTqHIg3tLQxXZgEGz2YVjK%2BAln8ZjrL%2BuWitGOpbpmDBXh9JUHx0GakZQ1fOUB6moccWXsUqCovSDuG0C5IdUaTF5CBB7GFYaD%2FpX%2FP0vC6oCatf4vRqPXkNtszRbZZQxGhLe1Z2QZbSt1fQ%2FxMc8nbgv8KXb779UlCdiZ0kG7PaHFNt3ybXDhWFYXrIMJw1BSUVnAcJz7WOoneOfJiK7UMEsCDmkCKACUbZtVragdGWYERDuI%2Fc%3D
.mediafire.com/ Name: 33acrossId_last
Value: Sun%2C%2009%20Nov%202025%2010%3A53%3A09%20GMT
.360yield.com/ Name: tuuid
Value: c707a058-2136-4f29-b1c4-083fa08a881b
.360yield.com/ Name: tuuid_lu
Value: 1762685589
.mediafire.com/ Name: cto_bundle
Value: r2bPHF9DZ0VsM281Zmp6WVNtMWNra3FxbWJHQkRmSmFsZnNoNmJybnUlMkJWYSUyQnpDNWNUNFdmUWpLdmhQbXRQOGZYUTBUVEJ5UGN1MHFmeTZxaWdnYmhhNVExN1lodzlBWTQwQkFPWUcxdVFzQk9kTUN1OE9wMkpoaUNrYUZtQ2F6aiUyQmNGTyUyRnZoeVgzb05qeGY0UXhZTkl6MWRBQSUzRCUzRA
.mediafire.com/ Name: cto_bidid
Value: 7DO1Gl9BQWlFMHJ2Z2dPRzFtWnZTWjZYc3ZKa1VsM0dFcmE2T1F6ZHprZWxnVDMzZHE0QkZkSDNNbUdxZ21rMDJBQm1wWjVmU2pWbFlVdVlBMFo0NVdrMFlKVlo1WmZVR0xFJTJGdVE1WUF4aEpEbjBzJTNE
.gumgum.com/ Name: vst
Value: u_d05d49cb-e2eb-4f7c-9240-19b8f0fc7950
.360yield.com/ Name: um
Value: !313,lnsK2sKNze3A0cKUBB3-dXfAbW-H6jAA4n0JFDJBh2WMexpNzCa.fQ469lCIcVkDpo5AaJG9KDiMm2ddT1xZa6netBO-71cwHxeD9ZxLERFhOpzN,1770461589
.360yield.com/ Name: umeh
Value: !313,0,1824893589,-1
.tapad.com/ Name: TapAd_TS
Value: 1762685589465
.tapad.com/ Name: TapAd_DID
Value: 902b7e08-fa5e-4445-8e77-e3a6b377c57e
.tapad.com/ Name: TapAd_3WAY_SYNCS
Value:
.adnxs.com/ Name: XANDR_PANID
Value: RvQ24D4wjmoV6q538IyYffu4F16yrg2PKl0myHxJ9MlTOy-P7imdXkdMGHSZl8Uc71z6OvQ_CSF8yci6YL52hACj_w6tjKihXb5htJPxTv8.
.adnxs.com/ Name: uuid2
Value: 8235546582011012259
.adsrvr.org/ Name: TDCPM
Value: CAEYASABKAIyCwim0NHznOLPPhAFOAFaBzhoOXUxMWhgAg..
.csync.loopme.me/ Name: viewer_token
Value: 83649b06-be2d-403c-b81d-ec4595791399
.ipredictive.com/ Name: cu
Value: aecd7ee1-4168-4d56-868c-6e0a1600cece|1762685590988
.go.sonobi.com/ Name: __uis
Value: 01942e64-87c8-403a-b0dd-ae16eb00c547
.go.sonobi.com/ Name: HAPLB8G
Value: s8588|aRBym
.lijit.com/ Name: ljt_reader
Value: LpHtARZHbtwqUZ8wRKKKaTbn
.lijit.com/ Name: _ljtrtb_27
Value: c485f9f6-2d7e-4627-890d-a71acdf647ae
.pubmatic.com/ Name: KTPCACOOKIE
Value: YES
.pubmatic.com/ Name: KADUSERCOOKIE
Value: C1860927-6713-47E0-B05B-B74C5C3CA85E
www.mediafire.com/ Name: ezhbf
Value: 10
.mediafire.com/ Name: _ga_K68XP6D85D
Value: GS2.1.s1762685586$o1$g0$t1762685591$j60$l0$h0
.id5-sync.com/ Name: 3pi
Value: 2#1762685589734#-171716543|434#1762685591155#-1764431696|821#1762685590250#-1147403691|264#1762685590047#2101753505#c485f9f6-2d7e-4627-890d-a71acdf647ae|203#1762685590787#-227165330#cba929f6-04ca-4b00-a349-fbf3c575ffa3|124#1762685589364#-1590122968|108#1762685589901#1440782170|796#1762685591591#2117737713|1245#1762685591400#807540919|429#1762685591773#529337747#C1860927-6713-47E0-B05B-B74C5C3CA85E
.doubleclick.net/ Name: ar_debug
Value: 1
.casalemedia.com/ Name: CMID
Value: aRBymNHM56cAFDx0BU9sQQAA
.casalemedia.com/ Name: CMPS
Value: 5686
.casalemedia.com/ Name: CMPRO
Value: 5686
.contextweb.com/ Name: V
Value: LQ75WsR6ewyi
.contextweb.com/ Name: VP
Value: part_LQ75WsR6ewyi
.contextweb.com/ Name: pb_rtb_ev
Value: 3-21fh|7Bj.0.CAESEFQc3rKmeOSiWMR4HpR9XdQ
.contextweb.com/ Name: pb_rtb_ev_part
Value: 3-21fh|7Bj.0.CAESEFQc3rKmeOSiWMR4HpR9XdQ
bh.contextweb.com/ Name: INGRESSCOOKIE
Value: b2140e6606597fd1
.criteo.com/ Name: cto_bundle
Value: rl7JL19FbmFTdm5DVkYlMkZKNEQyeUlLd1BHNlFKVXRLR00lMkJ2aGdsYWZtYkpqZ092a3U5V1I2SjZUc3NscnBrMVUxbzQlMkIzVDZsVzBJTiUyRno1U0ZOU25NeXI3bkUwUXUzcHFIYU1GNGhLRGhpd1VZSkR1U2lHVkZYb3pMTWYzSFRKakhaU3F3ZVB1dlM1Uzl4enc1bTI3REZuQUFGQSUzRCUzRA
.bidswitch.net/ Name: tuuid
Value: 387be251-262f-4873-bab4-54d0c6659bcf
.bidswitch.net/ Name: c
Value: 1762685592
.bidswitch.net/ Name: tuuid_lu
Value: 1762685592
.linkedin.com/ Name: bcookie
Value: "v=2&23094be4-0619-4d73-89df-6c11a11123c3"
.linkedin.com/ Name: lidc
Value: "b=TGST00:s=T:r=T:a=T:p=T:g=3787:u=1:x=1:i=1762685592:t=1762771992:v=2:sig=AQFn_YJHOt5Tf-RxvoeyujCtnQG3sla-"
.yieldmo.com/ Name: yieldmo_id
Value: xFRJwzzTyJzfziJ8IYrX%7C1762646400000%7C0
.inmobi.com/ Name: TEST-COOKIE
Value: YES
.bidswitch.net/ Name: google_push
Value: AXcoOmQMyJ3Vmi6FPOjRuu0EsbOcaWtYIWRMekiv06TEqnGOdTLJolNBJ8JcEUtjhNuRvxYTfpASUDuz37FQQTMdJcsYFaGzZ7fWQ_bjh22r9SQCStU84fy-PKiKA9WjiZVaLKExUngHeahRBAdO4Zxg5A
.inmobi.com/ Name: iid
Value: ID5-3-caea8a85-d489-4907-aec9-5fd2f4a521ae
.inmobi.com/ Name: gob_cookie
Value: YES
.adnxs.com/ Name: anj
Value: dTM7k!M41.D>6NRF']wIg2GVH@>ePf!@wnfH8K6pQK`!5=E<*L5?%M9`obXPcvjgQ66.df4g>1(25FKfAGF1yO1$>x*bpRz*qF1`*b^4H)y.+F
.quantserve.com/ Name: mc
Value: 69107299-2486d-249ec-ec350
.quantserve.com/ Name: sp
Value: CgkI0aYCEgMQ2xA=
.mediafire.com/ Name: __qca
Value: P1-eeff3a0b-14d9-4358-9897-24ace771433a
.rlcdn.com/ Name: rlas3
Value: xldWv20eYwUbnfVwdN3aU4RhMenMBXbKGBZD+QDqCco=
.rlcdn.com/ Name: pxrc
Value: CJnlwcgGEgUI6AcQABIFCOhHEAA=
.pippio.com/ Name: did
Value: oJEjaMriaPt14Teu
.pippio.com/ Name: didts
Value: 1762685593
.pippio.com/ Name: nnls
Value:
.pippio.com/ Name: pxrc
Value: CJnlwcgGEgYIgr0rEAA=
.linkedin.com/ Name: li_sugr
Value: 9e57638b-1807-48ad-8c18-9b1a5c744ebf

46 Console Messages

Source Level URL
Text
security warning URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file(Line 1366)
Message:
document.domain mutation is ignored because the surrounding agent cluster is origin-keyed.
security warning
Message:
Error with Permissions-Policy header: Unrecognized feature: 'bluetooth'.
network error URL: https://www.mediafiredls.com/onclick/0
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://ups.analytics.yahoo.com/ups/58713/fed?v=1&1p=0&gdpr=0&gdpr_consent=&us_privacy=&url=https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file&pixelId=58713
Message:
Failed to load resource: the server responded with a status of 400 ()
other error URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Message:
Attestation check for Protected Audience on https://securepubads.g.doubleclick.net failed.
other error URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Message:
Attestation check for Protected Audience on https://securepubads.g.doubleclick.net failed.
other error URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Message:
Attestation check for Protected Audience on https://securepubads.g.doubleclick.net failed.
other error URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Message:
Attestation check for Protected Audience on https://securepubads.g.doubleclick.net failed.
other error URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Message:
Attestation check for Protected Audience on https://securepubads.g.doubleclick.net failed.
other error URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Message:
Attestation check for Protected Audience on https://securepubads.g.doubleclick.net failed.
other error URL: https://securepubads.g.doubleclick.net/static/topics/topics_frame.html
Message:
Attestation check for Shared Storage on https://securepubads.g.doubleclick.net failed.
network error URL: https://ups.analytics.yahoo.com/ups/58813/fed?gpp_sid=-1&gdpr=false&gdpr_consent=&v=1&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fzh1io5g5cavqo7l%2FRose%252527s_bot.zip%2Ffile
Message:
Failed to load resource: the server responded with a status of 400 ()
other error URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Message:
Attestation check for Protected Audience on https://securepubads.g.doubleclick.net failed.
other error URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Message:
Attestation check for Protected Audience on https://securepubads.g.doubleclick.net failed.
other error URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Message:
Attestation check for Protected Audience on https://securepubads.g.doubleclick.net failed.
other error URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Message:
Attestation check for Protected Audience on https://securepubads.g.doubleclick.net failed.
other error URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Message:
Attestation check for Protected Audience on https://securepubads.g.doubleclick.net failed.
other error URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Message:
Attestation check for Protected Audience on https://securepubads.g.doubleclick.net failed.
rendering warning URL: https://ep2.adtrafficquality.google/sodar/sodar2/237/runner.html
Message:
[GroupMarkerNotSet(crbug.com/242999)!:A0E01800D4110000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader (about:flags#enable-unsafe-swiftshader) flag to opt in to lower security guarantees for trusted content.
other error URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Message:
Attestation check for Protected Audience on https://securepubads.g.doubleclick.net failed.
other error URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Message:
Attestation check for Protected Audience on https://securepubads.g.doubleclick.net failed.
other error URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Message:
Attestation check for Protected Audience on https://securepubads.g.doubleclick.net failed.
other error URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Message:
Attestation check for Protected Audience on https://securepubads.g.doubleclick.net failed.
other error URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Message:
Attestation check for Protected Audience on https://securepubads.g.doubleclick.net failed.
other error URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Message:
Attestation check for Protected Audience on https://securepubads.g.doubleclick.net failed.
other error URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Message:
Attestation check for Protected Audience on https://securepubads.g.doubleclick.net failed.
other error URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Message:
Attestation check for Protected Audience on https://securepubads.g.doubleclick.net failed.
other error URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Message:
Attestation check for Protected Audience on https://securepubads.g.doubleclick.net failed.
other error URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Message:
Attestation check for Protected Audience on https://securepubads.g.doubleclick.net failed.
other error URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Message:
Attestation check for Protected Audience on https://securepubads.g.doubleclick.net failed.
other error URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Message:
Attestation check for Protected Audience on https://securepubads.g.doubleclick.net failed.
other error URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Message:
Attestation check for Protected Audience on https://securepubads.g.doubleclick.net failed.
other error URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Message:
Attestation check for Protected Audience on https://securepubads.g.doubleclick.net failed.
other error URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Message:
Attestation check for Protected Audience on https://securepubads.g.doubleclick.net failed.
other error URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Message:
Attestation check for Protected Audience on https://securepubads.g.doubleclick.net failed.
other error URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Message:
Attestation check for Protected Audience on https://securepubads.g.doubleclick.net failed.
other error URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Message:
Attestation check for Attribution Reporting on https://ad.doubleclick.net failed.
other error URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Message:
Attestation check for Attribution Reporting on https://ad.doubleclick.net failed.
rendering warning URL: https://ep2.adtrafficquality.google/sodar/Klz6NWr5.html
Message:
[GroupMarkerNotSet(crbug.com/242999)!:A0E01800D4110000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader (about:flags#enable-unsafe-swiftshader) flag to opt in to lower security guarantees for trusted content.
other error URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Message:
Attestation check for Protected Audience on https://securepubads.g.doubleclick.net failed.
other error URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Message:
Attestation check for Protected Audience on https://securepubads.g.doubleclick.net failed.
other error URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Message:
Attestation check for Protected Audience on https://securepubads.g.doubleclick.net failed.
other error URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Message:
Attestation check for Protected Audience on https://securepubads.g.doubleclick.net failed.
other error URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Message:
Attestation check for Attribution Reporting on https://pixel.quantserve.com failed.
other error URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Message:
Attestation check for Protected Audience on https://securepubads.g.doubleclick.net failed.
other error URL: https://www.mediafire.com/file/zh1io5g5cavqo7l/Rose%2527s_bot.zip/file
Message:
Attestation check for Protected Audience on https://securepubads.g.doubleclick.net failed.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=0
X-Frame-Options SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

322f9f81cfd88b7498cd441174614e0b.safeframe.googlesyndication.com
ab.dns-finder.com
ad-delivery.net
ad.doubleclick.net
ad.turn.com
ads.yieldmo.com
analytics.google.com
api.amplitude.com
api.btloader.com
api.rlcdn.com
bh.contextweb.com
bshr.ezodn.com
btloader.com
c3.a-mo.net
carbon-cdn.ccgateway.net
cdn-ima.33across.com
cdn.amplitude.com
cdn.econventa.com
cdn.id5-sync.com
cdn.jsdelivr.net
ce.lijit.com
cm.g.doubleclick.net
cmp.gatekeeperconsent.com
connectid.analytics.yahoo.com
csync.loopme.me
d-code.liadm.com
d9.flashtalking.com
dis.criteo.com
dis.eu.criteo.com
dsum-sec.casalemedia.com
econventa.com
ep1.adtrafficquality.google
ep2.adtrafficquality.google
esp.rtbhouse.com
fonts.gstatic.com
g.ezoic.net
go.ezodn.com
google-bidout-d.openx.net
googleads.g.doubleclick.net
gum.criteo.com
i.liadm.com
ib.adnxs.com
ice.360yield.com
id.a-mx.com
id.crwdcntrl.net
id.hadron.ad.gt
id5-sync.com
idsync.rlcdn.com
idx.liadm.com
image6.pubmatic.com
invstatic101.creativecdn.com
lb.eu-1-id5-sync.com
lbs.eu-1-id5-sync.com
lexicon.33across.com
link.rubiconproject.com
match.adsrvr.org
mug.criteo.com
oa.openxcdn.net
oajs.openx.net
pagead2.googlesyndication.com
pb-ing-02.ccgateway.net
pippio.com
pixel.quantserve.com
pixel.tapad.com
pr-bh.ybp.yahoo.com
privacy-location-edge.ccgateway.net
privacy.gatekeeperconsent.com
px.ads.linkedin.com
rp.liadm.com
rp4.liadm.com
rtb.gumgum.com
rules.quantcount.com
s0.2mdn.net
script-api.ccgateway.net
secure.quantserve.com
securepubads.g.doubleclick.net
ssum-sec.casalemedia.com
static.cloudflareinsights.com
static.criteo.net
static.mediafire.com
static.xx.fbcdn.net
stats.g.doubleclick.net
sync.go.sonobi.com
sync.inmobi.com
sync.ipredictive.com
tags.crwdcntrl.net
the.gatekeeperconsent.com
tpc.googlesyndication.com
translate.google.com
translate.googleapis.com
ups.analytics.yahoo.com
us-u.openx.net
www.ezojs.com
www.facebook.com
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.gstatic.com
www.mediafire.com
www.mediafiredls.com
x.bidswitch.net
www.google.com
100.24.186.222
104.17.148.83
104.18.27.193
104.18.28.101
107.178.254.65
130.211.23.194
138.199.41.120
141.95.33.120
142.251.16.148
142.251.16.149
142.251.179.155
162.19.138.82
18.212.140.196
18.214.193.183
2001:41d0:701:1000::20f2
2001:4860:4802:32::181
2001:4998:14:800::1000
2600:1408:c400:1681::2300
2600:1f10:4c55:e23d:5d5b:8bb5:8ae2:1fff
2600:1f18:4e9:5a01:eb39:489e:f392:607d
2600:1f18:730:b150:db37:2bdd:b575:f92a
2600:9000:2508:3400:1c:2afd:fb00:93a1
2600:9000:26a0:b800:6:44e3:f8c0:93a1
2600:9000:27c2:9200:10:dd8:5e40:93a1
2606:4700:10::6814:14bd
2606:4700:10::6814:2396
2606:4700:10::ac42:948c
2606:4700:10::ac42:a937
2606:4700:10::ac42:ab85
2606:4700:20::681a:2ad
2606:4700:20::ac43:4551
2606:4700:3031::ac43:c7ba
2606:4700:3032::ac43:aa90
2606:4700:3035::6815:2a20
2606:4700:3036::ac43:8e79
2606:4700:3037::6815:574f
2606:4700::6810:4f49
2606:4700::6810:aee2
2607:f350:3:2569:0:10:0:d
2607:f8b0:4004:c07::84
2607:f8b0:4004:c07::9b
2607:f8b0:4004:c08::71
2607:f8b0:4004:c08::95
2607:f8b0:4004:c09::9d
2607:f8b0:4004:c0b::5e
2607:f8b0:4004:c0b::66
2607:f8b0:4004:c17::84
2607:f8b0:4004:c19::68
2607:f8b0:4004:c19::84
2607:f8b0:4004:c19::9c
2607:f8b0:4004:c19::9d
2607:f8b0:4004:c1f::61
2607:f8b0:4004:c21::5f
2607:f8b0:4004:c21::9a
2607:f8b0:4004:c21::9b
2607:f8b0:4004:c21::9d
2607:f8b0:4004:c23::5e
2620:100:a00b::30
2620:100:a00b::38
2620:100:a00b::3d
2620:112:f008:200::101
2620:116:800b:21:c1e8:5385:5098:6bf0
2620:1ec:50::12
2a02:2638:3::3f
2a03:2880:f003:100:face:b00c:0:3
2a03:2880:f103:83:face:b00c:0:25de
3.167.69.118
3.170.42.100
3.213.55.140
3.221.183.211
3.223.154.179
3.225.222.210
3.237.175.195
3.33.220.150
34.1.234.235
34.102.146.192
34.107.165.188
34.111.113.62
34.120.135.53
34.206.130.144
34.210.204.30
34.36.200.111
34.96.70.87
35.165.50.35
35.190.39.111
35.211.202.130
35.212.59.62
35.244.154.8
35.244.159.8
35.71.131.137
37.19.206.163
52.54.41.155
54.165.159.98
54.89.30.34
68.67.160.186
68.67.181.248
74.119.117.62
74.214.194.131
8.28.7.81
012b8fdf4fcc71f19d70696af49aaf45fae20937019aad0205a8eabee2a1e08a
018185e30fbbce704be5b336095797ee6594f767c5c81ebc4945257994adad3f
0192b6a72305c64520e6d5a6e07912cf2aff915d4c6279148a7eac5d1e3e6d60
0218a90d0b505563892cec2372285e44ff83ec6b22d1bdc586ca2ff4bbaddb0f
032e1fdc72c9c669bbd7dcb841fc1cdcd7a9148a5802dd668c508efd0c11d7a0
03add086aedf9d191a81747b57d7c46d0395b20c8d79df6581985c18b6bed599
03c8d2dc7d985c3004ff2cd6d8148dd03560f37ed15efdf6c2d7f4d771d0e599
03fb14c2e4fb94c1e4c75c46acd761fb7751469d55ccee1c7e6a62f265916d10
045cdffe2577a8720fbe2ca26df9bfc988096023c2c429cd3a3b275f9859507b
04c94ecaae50f713607dd45d40c5756d0e6a9e58c6398433ac098bc9bee89f5d
05260ec904c40508dd3c78adde4ddac1771fff34e708d489a3caa07467c88962
05cfe92d9794a54258a19bfec7ae0faa73f61b66416983136594b4f95bb114dd
0658fb633db8e191f0ba46ccfee48916e99af36793629714f6f445f0306927f7
081f94d2c63723df86834268d381fcb54bbeda3566e1ca95f3c7ea1f7f1dc217
0859bb184539a42f82b91e127e6b478d3489daac9c6c3822b0b84674260085c3
0889832a605040b3e564c59da0a730bef7e125f4f70719d1afd2ca92899029f8
088c967af12cc5e78bb8334507229516e64013171dcd839c40aff86ac3c70246
0af95d67b93560269da520b2de788733a368bb8fec764e7d49cef92b468d51ce
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0dcae222606cf25659d185a62f2fcd41caf42f6dd3d9dda50eda1f281e304065
0f3ac3cb7d10e9decc27c3a2939e4b81dda2c2125dd3e96bc2793f129f25286d
0f67393986c012dbf48aa3149e2874bd84ed5f466362ad1ac31305f697f1da7b
1235cf3868c73a8ec94a47dd99325637a5571d430e87d58401e9c6e4ff394a45
14b660a511e14a9a481c6fe43c576f36c61b656cfd379728c54f1128e1855966
17bc52415eda19b946f9ec4de84cdd8e8774fb8b8971daa1895b651532a6f709
1b3e74c47c57f5a2cb0ae7fe032896407ca8aa9cb3967069806adc7ba89e7652
1c55d9b826e8dfa994370e306ae8dc2e849f3e003381dc848a0b95f782c0c0e3
1c6ba1010c2cc88c59de9e9584728da124770fa399643ffc1beffcec54b84be7
1ca0d5744e4f39ea464be06f38e214eabd97b2ca934e919a3673f0a62f76368c
2180adfc4b8cdfd2ea48e647e3bb17e531b2b3e2dd99f0277b044387fc929cbe
2450e5580136f94bda7ccf95e3167b57e15b05b513a430967943a50036fa47a4
2505b331cfe3905b07926e49104c7949bf384b8c4b4ff6f3709e91c6f5cd6366
255701179a3efc03d3bef75ae6551b7c2278a21fbeb1c479a49779d31d5cc985
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
27895cf369160e709d241aec25915f2deea50df26a516fb817c4cc62f4729b04
2818bbf85b8c0ab13945d52ef16974f9a36c0808a09455e1692d921e14b0c128
2a5cfa356af90e4dc14d89477463deb2c098c826ebc6d74c1577eb3d5973cac9
2b70873d57bd99dd87a2ba237063c73410e67de1d630fd303622c940bb027ff5
2b8bdb8e1e345a290d728e5e3bb3866e954fe113a2dde5429d9a7ce9c7cdeb33
2c03c98ced5fdb6127e864c884b409b7b7d11085be4b22b1514e14ce21debf91
2cb36c9fcefd08da06a548f7155fe97681df0d659ca31863d6fc60d29bdd09bb
2e5f5cb912c0619933ea6c3ad8ac1466a005f792e3338d96a8432d144c63520f
2f8389626ed9aeb14014eb57d8b59eb81437019c330a41d955fddf6d664152d9
30be558393bd8b0585c806a6eaed6d6f5b51d1ca63c0113061dfe35eaa128ce3
315e882a5c1d18c40426f8f62762fa306d4364cdfcaf6a8e8a712fb117d06c3d
345dbaad5cd394bb195e79a7d835ee2af91c02c76413d974f2e7fd3b9fcbfe39
35ba9ff40ec80c9b7e526ec5053b286500533de4ba39efbd2b7b715952054b51
35db39227832bface3f1eb2f23df430f154e190afcd8239cfddc4bd75cb72f22
3733ce04a5c4dbb8b07b847650fd68e82f93ab8abf6b35ca294d6d40130f06c0
3b9ffd186b78d9ad93b8f8f63b927976df2c98d29ecf5186c18b80d645cfd134
3cefef7fc952707c97375ef3fa95a8c45a96eda7845d02bc1c28bf3570c0cfba
3dfff187419bdcc94fa384049f212371c42bd391315f5c19464980ee9d759549
40092961c1ff1439f1e452cfd24fd924c4caa6f12323895a159e43f6158cdef0
4342feac38021c4fe3069eba0edf1c2e1b4345e2b548b0afb7ab21b7369b3bc8
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
4448e430d3c53bad548a5d135e1c7e2f9593e806ba47892640d430ea752e979e
446a24acf9272b37cf14bf847684201154b6648113a148f1381b7489db6294f3
44b848ce1bea5ca25251a1c22058f8df660f1c8161c21ebc13a9ba55ec479d10
456d1d598f7ae1db54b77a49bca6a0d304d9bbb990123bce91c33bf4115d8ac7
46468ec4089d4bea3f0e0811eea2d9e9cde6305118df0673d2972d290f1d00f0
46f8bed71e45edd8de227c7c08c24fba26c3834cfc5675b4294b11ab60f5bc8d
4718dd9f68e969d1cb5e1b6172206b7150ad1d8cd5c5c1fe5812dd0e1646d426
487f8e40ed25b85028629c70e5da0b18c5e58307226580a9c8a04288e8bd1e93
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4dac0026fbfa2615dce30c0af12830863fe885f84387a0147b9e338f548d5d82
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4f32453269c5e10a9745848684624f6155103ffe1d6e7571f652775856766684
502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358
50a63bf06dcdc62ce03de6a07d10770dc80cfa47ef2b63db1e9f6a5fbd786a7d
50fbbe164918e6fb86e26b49d99c193d1c36ec6bbf9a51b9967ca74f2282ccde
521b509ca1eb22bc11428a8beed65e19f0d548e1c625286e41bb6be1fff1c9c8
5249c73799ce5ee08a0a436f335522b49830d8309424205a0c7167519d166e3a
544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9
54573654901c495ecf67cc8ffd30108dd6f3a3c7332fd4dba41ab13877b75b8d
546e9b88af3630057667ae1a422f04b1043b4883bffac25be4bea1d8e84fc17c
55578770bf148bc4bc8ea7b540dff4ce6819cad696de7a9c3d38d36b56081cf6
557e96fc45df3f432925767711a0576d55f03256d8ef666fe8f63db372e66920
56351c084d8d56437d41f1e58b7eb184b563871e88bab60f6b15486c39f13996
5feba1ef2c6561994f5991ec885c49c58ebc537e623cb63760fde7cc6254a697
5ff12e3286ff6a7014e58f2bc0617b332d877d3b6f2913f66f15995efd7b6fac
6318394f737c66f0e2ccfcd88e3935c6667633a1b95fa29fba2b75431d55eef2
6358c3605c13b5928e94e641e8935dc812c7be724c395e9a66ea820809825efc
643242e26749d72edbf48c27efff4b4ec689d352ff3698117c1d53018e4d926b
6896b59e8034378b31284eea779e568986c0337a8eb3e648efbf52fd8d5d3781
696642980342cdb9c2e57d199ea188db4928c518de52d9dbe349cd0ca8e400bc
6b9ae1fa0d1fc51ee0ad3feb565083bee200289c71bb346020f9b3d80cf73636
6cc7f9ef62074d75725d8ad7663dafa69bc0e51e3ba247db03a78ec3161f19c6
6f856d03aace62468ff8bcfa901def0fb022fd719a49592b462f53f0efa71fbe
6fca1361d81b8d8d05afbe947e257aef026891372b45e0d2de123a907a4ed1af
715199235705aaa7c6781030dac85b766262d77ec7c07aac6f4928f464d93583
720671166ac43aba99e3952b0b9341ab4e0fee1fd891db54e2a07f05db653142
76b14705bcd5752ac05035c95c7f53bfe8e65dda03bc77662e0aff067e3258e7
7871780d48bd635be91dd8ab36bdcb632e07c0c94cd0d36ebe60f97412fb6de1
7b73200d535d1abd879761a9c8a28f55f34303597bb68a96f3c2276a5bebc1c6
7ba1bc2084def769e77a7dbf97cd91d68fe6c6d55b5d183a7d36630da8da2b02
7bfa95afa4fa36ed14b3401fea068d25cb346e21ddac11c4bd0319c0cfacb435
7d0d5581c216a6d698f0e57d6f39895da9e8069b49abe21e5311b3f05468d5b6
7d4d203faf5eeeb577affb6b9f87497ddd9c8d1bec75da74630fe6402e74c553
7f596391730ffc1ae1aaa2b67074a27da2706c305f11fa1b1231a2bd9fae289e
81941d9798c90799ffb82dcc0bc90d36612a447d3de901c7a22109806b421807
82b94716473aa225e715e117802145c5d2d725aa1ba9d476d61a5d3da16a8c26
83a7b3a37afdc71c3fdaadc4c5ce1eeebdf01dd2d4154dc891ef7bc187ba3b68
840942a33374ee42434666e7dafe625d2702b4c0cc23f901f48c31b9db39c953
8539c91ae0a82f8cab27d481ea38ac4e66d1e5b36701fe295bcba4399b9255bd
880444af8f79aca9fdb01d819bb615c7d8ce8fb9327df856784f7027819de58b
8890000c6b81e5c81f0d333f7008b244275a61b934dc6db94ef384d1421c54bb
893719087a8bc6dcdfabc4e1d54fd6d724953d40da2ad369f8b4fb5f689394d7
89786a1f649d6044a4702e297404445af6a3eab8332d9f676cb4312196da3d7f
8988bd4c4030609759c75a6d233755e397c96dc3481d936391cacc160e363f7f
89ec2a5152f4f214a0fe49725345dc70848ed05f13cf20646d372d339477a11d
8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f
8b3a000db28359e0512e1484988806b9cdaeb457e29ef6b82bfe097e6eed3231
8bacb685be7cec7f41a0270e694fa90c0fb448b2c0ded5f1734baf51050d695c
8c04e118bdd5757192be2a1eb360786f9fa1c4b398806430b7f41f203f64d8e6
8d0380a2602ecc27249a4264bf13382b9f579bce5fb60c3e4a02a033cd4078dd
8da9b8dc7a16d03966226d79b3ab81fac5710dd28a52a6769568fdd4ac789159
923c9d6153ab7d3f69fd38564c0a63f4d02dabd800a9d93f10306d1de5d6513d
93a010187522c5e6ef85ab3c24b346b668eb0dce2a6221bfeaa246b76798c570
949c848844b8376179ced65ad92c21360c3593420a3e0a7a58678ae4dd119df0
9b41253384e2818bd0f76171d6ffd723d4c85c5e1a69da74f174489cb52a40ce
9c6edfb7305332d09b0d4dc3dce7d5566bc16e09539991f3dad93d037e0d9d46
9d431a83a03e924ac1a1afa9cb3e75ef35dec2e51784bb68f3d34fda527143bf
9dfd6360a8cbf89773849fba48320042b9ef83d0611b7a0c86f91740889a55f5
9ec25b6605089e0ee62ccbae28fadf5be117bc43c3ce513b3e56c17a64ad3a8f
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a11d3b4b6f2902037c365146ff80b5bf95923f3176f1a827355e45177314d423
a220fbb101547e4fc86885312289c285b9b523b8f4073ea5041ce9ed859cbdcb
a4fafcd389d58bbd82e49d9a68e81e9dc8384330ff14ec3283a4d0d11812047b
a5e87590d9232e0b0be4c640eeb47cb4f4299af754f195c802d49fe380ea1870
a6e1d04a1635eefd471a8a7d496e140154fc383b219156d24c3becfc2fc87cc5
a7f65c0446b6cac3175458f6388304d0c23e70d11fa0db20920a619f1bc18623
aa8a5c4a92b78ce2c775274d190dafb720a44b4facce02c94e63f63c90c60a57
ab5c23a05e39deed14d9d8262b0dce9f024f86105a27196cad37d14a3f516e09
ae5072e36a1daf15ddc62e9f7d105f39df37e3b310761c4a716f18565a826eb4
aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
afcc45131a73ff6860e6b9bc28ba2fd93e8ec178bf0df3a95240164070401a63
b046a6c62812c45b02c69f67f0916771708bd9e5750f5777d1f6dc819f0e8165
b04cd869cfd41a48c006458f71969a0eb26f33fec12f3cfe00408f8b73bf3ff8
b06b7e01b88155274071a175c1f887e315afe0efcb976d165bd88f293f83f3e0
b0efccd6b766be217e0bc275a1902a148a4f68635b9e88f5e73d9f61015b5df7
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b14fffccfdcc22d4bac07b2b82027b9caf51ca0adc9e4c9391db276fe14206ec
b23d26bf925467ae815899bd17425dfdb3ea5e0bdc23fc4fbf23b60b8f72ca27
b837449c7254dd5887b620b7903bb4dbafbf2424ae3eb25e7a9f3471ff105365
b8f0ca68362cf245f891fc09ddfa50806d195e78e196cf96ac5d9cf72be2577a
b944de338f1cb0407c7f286a22047ad4879a3a4e6d3f97c097d59bf1260697a6
b96c9ee60e9c70dc8b620d4f90fdda2e76175302540b3c68398a29ae525fd5aa
bb752c6d8cbeadd39cfd090c1428ad6a5eaa87adcd05f4aff3f071d731aeb31a
bbe98ca541dc9afec7186d90ad5c268c57094f6df73a18e0a70b8b2bed286744
bccb4111eb4c8b10e4cd76ec113f0d8786d91869f5913620ab4d8b7fe4408c44
bcf7993523efcd42f5599e1c210b6433e35a39de688c9e5ae90829741937df71
bea1c5ab168f662fc9eb5bda3474e5b1bbd0d3ecc1d9c68e2a753f613c2ae0c2
bf1b99399ebef06add3f8bc7218fcab1705e5b45a6128ef33972eec7733ecbff
c46112b521d8782f9ace52b74a86041d1378ad4ce71b94a8e6870f2823cadf94
c6c094bc0054f9cbe34102ff49f86b3928b5ac09f3d2ac87e170d0500675921f
c818e16bc6f5bdd6be3ec1a4506a787bd7f1fa6cb7c5a15db07516f373d16d9b
ca7307172a9db317510157b44914bf28976af4545e1acce6664c41b98a2826f9
cdc78cc8b2994712a041a2a4cb02f488afbab00981771bdd3a8036c2dddf540f
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d17e84af7ba998526041e90409fec0d80e0bf436fecd99cd94ea4124f1047141
d1d42955e69aae005efd7d5a24d10ffc36dabebd9867cca1e5b8dbb998e273a4
d34364518d1fdc1b69ba193a0593a933aac3cc1327f6d36f87f5da9052caf62b
d4441ece945f2f14f46d1c462345ee2ba1c2e028e13137da40824116ee90b0f5
d4c82997625475c5f3e3e97b615d3da0709ed525947749da6c235dbe3270d458
d52e8dac604c9c92b753f7455f0560e4bb0778e57917092d020aa856e1244c5d
d6012d5a18f33f8846ac4b536bb591a82274c8906237d252299d90e664836f4e
d6577a0d1cd3174e43c8889a25c8e7a8b4011332d5ff4064000918a69a607eaf
d65f4b2e8eee94ddc7f762d098de19558d879a3b597c8913b4d075532e3ed4b4
d84ccd933e0ca4f34a93445eb9390ed32540ca67dec0a7a00cf8b65a54e59a85
d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8
d9cf8cfc12bc0343503657e99a507a824aa4549c0a34d158e357ba4dacb00773
dac56831476fb5f3f2c40c74e494002b792f5797910296d14c354be48995e136
dc54b817820f14ce6395ba2a037f37d4bb0af75d5b017336140793fbe2f7f738
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
df4523ddcd305ecbe557879564a20eb7209260523a1f19f0ba973d7579a4885e
e0ff1aa498c3e7899a1ba72cea996bea56b397a6e93864cff709ce8d1776e5ea
e1477e459968a08904795c6c229d876e4c339599d1a876cdbda25001cf6c3f48
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e55d84fd54f9f7e4894c88240c3dd7208a0af714193d38911d2500fbaebae74d
e5c5c1dfc824c40c00e2885c5b2b868752d7f2d7696bae2f28ce36d5d81691c0
e719dd1add2297d7344ea35e1c8945b9db1902c9915029185a707daa885e91f1
e814d50a228f54aecf40d8a58e41d48ce1dfc4376fd5fbedc28078fe0a8c5526
e83fa6da04321fcd6ed898ff965996c22c8a7fb008371b452334a117dc890912
e99789d450a9dab1fea76362b595a87823157c4b4b886f02aaebf7649167b829
ea47742e94e6a95b08832e9e5875a5a73ab2ea3bc740e6938d927c39e03273bf
ed1db5491cbd7a9d8fe7212eb39dc0b71af3c836edd99c8cfff4d2eb17710ad3
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efabba3678b85fcab831b778ea2ddaad1e2a1e952584d3566bc39b7ccb3429d9
f04216dbfc1a42aaacde2f68603d28c16bd561605b119c4c46fff440a2a9ed15
f0b95af1ea73d8c518e84a22753c979ffb181d4b012d2197e7302982dc5ee097
f1a61277e3f902f50ab42015d8b07218db9b7601bb0967e54a52bfdcb4fa7e81
f1a67642fc97b508ce07cf6df329022bf5184a1c573044dc021e0d6e64688c64
f1a68bf826c55985468304f4284a09cb8a68e82503d764166e611a7c58a85a4b
f1c02e9ba02a159b34fc2d7d2be0a743b497a6cd0a422a0c3acc88b871b2af96
f303c517d2a00e19bcd56065330ac8a4cb82717cf1976e9c029e9a1442be288c
f52a0c7d9fa7ae8e45916c491ae7193f9a1e289f128f05264122c53d8da970db
f89239b20e6a4dbae7354cd7677fbfb57c6b517066a94276b43270c078753072
f917a9105c311331b1d40f4d2bdbf11233c1c465616c1a9c46232f451463b061
fb1bd700eb83832fc2ca14c9fd537e5facad95f3bd15632db0c4b1c5a5bd7e20
fec5a361dec923efe92848ca27b02b158b164380a9eaf6cc1625e08e0d9c101e