www.mediafire.com Open in urlscan Pro
104.17.148.83 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.mediafire.com/file/lnouqg02oeflknv/b1.5_04.zip/file
Submission Tags: falconsandbox
Submission: On November 09 via api (November 9th 2025, 10:53:24 am UTC) from US — Scanned from DE

Summary HTTP 93 Redirects Links 9 Behaviour Indicators

Summary

This website contacted 23 IPs in 3 countries across 18 domains to perform 93 HTTP transactions. The main IP is 104.17.148.83, located in Ascension Island and belongs to CLOUDFLARENET, US. The main domain is www.mediafire.com. The Cisco Umbrella rank of the primary domain is 33804.
TLS certificate: Issued by Sectigo Public Server Authentication ... on August 5th 2025. Valid for: a year.

This is the only time www.mediafire.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 20	104.17.148.83 104.17.148.83	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	172.67.199.186 172.67.199.186	13335 (CLOUDFLAR...) (CLOUDFLARENET)
7	104.21.42.32 104.21.42.32	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	142.250.184.200 142.250.184.200	15169 (GOOGLE) (GOOGLE)
2	172.66.171.133 172.66.171.133	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	172.67.170.144 172.67.170.144	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	142.250.185.110 142.250.185.110	15169 (GOOGLE) (GOOGLE)
1	104.16.80.73 104.16.80.73	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	18.245.86.4 18.245.86.4	16509 (AMAZON-02) (AMAZON-02)
2	104.26.9.66 104.26.9.66	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	157.240.253.35 157.240.253.35	32934 (FACEBOOK) (FACEBOOK)
1	35.85.77.91 35.85.77.91	16509 (AMAZON-02) (AMAZON-02)
11	104.20.47.80 104.20.47.80	13335 (CLOUDFLAR...) (CLOUDFLARENET)
7	172.217.23.102 172.217.23.102	15169 (GOOGLE) (GOOGLE)
2	34.36.200.111 34.36.200.111	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
16	52.57.221.121 52.57.221.121	16509 (AMAZON-02) (AMAZON-02)
5	188.114.96.3 188.114.96.3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	130.211.23.194 130.211.23.194	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
3	142.250.186.131 142.250.186.131	15169 (GOOGLE) (GOOGLE)
1	142.250.186.42 142.250.186.42	15169 (GOOGLE) (GOOGLE)
1	142.250.185.195 142.250.185.195	15169 (GOOGLE) (GOOGLE)
1	172.67.73.78 172.67.73.78	13335 (CLOUDFLAR...) (CLOUDFLARENET)
93	23

20 104.17.148.83 (Ascension Island) 1 redirects

ASN13335 (CLOUDFLARENET, US)

www.mediafire.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
static.mediafire.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.67.199.186 (Ascension Island)

ASN13335 (CLOUDFLARENET, US)

cmp.gatekeeperconsent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
privacy.gatekeeperconsent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 104.21.42.32 (Ascension Island)

ASN13335 (CLOUDFLARENET, US)

the.gatekeeperconsent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.184.200 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s11-in-f8.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.66.171.133 (Ascension Island)

ASN13335 (CLOUDFLARENET, US)

btloader.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.67.170.144 (Ascension Island)

ASN13335 (CLOUDFLARENET, US)

www.ezojs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.110 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s49-in-f14.1e100.net

translate.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.16.80.73 (Ascension Island)

ASN13335 (CLOUDFLARENET, US)

static.cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.245.86.4 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-245-86-4.fra60.r.cloudfront.net

cdn.amplitude.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.26.9.66 (Ascension Island)

ASN13335 (CLOUDFLARENET, US)

cdn.econventa.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
econventa.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 157.240.253.35 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
PTR: edge-star-mini-shv-02-fra5.facebook.com

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.85.77.91 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-85-77-91.us-west-2.compute.amazonaws.com

api.amplitude.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 104.20.47.80 (Ascension Island)

ASN13335 (CLOUDFLARENET, US)

ad-delivery.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 172.217.23.102 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s45-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.36.200.111 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 111.200.36.34.bc.googleusercontent.com

ab.dns-finder.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 52.57.221.121 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-57-221-121.eu-central-1.compute.amazonaws.com

g.ezoic.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 188.114.96.3 (Ascension Island)

ASN13335 (CLOUDFLARENET, US)

go.ezodn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 130.211.23.194 (United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 194.23.211.130.bc.googleusercontent.com

api.btloader.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.186.131 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s07-in-f3.1e100.net

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.42 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f10.1e100.net

translate.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.195 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s52-in-f3.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.67.73.78 (Ascension Island)

ASN13335 (CLOUDFLARENET, US)

www.mediafiredls.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
20	mediafire.com 1 redirects www.mediafire.com — Cisco Umbrella Rank: 33804 static.mediafire.com — Cisco Umbrella Rank: 80803	192 KB
16	ezoic.net g.ezoic.net — Cisco Umbrella Rank: 11487	61 KB
11	ad-delivery.net ad-delivery.net — Cisco Umbrella Rank: 1142	2 KB
10	gatekeeperconsent.com cmp.gatekeeperconsent.com — Cisco Umbrella Rank: 23069 the.gatekeeperconsent.com — Cisco Umbrella Rank: 20283 privacy.gatekeeperconsent.com — Cisco Umbrella Rank: 27207	197 KB
7	doubleclick.net ad.doubleclick.net — Cisco Umbrella Rank: 168	903 B
5	ezodn.com go.ezodn.com — Cisco Umbrella Rank: 13871	8 KB
5	btloader.com btloader.com — Cisco Umbrella Rank: 1045 api.btloader.com — Cisco Umbrella Rank: 1182	31 KB
4	gstatic.com www.gstatic.com fonts.gstatic.com	11 KB
3	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 44	386 KB
2	dns-finder.com ab.dns-finder.com — Cisco Umbrella Rank: 1267	233 B
2	econventa.com cdn.econventa.com — Cisco Umbrella Rank: 86049 econventa.com — Cisco Umbrella Rank: 73994	51 KB
2	amplitude.com cdn.amplitude.com — Cisco Umbrella Rank: 2699 api.amplitude.com — Cisco Umbrella Rank: 3105	22 KB
2	ezojs.com www.ezojs.com — Cisco Umbrella Rank: 14199	141 KB
1	mediafiredls.com www.mediafiredls.com — Cisco Umbrella Rank: 78639	508 B
1	googleapis.com translate.googleapis.com — Cisco Umbrella Rank: 997	102 KB
1	facebook.com www.facebook.com — Cisco Umbrella Rank: 123	108 B
1	cloudflareinsights.com static.cloudflareinsights.com — Cisco Umbrella Rank: 397	7 KB
1	google.com translate.google.com — Cisco Umbrella Rank: 1141	28 KB
93	18

	Domain	Requested by
16	g.ezoic.net	www.ezojs.com www.mediafire.com go.ezodn.com
12	static.mediafire.com	www.mediafire.com
11	ad-delivery.net	btloader.com
8	www.mediafire.com	1 redirects www.mediafire.com static.cloudflareinsights.com
7	ad.doubleclick.net	btloader.com
7	the.gatekeeperconsent.com	www.mediafire.com the.gatekeeperconsent.com
5	go.ezodn.com	www.mediafire.com
3	www.gstatic.com	www.mediafire.com www.gstatic.com
3	api.btloader.com	btloader.com
3	www.googletagmanager.com	www.mediafire.com www.googletagmanager.com
2	ab.dns-finder.com	btloader.com
2	privacy.gatekeeperconsent.com	the.gatekeeperconsent.com
2	www.ezojs.com	www.mediafire.com www.ezojs.com
2	btloader.com	www.mediafire.com btloader.com
1	www.mediafiredls.com	www.mediafire.com
1	fonts.gstatic.com	www.mediafire.com
1	econventa.com	cdn.econventa.com
1	translate.googleapis.com
1	api.amplitude.com	cdn.amplitude.com
1	www.facebook.com	www.mediafire.com
1	cdn.econventa.com	www.mediafire.com
1	cdn.amplitude.com	www.mediafire.com
1	static.cloudflareinsights.com	www.mediafire.com
1	translate.google.com	www.mediafire.com
1	cmp.gatekeeperconsent.com	www.mediafire.com
93	25

This site contains links to these domains. Also see Links.

Domain
download1580.mediafire.com
blog.mediafire.com
www.fast.io
mediafire.zendesk.com
translate.google.com
twitter.com
www.facebook.com

Subject Issuer	Validity	Valid
*.mediafire.com Sectigo Public Server Authentication CA DV R36	`2025-08-05` - `2026-07-30`	a year	crt.sh
gatekeeperconsent.com WE1	`2025-10-07` - `2026-01-05`	3 months	crt.sh
*.google-analytics.com WE2	`2025-10-13` - `2026-01-05`	3 months	crt.sh
btloader.com WE1	`2025-09-27` - `2025-12-26`	3 months	crt.sh
www.ezojs.com WE1	`2025-10-16` - `2026-01-14`	3 months	crt.sh
*.google.com WE2	`2025-10-13` - `2026-01-05`	3 months	crt.sh
cloudflareinsights.com WE1	`2025-10-22` - `2026-01-20`	3 months	crt.sh
cdn.amplitude.com Amazon RSA 2048 M01	`2025-10-15` - `2026-11-13`	a year	crt.sh
econventa.com WE1	`2025-09-14` - `2025-12-13`	3 months	crt.sh
*.facebook.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2025-08-18` - `2025-11-16`	3 months	crt.sh
*.amplitude.com Amazon RSA 2048 M03	`2025-01-01` - `2026-01-30`	a year	crt.sh
ad-delivery.net WE1	`2025-10-30` - `2026-01-28`	3 months	crt.sh
*.doubleclick.net WE2	`2025-10-13` - `2026-01-05`	3 months	crt.sh
ab.dns-finder.com WR3	`2025-10-22` - `2026-01-20`	3 months	crt.sh
ezoic.net E8	`2025-09-10` - `2025-12-09`	3 months	crt.sh
ezodn.com WE1	`2025-10-06` - `2026-01-04`	3 months	crt.sh
api.btloader.com WR3	`2025-09-23` - `2025-12-22`	3 months	crt.sh
*.gstatic.com WE2	`2025-10-13` - `2026-01-05`	3 months	crt.sh
upload.video.google.com WE2	`2025-10-13` - `2026-01-05`	3 months	crt.sh
mediafiredls.com WE1	`2025-11-02` - `2026-01-31`	3 months	crt.sh

This page contains 5 frames:

Primary Page: https://www.mediafire.com/file/lnouqg02oeflknv/b1.5_04.zip/file
Frame ID: C1383541894F9483B8C4DC6C2A7771B2
Requests: 88 HTTP requests in this frame

Frame: https://www.facebook.com/plugins/like.php?href=http://www.facebook.com/MediaFire&width=193&layout=button_count&action=like&show_faces=false&share=true&height=30&appId=124578887583575
Frame ID: 13D513721085B5C7AD0EB54E3495E498
Requests: 1 HTTP requests in this frame

Frame: https://www.mediafire.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/fd468eb09fcf/main.js
Frame ID: DBA2523D4A169304814216CC5F9F2932
Requests: 2 HTTP requests in this frame

Frame: https://btloader.com/trustedIframe.html?o=5678961798414336&upapi=true
Frame ID: F3A8548069505551CF64DADB9B62A0E1
Requests: 1 HTTP requests in this frame

Frame: data://truncated
Frame ID: E0974EF12FCCE7272E7A704333875FBF
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

b1.5_04

Detected technologies

Amplitude (Analytics) Expand

Overall confidence: 100%
Detected patterns

cdn\.amplitude\.com

Cloudflare Browser Insights (Analytics) Expand

Overall confidence: 100%
Detected patterns

static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Page Statistics

93
Requests

99 %
HTTPS

0 %
IPv6

18
Domains

25
Subdomains

23
IPs

3
Countries

1242 kB
Transfer

4516 kB
Size

51
Cookies

9 Outgoing links

These are links going to different origins than the main page.

URL: https://download1580.mediafire.com/q68fvuv961egC4V_3q_x5DaXBmuZbwxp2c4NaZVoMuw30LJ85vnIZTgcWssHoDLkz39YHju1iHYBKWp4yA6K3khQ0EWX7unYLojTGHTQKq9ei95_-jY_CEgi2RIHIBARZu2p9UziGx650aYm-Dy03QGWA9XCExG3vozXQELM72ESzi3t/lnouqg02oeflknv/b1.5_04.zip
Title: Download (386.3KB)

Search URL Search Domain Scan URL

URL: http://blog.mediafire.com/
Title: Company Blog

Search URL Search Domain Scan URL

URL: https://www.fast.io/share/new?utm_source=mfftr_file
Title: File Sharing for Creators

Search URL Search Domain Scan URL

URL: https://mediafire.zendesk.com/hc/en-us
Title: Support

Search URL Search Domain Scan URL

URL: https://translate.google.com/
Title: Google Übersetzer

Search URL Search Domain Scan URL

URL: https://twitter.com/#!/mediafire

Search URL Search Domain Scan URL

URL: https://www.facebook.com/mediafire

Search URL Search Domain Scan URL

URL: https://twitter.com/mediafire
Title: Twitter Page

Search URL Search Domain Scan URL

URL: https://blog.mediafire.com/
Title: MediaFire Blog

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 29

https://www.mediafire.com/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
https://www.mediafire.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/fd468eb09fcf/main.js

93 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3 200 Primary Request file Show response
www.mediafire.com/file/lnouqg02oeflknv/b1.5_04.zip/ 323 KB
86 KB 251ms
230ms Document
text/html 104.17.148.83
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://www.mediafire.com/file/lnouqg02oeflknv/b1.5_04.zip/file

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.148.83 , Ascension Island, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e23279aa6deaa5a679eec1d62492bb3ccbe9ba55f22c4c23bd1cbbba8152afd0

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

access-control-allow-methods: OPTIONS, POST, GET
access-control-allow-origin: https://www.mediafire.com
alt-svc: h3=":443"; ma=86400
cache-control: no-cache, no-store, must-revalidate, max-age=0, post-check=0, pre-check=0
cf-cache-status: DYNAMIC
cf-ray: 99bcc42749c73624-FRA
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Sun, 09 Nov 2025 10:53:25 GMT
expires: 0
pragma: no-cache
priority: u=0,i
server: cloudflare
server-timing: cfCacheStatus;desc="DYNAMIC" cfOrigin;dur=0,cfEdge;dur=209 cfExtPri
strict-transport-security: max-age=0
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
x-mf-env: liveApi
x-mf-fe: mf2
x-robots-tag: noindex, nofollow

GET
H3 200 min.js Show response
cmp.gatekeeperconsent.com/ 1 KB
820 B 48ms
23ms Script
application/javascript 172.67.199.186
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cmp.gatekeeperconsent.com/min.js
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/lnouqg02oeflknv/b1.5_04.zip/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.199.186 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 345dbaad5cd394bb195e79a7d835ee2af91c02c76413d974f2e7fd3b9fcbfe39

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-encoding: zstd
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=6SyrgxlQqscVaTlU59dD%2BY2aFI8tLiZCSUvgrgcWXOTt1dWDt4QC2UOYAj1iliLHZ3gq14G3GwXCHcXO7ApH%2Btx9RHgNSBLmtzZ%2BMu5k3lQdu7iZjnpZHsI%3D"}]}
cf-ray: 99bcc428e8dddbff-FRA
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Sun, 09 Nov 2025 10:53:25 GMT
content-type: application/javascript
vary: accept-encoding
server: cloudflare
priority: u=1,i=?0

GET
H3 200 cmp.min.js Show response
the.gatekeeperconsent.com/ 8 KB
3 KB 48ms
20ms Script
application/javascript 104.21.42.32
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://the.gatekeeperconsent.com/cmp.min.js
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/lnouqg02oeflknv/b1.5_04.zip/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.42.32 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e0ff1aa498c3e7899a1ba72cea996bea56b397a6e93864cff709ce8d1776e5ea

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex, follow
content-encoding: gzip
cf-cache-status: HIT
age: 10
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=r3%2BeFEZeUz%2Br7v4BgmouArq7MctOdGm6ojYVK55td17LJze1IBiRxeD7PpNsCMegZjD3H3IAVirjaiv540XxWoMqGDH9rz%2BASI6DaHZdDfXkx%2Fz1Vs%2FqbZk%3D"}]}
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Sun, 09 Nov 2025 10:53:25 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding
last-modified: Sun, 09 Nov 2025 10:53:14 GMT
priority: u=1,i=?0
cache-control: max-age=300, public
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray: 99bcc428fb85db0e-FRA
server: cloudflare

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 281 KB
102 KB 76ms
27ms Script
application/javascript 142.250.184.200
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-829541-1

Requested by

Host: www.mediafire.com
URL: https://www.mediafire.com/file/lnouqg02oeflknv/b1.5_04.zip/file

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.200 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

1bbfa06807ac1bd74c992aad9d3380cff5974cdd2568df64517c265636054b45

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: zstd
expires: Sun, 09 Nov 2025 10:53:25 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 09 Nov 2025 10:53:25 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Sun, 09 Nov 2025 09:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 104325
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 tag Show response
btloader.com/ 91 KB
29 KB 55ms
29ms Script
application/javascript 172.66.171.133
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/lnouqg02oeflknv/b1.5_04.zip/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.66.171.133 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 643242e26749d72edbf48c27efff4b4ec689d352ff3698117c1d53018e4d926b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex, nofollow
cache-control: public, max-age=300, stale-if-error=3600, stale-while-revalidate=300
content-encoding: gzip
cf-cache-status: HIT
etag: "b9b0e8d191f907a7311a6f44fab6a796"
via: 1.1 google
cf-ray: 99bcc42958779763-FRA
access-control-allow-origin: *
date: Sun, 09 Nov 2025 10:53:25 GMT
content-type: application/javascript
last-modified: Sun, 09 Nov 2025 10:07:23 GMT
server: cloudflare
vary: Accept-Encoding

GET
H3 200 sa.min.js Show response
www.ezojs.com/ezoic/ 164 KB
51 KB 45ms
17ms Script
application/javascript 172.67.170.144
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://www.ezojs.com/ezoic/sa.min.js
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/lnouqg02oeflknv/b1.5_04.zip/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.170.144 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f303c517d2a00e19bcd56065330ac8a4cb82717cf1976e9c029e9a1442be288c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex, follow
content-encoding: gzip
cf-cache-status: HIT
etag: W/"205ee0647483fd8c83c0a3cb28f8a4e9"
age: 503
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=fZJJFwnqlL71liWYIJv%2F7W8mGwvkjAH4vtwUQr28qXNI%2B0YtFhGl3AM7bqOtHcXHdm%2F7LYim5KHyXpx0mc5F6uwCkAQDbCgLyUFzE6o%3D"}]}
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Sun, 09 Nov 2025 10:53:25 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding
priority: u=3,i=?0
cache-control: public, max-age=600, stale-while-revalidate=3600
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray: 99bcc4295801361b-FRA
server: cloudflare

GET
H2 200 element.js Show response
translate.google.com/translate_a/ 78 KB
28 KB 83ms
36ms Script
text/javascript 142.250.185.110
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://translate.google.com/translate_a/element.js?cb=googFooterTranslate

Requested by

Host: www.mediafire.com
URL: https://www.mediafire.com/file/lnouqg02oeflknv/b1.5_04.zip/file

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.110 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f14.1e100.net

Software

ESF /

Resource Hash

e2b7bebbca31b49252cd1ae00d56eb01e70f3b3e6a8eb79185e5c79d7ca81ed1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 09 Nov 2025 10:53:25 GMT
x-xss-protection: 0
content-type: text/javascript; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
server: ESF
x-frame-options: SAMEORIGIN

GET
H2 200 vcd15cbe7772f49c399c6a5babf22c1241717689176015 Show response
static.cloudflareinsights.com/beacon.min.js/ 19 KB
7 KB 54ms
31ms Script
text/javascript 104.16.80.73
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/lnouqg02oeflknv/b1.5_04.zip/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.80.73 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Origin: https://www.mediafire.com
Referer: https://www.mediafire.com/

Response headers

cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"2024.6.1"
cross-origin-resource-policy: cross-origin
cf-ray: 99bcc42959e8dbab-FRA
access-control-allow-origin: *
date: Sun, 09 Nov 2025 10:53:25 GMT
content-type: text/javascript;charset=UTF-8
last-modified: Thu, 06 Jun 2024 15:52:56 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 consent_modules.json Show response
privacy.gatekeeperconsent.com/ 125 B
568 B 35ms
12ms XHR
application/json 172.67.199.186
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://privacy.gatekeeperconsent.com/consent_modules.json
Requested by: Host: the.gatekeeperconsent.com
URL: https://the.gatekeeperconsent.com/cmp.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.199.186 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b13b1429e9de21ca5725d71313a23025090c8b7b64151338aab75b5f96088b5e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cache-control: max-age=15780000, public
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-encoding: zstd
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=cvKPiV%2FuxbyxiRlgxDtYfouMxs3oy92pnKhAYQllDRM7%2BhY5REmwHATEIpaB7%2Bl%2FoD6j4bqYUqQdE0E1McngpHAiW9o1ikZhi9Wayp41EpiwqX%2BwkEduPawEL5W5"}]}
cf-ray: 99bcc4294b97cb3f-FRA
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Sun, 09 Nov 2025 10:53:25 GMT
content-type: application/json;charset=UTF-8
vary: accept-encoding
server: cloudflare
priority: u=1,i

GET
H2 200 amplitude-8.5.0-min.gz.js Show response
cdn.amplitude.com/libs/ 68 KB
22 KB 41ms
14ms Script
application/javascript 18.245.86.4
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.amplitude.com/libs/amplitude-8.5.0-min.gz.js
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/lnouqg02oeflknv/b1.5_04.zip/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.245.86.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-245-86-4.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2450e5580136f94bda7ccf95e3167b57e15b05b513a430967943a50036fa47a4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Origin: https://www.mediafire.com
Referer: https://www.mediafire.com/

Response headers

access-control-max-age: 3000
content-encoding: gzip
etag: "660c3b546f2a131de50b69b91f26c636"
x-amz-version-id: NY8_7uBz3xoXYJBVsMSBAGHOz8ixMBS3
age: 179461
access-control-allow-methods: GET, HEAD
x-cache: Hit from cloudfront
x-amz-cf-id: HO0FTcPuUWkfdSXe9n6xlOWrPxKffAUHV5sI-rbRuhIgyk1lUAfYQg==
date: Fri, 07 Nov 2025 09:02:25 GMT
content-type: application/javascript
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method
last-modified: Fri, 13 Aug 2021 22:37:42 GMT
cache-control: max-age=31536000
via: 1.1 34f8e9435dea359238debf97e45feb10.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 22154
x-amz-cf-pop: FRA60-P6
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 381 KB
121 KB 70ms
27ms Script
application/javascript 142.250.184.200
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-53LP4T

Requested by

Host: www.mediafire.com
URL: https://www.mediafire.com/file/lnouqg02oeflknv/b1.5_04.zip/file

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.200 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

f11464e5eae1992d297c9b4ea17a3813d9600bcb99534495af9d2e85d4aca17a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: zstd
expires: Sun, 09 Nov 2025 10:53:25 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 09 Nov 2025 10:53:25 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Sun, 09 Nov 2025 09:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 123669
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 infinity.js.aspx Show response
cdn.econventa.com/Scripts/ 164 KB
48 KB 37ms
17ms Script
text/javascript 104.26.9.66
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.econventa.com/Scripts/infinity.js.aspx?guid=5ff0fb62-0643-4ff1-aaee-c737f9ffc0e0
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/lnouqg02oeflknv/b1.5_04.zip/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.26.9.66 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2b8bdb8e1e345a290d728e5e3bb3866e954fe113a2dde5429d9a7ce9c7cdeb33

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cache-control: max-age=1200, no-transform
content-encoding: gzip
cf-cache-status: HIT
age: 820
cf-ray: 99bcc4295a0f18ed-FRA
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Sun, 09 Nov 2025 10:53:25 GMT
content-type: text/javascript
vary: Accept-Encoding
server: cloudflare
last-modified: Sun, 09 Nov 2025 10:39:32 GMT
priority: u=3,i=?0

GET
H3 200 mf_logo_full_color.svg
static.mediafire.com/images/backgrounds/header/ 3 KB
2 KB 58ms
49ms Image
image/svg+xml 104.17.148.83
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://static.mediafire.com/images/backgrounds/header/mf_logo_full_color.svg
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/lnouqg02oeflknv/b1.5_04.zip/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.148.83 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8539c91ae0a82f8cab27d481ea38ac4e66d1e5b36701fe295bcba4399b9255bd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"5813cfb2-d1d"
age: 1154
access-control-allow-methods: OPTIONS, POST, GET
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Sun, 09 Nov 2025 10:53:25 GMT
content-type: image/svg+xml
last-modified: Fri, 28 Oct 2016 22:22:42 GMT
vary: Accept-Encoding
priority: u=3,i
x-mf-fe: mf2
cf-ray: 99bcc4294b383624-FRA
access-control-allow-origin: *
server: cloudflare

GET
H3 200 file-zip-v3.png
static.mediafire.com/images/filetype/ 2 KB
2 KB 57ms
47ms Image
image/png 104.17.148.83
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://static.mediafire.com/images/filetype/file-zip-v3.png
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/lnouqg02oeflknv/b1.5_04.zip/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.148.83 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4448e430d3c53bad548a5d135e1c7e2f9593e806ba47892640d430ea752e979e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cf-cache-status: HIT
etag: "62deda56-750"
age: 5737
access-control-allow-methods: OPTIONS, POST, GET
expires: Tue, 09 Dec 2025 09:17:28 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Sun, 09 Nov 2025 10:53:25 GMT
content-type: image/png
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
vary: Accept-Encoding
priority: u=3,i
cache-control: max-age=2592000
x-mf-fe: mf2
cf-ray: 99bcc4294b3a3624-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1872
server: cloudflare

GET
H3 200 icons_sprite.svg
www.mediafire.com/images/icons/svg_light/ 36 KB
8 KB 66ms
66ms Image
image/svg+xml 104.17.148.83
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://www.mediafire.com/images/icons/svg_light/icons_sprite.svg
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/lnouqg02oeflknv/b1.5_04.zip/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.148.83 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7ba1bc2084def769e77a7dbf97cd91d68fe6c6d55b5d183a7d36630da8da2b02

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/file/lnouqg02oeflknv/b1.5_04.zip/file

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"62deda56-90ab"
age: 5708
access-control-allow-methods: OPTIONS, POST, GET
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Sun, 09 Nov 2025 10:53:25 GMT
content-type: image/svg+xml
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
vary: Accept-Encoding
priority: u=3,i
cf-ray: 99bcc4293b2a3624-FRA
x-mf-fe: mf2
access-control-allow-origin: *
server: cloudflare

GET
H3 200 apps_list_sprite-v6.png
static.mediafire.com/images/backgrounds/download/ 8 KB
8 KB 49ms
49ms Image
image/png 104.17.148.83
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://static.mediafire.com/images/backgrounds/download/apps_list_sprite-v6.png
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/lnouqg02oeflknv/b1.5_04.zip/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.148.83 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dc54b817820f14ce6395ba2a037f37d4bb0af75d5b017336140793fbe2f7f738

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cf-cache-status: HIT
etag: "62deda56-1fd1"
age: 5708
access-control-allow-methods: OPTIONS, POST, GET
expires: Tue, 09 Dec 2025 09:17:37 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Sun, 09 Nov 2025 10:53:25 GMT
content-type: image/png
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
vary: Accept-Encoding
priority: u=1,i
cache-control: max-age=2592000
cf-ray: 99bcc4294b3f3624-FRA
x-mf-fe: mf1
accept-ranges: bytes
access-control-allow-origin: *
content-length: 8145
server: cloudflare

GET
H3 200 arrow_dropdown.svg
www.mediafire.com/images/icons/svg_dark/ 315 B
504 B 36ms
36ms Image
image/svg+xml 104.17.148.83
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://www.mediafire.com/images/icons/svg_dark/arrow_dropdown.svg
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/lnouqg02oeflknv/b1.5_04.zip/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.148.83 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 82b94716473aa225e715e117802145c5d2d725aa1ba9d476d61a5d3da16a8c26

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/file/lnouqg02oeflknv/b1.5_04.zip/file

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"62deda56-13b"
age: 5718
access-control-allow-methods: OPTIONS, POST, GET
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Sun, 09 Nov 2025 10:53:25 GMT
content-type: image/svg+xml
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
vary: Accept-Encoding
priority: u=3,i
cf-ray: 99bcc4293b2b3624-FRA
x-mf-fe: mf2
access-control-allow-origin: *
server: cloudflare

GET
H3 200 check_circle_green.svg
static.mediafire.com/images/icons/svg_dark/ 444 B
561 B 34ms
34ms Image
image/svg+xml 104.17.148.83
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://static.mediafire.com/images/icons/svg_dark/check_circle_green.svg
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/lnouqg02oeflknv/b1.5_04.zip/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.148.83 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 03c8d2dc7d985c3004ff2cd6d8148dd03560f37ed15efdf6c2d7f4d771d0e599

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"62deda56-1bc"
age: 5727
access-control-allow-methods: OPTIONS, POST, GET
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Sun, 09 Nov 2025 10:53:25 GMT
content-type: image/svg+xml
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
vary: Accept-Encoding
priority: u=1,i
x-mf-fe: mf2
cf-ray: 99bcc4294b403624-FRA
access-control-allow-origin: *
server: cloudflare

GET
H3 200 fb_16x16.png
static.mediafire.com/images/backgrounds/download/social/ 181 B
452 B 33ms
33ms Image
image/png 104.17.148.83
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://static.mediafire.com/images/backgrounds/download/social/fb_16x16.png
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/lnouqg02oeflknv/b1.5_04.zip/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.148.83 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 720671166ac43aba99e3952b0b9341ab4e0fee1fd891db54e2a07f05db653142

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cf-cache-status: HIT
etag: "62deda56-b5"
age: 5725
access-control-allow-methods: OPTIONS, POST, GET
expires: Tue, 09 Dec 2025 09:17:37 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Sun, 09 Nov 2025 10:53:25 GMT
content-type: image/png
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
vary: Accept-Encoding
priority: u=1,i
cache-control: max-age=2592000
x-mf-fe: mf2
cf-ray: 99bcc4294b3e3624-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 181
server: cloudflare

GET
H3 200 footerIcons.png
static.mediafire.com/images/backgrounds/footer/social/ 583 B
855 B 29ms
28ms Image
image/png 104.17.148.83
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://static.mediafire.com/images/backgrounds/footer/social/footerIcons.png
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/lnouqg02oeflknv/b1.5_04.zip/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.148.83 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f917a9105c311331b1d40f4d2bdbf11233c1c465616c1a9c46232f451463b061

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cf-cache-status: HIT
etag: "62deda56-247"
age: 5743
access-control-allow-methods: OPTIONS, POST, GET
expires: Tue, 09 Dec 2025 09:17:29 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Sun, 09 Nov 2025 10:53:25 GMT
content-type: image/png
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
vary: Accept-Encoding
priority: u=3,i
cache-control: max-age=2592000
x-mf-fe: mf2
cf-ray: 99bcc4294b413624-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 583
server: cloudflare

GET
H3 200 tcf2_stub.js Show response
privacy.gatekeeperconsent.com/ 1 KB
1 KB 49ms
36ms Script
application/javascript 172.67.199.186
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://privacy.gatekeeperconsent.com/tcf2_stub.js
Requested by: Host: the.gatekeeperconsent.com
URL: https://the.gatekeeperconsent.com/cmp.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.199.186 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 925beb768cc9209c0f4de784f15d6c1dde72232c5b457cb186fdea749d07eae8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cache-control: max-age=15780000, public
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-encoding: zstd
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=wkSX6EYvCtNjsaY%2FWZ8y5gIouOR%2FYHixIX0Hv%2F%2BKiprivbU%2Fg0f5zJazV3Vueui3U5KIpvuIzjTI7xmfGkAv6p03tZowQyJbLuQTuPXMkx8Qv30ibVkzKXUF8U7a"}]}
cf-ray: 99bcc4299b4c364b-FRA
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Sun, 09 Nov 2025 10:53:25 GMT
content-type: application/javascript
vary: accept-encoding
server: cloudflare
priority: u=3,i=?0

GET
H3 200 cmp.js Show response
the.gatekeeperconsent.com/v2/ 330 KB
80 KB 22ms
16ms Script
text/javascript 104.21.42.32
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://the.gatekeeperconsent.com/v2/cmp.js?v=445
Requested by: Host: the.gatekeeperconsent.com
URL: https://the.gatekeeperconsent.com/cmp.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.42.32 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9f337ce148170e54678bf4380a0bd5853d3fadefec8697dd426e6f71a0479f5e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
age: 578121
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=ZGYZSBw%2FwVJRKerdD5KrgEWwXOZgH2aEm1dp%2FGD922l5MvdCk7gAAl2KhTIl%2FduzW4Kp7%2F4a3flC8iXjHNJaekmFljit09avg2pwBSqtp776AKmnHJI9hAg%3D"}]}
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Sun, 09 Nov 2025 10:53:25 GMT
content-type: text/javascript; charset=utf-8
last-modified: Thu, 23 Oct 2025 18:36:19 GMT
vary: Accept-Encoding
priority: u=3,i=?0
cache-control: max-age=15780000, public
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray: 99bcc4298b90db0e-FRA
accept-ranges: bytes
server: cloudflare

GET
H3 200 like.php Show response
www.facebook.com/plugins/ Frame 13D5 0
108 B 122ms
101ms Document
text/html 157.240.253.35
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://www.facebook.com/plugins/like.php?href=http://www.facebook.com/MediaFire&width=193&layout=button_count&action=like&show_faces=false&share=true&height=30&appId=124578887583575

Requested by

Host: www.mediafire.com
URL: https://www.mediafire.com/file/lnouqg02oeflknv/b1.5_04.zip/file

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.253.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-02-fra5.facebook.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	default-src blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'nonce-QesCOXE0' blob: 'self' connect.facebook.net 'wasm-unsafe-eval' https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com https://.google-analytics.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com https://fonts.gstatic.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net .carriersignal.info blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com .tenor.co .tenor.com .giphy.com https://trustly.one/ https://.trustly.one/ https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co .tenor.com https://.giphy.com;child-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net accounts.meta.com .accounts.meta.com https://trustly.one/ https://.trustly.one/ https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net .google.com .doubleclick.net;manifest-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;object-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.mediafire.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: private, no-cache, no-store, must-revalidate
content-length: 0
content-security-policy: default-src blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'nonce-QesCOXE0' blob: 'self' connect.facebook.net 'wasm-unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;child-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net accounts.meta.com *.accounts.meta.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;manifest-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;object-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
content-type: text/html;charset=utf-8
cross-origin-opener-policy: same-origin-allow-popups
date: Sun, 09 Nov 2025 10:53:25 GMT
document-policy: include-js-call-stacks-in-crash-reports
expires: Sat, 01 Jan 2000 00:00:00 GMT
pragma: no-cache
priority: u=0,i
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7570677028074709691&cpp=C3&cv=1029628212&st=1762685605432"}]}
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7570677028074709691&cpp=C3&cv=1029628212&st=1762685605432"
x-content-type-options: nosniff
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=9, rtx=0, c=24, mss=1232, tbw=5219, tp=10, tpl=0, uplat=94, ullat=0
x-fb-debug: x9IUzSBvQIoyUOKJetTnDKtbVsDLdGFMPoGSqm1PJ+USpuJys477VF6CpJmGB6bVHiECTsC/1YUuG2es7JLj1w==
x-xss-protection: 0

GET
H3 200 world.svg
static.mediafire.com/images/backgrounds/download/additional_content/ 143 KB
53 KB 31ms
26ms Image
image/svg+xml 104.17.148.83
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://static.mediafire.com/images/backgrounds/download/additional_content/world.svg
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/lnouqg02oeflknv/b1.5_04.zip/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.148.83 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4342feac38021c4fe3069eba0edf1c2e1b4345e2b548b0afb7ab21b7369b3bc8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"62deda56-23ce2"
age: 5737
access-control-allow-methods: OPTIONS, POST, GET
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Sun, 09 Nov 2025 10:53:25 GMT
content-type: image/svg+xml
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
vary: Accept-Encoding
priority: u=3,i
x-mf-fe: mf2
cf-ray: 99bcc4298b6e3624-FRA
access-control-allow-origin: *
server: cloudflare

GET
H3 200 continent-na.svg
static.mediafire.com/images/backgrounds/download/additional_content/ 50 KB
19 KB 32ms
27ms Image
image/svg+xml 104.17.148.83
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://static.mediafire.com/images/backgrounds/download/additional_content/continent-na.svg
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/lnouqg02oeflknv/b1.5_04.zip/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.148.83 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 05cfe92d9794a54258a19bfec7ae0faa73f61b66416983136594b4f95bb114dd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"62deda56-c817"
age: 5661
access-control-allow-methods: OPTIONS, POST, GET
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Sun, 09 Nov 2025 10:53:25 GMT
content-type: image/svg+xml
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
vary: Accept-Encoding
priority: u=3,i
x-mf-fe: mf2
cf-ray: 99bcc4298b703624-FRA
access-control-allow-origin: *
server: cloudflare

GET
H3 200 can.svg
static.mediafire.com/images/flags_svg/ 1 KB
983 B 28ms
24ms Image
image/svg+xml 104.17.148.83
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://static.mediafire.com/images/flags_svg/can.svg
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/lnouqg02oeflknv/b1.5_04.zip/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.148.83 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aee034d31571969a8134d9e6afd5cfca4ee3a95a3111326f9170be403a66b3f6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"62deda56-58f"
age: 2813
access-control-allow-methods: OPTIONS, POST, GET
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Sun, 09 Nov 2025 10:53:25 GMT
content-type: image/svg+xml
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
vary: Accept-Encoding
priority: u=3,i
x-mf-fe: mf1
cf-ray: 99bcc4298b733624-FRA
access-control-allow-origin: *
server: cloudflare

GET
H3 200 flag.svg
static.mediafire.com/images/backgrounds/download/additional_content/ 234 B
463 B 43ms
39ms Image
image/svg+xml 104.17.148.83
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://static.mediafire.com/images/backgrounds/download/additional_content/flag.svg
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/lnouqg02oeflknv/b1.5_04.zip/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.148.83 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f52a0c7d9fa7ae8e45916c491ae7193f9a1e289f128f05264122c53d8da970db

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"62deda56-ea"
age: 5724
access-control-allow-methods: OPTIONS, POST, GET
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Sun, 09 Nov 2025 10:53:25 GMT
content-type: image/svg+xml
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
vary: Accept-Encoding
priority: u=3,i
x-mf-fe: mf1
cf-ray: 99bcc4298b753624-FRA
access-control-allow-origin: *
server: cloudflare

GET
H3 200 mf_round.svg
static.mediafire.com/images/backgrounds/download/additional_content/ 1 KB
1 KB 32ms
27ms Image
image/svg+xml 104.17.148.83
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://static.mediafire.com/images/backgrounds/download/additional_content/mf_round.svg
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/lnouqg02oeflknv/b1.5_04.zip/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.148.83 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f1a67642fc97b508ce07cf6df329022bf5184a1c573044dc021e0d6e64688c64

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"62deda56-5b1"
age: 5720
access-control-allow-methods: OPTIONS, POST, GET
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Sun, 09 Nov 2025 10:53:25 GMT
content-type: image/svg+xml
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
vary: Accept-Encoding
priority: u=3,i
x-mf-fe: mf1
cf-ray: 99bcc4298b763624-FRA
access-control-allow-origin: *
server: cloudflare

GET
H3 200 browser_chrome.svg
static.mediafire.com/images/backgrounds/download/additional_content/ 8 KB
2 KB 35ms
30ms Image
image/svg+xml 104.17.148.83
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://static.mediafire.com/images/backgrounds/download/additional_content/browser_chrome.svg
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/lnouqg02oeflknv/b1.5_04.zip/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.148.83 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1c6ba1010c2cc88c59de9e9584728da124770fa399643ffc1beffcec54b84be7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"62deda56-1e24"
age: 5509
access-control-allow-methods: OPTIONS, POST, GET
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Sun, 09 Nov 2025 10:53:25 GMT
content-type: image/svg+xml
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
vary: Accept-Encoding
priority: u=3,i
x-mf-fe: mf1
cf-ray: 99bcc4299b783624-FRA
access-control-allow-origin: *
server: cloudflare

POST
H2 200 / Show response
api.amplitude.com/ 7 B
137 B 725ms
363ms XHR
text/html 35.85.77.91
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://api.amplitude.com/

Requested by

Host: cdn.amplitude.com
URL: https://cdn.amplitude.com/libs/amplitude-8.5.0-min.gz.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.85.77.91 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-85-77-91.us-west-2.compute.amazonaws.com

Software

Resource Hash

aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Referer: https://www.mediafire.com/

Response headers

strict-transport-security: max-age=15768000
access-control-allow-origin: *
content-length: 7
date: Sun, 09 Nov 2025 10:53:26 GMT
content-type: text/html;charset=utf-8

GET
H3

200

main.js Show response
www.mediafire.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/fd468eb09fcf/ Frame DBA2
Redirect Chain

https://www.mediafire.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
https://www.mediafire.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/fd468eb09fcf/main.js?

10 KB
5 KB

18ms
17ms

Script
application/javascript

104.17.148.83
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://www.mediafire.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/fd468eb09fcf/main.js?

Requested by

Host: www.mediafire.com
URL: https://www.mediafire.com/file/lnouqg02oeflknv/b1.5_04.zip/file

Protocol

Server

104.17.148.83 , Ascension Island, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

09675fd54aab45b3d069813f52f6412144c96114dbaa344f313c599b8b7a8135

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer

Response headers

cache-control: max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public
content-encoding: gzip
x-content-type-options: nosniff
cf-ray: 99bcc42a0bc23624-FRA
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Sun, 09 Nov 2025 10:53:25 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare
priority: u=3,i=?0

Redirect headers

cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public
location: /cdn-cgi/challenge-platform/h/g/scripts/jsd/fd468eb09fcf/main.js?
cf-ray: 99bcc429dba33624-FRA
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
content-length: 0
server-timing: cfExtPri
date: Sun, 09 Nov 2025 10:53:25 GMT
vary: Accept-Encoding
server: cloudflare
priority: u=3,i=?0

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
623 B 84ms
57ms Fetch
image/gif 104.20.47.80
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=2&e=0.7402703205548767
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.47.80 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 537049
x-goog-stored-content-encoding: identity
expires: Mon, 03 Nov 2025 06:41:00 GMT
x-goog-stored-content-length: 43
date: Sun, 09 Nov 2025 10:53:25 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
vary: accept-encoding
x-guploader-uploadid: ABgVH88YWGJooP3RQypITTu4eUOoozimloKclx-VwjquNN2LVUHBg9UPfL6FjLVUgTCMD2_7
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 99bcc42a4e6d594d-FRA
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico Show response
ad.doubleclick.net/ 1 KB
129 B 39ms
16ms Fetch
image/x-icon 172.217.23.102
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.015123212479075776

Requested by

Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s45-in-f6.1e100.net

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Mon, 10 Nov 2025 10:53:25 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 09 Nov 2025 10:53:25 GMT
content-type: image/x-icon
vary: Accept-Encoding
last-modified: Tue, 08 May 2012 13:08:06 GMT
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
110 B 85ms
59ms Fetch
image/gif 104.20.47.80
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.22928616892444842
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.47.80 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 537049
x-goog-stored-content-encoding: identity
expires: Mon, 03 Nov 2025 06:41:00 GMT
x-goog-stored-content-length: 43
date: Sun, 09 Nov 2025 10:53:25 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
vary: accept-encoding
x-guploader-uploadid: ABgVH88YWGJooP3RQypITTu4eUOoozimloKclx-VwjquNN2LVUHBg9UPfL6FjLVUgTCMD2_7
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 99bcc42a4e6c594d-FRA
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H2 200 dns Show response
ab.dns-finder.com/meta/ 2 B
233 B 151ms
119ms Fetch
text/plain 34.36.200.111
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://ab.dns-finder.com/meta/dns
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.36.200.111 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 111.200.36.34.bc.googleusercontent.com
Software: /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cache-control: private, max-age=180, stale-if-error=180, stale-while-revalidate=180
access-control-expose-headers: X-Resolver
x-resolver: default
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
date: Sun, 09 Nov 2025 10:53:25 GMT
content-type: text/plain; charset=utf-8
vary: Origin

GET
H2 200 trustedIframe.html Show response
btloader.com/ Frame F3A8 6 KB
2 KB 47ms
32ms Document
text/html 172.66.171.133
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://btloader.com/trustedIframe.html?o=5678961798414336&upapi=true
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.66.171.133 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 76b14705bcd5752ac05035c95c7f53bfe8e65dda03bc77662e0aff067e3258e7

Request headers

Referer: https://www.mediafire.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

cache-control: public, max-age=3600, stale-while-revalidate=3600
cf-ray: 99bcc42a3bcd4e6c-FRA
content-encoding: br
content-type: text/html
date: Sun, 09 Nov 2025 10:53:25 GMT
server: cloudflare
vary: accept-encoding

POST
H2 200 saa.go Show response
g.ezoic.net/ 10 KB
4 KB 43ms
13ms XHR
text/javascript 52.57.221.121
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/saa.go
Requested by: Host: www.ezojs.com
URL: https://www.ezojs.com/ezoic/sa.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.57.221.121 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-57-221-121.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 4ba5eca789e58035079a496f337447ba5e6105e22772f0690a951bf3182eaf01

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex
access-control-max-age: 1728000
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
content-encoding: br
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, PUT, OPTIONS
expires: Sat, 08 Nov 2025 10:53:25 GMT
access-control-allow-origin: https://www.mediafire.com
date: Sun, 09 Nov 2025 10:53:25 GMT
content-type: text/javascript
vary: Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
access-control-allow-headers: Content-Type

GET
H3 200 boise.js Show response
go.ezodn.com/detroitchicago/ 824 B
942 B 44ms
15ms Script
application/javascript 188.114.96.3
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://go.ezodn.com/detroitchicago/boise.js?gcb=195-13&cb=5
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/lnouqg02oeflknv/b1.5_04.zip/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.96.3 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a4fafcd389d58bbd82e49d9a68e81e9dc8384330ff14ec3283a4d0d11812047b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex, follow
content-encoding: br
cf-cache-status: HIT
age: 1052683
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=2DuLZ7N%2FQLBzYvr1q5MyjDqzbgPHktbxTckGf7fYdTvwoBOfXRoH7dpcHsUaV8OAGtdHwpkv6SBX7HUTXb9t%2BOTt7wO%2BMJdbfPP5JA%3D%3D"}]}
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Sun, 09 Nov 2025 10:53:25 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding
last-modified: Tue, 28 Oct 2025 06:28:42 GMT
priority: u=3,i=?0
cache-control: public, max-age=31536000
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray: 99bcc42ab8321ca9-FRA
content-length: 426
server: cloudflare

GET
H3 200 abilene.js Show response
go.ezodn.com/parsonsmaize/ 11 KB
4 KB 46ms
17ms Script
application/javascript 188.114.96.3
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://go.ezodn.com/parsonsmaize/abilene.js?gcb=195-13&cb=dc112bb7ea
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/lnouqg02oeflknv/b1.5_04.zip/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.96.3 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f1c02e9ba02a159b34fc2d7d2be0a743b497a6cd0a422a0c3acc88b871b2af96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex, follow
content-encoding: br
cf-cache-status: HIT
age: 952676
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=vtvZ5mWZV4Jg02s9W25%2Bp2GLM7M4ZHsaQy%2Fgw%2B8I9ldCtA1gHyCCaZiWR9NJy8ZbB%2BYy78JFcpiJauzahGagIiW1Bu%2BwJ7mIF2DH1g%3D%3D"}]}
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Sun, 09 Nov 2025 10:53:25 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding
last-modified: Wed, 29 Oct 2025 10:15:28 GMT
priority: u=3,i=?0
cache-control: public, max-age=31536000
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray: 99bcc42ab8361ca9-FRA
server: cloudflare

GET
H3 200 identity.js Show response
www.ezojs.com/ 301 KB
90 KB 16ms
16ms Script
application/javascript 172.67.170.144
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://www.ezojs.com/identity.js
Requested by: Host: www.ezojs.com
URL: https://www.ezojs.com/ezoic/sa.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.170.144 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7f596391730ffc1ae1aaa2b67074a27da2706c305f11fa1b1231a2bd9fae289e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex, follow
content-encoding: gzip
cf-cache-status: HIT
etag: W/"d5f5d9ca38e16d7ca490a0c49b6c41b6"
age: 200
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=ka%2Bv9Q2eu7N6uvn0NOpEutuCyvjhgSATuD4sti2prK2KQ6VlS7r%2FS0LCeYabMWQrWr1S2E3cZmxuLviug70jnynOvGytZJ6h5j%2BdlyY%3D"}]}
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Sun, 09 Nov 2025 10:53:25 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding
priority: u=3,i=?0
cache-control: public, max-age=900, stale-while-revalidate=3600
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray: 99bcc42a8804361b-FRA
server: cloudflare

GET
H2 200 ezintegration
g.ezoic.net/ 43 B
121 B 8ms
7ms Image
image/gif 52.57.221.121
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://g.ezoic.net/ezintegration?d=www.mediafire.com&ts=1762685605467
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/lnouqg02oeflknv/b1.5_04.zip/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.57.221.121 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-57-221-121.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

expires: Sat, 08 Nov 2025 10:53:25 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
content-length: 43
date: Sun, 09 Nov 2025 10:53:25 GMT
x-middleton-display: integration_verify
content-type: image/gif
vary: Accept-Encoding

POST
H3 200 99bcc42749c73624 Show response
www.mediafire.com/cdn-cgi/challenge-platform/h/g/jsd/r/0.1579608968735335:1762684405:hRMCaCJowWoG7lcvFEq0QA6B2D2RIsd57nwQJRx3I4M/ Frame DBA2 0
470 B 22ms
18ms XHR
text/plain 104.17.148.83
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://www.mediafire.com/cdn-cgi/challenge-platform/h/g/jsd/r/0.1579608968735335:1762684405:hRMCaCJowWoG7lcvFEq0QA6B2D2RIsd57nwQJRx3I4M/99bcc42749c73624
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.148.83 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer

Response headers

cf-ray: 99bcc42b2c803624-FRA
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
content-length: 0
date: Sun, 09 Nov 2025 10:53:25 GMT
content-type: text/plain; charset=UTF-8
server: cloudflare
priority: u=1,i

POST
H2 204 exd
api.btloader.com/ 0
0 142ms
119ms Fetch 130.211.23.194
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://api.btloader.com/exd?tid=pai5KTGyAV-LKWJfZY30A-9a683fd64a&sid=1GO67gBH-KFCfNb1tY-9a683fd64a&cv=2.1.167&upapi=true
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.23.194 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 194.23.211.130.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

via: 1.1 google
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 09 Nov 2025 10:53:25 GMT
vary: Origin

GET
H2 200 m=el_main_css
www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.2f3WBw8L4SI.L.W.O/am=AAAD/d=0/rs=AN8SPfpxZ_PDqjwQqfIDlbJ_9iabaVfvFA/ 22 KB
5 KB 51ms
17ms Stylesheet
text/css 142.250.186.131
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.2f3WBw8L4SI.L.W.O/am=AAAD/d=0/rs=AN8SPfpxZ_PDqjwQqfIDlbJ_9iabaVfvFA/m=el_main_css

Requested by

Host:
URL: /_/translate_http/_/js/k=translate_http.tr.de.f55SSMLZ8K4.O/am=AAAD/d=1/rs=AN8SPfpcuoxJKEDwAl3ccnB1YOnerkUi9w/m=el_conf

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.131 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f3.1e100.net

Software

sffe /

Resource Hash

fb1bd700eb83832fc2ca14c9fd537e5facad95f3bd15632db0c4b1c5a5bd7e20

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
age: 4742
report-to: {"group":"rosetta","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/rosetta"}]}
x-content-type-options: nosniff
expires: Mon, 09 Nov 2026 09:34:23 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 09 Nov 2025 09:34:23 GMT
last-modified: Wed, 15 Oct 2025 01:09:54 GMT
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=31536000
cross-origin-opener-policy: same-origin; report-to="rosetta"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/rosetta
accept-ranges: bytes
access-control-allow-origin: *
content-length: 4155
x-xss-protection: 0
server: sffe

GET
H2 200 m=el_main Show response
translate.googleapis.com/_/translate_http/_/js/k=translate_http.tr.de.f55SSMLZ8K4.O/am=AAAQ/d=1/exm=el_conf/ed=1/rs=AN8SPfqCc6bNF6BKdZ--ilKqpC6uOcINRQ/ 352 KB
102 KB 38ms
9ms Script
text/javascript 142.250.186.42
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://translate.googleapis.com/_/translate_http/_/js/k=translate_http.tr.de.f55SSMLZ8K4.O/am=AAAQ/d=1/exm=el_conf/ed=1/rs=AN8SPfqCc6bNF6BKdZ--ilKqpC6uOcINRQ/m=el_main

Requested by

Host:
URL: /_/translate_http/_/js/k=translate_http.tr.de.f55SSMLZ8K4.O/am=AAAD/d=1/rs=AN8SPfpcuoxJKEDwAl3ccnB1YOnerkUi9w/m=el_conf

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

142.250.186.42 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f10.1e100.net

Software

sffe /

Resource Hash

696642980342cdb9c2e57d199ea188db4928c518de52d9dbe349cd0ca8e400bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
age: 232105
report-to: {"group":"rosetta","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/rosetta"}]}
x-content-type-options: nosniff
expires: Fri, 06 Nov 2026 18:25:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 06 Nov 2025 18:25:00 GMT
last-modified: Wed, 05 Nov 2025 10:10:01 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=31536000
cross-origin-opener-policy: same-origin; report-to="rosetta"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/rosetta
accept-ranges: bytes
access-control-allow-origin: *
content-length: 103949
x-xss-protection: 0
server: sffe

GET
H3 200 Tag.engine Show response
econventa.com/ 2 KB
4 KB 141ms
131ms Script
application/json 104.26.9.66
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://econventa.com/Tag.engine?time=-60&id=5ff0fb62-0643-4ff1-aaee-c737f9ffc0e0&rand=58633&ver=async&referrerUrl=&fingerPrint=123&abr=false&stdTime=60&fpe=1&bw=1600&bh=1200&res=1600x1200&curl=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Flnouqg02oeflknv%2Fb1.5_04.zip%2Ffile&kw=online%20storage%2Cfree%20storage%2Ccloud%20storage%2Ccollaboration%2Cbackup%20file%20sharing%2Cshare%20files%2Cphoto%20backup%2Cphoto%20sharing%2Cftp%20replacement%2Ccross%20platform%2Cremote%20access%2Cmobile%20access%2Csend%20large%20files%2Crecover%20files%2Cfile%20versioning%2Cundelete%2Cwindows%2Cpc%2Cmac%2Cos%20x%2Clinux%2Ciphone
Requested by: Host: cdn.econventa.com
URL: https://cdn.econventa.com/Scripts/infinity.js.aspx?guid=5ff0fb62-0643-4ff1-aaee-c737f9ffc0e0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.26.9.66 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8bb4504c438425d5f73480e8935e36ad26179599fd462848ebb59bf2e9e43e57

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version
cf-ray: 99bcc42b6a1d18ed-FRA
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Sun, 09 Nov 2025 10:53:25 GMT
content-type: application/json
vary: Accept-Encoding
server: cloudflare
priority: u=3,i=?0

GET
H3 200 config.json Show response
the.gatekeeperconsent.com/v2/ 18 KB
3 KB 26ms
18ms XHR
application/json 104.21.42.32
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://the.gatekeeperconsent.com/v2/config.json?domain=www.mediafire.com&changeLogId=0&cb=0

Requested by

Host: the.gatekeeperconsent.com
URL: https://the.gatekeeperconsent.com/v2/cmp.js?v=445

Protocol

Security

QUIC, , AES_128_GCM

Server

104.21.42.32 , Ascension Island, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c0f74ef7784a0cc296ef08dcec4f3d9b5db71c3b2df596552715c058a61d7745

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'
X-Content-Type-Options	nosniff
X-Frame-Options	deny

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=lVcd6%2F%2FPfsW9iS4x0vBZG3MJ2Z0wpAzmwUFvFW2Wwk7VKF%2BtzfYawbKEdjVe7DX8TN%2BTP4vCN%2Bo38anf9HX%2FtmkAjY7HeCf9vI7sb12FKMqMB%2BdeST48k10%3D"}]}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Sun, 09 Nov 2025 10:53:25 GMT
content-type: application/json, application/json
vary: Accept-Encoding
priority: u=1,i
x-frame-options: deny
content-security-policy: default-src 'none'
cache-control: max-age=3600, public
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray: 99bcc42b7d523735-FRA
access-control-allow-origin: *
server: cloudflare

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 500 KB
162 KB 21ms
17ms Script
application/javascript 142.250.184.200
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-K68XP6D85D&cx=c&gtm=4e5b50

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-53LP4T

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.200 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

c3185477d905b9788eab0ec7cff6852e3127b94743c0decf7287a983e31b7f13

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
content-encoding: zstd
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Sun, 09 Nov 2025 10:53:25 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 166096
date: Sun, 09 Nov 2025 10:53:25 GMT
x-xss-protection: 0
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Google Tag Manager
access-control-allow-headers: Cache-Control

GET
H3 200 gvl.json Show response
the.gatekeeperconsent.com/cmp/ 802 KB
93 KB 12ms
12ms XHR
application/json 104.21.42.32
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://the.gatekeeperconsent.com/cmp/gvl.json?v=10&lang=en
Requested by: Host: the.gatekeeperconsent.com
URL: https://the.gatekeeperconsent.com/v2/cmp.js?v=445
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.42.32 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0e4f51b28ecec8f56883feac2f87d89c46d8b2d56b008dd9aa05f404915f8a8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
age: 188915
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=08K87rDTLFGppsVylZVPDWCZm66vBUMzZjaT1PmKCilxltSvq55XvF1L9AUqGZMP7OhrRDS%2BWtyCLd42e%2B4Cmw1Nf1UwATdPF02zO8hJJmmbfm4EhwrqndA%3D"}]}
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Sun, 09 Nov 2025 10:53:25 GMT
content-type: application/json
last-modified: Fri, 07 Nov 2025 06:24:49 GMT
vary: Accept-Encoding
priority: u=1,i
cache-control: max-age=345600, public
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray: 99bcc42bcd543735-FRA
accept-ranges: bytes
access-control-allow-origin: *
server: cloudflare

POST
H2 200 sa.go Show response
g.ezoic.net/ 132 KB
31 KB 25ms
22ms XHR
text/javascript 52.57.221.121
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/sa.go
Requested by: Host: www.ezojs.com
URL: https://www.ezojs.com/ezoic/sa.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.57.221.121 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-57-221-121.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 854d4c77e8e00f312f25730c7c361a883849690a2dbbadb697a4373081b6455f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex
access-control-max-age: 1728000
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
content-encoding: br
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, PUT, OPTIONS
expires: Sat, 08 Nov 2025 10:53:25 GMT
access-control-allow-origin: https://www.mediafire.com
date: Sun, 09 Nov 2025 10:53:25 GMT
content-type: text/javascript
vary: Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
access-control-allow-headers: Content-Type

GET
H3 200 mulvane.js Show response
go.ezodn.com/parsonsmaize/ 1 KB
1005 B 14ms
14ms Script
application/javascript 188.114.96.3
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://go.ezodn.com/parsonsmaize/mulvane.js?gcb=195-13&cb=e75e48eec0
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/lnouqg02oeflknv/b1.5_04.zip/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.96.3 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9b41253384e2818bd0f76171d6ffd723d4c85c5e1a69da74f174489cb52a40ce

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex, follow
content-encoding: br
cf-cache-status: HIT
age: 972295
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=N%2BWHLxSau%2F5RGZljyd9ZB9KPdrOWAzCpO9%2BSivcbRWapBlV573dd4EC3qXn%2F%2F2Uy4Ui3ldGslb231v9U%2FRdlmn3FJPETjIAGI6CMRA%3D%3D"}]}
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Sun, 09 Nov 2025 10:53:25 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding
last-modified: Wed, 29 Oct 2025 04:48:30 GMT
priority: u=3,i=?0
cache-control: public, max-age=31536000
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray: 99bcc42bd9291ca9-FRA
content-length: 522
server: cloudflare

GET
H3 200 birmingham.js Show response
go.ezodn.com/detroitchicago/ 752 B
857 B 17ms
16ms Script
application/javascript 188.114.96.3
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://go.ezodn.com/detroitchicago/birmingham.js?gcb=195-13&cb=539c47377c
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/lnouqg02oeflknv/b1.5_04.zip/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.96.3 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 30be558393bd8b0585c806a6eaed6d6f5b51d1ca63c0113061dfe35eaa128ce3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex, follow
content-encoding: br
cf-cache-status: HIT
age: 973792
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=yPDboFJRW3fVBbiHJ0Ao2F%2FtJ9yj0vfHeLGoLpZkDqge%2Fevq4gmRdlS5h1rqaIbXH6jLSjhsAwSYguJUw8ChOxMkE4HLg6Oecqgezg%3D%3D"}]}
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Sun, 09 Nov 2025 10:53:25 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding
last-modified: Wed, 29 Oct 2025 04:23:33 GMT
priority: u=3,i=?0
cache-control: public, max-age=31536000
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray: 99bcc42bd92d1ca9-FRA
content-length: 380
server: cloudflare

GET
H3 200 ezoicanalytics.js Show response
go.ezodn.com/ 2 KB
1 KB 17ms
17ms Script
application/javascript 188.114.96.3
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://go.ezodn.com/ezoicanalytics.js?cb=1&dcb=195-13&shcb=34
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/lnouqg02oeflknv/b1.5_04.zip/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.96.3 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e814d50a228f54aecf40d8a58e41d48ce1dfc4376fd5fbedc28078fe0a8c5526

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex, follow
content-encoding: br
cf-cache-status: HIT
age: 33349
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=gMZEXSJAxLWj8EQTtn%2BgspukZ4wwYXXa9rJW40ZSvuU0T7jnj%2Bh%2F3kBnJEMJ9dbb1KUfQwHCFl2peWdFrzldmtdspC1KRJrDifNbSw%3D%3D"}]}
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Sun, 09 Nov 2025 10:53:25 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding
last-modified: Sun, 09 Nov 2025 01:37:36 GMT
priority: u=3,i=?0
cache-control: public, max-age=86400
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray: 99bcc42bd92f1ca9-FRA
server: cloudflare

GET
DATA 200
OK truncated Show response
/ Frame E097 2 KB
2 KB Document
text/html

General

Check archive.org

Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0dcae222606cf25659d185a62f2fcd41caf42f6dd3d9dda50eda1f281e304065

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

Content-Type: text/html;charset=UTF-8

GET
H3 200 24px.svg
fonts.gstatic.com/s/i/productlogos/translate/v14/ 6 KB
3 KB 27ms
7ms Image
image/svg+xml 142.250.185.195
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://fonts.gstatic.com/s/i/productlogos/translate/v14/24px.svg

Requested by

Host: www.mediafire.com
URL: https://www.mediafire.com/file/lnouqg02oeflknv/b1.5_04.zip/file

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.195 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f3.1e100.net

Software

sffe /

Resource Hash

ab5c23a05e39deed14d9d8262b0dce9f024f86105a27196cad37d14a3f516e09

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
age: 438840
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Wed, 04 Nov 2026 08:59:25 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 04 Nov 2025 08:59:25 GMT
last-modified: Wed, 20 Apr 2022 14:24:23 GMT
content-type: image/svg+xml
vary: Accept-Encoding
cache-control: public, max-age=31536000
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 3340
x-xss-protection: 0
server: sffe

GET
H2 200 googlelogo_color_42x16dp.png
www.gstatic.com/images/branding/googlelogo/1x/ 910 B
1 KB 9ms
8ms Image
image/png 142.250.186.131
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://www.gstatic.com/images/branding/googlelogo/1x/googlelogo_color_42x16dp.png

Requested by

Host: www.mediafire.com
URL: https://www.mediafire.com/file/lnouqg02oeflknv/b1.5_04.zip/file

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.131 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f3.1e100.net

Software

sffe /

Resource Hash

6318394f737c66f0e2ccfcd88e3935c6667633a1b95fa29fba2b75431d55eef2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

age: 119509
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
x-content-type-options: nosniff
expires: Sun, 08 Nov 2026 01:41:36 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 08 Nov 2025 01:41:36 GMT
last-modified: Thu, 02 Nov 2023 22:48:00 GMT
content-type: image/png
vary: Origin
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
content-length: 910
x-xss-protection: 0
server: sffe

GET
H2 200 translate_24dp.png
www.gstatic.com/images/branding/product/2x/ 2 KB
2 KB 11ms
11ms Image
image/png 142.250.186.131
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://www.gstatic.com/images/branding/product/2x/translate_24dp.png

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.2f3WBw8L4SI.L.W.O/am=AAAD/d=0/rs=AN8SPfpxZ_PDqjwQqfIDlbJ_9iabaVfvFA/m=el_main_css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.131 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f3.1e100.net

Software

sffe /

Resource Hash

4dac0026fbfa2615dce30c0af12830863fe885f84387a0147b9e338f548d5d82

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.2f3WBw8L4SI.L.W.O/am=AAAD/d=0/rs=AN8SPfpxZ_PDqjwQqfIDlbJ_9iabaVfvFA/m=el_main_css

Response headers

age: 31737
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
x-content-type-options: nosniff
expires: Mon, 09 Nov 2026 02:04:28 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 09 Nov 2025 02:04:28 GMT
last-modified: Thu, 14 Oct 2021 09:08:00 GMT
content-type: image/png
vary: Origin
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
content-length: 1842
x-xss-protection: 0
server: sffe

GET
H3 200 gvl.json Show response
the.gatekeeperconsent.com/cmp/ 49 KB
10 KB 14ms
14ms XHR
application/json 104.21.42.32
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://the.gatekeeperconsent.com/cmp/gvl.json?v=10&lang=de
Requested by: Host: the.gatekeeperconsent.com
URL: https://the.gatekeeperconsent.com/v2/cmp.js?v=445
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.42.32 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f6b526d7aba8368301c472d0f661c5fad948af7f7c2a69379a86954d985f3344

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
age: 106090
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=JI4wR5mzkTse5qeupYdaz1bRwJo7GoBZ0TY93x814o5ZpPqNT6G6jqNl7M2Xg3Tt1gqKo6S4D6GTc8WKr%2BsUw0OWQOZu6xdRYOR9FslRI6SEowYsvhIPt6U%3D"}]}
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Sun, 09 Nov 2025 10:53:25 GMT
content-type: application/json
last-modified: Sat, 08 Nov 2025 05:25:15 GMT
vary: Accept-Encoding
priority: u=1,i
cache-control: max-age=345600, public
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray: 99bcc42c1d583735-FRA
accept-ranges: bytes
access-control-allow-origin: *
server: cloudflare

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
111 B 14ms
14ms Fetch
image/gif 104.20.47.80
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.4454161089415397
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.47.80 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 537049
x-goog-stored-content-encoding: identity
expires: Mon, 03 Nov 2025 06:41:00 GMT
x-goog-stored-content-length: 43
date: Sun, 09 Nov 2025 10:53:25 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
vary: accept-encoding
x-guploader-uploadid: ABgVH88YWGJooP3RQypITTu4eUOoozimloKclx-VwjquNN2LVUHBg9UPfL6FjLVUgTCMD2_7
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 99bcc42c2fd1594d-FRA
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

OPTIONS
H3 200 main_modal_firstpage
the.gatekeeperconsent.com/cmp/v2/ Frame 0
0 13ms
13ms Preflight 104.21.42.32
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://the.gatekeeperconsent.com/cmp/v2/main_modal_firstpage?domain=www.mediafire.com&region=default&lang=de-DE&cb=445&changeLogId=2358709
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.42.32 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://www.mediafire.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET, POST, PUT, OPTIONS
access-control-allow-origin: https://www.mediafire.com
access-control-max-age: 1728000
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 99bcc42c6d5e3735-FRA
content-length: 0
date: Sun, 09 Nov 2025 10:53:25 GMT
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
priority: u=1,i
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=u8RAy47JMW8MjlQ99dar51iJbfgv7vDtitKSqbELEDOlWMBAKdeWjKiJkavXKn%2BwCvLJJCJPmFrCSqcCZlE7fOG%2BKc7H87qvj0OjJ0ukwrxfXhKPpPBmZfc%3D"}]}
server: cloudflare
server-timing: cfExtPri
vary: Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers

GET
H3 200 main_modal_firstpage Show response
the.gatekeeperconsent.com/cmp/v2/ 22 KB
5 KB 16ms
16ms Fetch
text/html 104.21.42.32
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://the.gatekeeperconsent.com/cmp/v2/main_modal_firstpage?domain=www.mediafire.com&region=default&lang=de-DE&cb=445&changeLogId=2358709
Requested by: Host: the.gatekeeperconsent.com
URL: https://the.gatekeeperconsent.com/v2/cmp.js?v=445
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.42.32 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 71d32d7fd94e614f348af4afbbd05bee609e45428addc2c35cbe86c88748a2f4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type: application/json
Referer: https://www.mediafire.com/

Response headers

access-control-max-age: 1728000
content-encoding: zstd
cf-cache-status: HIT
age: 193434
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=dEUHLaPB9cc6%2BBOTG9ptDQUBSexUZAcduLpgNEHhAbjqqHHP417tUCaTbV4g4WSalavpXza1YNT9b5HuCsUh3fHxTiLDlT76p3MVSEBk5XPNApjl0DWwk8Q%3D"}]}
access-control-allow-methods: GET, POST, PUT, OPTIONS
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Sun, 09 Nov 2025 10:53:25 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
last-modified: Fri, 07 Nov 2025 05:09:31 GMT
access-control-allow-headers: Content-Type
priority: u=1,i
cache-control: max-age=2592000, public
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
access-control-allow-credentials: true
cf-ray: 99bcc42c8d5f3735-FRA
access-control-allow-origin: https://www.mediafire.com
server: cloudflare

POST
H2 200 analytics Show response
g.ezoic.net/ezais/ 14 KB
5 KB 46ms
19ms Fetch
text/plain 52.57.221.121
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/ezais/analytics?cb=1
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/ezoicanalytics.js?cb=1&dcb=195-13&shcb=34
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.57.221.121 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-57-221-121.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 2944ab2d51f65aef502a3809e8e36483d8f9c66629b5547993142f8cfacbfd6c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex
access-control-max-age: 1728000
content-encoding: br
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, PUT, OPTIONS
access-control-allow-origin: https://www.mediafire.com
date: Sun, 09 Nov 2025 10:53:25 GMT
content-type: text/plain; charset=utf-8
vary: Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
access-control-allow-headers: Content-Type

GET
H2 404 0 Show response
www.mediafiredls.com/onclick/ 5 B
508 B 41ms
13ms XHR
text/plain 172.67.73.78
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://www.mediafiredls.com/onclick/0

Requested by

Host: www.mediafire.com
URL: https://www.mediafire.com/file/lnouqg02oeflknv/b1.5_04.zip/file

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.73.78 , Ascension Island, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c6c094bc0054f9cbe34102ff49f86b3928b5ac09f3d2ac87e170d0500675921f

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-encoding: br
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=HdtnptfijL%2Bhe2gvBPCdUN9SJi%2F%2BSnqx1FYux10VrkC%2B%2BZ6vZlhJQFSiM4JfPO2CIHfth7BDFchr9HRyeS6kir4vJ9HQZGYaLMpIqQE9HN25z4g%3D"}]}
referrer-policy: same-origin
cf-ray: 99bcc42cab03d9d6-FRA
expires: Thu, 01 Jan 1970 00:00:01 GMT
access-control-allow-origin: *
date: Sun, 09 Nov 2025 10:53:25 GMT
content-type: text/plain
vary: accept-encoding
server: cloudflare
x-frame-options: SAMEORIGIN

POST
H3 204 rum Show response
www.mediafire.com/cdn-cgi/ 0
142 B 16ms
15ms XHR
text/plain 104.17.148.83
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://www.mediafire.com/cdn-cgi/rum?

Requested by

Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.148.83 , Ascension Island, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
content-type: application/json
Referer: https://www.mediafire.com/file/lnouqg02oeflknv/b1.5_04.zip/file

Response headers

access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-methods: POST,OPTIONS
x-content-type-options: nosniff
cf-ray: 99bcc42c8d563624-FRA
access-control-allow-origin: https://www.mediafire.com
date: Sun, 09 Nov 2025 10:53:25 GMT
vary: Origin
server: cloudflare
x-frame-options: DENY

GET
H3 200 favicon.ico
www.mediafire.com/ 11 KB
2 KB 35ms
34ms Other
image/x-icon 104.17.148.83
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://www.mediafire.com/favicon.ico
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.148.83 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cdc78cc8b2994712a041a2a4cb02f488afbab00981771bdd3a8036c2dddf540f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/file/lnouqg02oeflknv/b1.5_04.zip/file

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"62deda56-2a46"
age: 149761
access-control-allow-methods: OPTIONS, POST, GET
expires: Sun, 07 Dec 2025 17:17:24 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Sun, 09 Nov 2025 10:53:25 GMT
content-type: image/x-icon
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
vary: Accept-Encoding
priority: u=1,i
cache-control: max-age=2592000
cf-ray: 99bcc42c8d573624-FRA
x-mf-fe: mf1
access-control-allow-origin: *
server: cloudflare

GET
H2 200 olathe.js Show response
g.ezoic.net/parsonsmaize/ 2 KB
954 B 9ms
8ms Script
application/javascript 52.57.221.121
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/parsonsmaize/olathe.js?gcb=195-13&cb=30
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/lnouqg02oeflknv/b1.5_04.zip/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.57.221.121 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-57-221-121.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 3cefef7fc952707c97375ef3fa95a8c45a96eda7845d02bc1c28bf3570c0cfba

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex, follow
cache-control: max-age=31536000, public
content-encoding: br
date: Sun, 09 Nov 2025 10:53:25 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding

GET
H2 200 et.js Show response
g.ezoic.net/porpoiseant/ 1 KB
602 B 52ms
51ms Script
application/javascript 52.57.221.121
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/porpoiseant/et.js?gcb=195-13&cb=3
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/lnouqg02oeflknv/b1.5_04.zip/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.57.221.121 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-57-221-121.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 0f67393986c012dbf48aa3149e2874bd84ed5f466362ad1ac31305f697f1da7b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex, follow
cache-control: max-age=31536000, public
content-encoding: br
content-length: 571
date: Sun, 09 Nov 2025 10:53:25 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding

GET
H2 200 reno.js Show response
g.ezoic.net/detroitchicago/ 2 KB
601 B 12ms
11ms Script
application/javascript 52.57.221.121
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/detroitchicago/reno.js?gcb=195-13&cb=45171a0f72
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/lnouqg02oeflknv/b1.5_04.zip/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.57.221.121 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-57-221-121.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 6896b59e8034378b31284eea779e568986c0337a8eb3e648efbf52fd8d5d3781

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex, follow
cache-control: max-age=31536000, public
content-encoding: br
content-length: 570
date: Sun, 09 Nov 2025 10:53:25 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding

GET
H2 200 overlandpark.js Show response
g.ezoic.net/detroitchicago/ 1 KB
519 B 9ms
8ms Script
application/javascript 52.57.221.121
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/detroitchicago/overlandpark.js?gcb=195-13&cb=301bbdaf04
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/lnouqg02oeflknv/b1.5_04.zip/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.57.221.121 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-57-221-121.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 8b3a000db28359e0512e1484988806b9cdaeb457e29ef6b82bfe097e6eed3231

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex, follow
cache-control: max-age=31536000, public
content-encoding: br
content-length: 488
date: Sun, 09 Nov 2025 10:53:25 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding

GET
H2 200 denver.js Show response
g.ezoic.net/detroitchicago/ 2 KB
1 KB 12ms
11ms Script
application/javascript 52.57.221.121
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/detroitchicago/denver.js?gcb=195-13&cb=4ff75c6f00
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/lnouqg02oeflknv/b1.5_04.zip/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.57.221.121 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-57-221-121.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 3b9ffd186b78d9ad93b8f8f63b927976df2c98d29ecf5186c18b80d645cfd134

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex, follow
cache-control: max-age=31536000, public
content-encoding: br
date: Sun, 09 Nov 2025 10:53:25 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding

GET
H2 200 wichita.js Show response
g.ezoic.net/detroitchicago/ 2 KB
982 B 15ms
14ms Script
application/javascript 52.57.221.121
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/detroitchicago/wichita.js?gcb=195-13&cb=e49d8d9bca
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/lnouqg02oeflknv/b1.5_04.zip/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.57.221.121 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-57-221-121.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: b837449c7254dd5887b620b7903bb4dbafbf2424ae3eb25e7a9f3471ff105365

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex, follow
cache-control: max-age=31536000, public
content-encoding: br
date: Sun, 09 Nov 2025 10:53:25 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding

GET
H2 200 vitals.js Show response
g.ezoic.net/tardisrocinante/ 11 KB
4 KB 14ms
14ms Script
application/javascript 52.57.221.121
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/tardisrocinante/vitals.js?gcb=13&cb=5
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/lnouqg02oeflknv/b1.5_04.zip/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.57.221.121 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-57-221-121.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 6fca1361d81b8d8d05afbe947e257aef026891372b45e0d2de123a907a4ed1af

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex, follow
cache-control: max-age=31536000, public
content-encoding: br
date: Sun, 09 Nov 2025 10:53:25 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding

GET
H2 200 drake.js Show response
g.ezoic.net/beardeddragon/ 4 KB
1 KB 14ms
13ms Script
application/javascript 52.57.221.121
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/beardeddragon/drake.js?gcb=13&cb=1b0a0a9dcc
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/lnouqg02oeflknv/b1.5_04.zip/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.57.221.121 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-57-221-121.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: a5e87590d9232e0b0be4c640eeb47cb4f4299af754f195c802d49fe380ea1870

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex, follow
cache-control: max-age=31536000, public
content-encoding: br
date: Sun, 09 Nov 2025 10:53:25 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding

GET
H2 200 chanute.js Show response
g.ezoic.net/parsonsmaize/ 20 KB
5 KB 15ms
14ms Script
application/javascript 52.57.221.121
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/parsonsmaize/chanute.js?a=a&cb=17&dcb=195-13&shcb=34
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/lnouqg02oeflknv/b1.5_04.zip/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.57.221.121 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-57-221-121.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 89786a1f649d6044a4702e297404445af6a3eab8332d9f676cb4312196da3d7f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex, follow
cache-control: max-age=31536000, public
content-encoding: br
date: Sun, 09 Nov 2025 10:53:25 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding

GET
H2 200 jellyfish.js Show response
g.ezoic.net/porpoiseant/ 23 KB
6 KB 14ms
14ms Script
application/javascript 52.57.221.121
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/porpoiseant/jellyfish.js?a=a&cb=18&dcb=195-13&shcb=34
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/lnouqg02oeflknv/b1.5_04.zip/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.57.221.121 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-57-221-121.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 46468ec4089d4bea3f0e0811eea2d9e9cde6305118df0673d2972d290f1d00f0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex, follow
cache-control: max-age=31536000, public
content-encoding: br
date: Sun, 09 Nov 2025 10:53:25 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding

POST
H2 200 imp.gif
g.ezoic.net/detroitchicago/ 43 B
113 B 38ms
31ms Ping
image/gif 52.57.221.121
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/detroitchicago/imp.gif
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/parsonsmaize/abilene.js?gcb=195-13&cb=dc112bb7ea
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.57.221.121 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-57-221-121.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://www.mediafire.com/

Response headers

access-control-max-age: 1728000, 1728000
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, PUT, OPTIONS, HEAD, PUT, POST, GET, OPTIONS
expires: Sat, 08 Nov 2025 10:53:25 GMT
access-control-allow-origin: https://www.mediafire.com, https://www.mediafire.com
content-length: 43
date: Sun, 09 Nov 2025 10:53:25 GMT
x-middleton-display: imp_sol
content-type: image/gif
vary: Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
access-control-allow-headers: Content-Type, Content-Type

GET
H2 200 omaha.js Show response
g.ezoic.net/detroitchicago/ 1 KB
624 B 12ms
9ms Script
application/javascript 52.57.221.121
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/detroitchicago/omaha.js?gcb=195-13&cb=8f3688675f
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/lnouqg02oeflknv/b1.5_04.zip/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.57.221.121 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-57-221-121.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 032e1fdc72c9c669bbd7dcb841fc1cdcd7a9148a5802dd668c508efd0c11d7a0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex, follow
cache-control: max-age=31536000, public
content-encoding: br
content-length: 593
date: Sun, 09 Nov 2025 10:53:25 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding

GET
H3 200 favicon.ico Show response
ad.doubleclick.net/ 1 KB
129 B 16ms
15ms Fetch
image/x-icon 172.217.23.102
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.48576273552642446

Requested by

Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s45-in-f6.1e100.net

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Mon, 10 Nov 2025 10:53:25 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 09 Nov 2025 10:53:25 GMT
content-type: image/x-icon
vary: Accept-Encoding
last-modified: Tue, 08 May 2012 13:08:06 GMT
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
111 B 13ms
13ms Fetch
image/gif 104.20.47.80
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=2&e=0.8657130153330055
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.47.80 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 537049
x-goog-stored-content-encoding: identity
expires: Mon, 03 Nov 2025 06:41:00 GMT
x-goog-stored-content-length: 43
date: Sun, 09 Nov 2025 10:53:25 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
vary: accept-encoding
x-guploader-uploadid: ABgVH88YWGJooP3RQypITTu4eUOoozimloKclx-VwjquNN2LVUHBg9UPfL6FjLVUgTCMD2_7
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 99bcc42d487b594d-FRA
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
140 B 14ms
13ms Fetch
image/gif 104.20.47.80
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=2&e=0.043784697977610976
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.47.80 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 537050
x-goog-stored-content-encoding: identity
expires: Mon, 03 Nov 2025 06:41:00 GMT
x-goog-stored-content-length: 43
date: Sun, 09 Nov 2025 10:53:26 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
vary: accept-encoding
x-guploader-uploadid: ABgVH88YWGJooP3RQypITTu4eUOoozimloKclx-VwjquNN2LVUHBg9UPfL6FjLVUgTCMD2_7
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 99bcc4317bd9594d-FRA
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico Show response
ad.doubleclick.net/ 1 KB
129 B 16ms
16ms Fetch
image/x-icon 172.217.23.102
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.602018511256907

Requested by

Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s45-in-f6.1e100.net

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Mon, 10 Nov 2025 10:53:26 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 09 Nov 2025 10:53:26 GMT
content-type: image/x-icon
vary: Accept-Encoding
last-modified: Tue, 08 May 2012 13:08:06 GMT
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
111 B 24ms
22ms Fetch
image/gif 104.20.47.80
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.42693114112541164
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.47.80 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 537050
x-goog-stored-content-encoding: identity
expires: Mon, 03 Nov 2025 06:41:00 GMT
x-goog-stored-content-length: 43
date: Sun, 09 Nov 2025 10:53:26 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
vary: accept-encoding
x-guploader-uploadid: ABgVH88YWGJooP3RQypITTu4eUOoozimloKclx-VwjquNN2LVUHBg9UPfL6FjLVUgTCMD2_7
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 99bcc4318be0594d-FRA
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H2 200 dns Show response
ab.dns-finder.com/meta/ 2 B
0 0ms
0ms Fetch
text/plain 34.36.200.111
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://ab.dns-finder.com/meta/dns
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.36.200.111 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 111.200.36.34.bc.googleusercontent.com
Software: /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cache-control: private, max-age=180, stale-if-error=180, stale-while-revalidate=180
access-control-expose-headers: X-Resolver
x-resolver: default
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
date: Sun, 09 Nov 2025 10:53:25 GMT
content-type: text/plain; charset=utf-8
vary: Origin

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
111 B 14ms
14ms Fetch
image/gif 104.20.47.80
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.2412373770920998
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.47.80 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 537050
x-goog-stored-content-encoding: identity
expires: Mon, 03 Nov 2025 06:41:00 GMT
x-goog-stored-content-length: 43
date: Sun, 09 Nov 2025 10:53:26 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
vary: accept-encoding
x-guploader-uploadid: ABgVH88YWGJooP3RQypITTu4eUOoozimloKclx-VwjquNN2LVUHBg9UPfL6FjLVUgTCMD2_7
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 99bcc432ecd9594d-FRA
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico Show response
ad.doubleclick.net/ 1 KB
129 B 15ms
15ms Fetch
image/x-icon 172.217.23.102
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.893009627278952

Requested by

Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s45-in-f6.1e100.net

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Mon, 10 Nov 2025 10:53:27 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 09 Nov 2025 10:53:27 GMT
content-type: image/x-icon
vary: Accept-Encoding
last-modified: Tue, 08 May 2012 13:08:06 GMT
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
134 B 16ms
15ms Fetch
image/gif 104.20.47.80
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=2&e=0.7598106990906527
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.47.80 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 537050
x-goog-stored-content-encoding: identity
expires: Mon, 03 Nov 2025 06:41:00 GMT
x-goog-stored-content-length: 43
date: Sun, 09 Nov 2025 10:53:27 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
vary: accept-encoding
x-guploader-uploadid: ABgVH88YWGJooP3RQypITTu4eUOoozimloKclx-VwjquNN2LVUHBg9UPfL6FjLVUgTCMD2_7
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 99bcc4341de1594d-FRA
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico Show response
ad.doubleclick.net/ 1 KB
129 B 16ms
16ms Fetch
image/x-icon 172.217.23.102
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.8144348814974872

Requested by

Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s45-in-f6.1e100.net

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Mon, 10 Nov 2025 10:53:27 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 09 Nov 2025 10:53:27 GMT
content-type: image/x-icon
vary: Accept-Encoding
last-modified: Tue, 08 May 2012 13:08:06 GMT
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
117 B 13ms
13ms Fetch
image/gif 104.20.47.80
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=2&e=0.26283291806831377
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.47.80 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 537051
x-goog-stored-content-encoding: identity
expires: Mon, 03 Nov 2025 06:41:00 GMT
x-goog-stored-content-length: 43
date: Sun, 09 Nov 2025 10:53:27 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
vary: accept-encoding
x-guploader-uploadid: ABgVH88YWGJooP3RQypITTu4eUOoozimloKclx-VwjquNN2LVUHBg9UPfL6FjLVUgTCMD2_7
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 99bcc436bfb9594d-FRA
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico Show response
ad.doubleclick.net/ 1 KB
129 B 18ms
18ms Fetch
image/x-icon 172.217.23.102
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.9495740384459738

Requested by

Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s45-in-f6.1e100.net

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Mon, 10 Nov 2025 10:53:27 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 09 Nov 2025 10:53:27 GMT
content-type: image/x-icon
vary: Accept-Encoding
last-modified: Tue, 08 May 2012 13:08:06 GMT
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
111 B 12ms
12ms Fetch
image/gif 104.20.47.80
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=2&e=0.6969176134478172
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.47.80 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 537051
x-goog-stored-content-encoding: identity
expires: Mon, 03 Nov 2025 06:41:00 GMT
x-goog-stored-content-length: 43
date: Sun, 09 Nov 2025 10:53:27 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
vary: accept-encoding
x-guploader-uploadid: ABgVH88YWGJooP3RQypITTu4eUOoozimloKclx-VwjquNN2LVUHBg9UPfL6FjLVUgTCMD2_7
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 99bcc4395999594d-FRA
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
140 B 15ms
15ms Fetch
image/gif 104.20.47.80
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=2&e=0.7655320267990796
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.47.80 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 537052
x-goog-stored-content-encoding: identity
expires: Mon, 03 Nov 2025 06:41:00 GMT
x-goog-stored-content-length: 43
date: Sun, 09 Nov 2025 10:53:28 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
vary: accept-encoding
x-guploader-uploadid: ABgVH88YWGJooP3RQypITTu4eUOoozimloKclx-VwjquNN2LVUHBg9UPfL6FjLVUgTCMD2_7
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 99bcc43bfba5594d-FRA
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico Show response
ad.doubleclick.net/ 1 KB
129 B 16ms
16ms Fetch
image/x-icon 172.217.23.102
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.40101791509731055

Requested by

Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s45-in-f6.1e100.net

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Mon, 10 Nov 2025 10:53:28 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 09 Nov 2025 10:53:28 GMT
content-type: image/x-icon
vary: Accept-Encoding
last-modified: Tue, 08 May 2012 13:08:06 GMT
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 country Show response
api.btloader.com/ 37 B
153 B 119ms
119ms Fetch
application/json 130.211.23.194
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://api.btloader.com/country?o=5678961798414336
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.23.194 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 194.23.211.130.bc.googleusercontent.com
Software: /
Resource Hash: 04fcb3b36a8a7bdccb4d6d19f659416dbea46e4599303c362b95cc36b079c1ce

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cache-control: private, max-age=300, stale-while-revalidate=600, stale-if-error=600
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37
date: Sun, 09 Nov 2025 10:53:28 GMT
content-type: application/json
vary: Origin

POST
H2 204 pv
api.btloader.com/ 0
0 164ms
163ms Fetch 130.211.23.194
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://api.btloader.com/pv?nlf=false&tid=pai5KTGyAV-LKWJfZY30A-9a683fd64a&sid=1GO67gBH-KFCfNb1tY-9a683fd64a&cv=2.1.167&upapi=true
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.23.194 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 194.23.211.130.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

via: 1.1 google
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 09 Nov 2025 10:53:28 GMT
vary: Origin

Verdicts & Comments Add Verdict or Comment

205 JavaScript Window variables

These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.

51 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.mediafire.com/file/lnouqg02oeflknv/b1.5_04.zip	1969-12-31 23:59:59	Name: g36FastPopSessionRequestNumber Value: 1
www.mediafire.com/file/lnouqg02oeflknv/b1.5_04.zip	1970-01-21 18:23:41	Name: ezux_lpl_484470 Value: 1762685605888\|b02e4a70-f410-4bb4-64da-03754a19b5aa\|false
.mediafire.com/	1970-01-21 19:14:05	Name: ukey Value: oyb8n7b16j8op7gerars3x335uq1riy6
.mediafire.com/	1970-01-21 09:42:24	Name: lnq6 Value: 1
.mediafire.com/	1970-01-21 10:21:17	Name: conv_tracking_data-2 Value: %7B%22mf_source%22%3A%22regular_download-59%22%2C%22mf_content%22%3A%22Free%22%2C%22mf_medium%22%3A%22linux%5C%2FChrome%22%2C%22mf_campaign%22%3A%22lnouqg02oeflknv%22%2C%22mf_term%22%3A%221e659b3431584e812b0326bf77cb6fe0%22%7D
.mediafire.com/	1970-01-21 09:38:07	Name: __cf_bm Value: Zse8hYcRZfIE8kJAqAeIjRD8vcFxM73lWqgbNwxQUTA-1762685605-1.0.1.1-6aKi_6YSKoAggHh6AgCjIpYMuROpC4X5.JF3Au2I4qRczAMbH9IYZKkxIJL7A9bcZtnjmsfKyA5yr0dl.AWtp35SpdTBnP_cgkCUyLKj0.I
www.mediafire.com/	1970-01-21 09:48:10	Name: chkout_src Value: eyJ0ZW1wbGF0ZUlkIjoiNTkifQ%3D%3D
.mediafire.com/	1970-01-21 18:23:41	Name: amp_28916b Value: NqHYl6mXnbQOgGXlqAANEu...1j9k3vlgb.1j9k3vlgc.0.1.1
.mediafire.com/	1970-01-21 09:40:58	Name: ezovuuidtime_484470 Value: 1762685605
.mediafire.com/	1970-01-21 09:38:07	Name: lp_484470 Value: https://www.mediafire.com/file/lnouqg02oeflknv/b1.5_04.zip/file
.mediafire.com/	1970-01-21 09:38:07	Name: ezovuuid_484470 Value: 15a453a8-9836-4f8f-7645-99b7b4d9fae1
.mediafire.com/	1970-01-21 09:38:07	Name: ezoref_484470 Value:
.mediafire.com/	1970-01-21 09:40:58	Name: active_template::484470 Value: pub_site.1762685605
.mediafire.com/	1970-01-21 09:38:07	Name: ezopvc_484470 Value: 1
www.mediafire.com/	1970-01-21 09:40:58	Name: ezstandaloneuser Value: true
.mediafire.com/	1970-01-21 18:23:41	Name: cf_clearance Value: KAeDjW8yeFc.n536m6NSKNIDs5IzdE9u9GmNmLLkDms-1762685605-1.2.1.1-ONVus6sdB9wGILhIJvYHEuxiYpSSHym5Q5ngfJw6tk1xrZEUC8iFuYh3cu5ZlkUhf3Ap9bkYi71RK3jnlmojSfJw3mtUAB0STZLXyZsDC5yeOFchdri5o4k7_m8oOiehsiGnHGYU.Ts9.XZT9YglmKCVvr_x4Wb3YkNSCVp1LWz6JIEHl.VSomGo8t7SefTORhq0YX2M4CGrnJY8YoHd2y_xmGs9VWPMubIGKlNGJ1k
econventa.com/	1969-12-31 23:59:59	Name: IKSR Value: %7B%7D
econventa.com/	1969-12-31 23:59:59	Name: INF_DFL8 Value: false
econventa.com/	1970-01-21 19:14:05	Name: IUID Value: 68c15f55-7433-4d3a-afbd-661598eee860
econventa.com/	1969-12-31 23:59:59	Name: ISSH Value: 7F40ED
econventa.com/	1969-12-31 23:59:59	Name: VMI Value:
econventa.com/	1970-01-21 19:14:05	Name: IPLH Value: %23%7B%7D
econventa.com/	1970-01-21 19:14:05	Name: IPLH_Q Value: %23%5B%5D
econventa.com/	1970-01-21 19:14:05	Name: CHN Value: %23%5B%5D
econventa.com/	1970-01-21 19:14:05	Name: MSSH Value: %23%7B%7D
econventa.com/	1970-01-21 19:14:05	Name: MSRH Value: %23%7B%7D
econventa.com/	1970-01-21 19:14:05	Name: ILP Value: null
econventa.com/	1970-01-21 19:14:05	Name: ILPLU Value: %2301%2F01%2F0001%2000%3A00%3A00
econventa.com/	1970-01-21 19:14:05	Name: ILEALC Value: %2301%2F01%2F0001%2000%3A00%3A00
econventa.com/	1970-01-21 09:38:20	Name: ILMPF Value: %23False
econventa.com/	1970-01-21 19:14:05	Name: IPMPLU Value: %2301%2F01%2F0001%2000%3A00%3A00
econventa.com/	1970-01-21 19:14:05	Name: IPMUID Value: %23
econventa.com/	1970-01-21 19:14:05	Name: BSWUID Value: %23
econventa.com/	1970-01-21 19:14:05	Name: IBL Value: %23%5B%5D
econventa.com/	1970-01-21 19:14:05	Name: IOPT Value: %23%5B%5D
econventa.com/	1970-01-21 19:14:05	Name: IPLSH Value: %23%7B%7D
econventa.com/	1970-01-21 19:14:05	Name: IPLSH_Q Value: %23%5B%5D
econventa.com/	1970-01-21 19:14:05	Name: IZH Value: %23%7B%7D
econventa.com/	1970-01-21 19:14:05	Name: IZH_Q Value: %23%5B%5D
econventa.com/	1970-01-21 19:14:05	Name: IMCH Value: %23%7B%7D
econventa.com/	1970-01-21 19:14:05	Name: IMCH_Q Value: %23%5B%5D
econventa.com/	1970-01-21 19:14:05	Name: IMH Value: %23%7B%7D
econventa.com/	1970-01-21 19:14:05	Name: IMH_Q Value: %23%5B%5D
econventa.com/	1970-01-21 19:14:05	Name: ISH Value: %23%7B%22101%22%3A%5B%7B%22SId%22%3A%227F40ED%22%2C%22D%22%3A%2225%2F11%2F9T10%3A53%3A25%22%7D%5D%7D
econventa.com/	1970-01-21 19:14:05	Name: ISH_Q Value: %23%5B101%5D
econventa.com/	1970-01-21 19:14:05	Name: ISPH Value: %23%7B%7D
econventa.com/	1970-01-21 19:14:05	Name: ISPH_Q Value: %23%5B%5D
econventa.com/	1970-01-21 19:14:05	Name: ICH Value: %23%7B%7D
econventa.com/	1970-01-21 19:14:05	Name: ICH_Q Value: %23%5B%5D
www.mediafire.com/	1970-01-21 19:14:05	Name: ezds Value: ffid%3D1%2Cw%3D1600%2Ch%3D1200
www.mediafire.com/	1970-01-21 19:14:05	Name: ezohw Value: w%3D1600%2Ch%3D1200

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	URL: https://www.mediafire.com/file/lnouqg02oeflknv/b1.5_04.zip/file(Line 1366) Message: document.domain mutation is ignored because the surrounding agent cluster is origin-keyed.
network	error	URL: https://www.mediafiredls.com/onclick/0 Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=0
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ab.dns-finder.com
ad-delivery.net
ad.doubleclick.net
api.amplitude.com
api.btloader.com
btloader.com
cdn.amplitude.com
cdn.econventa.com
cmp.gatekeeperconsent.com
econventa.com
fonts.gstatic.com
g.ezoic.net
go.ezodn.com
privacy.gatekeeperconsent.com
static.cloudflareinsights.com
static.mediafire.com
the.gatekeeperconsent.com
translate.google.com
translate.googleapis.com
www.ezojs.com
www.facebook.com
www.googletagmanager.com
www.gstatic.com
www.mediafire.com
www.mediafiredls.com
104.16.80.73
104.17.148.83
104.20.47.80
104.21.42.32
104.26.9.66
130.211.23.194
142.250.184.200
142.250.185.110
142.250.185.195
142.250.186.131
142.250.186.42
157.240.253.35
172.217.23.102
172.66.171.133
172.67.170.144
172.67.199.186
172.67.73.78
18.245.86.4
188.114.96.3
34.36.200.111
35.85.77.91
52.57.221.121
032e1fdc72c9c669bbd7dcb841fc1cdcd7a9148a5802dd668c508efd0c11d7a0
03c8d2dc7d985c3004ff2cd6d8148dd03560f37ed15efdf6c2d7f4d771d0e599
04fcb3b36a8a7bdccb4d6d19f659416dbea46e4599303c362b95cc36b079c1ce
05cfe92d9794a54258a19bfec7ae0faa73f61b66416983136594b4f95bb114dd
09675fd54aab45b3d069813f52f6412144c96114dbaa344f313c599b8b7a8135
0dcae222606cf25659d185a62f2fcd41caf42f6dd3d9dda50eda1f281e304065
0e4f51b28ecec8f56883feac2f87d89c46d8b2d56b008dd9aa05f404915f8a8a
0f67393986c012dbf48aa3149e2874bd84ed5f466362ad1ac31305f697f1da7b
1bbfa06807ac1bd74c992aad9d3380cff5974cdd2568df64517c265636054b45
1c6ba1010c2cc88c59de9e9584728da124770fa399643ffc1beffcec54b84be7
2450e5580136f94bda7ccf95e3167b57e15b05b513a430967943a50036fa47a4
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
2944ab2d51f65aef502a3809e8e36483d8f9c66629b5547993142f8cfacbfd6c
2b8bdb8e1e345a290d728e5e3bb3866e954fe113a2dde5429d9a7ce9c7cdeb33
30be558393bd8b0585c806a6eaed6d6f5b51d1ca63c0113061dfe35eaa128ce3
345dbaad5cd394bb195e79a7d835ee2af91c02c76413d974f2e7fd3b9fcbfe39
3b9ffd186b78d9ad93b8f8f63b927976df2c98d29ecf5186c18b80d645cfd134
3cefef7fc952707c97375ef3fa95a8c45a96eda7845d02bc1c28bf3570c0cfba
4342feac38021c4fe3069eba0edf1c2e1b4345e2b548b0afb7ab21b7369b3bc8
4448e430d3c53bad548a5d135e1c7e2f9593e806ba47892640d430ea752e979e
46468ec4089d4bea3f0e0811eea2d9e9cde6305118df0673d2972d290f1d00f0
4ba5eca789e58035079a496f337447ba5e6105e22772f0690a951bf3182eaf01
4dac0026fbfa2615dce30c0af12830863fe885f84387a0147b9e338f548d5d82
6318394f737c66f0e2ccfcd88e3935c6667633a1b95fa29fba2b75431d55eef2
643242e26749d72edbf48c27efff4b4ec689d352ff3698117c1d53018e4d926b
6896b59e8034378b31284eea779e568986c0337a8eb3e648efbf52fd8d5d3781
696642980342cdb9c2e57d199ea188db4928c518de52d9dbe349cd0ca8e400bc
6fca1361d81b8d8d05afbe947e257aef026891372b45e0d2de123a907a4ed1af
71d32d7fd94e614f348af4afbbd05bee609e45428addc2c35cbe86c88748a2f4
720671166ac43aba99e3952b0b9341ab4e0fee1fd891db54e2a07f05db653142
76b14705bcd5752ac05035c95c7f53bfe8e65dda03bc77662e0aff067e3258e7
7ba1bc2084def769e77a7dbf97cd91d68fe6c6d55b5d183a7d36630da8da2b02
7f596391730ffc1ae1aaa2b67074a27da2706c305f11fa1b1231a2bd9fae289e
82b94716473aa225e715e117802145c5d2d725aa1ba9d476d61a5d3da16a8c26
8539c91ae0a82f8cab27d481ea38ac4e66d1e5b36701fe295bcba4399b9255bd
854d4c77e8e00f312f25730c7c361a883849690a2dbbadb697a4373081b6455f
89786a1f649d6044a4702e297404445af6a3eab8332d9f676cb4312196da3d7f
8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f
8b3a000db28359e0512e1484988806b9cdaeb457e29ef6b82bfe097e6eed3231
8bb4504c438425d5f73480e8935e36ad26179599fd462848ebb59bf2e9e43e57
925beb768cc9209c0f4de784f15d6c1dde72232c5b457cb186fdea749d07eae8
9b41253384e2818bd0f76171d6ffd723d4c85c5e1a69da74f174489cb52a40ce
9f337ce148170e54678bf4380a0bd5853d3fadefec8697dd426e6f71a0479f5e
a4fafcd389d58bbd82e49d9a68e81e9dc8384330ff14ec3283a4d0d11812047b
a5e87590d9232e0b0be4c640eeb47cb4f4299af754f195c802d49fe380ea1870
ab5c23a05e39deed14d9d8262b0dce9f024f86105a27196cad37d14a3f516e09
aee034d31571969a8134d9e6afd5cfca4ee3a95a3111326f9170be403a66b3f6
aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
b13b1429e9de21ca5725d71313a23025090c8b7b64151338aab75b5f96088b5e
b837449c7254dd5887b620b7903bb4dbafbf2424ae3eb25e7a9f3471ff105365
c0f74ef7784a0cc296ef08dcec4f3d9b5db71c3b2df596552715c058a61d7745
c3185477d905b9788eab0ec7cff6852e3127b94743c0decf7287a983e31b7f13
c6c094bc0054f9cbe34102ff49f86b3928b5ac09f3d2ac87e170d0500675921f
cdc78cc8b2994712a041a2a4cb02f488afbab00981771bdd3a8036c2dddf540f
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8
dc54b817820f14ce6395ba2a037f37d4bb0af75d5b017336140793fbe2f7f738
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
e0ff1aa498c3e7899a1ba72cea996bea56b397a6e93864cff709ce8d1776e5ea
e23279aa6deaa5a679eec1d62492bb3ccbe9ba55f22c4c23bd1cbbba8152afd0
e2b7bebbca31b49252cd1ae00d56eb01e70f3b3e6a8eb79185e5c79d7ca81ed1
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e814d50a228f54aecf40d8a58e41d48ce1dfc4376fd5fbedc28078fe0a8c5526
f11464e5eae1992d297c9b4ea17a3813d9600bcb99534495af9d2e85d4aca17a
f1a67642fc97b508ce07cf6df329022bf5184a1c573044dc021e0d6e64688c64
f1c02e9ba02a159b34fc2d7d2be0a743b497a6cd0a422a0c3acc88b871b2af96
f303c517d2a00e19bcd56065330ac8a4cb82717cf1976e9c029e9a1442be288c
f52a0c7d9fa7ae8e45916c491ae7193f9a1e289f128f05264122c53d8da970db
f6b526d7aba8368301c472d0f661c5fad948af7f7c2a69379a86954d985f3344
f917a9105c311331b1d40f4d2bdbf11233c1c465616c1a9c46232f451463b061
fb1bd700eb83832fc2ca14c9fd537e5facad95f3bd15632db0c4b1c5a5bd7e20

www.mediafire.com Open in urlscan Pro 104.17.148.83 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

93 Requests

99 %HTTPS

0 %IPv6

18 Domains

25 Subdomains

23 IPs

3 Countries

1242 kBTransfer

4516 kBSize

51 Cookies

9 Outgoing links

Redirected requests

93 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.mediafire.com Open in urlscan Pro
104.17.148.83 Public Scan

Screenshot
Live screenshot

Full Image

93
Requests

99 %
HTTPS

0 %
IPv6

18
Domains

25
Subdomains

23
IPs

3
Countries

1242 kB
Transfer

4516 kB
Size

51
Cookies

93 HTTP transactions
1 data transactions