www.mediafire.com Open in urlscan Pro
104.17.147.83 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file
Submission Tags: @phish_report
Submission: On December 18 via api (December 18th 2025, 2:05:58 pm UTC) from FI — Scanned from US

Summary HTTP 225 Redirects Links 17 Behaviour Indicators

Summary

This website contacted 71 IPs in 6 countries across 60 domains to perform 225 HTTP transactions. The main IP is 104.17.147.83, located in Ascension Island and belongs to CLOUDFLARENET, US. The main domain is www.mediafire.com. The Cisco Umbrella rank of the primary domain is 46418.
TLS certificate: Issued by Sectigo Public Server Authentication ... on August 5th 2025. Valid for: a year.

This is the only time www.mediafire.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 19	104.17.147.83 104.17.147.83	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.21.42.32 104.21.42.32	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	172.67.199.186 172.67.199.186	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	142.251.167.97 142.251.167.97	15169 (GOOGLE) (GOOGLE)
2	172.66.171.133 172.66.171.133	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	172.67.170.144 172.67.170.144	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	142.250.31.138 142.250.31.138	15169 (GOOGLE) (GOOGLE)
1	104.16.79.73 104.16.79.73	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	3.167.88.108 3.167.88.108	16509 (AMAZON-02) (AMAZON-02)
2	104.26.8.66 104.26.8.66	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	157.240.229.35 157.240.229.35	32934 (FACEBOOK) (FACEBOOK)
20	54.85.8.229 54.85.8.229	14618 (AMAZON-AES) (AMAZON-AES)
5	172.67.142.121 172.67.142.121	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	57.144.172.128 57.144.172.128	32934 (FACEBOOK) (FACEBOOK)
15	172.253.62.154 172.253.62.154	15169 (GOOGLE) (GOOGLE)
11	104.20.47.80 104.20.47.80	13335 (CLOUDFLAR...) (CLOUDFLARENET)
7	142.251.16.149 142.251.16.149	15169 (GOOGLE) (GOOGLE)
2	34.36.200.111 34.36.200.111	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
5	3.235.176.233 3.235.176.233	14618 (AMAZON-AES) (AMAZON-AES)
5	38.70.189.70 38.70.189.70	399647 (RUMBLE) (RUMBLE)
3	130.211.23.194 130.211.23.194	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	172.253.62.113 172.253.62.113	15169 (GOOGLE) (GOOGLE)
1	207.65.37.179 207.65.37.179	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1	44.245.196.41 44.245.196.41	16509 (AMAZON-02) (AMAZON-02)
3	142.250.31.94 142.250.31.94	15169 (GOOGLE) (GOOGLE)
1	64.233.180.95 64.233.180.95	15169 (GOOGLE) (GOOGLE)
2	104.20.23.13 104.20.23.13	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	172.67.73.78 172.67.73.78	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	142.251.167.100 142.251.167.100	15169 (GOOGLE) (GOOGLE)
1	142.251.163.155 142.251.163.155	15169 (GOOGLE) (GOOGLE)
1	141.95.98.64 141.95.98.64	16276 (OVH OVH SAS) (OVH OVH SAS)
1	34.102.146.192 34.102.146.192	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	3.167.69.51 3.167.69.51	16509 (AMAZON-02) (AMAZON-02)
1	104.16.175.226 104.16.175.226	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	74.119.117.47 74.119.117.47	19750 (AS-CRITEO) (AS-CRITEO)
1	34.96.70.87 34.96.70.87	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	3.161.213.35 3.161.213.35	16509 (AMAZON-02) (AMAZON-02)
1	172.253.63.132 172.253.63.132	15169 (GOOGLE) (GOOGLE)
1	172.253.122.94 172.253.122.94	15169 (GOOGLE) (GOOGLE)
1	34.8.255.148 34.8.255.148	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 2	34.120.135.53 34.120.135.53	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 5	162.19.138.83 162.19.138.83	16276 (OVH OVH SAS) (OVH OVH SAS)
1	162.19.223.45 162.19.223.45	16276 (OVH OVH SAS) (OVH OVH SAS)
1	162.19.138.116 162.19.138.116	16276 (OVH OVH SAS) (OVH OVH SAS)
7	34.54.78.238 34.54.78.238	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
12	172.253.115.132 172.253.115.132	15169 (GOOGLE) (GOOGLE)
21	172.253.122.156 172.253.122.156	15169 (GOOGLE) (GOOGLE)
1	35.190.39.111 35.190.39.111	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	34.234.102.22 34.234.102.22	14618 (AMAZON-AES) (AMAZON-AES)
5	35.244.159.8 35.244.159.8	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	69.147.92.11 69.147.92.11	14777 (YAHOO) (YAHOO)
2	74.119.117.62 74.119.117.62	19750 (AS-CRITEO) (AS-CRITEO)
4 5	142.251.179.154 142.251.179.154	15169 (GOOGLE) (GOOGLE)
4 4	35.71.131.137 35.71.131.137	16509 (AMAZON-02) (AMAZON-02)
3 3	69.147.92.12 69.147.92.12	14777 (YAHOO) (YAHOO)
1 1	69.194.242.12 69.194.242.12	26120 (RHYTHMONE) (RHYTHMONE)
2 2	52.223.40.198 52.223.40.198	16509 (AMAZON-02) (AMAZON-02)
2	23.221.241.44 23.221.241.44	16625 (AKAMAI-AS) (AKAMAI-AS)
2	8.28.7.105 8.28.7.105	62713 (AS-PUBMATIC) (AS-PUBMATIC)
2	8.28.7.81 8.28.7.81	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1 2	185.167.164.38 185.167.164.38	198622 (ADFORM Ad...) (ADFORM Adform A/S)
1 1	34.85.181.204 34.85.181.204	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
6	207.65.32.88 207.65.32.88	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1 2	98.82.157.231 98.82.157.231	14618 (AMAZON-AES) (AMAZON-AES)
1	38.91.45.7 38.91.45.7	174 (COGENT-174) (COGENT-174)
1	3.144.50.131 3.144.50.131	16509 (AMAZON-02) (AMAZON-02)
1	54.81.14.247 54.81.14.247	14618 (AMAZON-AES) (AMAZON-AES)
1 2	52.45.156.78 52.45.156.78	14618 (AMAZON-AES) (AMAZON-AES)
2 2	35.244.154.8 35.244.154.8	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 1	107.178.254.65 107.178.254.65	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 2	150.171.22.12 150.171.22.12	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	207.65.37.182 207.65.37.182	() ()
2 2	68.67.160.75 68.67.160.75	() ()
1 2	151.101.2.49 151.101.2.49	() ()
1	34.96.105.8 34.96.105.8	() ()
1	54.90.8.2 54.90.8.2	() ()
2 3	34.111.113.62 34.111.113.62	() ()
225	71

19 104.17.147.83 (Ascension Island) 1 redirects

ASN13335 (CLOUDFLARENET, US)

www.mediafire.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools
static.mediafire.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 104.21.42.32 (Ascension Island)

ASN13335 (CLOUDFLARENET, US)

cmp.gatekeeperconsent.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 172.67.199.186 (Ascension Island)

ASN13335 (CLOUDFLARENET, US)

the.gatekeeperconsent.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools
privacy.gatekeeperconsent.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

3 142.251.167.97 (United States)

ASN15169 (GOOGLE, US)
PTR: ww-in-f97.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 172.66.171.133 (Ascension Island)

ASN13335 (CLOUDFLARENET, US)

btloader.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 172.67.170.144 (Ascension Island)

ASN13335 (CLOUDFLARENET, US)

www.ezojs.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 142.250.31.138 (United States)

ASN15169 (GOOGLE, US)
PTR: bj-in-f138.1e100.net

translate.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 104.16.79.73 (Ascension Island)

ASN13335 (CLOUDFLARENET, US)

static.cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 3.167.88.108 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-3-167-88-108.iad55.r.cloudfront.net

cdn.amplitude.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 104.26.8.66 (Ascension Island)

ASN13335 (CLOUDFLARENET, US)

cdn.econventa.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools
econventa.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 157.240.229.35 (Ashburn, United States)

ASN32934 (FACEBOOK, US)
PTR: edge-star-mini-shv-02-iad3.facebook.com

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

20 54.85.8.229 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-85-8-229.compute-1.amazonaws.com

g.ezoic.net	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

5 172.67.142.121 (Ascension Island)

ASN13335 (CLOUDFLARENET, US)

go.ezodn.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 57.144.172.128 (Southfield, United States)

ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-01-det1.fbcdn.net

static.xx.fbcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

15 172.253.62.154 (United States)

ASN15169 (GOOGLE, US)
PTR: bc-in-f154.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

11 104.20.47.80 (Ascension Island)

ASN13335 (CLOUDFLARENET, US)

ad-delivery.net	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

7 142.251.16.149 (United States)

ASN15169 (GOOGLE, US)
PTR: bl-in-f149.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 34.36.200.111 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 111.200.36.34.bc.googleusercontent.com

ab.dns-finder.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

5 3.235.176.233 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-235-176-233.compute-1.amazonaws.com

btlr.sharethrough.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

5 38.70.189.70 (Toronto, Canada)

ASN399647 (RUMBLE, US)

a.ads.rmbl.ws	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

3 130.211.23.194 (United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 194.23.211.130.bc.googleusercontent.com

api.btloader.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 172.253.62.113 (United States)

ASN15169 (GOOGLE, US)
PTR: bc-in-f113.1e100.net

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 207.65.37.179 (United States)

ASN62713 (AS-PUBMATIC, US)

hbopenbid.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 44.245.196.41 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-44-245-196-41.us-west-2.compute.amazonaws.com

api.amplitude.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

3 142.250.31.94 (United States)

ASN15169 (GOOGLE, US)
PTR: bj-in-f94.1e100.net

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 64.233.180.95 (United States)

ASN15169 (GOOGLE, US)
PTR: on-in-f95.1e100.net

translate.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 104.20.23.13 (Ascension Island)

ASN13335 (CLOUDFLARENET, US)

cdn.id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 172.67.73.78 (Ascension Island)

ASN13335 (CLOUDFLARENET, US)

www.mediafiredls.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 142.251.167.100 (United States)

ASN15169 (GOOGLE, US)
PTR: ww-in-f100.1e100.net

analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 142.251.163.155 (United States)

ASN15169 (GOOGLE, US)
PTR: wv-in-f155.1e100.net

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 141.95.98.64 (France)

ASN16276 (OVH OVH SAS, FR)
PTR: ns3216658.ip-141-95-98.eu

api.id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 34.102.146.192 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 192.146.102.34.bc.googleusercontent.com

oa.openxcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 3.167.69.51 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-3-167-69-51.iad61.r.cloudfront.net

tags.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 104.16.175.226 (Ascension Island)

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 74.119.117.47 (United States)

ASN19750 (AS-CRITEO, US)

static.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 34.96.70.87 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 87.70.96.34.bc.googleusercontent.com

invstatic101.creativecdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 3.161.213.35 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-3-161-213-35.yul62.r.cloudfront.net

connectid.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 172.253.63.132 (United States)

ASN15169 (GOOGLE, US)
PTR: bi-in-f132.1e100.net

e578d51024a06ed55fe9f1aed02895c2.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 172.253.122.94 (United States)

ASN15169 (GOOGLE, US)
PTR: bh-in-f94.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 34.8.255.148 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 148.255.8.34.bc.googleusercontent.com

solutions.cdn.optable.co	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 34.120.135.53 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 53.135.120.34.bc.googleusercontent.com

oajs.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

5 162.19.138.83 (Frankfurt am Main, Germany) 1 redirects

ASN16276 (OVH OVH SAS, FR)
PTR: ns31532338.ip-162-19-138.eu

id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 162.19.223.45 (France)

ASN16276 (OVH OVH SAS, FR)

lbs.eu-1-id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 162.19.138.116 (Frankfurt am Main, Germany)

ASN16276 (OVH OVH SAS, FR)
PTR: ns31533567.ip-162-19-138.eu

lb.eu-1-id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

7 34.54.78.238 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 238.78.54.34.bc.googleusercontent.com

na.edge.optable.co	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

12 172.253.115.132 (United States)

ASN15169 (GOOGLE, US)
PTR: bg-in-f132.1e100.net

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

21 172.253.122.156 (United States)

ASN15169 (GOOGLE, US)
PTR: bh-in-f156.1e100.net

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 35.190.39.111 (United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 111.39.190.35.bc.googleusercontent.com

esp.rtbhouse.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 34.234.102.22 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-234-102-22.compute-1.amazonaws.com

bcp.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

5 35.244.159.8 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 8.159.244.35.bc.googleusercontent.com

google-bidout-d.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools
us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 69.147.92.11 (Ashburn, United States)

ASN14777 (YAHOO, US)
PTR: e1.ycpi.vip.dca.yahoo.com

ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 74.119.117.62 (United States)

ASN19750 (AS-CRITEO, US)

gum.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

5 142.251.179.154 (United States) 4 redirects

ASN15169 (GOOGLE, US)
PTR: pd-in-f154.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

4 35.71.131.137 (United States) 4 redirects

ASN16509 (AMAZON-02, US)
PTR: a6370ebea231e0c9a.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

3 69.147.92.12 (Ashburn, United States) 3 redirects

ASN14777 (YAHOO, US)
PTR: e2.ycpi.vip.dca.yahoo.com

ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 69.194.242.12 (United States) 1 redirects

ASN26120 (RHYTHMONE, US)

ad.turn.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 52.223.40.198 (United States) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: a6370ebea231e0c9a.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 23.221.241.44 (Ashburn, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-221-241-44.deploy.static.akamaitechnologies.com

ads.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 8.28.7.105 (United States)

ASN62713 (AS-PUBMATIC, US)

ut.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 8.28.7.81 (United States)

ASN62713 (AS-PUBMATIC, US)

image6.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 185.167.164.38 (Denmark) 1 redirects

ASN198622 (ADFORM Adform A/S, DK)

c1.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 34.85.181.204 (Washington, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 204.181.85.34.bc.googleusercontent.com

um.simpli.fi	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

6 207.65.32.88 (United States)

ASN62713 (AS-PUBMATIC, US)

image2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools
simage2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 98.82.157.231 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-98-82-157-231.compute-1.amazonaws.com

s.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 38.91.45.7 (Ashburn, United States)

ASN174 (COGENT-174, US)

match.deepintent.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 3.144.50.131 (Columbus, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-144-50-131.us-east-2.compute.amazonaws.com

user-sync.fwmrm.net	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 54.81.14.247 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-81-14-247.compute-1.amazonaws.com

pr-bh.ybp.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 52.45.156.78 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-45-156-78.compute-1.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 35.244.154.8 (Kansas City, United States) 2 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 8.154.244.35.bc.googleusercontent.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 107.178.254.65 (United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 65.254.178.107.bc.googleusercontent.com

pippio.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 150.171.22.12 (United States) 1 redirects

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 207.65.37.182 (None, )

ASN- ()

image4.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 68.67.160.75 (None, ) 2 redirects

ASN- ()

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 151.101.2.49 (None, ) 1 redirects

ASN- ()

sync-tm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 34.96.105.8 (None, )

ASN- ()

tr.blismedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 54.90.8.2 (None, )

ASN- ()

sync.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

3 34.111.113.62 (None, ) 2 redirects

ASN- ()

pixel.tapad.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

	Apex Domain Subdomains	Transfer
34	googlesyndication.com e578d51024a06ed55fe9f1aed02895c2.safeframe.googlesyndication.com tpc.googlesyndication.com — Cisco Umbrella Rank: 203 pagead2.googlesyndication.com — Cisco Umbrella Rank: 128	184 KB
28	doubleclick.net 4 redirects securepubads.g.doubleclick.net — Cisco Umbrella Rank: 264 ad.doubleclick.net — Cisco Umbrella Rank: 161 stats.g.doubleclick.net — Cisco Umbrella Rank: 178 cm.g.doubleclick.net — Cisco Umbrella Rank: 326	291 KB
20	ezoic.net g.ezoic.net — Cisco Umbrella Rank: 11312	31 KB
19	mediafire.com 1 redirects www.mediafire.com — Cisco Umbrella Rank: 46418 static.mediafire.com — Cisco Umbrella Rank: 84002	276 KB
14	pubmatic.com hbopenbid.pubmatic.com — Cisco Umbrella Rank: 660 ads.pubmatic.com — Cisco Umbrella Rank: 657 ut.pubmatic.com — Cisco Umbrella Rank: 1128 image6.pubmatic.com — Cisco Umbrella Rank: 1058 image2.pubmatic.com — Cisco Umbrella Rank: 935 simage2.pubmatic.com — Cisco Umbrella Rank: 1082 simage4.pubmatic.com Failed image4.pubmatic.com	37 KB
11	ad-delivery.net ad-delivery.net — Cisco Umbrella Rank: 1163	2 KB
8	optable.co solutions.cdn.optable.co — Cisco Umbrella Rank: 3325 na.edge.optable.co — Cisco Umbrella Rank: 2698	18 KB
8	id5-sync.com 1 redirects cdn.id5-sync.com — Cisco Umbrella Rank: 781 api.id5-sync.com — Cisco Umbrella Rank: 1639 id5-sync.com — Cisco Umbrella Rank: 514	40 KB
7	openx.net 1 redirects oajs.openx.net — Cisco Umbrella Rank: 2931 google-bidout-d.openx.net — Cisco Umbrella Rank: 2844 us-u.openx.net — Cisco Umbrella Rank: 581	2 KB
6	adsrvr.org 6 redirects match.adsrvr.org — Cisco Umbrella Rank: 445	4 KB
6	yahoo.com 3 redirects connectid.analytics.yahoo.com — Cisco Umbrella Rank: 2436 ups.analytics.yahoo.com — Cisco Umbrella Rank: 482 pr-bh.ybp.yahoo.com — Cisco Umbrella Rank: 2333	189 KB
5	rmbl.ws a.ads.rmbl.ws — Cisco Umbrella Rank: 19524	1 KB
5	sharethrough.com btlr.sharethrough.com — Cisco Umbrella Rank: 1363	616 B
5	ezodn.com go.ezodn.com — Cisco Umbrella Rank: 13820	8 KB
5	btloader.com btloader.com — Cisco Umbrella Rank: 1059 api.btloader.com — Cisco Umbrella Rank: 1202	30 KB
4	gstatic.com www.gstatic.com fonts.gstatic.com	11 KB
3	tapad.com 2 redirects pixel.tapad.com	1 KB
3	crwdcntrl.net tags.crwdcntrl.net — Cisco Umbrella Rank: 1131 bcp.crwdcntrl.net — Cisco Umbrella Rank: 1188 sync.crwdcntrl.net	14 KB
3	google.com translate.google.com — Cisco Umbrella Rank: 1152 analytics.google.com — Cisco Umbrella Rank: 165	28 KB
3	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 40	387 KB
3	gatekeeperconsent.com cmp.gatekeeperconsent.com — Cisco Umbrella Rank: 22437 the.gatekeeperconsent.com — Cisco Umbrella Rank: 19808 privacy.gatekeeperconsent.com — Cisco Umbrella Rank: 27753	71 KB
2	everesttech.net 1 redirects sync-tm.everesttech.net	537 B
2	adnxs.com ib.adnxs.com Failed	2 KB
2	linkedin.com 1 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 390	930 B
2	rlcdn.com 2 redirects idsync.rlcdn.com — Cisco Umbrella Rank: 557	840 B
2	demdex.net 1 redirects dpm.demdex.net — Cisco Umbrella Rank: 297	1 KB
2	amazon-adsystem.com 1 redirects s.amazon-adsystem.com — Cisco Umbrella Rank: 386	2 KB
2	adform.net 1 redirects c1.adform.net — Cisco Umbrella Rank: 758	1 KB
2	criteo.com gum.criteo.com — Cisco Umbrella Rank: 502	6 KB
2	eu-1-id5-sync.com lbs.eu-1-id5-sync.com — Cisco Umbrella Rank: 1223 lb.eu-1-id5-sync.com — Cisco Umbrella Rank: 976	489 B
2	dns-finder.com ab.dns-finder.com — Cisco Umbrella Rank: 1320	233 B
2	fbcdn.net static.xx.fbcdn.net — Cisco Umbrella Rank: 907	140 KB
2	econventa.com cdn.econventa.com — Cisco Umbrella Rank: 86116 econventa.com — Cisco Umbrella Rank: 74405	51 KB
2	amplitude.com cdn.amplitude.com — Cisco Umbrella Rank: 2617 api.amplitude.com — Cisco Umbrella Rank: 3116	22 KB
2	ezojs.com www.ezojs.com — Cisco Umbrella Rank: 14247	143 KB
1	blismedia.com tr.blismedia.com
1	pippio.com 1 redirects pippio.com — Cisco Umbrella Rank: 985	634 B
1	fwmrm.net user-sync.fwmrm.net — Cisco Umbrella Rank: 860	504 B
1	deepintent.com match.deepintent.com — Cisco Umbrella Rank: 1028	339 B
1	simpli.fi 1 redirects um.simpli.fi — Cisco Umbrella Rank: 1026	656 B
1	turn.com 1 redirects ad.turn.com — Cisco Umbrella Rank: 924	442 B
1	rtbhouse.com esp.rtbhouse.com — Cisco Umbrella Rank: 2671	570 B
1	creativecdn.com invstatic101.creativecdn.com — Cisco Umbrella Rank: 2252	3 KB
1	criteo.net static.criteo.net — Cisco Umbrella Rank: 1044	13 KB
1	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 303	991 B
1	openxcdn.net oa.openxcdn.net — Cisco Umbrella Rank: 2477	8 KB
1	mediafiredls.com www.mediafiredls.com — Cisco Umbrella Rank: 78483	510 B
1	googleapis.com translate.googleapis.com — Cisco Umbrella Rank: 1001	103 KB
1	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 60	21 KB
1	facebook.com www.facebook.com — Cisco Umbrella Rank: 129	23 KB
1	cloudflareinsights.com static.cloudflareinsights.com — Cisco Umbrella Rank: 359	7 KB
0	agkn.com Failed aa.agkn.com Failed
0	semasio.net Failed sg.semasio.net Failed
0	adentifi.com Failed rtb.adentifi.com Failed
0	stackadapt.com Failed sync.srv.stackadapt.com Failed
0	dotomi.com Failed pubmatic-match.dotomi.com Failed
0	ipredictive.com Failed sync.ipredictive.com Failed
0	temu.com Failed www.temu.com Failed
0	tracookiepixel.xyz Failed tracookiepixel.xyz Failed
0	loopme.me Failed csync.loopme.me Failed
225	60

	Domain	Requested by
21	pagead2.googlesyndication.com	securepubads.g.doubleclick.net pagead2.googlesyndication.com
20	g.ezoic.net	www.ezojs.com www.mediafire.com go.ezodn.com
15	securepubads.g.doubleclick.net	www.mediafire.com securepubads.g.doubleclick.net pagead2.googlesyndication.com
12	tpc.googlesyndication.com	securepubads.g.doubleclick.net
12	static.mediafire.com	www.mediafire.com
11	ad-delivery.net	btloader.com
7	na.edge.optable.co	solutions.cdn.optable.co
7	ad.doubleclick.net	btloader.com
7	www.mediafire.com	1 redirects www.mediafire.com
6	match.adsrvr.org	6 redirects
5	cm.g.doubleclick.net	4 redirects google-bidout-d.openx.net
5	id5-sync.com	1 redirects cdn.id5-sync.com www.mediafire.com
5	a.ads.rmbl.ws	www.mediafire.com
5	btlr.sharethrough.com	www.mediafire.com
5	go.ezodn.com	www.mediafire.com
4	us-u.openx.net	google-bidout-d.openx.net
4	ups.analytics.yahoo.com	3 redirects connectid.analytics.yahoo.com
3	pixel.tapad.com	2 redirects
3	simage2.pubmatic.com	www.mediafire.com ads.pubmatic.com
3	image2.pubmatic.com	ads.pubmatic.com www.mediafire.com
3	www.gstatic.com	www.mediafire.com www.gstatic.com
3	api.btloader.com	btloader.com
3	www.googletagmanager.com	www.mediafire.com www.googletagmanager.com
2	sync-tm.everesttech.net	1 redirects ads.pubmatic.com
2	ib.adnxs.com	www.mediafire.com
2	px.ads.linkedin.com	1 redirects www.mediafire.com
2	idsync.rlcdn.com	2 redirects
2	dpm.demdex.net	1 redirects www.mediafire.com
2	s.amazon-adsystem.com	1 redirects ads.pubmatic.com
2	c1.adform.net	1 redirects ads.pubmatic.com
2	image6.pubmatic.com	ads.pubmatic.com
2	ut.pubmatic.com	ads.pubmatic.com
2	ads.pubmatic.com	www.mediafire.com
2	gum.criteo.com	static.criteo.net gum.criteo.com
2	oajs.openx.net	1 redirects www.mediafire.com
2	analytics.google.com	www.googletagmanager.com
2	cdn.id5-sync.com	www.ezojs.com solutions.cdn.optable.co
2	ab.dns-finder.com	btloader.com
2	static.xx.fbcdn.net	www.facebook.com
2	www.ezojs.com	www.mediafire.com www.ezojs.com
2	btloader.com	www.mediafire.com btloader.com
1	sync.crwdcntrl.net
1	tr.blismedia.com	ads.pubmatic.com
1	image4.pubmatic.com	ads.pubmatic.com
1	pippio.com	1 redirects
1	pr-bh.ybp.yahoo.com	ads.pubmatic.com
1	user-sync.fwmrm.net	ads.pubmatic.com
1	match.deepintent.com	ads.pubmatic.com
1	um.simpli.fi	1 redirects
1	ad.turn.com	1 redirects
1	google-bidout-d.openx.net	oa.openxcdn.net
1	bcp.crwdcntrl.net	tags.crwdcntrl.net
1	esp.rtbhouse.com	invstatic101.creativecdn.com
1	lb.eu-1-id5-sync.com	cdn.id5-sync.com
1	lbs.eu-1-id5-sync.com	cdn.id5-sync.com
1	solutions.cdn.optable.co	www.ezojs.com
1	fonts.gstatic.com	www.mediafire.com
1	e578d51024a06ed55fe9f1aed02895c2.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
1	connectid.analytics.yahoo.com	securepubads.g.doubleclick.net
1	invstatic101.creativecdn.com	securepubads.g.doubleclick.net
1	static.criteo.net	securepubads.g.doubleclick.net
1	cdn.jsdelivr.net	securepubads.g.doubleclick.net
1	tags.crwdcntrl.net	securepubads.g.doubleclick.net
1	oa.openxcdn.net	securepubads.g.doubleclick.net
1	api.id5-sync.com	cdn.id5-sync.com
1	stats.g.doubleclick.net	www.googletagmanager.com
1	www.mediafiredls.com	www.mediafire.com
1	translate.googleapis.com
1	api.amplitude.com	cdn.amplitude.com
1	hbopenbid.pubmatic.com	www.mediafire.com
1	www.google-analytics.com	www.googletagmanager.com
1	econventa.com	cdn.econventa.com
1	www.facebook.com	www.mediafire.com
1	cdn.econventa.com	www.mediafire.com
1	cdn.amplitude.com	www.mediafire.com
1	privacy.gatekeeperconsent.com	the.gatekeeperconsent.com
1	static.cloudflareinsights.com	www.mediafire.com
1	translate.google.com	www.mediafire.com
1	the.gatekeeperconsent.com	www.mediafire.com
1	cmp.gatekeeperconsent.com	www.mediafire.com
0	aa.agkn.com Failed
0	sg.semasio.net Failed
0	rtb.adentifi.com Failed	ads.pubmatic.com
0	sync.srv.stackadapt.com Failed	ads.pubmatic.com
0	pubmatic-match.dotomi.com Failed	ads.pubmatic.com
0	sync.ipredictive.com Failed	ads.pubmatic.com
0	www.temu.com Failed	ads.pubmatic.com
0	simage4.pubmatic.com Failed	ads.pubmatic.com
0	tracookiepixel.xyz Failed	ads.pubmatic.com
0	csync.loopme.me Failed	www.mediafire.com
225	90

This site contains links to these domains. Also see Links.

Domain
download1326.mediafire.com
blog.mediafire.com
www.fast.io
mediafire.zendesk.com
translate.google.com
twitter.com
www.facebook.com
googleads.g.doubleclick.net
adssettings.google.com

Subject Issuer	Validity	Valid
*.mediafire.com Sectigo Public Server Authentication CA DV R36	`2025-08-05` - `2026-07-30`	a year	crt.sh
gatekeeperconsent.com WE1	`2025-12-05` - `2026-03-05`	3 months	crt.sh
*.google-analytics.com WR2	`2025-12-03` - `2026-02-25`	3 months	crt.sh
btloader.com WE1	`2025-11-25` - `2026-02-23`	3 months	crt.sh
www.ezojs.com WE1	`2025-12-14` - `2026-03-14`	3 months	crt.sh
*.google.com WR2	`2025-12-03` - `2026-02-25`	3 months	crt.sh
cloudflareinsights.com WE1	`2025-10-22` - `2026-01-20`	3 months	crt.sh
cdn.amplitude.com Amazon RSA 2048 M01	`2025-10-15` - `2026-11-13`	a year	crt.sh
econventa.com WE1	`2025-11-12` - `2026-02-10`	3 months	crt.sh
*.facebook.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2025-09-26` - `2025-12-25`	3 months	crt.sh
ezoic.net E8	`2025-11-09` - `2026-02-07`	3 months	crt.sh
ezodn.com WE1	`2025-12-04` - `2026-03-04`	3 months	crt.sh
*.g.doubleclick.net WR2	`2025-12-03` - `2026-02-25`	3 months	crt.sh
ad-delivery.net WE1	`2025-10-30` - `2026-01-28`	3 months	crt.sh
*.doubleclick.net WR2	`2025-12-03` - `2026-02-25`	3 months	crt.sh
ab.dns-finder.com WR3	`2025-12-14` - `2026-03-14`	3 months	crt.sh
*.sharethrough.com DigiCert Global G3 TLS ECC SHA384 2020 CA1	`2025-07-17` - `2026-08-17`	a year	crt.sh
a.ads.rmbl.ws E7	`2025-12-06` - `2026-03-06`	3 months	crt.sh
api.btloader.com WR3	`2025-11-15` - `2026-02-13`	3 months	crt.sh
*.pubmatic.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2025-02-19` - `2026-03-22`	a year	crt.sh
*.amplitude.com Amazon RSA 2048 M04	`2025-12-02` - `2026-12-30`	a year	crt.sh
*.gstatic.com WR2	`2025-12-03` - `2026-02-25`	3 months	crt.sh
upload.video.google.com WR2	`2025-12-03` - `2026-02-25`	3 months	crt.sh
id5-sync.com WE1	`2025-11-18` - `2026-02-16`	3 months	crt.sh
mediafiredls.com WE1	`2025-11-02` - `2026-01-31`	3 months	crt.sh
oa.openxcdn.net WR3	`2025-11-06` - `2026-02-04`	3 months	crt.sh
*.crwdcntrl.net Amazon RSA 2048 M04	`2025-08-09` - `2026-09-07`	a year	crt.sh
*.jsdelivr.net Sectigo RSA Domain Validation Secure Server CA	`2025-04-25` - `2026-05-04`	a year	crt.sh
*.criteo.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2025-10-16` - `2026-01-18`	3 months	crt.sh
invstatic101.creativecdn.com WR3	`2025-12-06` - `2026-03-06`	3 months	crt.sh
connectid.analytics.yahoo.com GlobalSign ECC OV SSL CA 2018	`2025-08-19` - `2026-02-12`	6 months	crt.sh
solutions.cdn.optable.co WR3	`2025-11-27` - `2026-02-25`	3 months	crt.sh
eu-1-id5-sync.com R12	`2025-11-01` - `2026-01-30`	3 months	crt.sh
na.edge.optable.co WR3	`2025-11-17` - `2026-02-15`	3 months	crt.sh
tpc.googlesyndication.com WR2	`2025-12-03` - `2026-02-25`	3 months	crt.sh
esp.rtbhouse.com WR3	`2025-11-27` - `2026-02-25`	3 months	crt.sh
*.openx.net RapidSSL TLS RSA CA G1	`2025-08-12` - `2026-08-19`	a year	crt.sh
*.pubgw.ads.yahoo.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2025-12-01` - `2026-01-21`	2 months	crt.sh
*.criteo.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2025-11-14` - `2026-02-11`	3 months	crt.sh
track.adform.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2025-09-05` - `2026-10-06`	a year	crt.sh
s.amazon-adsystem.com Amazon RSA 2048 M01	`2025-10-30` - `2026-08-04`	9 months	crt.sh
*.deepintent.com Go Daddy Secure Certificate Authority - G2	`2024-12-06` - `2026-01-07`	a year	crt.sh
*.fwmrm.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2025-10-29` - `2026-11-29`	a year	crt.sh
*.ybp.yahoo.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2025-11-25` - `2026-05-20`	6 months	crt.sh
*.everesttech.net GlobalSign Atlas R3 DV TLS CA 2025 Q2	`2025-04-16` - `2026-05-18`	a year	crt.sh
tr.blismedia.com WR3	`2025-11-05` - `2026-02-03`	3 months	crt.sh

This page contains 30 frames:

Primary Page: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file
Frame ID: 970464C6F29D169CA29183201008A920
Requests: 132 HTTP requests in this frame

Frame: https://www.facebook.com/plugins/like.php?href=http://www.facebook.com/MediaFire&width=193&layout=button_count&action=like&show_faces=false&share=true&height=30&appId=124578887583575
Frame ID: 88193A05713289CFC4BBA2403A9C67D4
Requests: 3 HTTP requests in this frame

Frame: https://www.mediafire.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/d39f91d70ce1/main.js
Frame ID: E9FD1AAA360D5BD976446F7A8D7DC3E2
Requests: 2 HTTP requests in this frame

Frame: https://btloader.com/trustedIframe.html?o=5678961798414336&upapi=true
Frame ID: DF5D42EB2397E0AD0D4C7EB75B4C16DD
Requests: 1 HTTP requests in this frame

Frame: https://e578d51024a06ed55fe9f1aed02895c2.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html
Frame ID: 115F582A266E1FEF6718623C059397C1
Requests: 1 HTTP requests in this frame

Frame: data://truncated
Frame ID: 1B8E261BD7805EE5D2140C2FDE88AC61
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuqE5PQYE2TOam1WngUQ6MpD2Htu-4wY6Lx2My9TPQ0JqUd7OPd3y3HEjCNg-fITxXySMHasm7Uke8DXk3Je_qomlKQLuLeQ24Px3xwdKJGWLIK36o6rcGFAXF1C_Hb9kbsaD-ZRZ2_eWCktBINRJsq1Zvgih-lxV5H6rtq0IpI5Yw6SQrgzJOr5i1U1Ium5Tj-NvuRHsR32Wb18GC1z1Ab_Xqag8K8dattPwZwqckUsKxya93mrz6DcsuyPp_WrdNrBKOvUsx-Zc-a3hgvrGmzwWV8qbCq2JIBy59HgAKcMGYcLmVtmmLmP7s_5gIQncUrQHYvBaipt1xeMelIAMfxFycKsZCMnV7nyfXdcgGWN7QhZlAhFhzvF3atPOAGKHRJVBstajBXTVgFF6Tci_UX_cY3BE72_vXc9BOV8IaZzysD9p7R5GcxofHN7iz95eRn410Nt4-yEw&sai=AMfl-YQG7P-4f-agxDwVdmnidK-4mnSADG0TU3tP3-qoubqlEt2my-GUpgOka3Vxfh0yoK1ID4O1S51BEVJvQTVbGtSgLN2HnhJfL7ZAVM-IPWRAamM2oOCgeyYOI4RVNmZv3xpN-3PHplTMS2rTSbaDOxGk3-QD4HYriON4CYmRUq_XWL7FtA10yBYFFlhpP6ujEpWbqcs9Rb5_vuD5DA7rbuPeUn_3o4023WDO1PVj5rtXQn9vTGh5Wn0E_RC5lGLiT1RZwzU2ZF9AkGXcEPbFP91TjZSb0_Q&sig=Cg0ArKJSzI0lmE9Fm8izEAE&uach_m=%5BUACH%5D&adurl=
Frame ID: 3B265AEEC8C40F2CA66449F20B3AA9FB
Requests: 11 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvdEJ07OujOQKPN0ftiYZfOXlAcMlM4X5KWuoRqJMilLdw3PZ5-N5Ms-kZfNh5O1DBf5bD7p5qUoH1fBOazwuJoZmwczF7_TWrdq03pSFKt8F6iKC1AEBFPDXdmuE6Dtg99YVzB3LicTh_qhgrxw7SUfWx0VkD9wdIrMhRc1llhCSAW340--2l4LIWeLpZ-7uhLtYtWbIomPKSYST4jp8sq-RboLcQ7lOUAIQOOKNolOmQlgh95BAisLkIrmbO4vJ2p6fRNFQT6PFs67lE26IFTBJdHJ0Id_2cUtG5aw4qpWHynu4AkNwv7O4xuthVHjhMvvxgB8Do8Ypcy8yqrISgV5ZAdB_wla-9jVC5TA8f-4nLsz4MsYZ28j0vnM7Ic9Ec1-VTiK0Q5aVrKQEt7mvXfFuOiizp_D7-wekjSJB_zTWCyhN_Rue0bYg&sai=AMfl-YQEWDoDersJinLQgMWCu7As7V9ppH5SnqFYAi0tRZuMe0PgmPMQOVLUIIkrzKiXCSy82OudZbq_71jITTRJSOveuesqiqHyqaZYQp18gC5VO1HIC6rRRrO_cFVv9OuyubitC7_UCB3iMdy_JDrDHBM_mmsPrI1XAdDxV8rKvi-t8Q3sWPzRR-pU7-7GVQfsdXPw_sJL03v2RE4oWbBxJ5Ykw4hPuXfPf3D2oRG1IvhB8dxdvXOcSVweqpStnOMaiDoItnevR7KGwZaFl-p9U7mt-xq00F4&sig=Cg0ArKJSzIstAQt-rKzXEAE&uach_m=%5BUACH%5D&adurl=
Frame ID: 87D9750BF7D23966F934382B768F7C56
Requests: 11 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstk4RHGGEoyoVA1TbMk-QxHVwVJc3Al7iFLMtToPcoKlj8-8xaiCN9ZdzEZqMqObNkTWr62Se4l4Tal7Bs1wYtlOyEpumNGVMuB7QIRDyMOLAvODCGYc7wV25P6PWrRTo64fkK6XjEmeKGLn2kfK6VjPQyZY7OoMc67yIJeoRyKH4UyjHWtSg3E4qx1ZlWPwbENFIgvKN13k_3Ot4zTkgtUpoDpfiCpyS7MEip1iKMSExXfV3qGnjanwcjVnE6l27tdZO4p90EAYDDTFPhARzOSeyQAvMQrkqrbqoT2Cn-dUxflwaFCK-BKQOZMO39SR4I6Wu5_VwbWjZrgYor3W4A7ojAEssu2_FA65jvO2QK_3bGSWId4i0XqlWS-EonZr2AoJXdvgFkKLibYSXTjUXalkZCCDWnVnwvobDmvsKKzKz10rERQLIsPMQ&sai=AMfl-YR5nh5eXHRdwKcb3uwpIH8iwJzawt0OjrwjR_pCc8zbHLYdhc7NPgw6MQ_KVVBB73I-cDogQmCSqrCMPtZsWjv4fUSPEbTaAnc4U3U0NC6eauv2ySi4FZEMMZrWGGRWTpVVq9ba-5ZlAocC2ZIS9GI0peMxgi3m5VN_Fv4BuKNHhJZ8JuYgE_h1CNkeyH2lSpgQMw9MSMOVn8tDUWBWUTYZC6y5jzCFte0vKBhU8xl1nrAnGGIXc6fC9e5Ig-i8BPW-9NI2bHv00utiZOWTEieaqDSqlGA&sig=Cg0ArKJSzJyEv9SjhjV3EAE&uach_m=%5BUACH%5D&adurl=
Frame ID: 9033BC0962CBE1AAB64A77FC8E2930E0
Requests: 11 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsveOI4H_qybYjNUDHRUlophnv1GaVWr2hNXVZheZeLh9dKb5bhMWYsPTBmZUiAIuKjP-nhjlAHZ22CT2590-sexIPW4T_vKPPKpKrZ5oM9YDKZaX_wfugIKMmTKNUyVqC0P9W3TzydkuUKcz82kCklrn8mDOr9rdW8ZH2qrFtYddsA758SZjUsZQxxQllHLl-g8jMH2y6G_4k8S2BLW13NVPz4jPble-6E1-ITZfWHS9CHPvXmvRUknkQANSodQB1JpJ3aQGHepEwcfvkrCNXENoagy_KylHBF6W6yiF_9SS6A4EREeFuQzH00-mRX6J0fr8GS4VVCinl1vags1VRCnqfCn96hC0lcLCjdhehQMSfV6i7b12TOROkrVIET-jItKg-VToRTPcw9fZv2JcM2o5bF5ixz96Rsplqauf5syUi3cJIrn0F9s-w&sai=AMfl-YS_JYsoZHTxL31PzxA82hQb1p1NB62XXs4XUPb3w_JY3OlC7YoEv5FhSj6mrOh01xdOlVFRolINnqxade6E2A_KhMl-vov1-ANJbV0wSaYfyKsXHe4ytLUuDrtFJR4hcYGMmxfuzam-LFp8pRdYnPgK84nbqqm1E1iM3Gdg89xmHRPyBlYcOovhjp_QOb-kcUTzJBvD-82BwMyHKkxv4rXDHrZS-RQ881BijjfuzYvIJUwz7bfe8XkoJ4fyA4P3Yq4odp-OB_jQJJsfJCeWh1wm0p0M7Icj&sig=Cg0ArKJSzEmQMOrg02TOEAE&uach_m=%5BUACH%5D&adurl=
Frame ID: BA03BD73D34F98821B9BF3A18E80D3CD
Requests: 11 HTTP requests in this frame

Frame: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Frame ID: 53391290C54A3831A09F8791B9C6C7AF
Requests: 6 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=www.mediafire.com&gdpr=0&gdpr_consent=&gpp=DBABJg~BFoAAEA.QA&gpp_sid=
Frame ID: B4913A9104A4A93EBA44AA40EE41BAB7
Requests: 2 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158936&gdpr=0&gdpr_consent=
Frame ID: B83B6EF28C647E1AF2A68E83BCA3CBD0
Requests: 17 HTTP requests in this frame

Frame: https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=140AEBBA-51AC-4910-8B0A-192900D0CE33&gdpr=0&gdpr_consent=
Frame ID: 8689AB1720E793EAC167D3BD33680AAE
Requests: 1 HTTP requests in this frame

Frame: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:123768C091264034ADD91CF9B0FB5C24
Frame ID: B89EB762DB25CEC8615F67DD87DB79F2
Requests: 1 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=140AEBBA-51AC-4910-8B0A-192900D0CE33&redir=true&gdpr=0&gdpr_consent=&dcc=t
Frame ID: 21B5B20C6F5D27FCEAE0E5DC41D8FDF4
Requests: 1 HTTP requests in this frame

Frame: https://match.deepintent.com/usersync/141?gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=
Frame ID: ECB790F29EF9D102622425514876D085
Requests: 1 HTTP requests in this frame

Frame: https://user-sync.fwmrm.net/ad/u?mode=user-register&dspid=64&dspuid=140AEBBA-51AC-4910-8B0A-192900D0CE33&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&_fw_is_lat=&_fw_atts=&_fw_coppa=
Frame ID: 185B152713B6555AC459B01C5422945F
Requests: 1 HTTP requests in this frame

Frame: https://tracookiepixel.xyz/log?c_uid=None&cust_id=None&bdsp_uid=AAEjI07SiBUAAAIMnCGOvA&key=af004bf9e3af8f9275b3bf8945e895b6446bf14bb0f1b0b93afc00ed40ac348c&gdpr=0
Frame ID: 7CFB08F9A8FB25679257BDCDDFDD78EF
Requests: 1 HTTP requests in this frame

Frame: https://pr-bh.ybp.yahoo.com/sync/pubmatic/140AEBBA-51AC-4910-8B0A-192900D0CE33?gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=
Frame ID: 6CF520171EEE4C0BB757CF4D9FBFBCDC
Requests: 4 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQwNjQmdGw9NDMyMDA=&piggybackCookie=y-MgHH_rZE2oDIKPUJDe20L6l8eQ0ClIqYt6Mgz2w-~A&gdpr=0
Frame ID: B987F9782D95D80273B701AC9B5380A6
Requests: 1 HTTP requests in this frame

Frame: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-6JJX4VRE2uWhx.z.linNL65pNIJiWeE-~A&gdpr=0&us_privacy=
Frame ID: 7EFD7A5E29019AF796EC4A24B4C21957
Requests: 1 HTTP requests in this frame

Frame: https://www.temu.com/api/adx/cm/pixel-pubmatic?id=140AEBBA-51AC-4910-8B0A-192900D0CE33&gdpr=0&gdpr_consent=&us_privacy=
Frame ID: 358CFF913F164A3117259060ED7C8935
Requests: 1 HTTP requests in this frame

Frame: https://sync.ipredictive.com/d/sync/cookie/generic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=${ADELPHIC_CUID}&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=
Frame ID: A6E6A3A4990437A1EABDFFB2BD99F69A
Requests: 1 HTTP requests in this frame

Frame: https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=140AEBBA-51AC-4910-8B0A-192900D0CE33&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=
Frame ID: EF4374F170EE85433DC182862428FBB6
Requests: 1 HTTP requests in this frame

Frame: https://sync.srv.stackadapt.com/sync?nid=11&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=
Frame ID: 3467B393BAF6E9E713397529627FE595
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=6401843043709241418&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=
Frame ID: 5678A3FE4F5DCAC87C522480122EDDD7
Requests: 1 HTTP requests in this frame

Frame: https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=0&gdpr_consent=&_test=aUQKUQAK4KUI9wBL
Frame ID: C13EDC08951D18CF213DB13CFDFA4117
Requests: 1 HTTP requests in this frame

Frame: https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=
Frame ID: E5B02449C51DA1C8C5851965EEF63D6B
Requests: 1 HTTP requests in this frame

Frame: https://tr.blismedia.com/v1/api/sync/pubmatic
Frame ID: 4DE36F071BF6DF87014BB9AFCB4714A0
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Minecraft Dungeons v1.17.0.0

Detected technologies

Amplitude (Analytics) Expand

Overall confidence: 100%
Detected patterns

cdn\.amplitude\.com

Cloudflare Browser Insights (Analytics) Expand

Overall confidence: 100%
Detected patterns

static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

Google AdSense (Advertising) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

OpenX (Advertising) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

PubMatic (Advertising) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.pubmatic\.com

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

225
Requests

89 %
HTTPS

0 %
IPv6

60
Domains

90
Subdomains

71
IPs

6
Countries

2166 kB
Transfer

7204 kB
Size

117
Cookies

17 Outgoing links

These are links going to different origins than the main page.

URL: https://download1326.mediafire.com/dzu4gprb7begnRjrgS7QMukhkHaZQPT_mmoeHgLY7P00lDopzIlVLKoXRuTAd1yX71fGNewKcVo8LadIrQ_RzABWa1LamQroyPEVo2x9TZNa3V-lnKIz8GQUgonf4LGVCQAHN_9pCH8srHAet1SWxRRTB6rbZt7xqpXI9HQdUOo/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip
Title: Download (2.41GB)

Search URL Search Domain Scan URL

URL: http://blog.mediafire.com/
Title: Company Blog

Search URL Search Domain Scan URL

URL: https://www.fast.io/share/new?utm_source=mfftr_file
Title: File Sharing for Creators

Search URL Search Domain Scan URL

URL: https://mediafire.zendesk.com/hc/en-us
Title: Support

Search URL Search Domain Scan URL

URL: https://translate.google.com/
Title: Translate

Search URL Search Domain Scan URL

URL: https://twitter.com/#!/mediafire

Search URL Search Domain Scan URL

URL: https://www.facebook.com/mediafire

Search URL Search Domain Scan URL

URL: https://twitter.com/mediafire
Title: Twitter Page

Search URL Search Domain Scan URL

URL: https://blog.mediafire.com/
Title: MediaFire Blog

Search URL Search Domain Scan URL

URL: https://googleads.g.doubleclick.net/pcs/click?xai=AKAOjstIpY_tUwHRTeJiX3u2Zhrd913pDkhiuNNmOK6ZYEQgdMvXORJ805zlYZ_soJUIM6C2e0KbXciXTJLzntH33PTvKezpxzGbL76d3CLKayDYzPpydS3fdQeUvyVWoYT_rMc7DuHULE254v8CUPfCeUo2KDKP3yDMPIXWeiXr0kvjeduRyyssqw46bPV2w5QPfU-9lan6d_z2C4UKGQwvFrxFP7S2vBnpZkIhH5DW7jItKWM1v07mhfoNvYnyxhTR5Tc5UoCzb92Sk1wern-LCptR_y0NSYiuDQEMPwMn0bZgZBOm9GzPfT40WOAAsjiPYHpYQonYLLExT6ix9rwz5JYJMVqtZExAUCuwLK9oGvgARi8HUaSF2n_vyATw0uZQ2aBLELkWUTSdMShuhdP8LvTlc6EJ7NjcY8MkhYXcA7u3A721_1lo-6eMOQ&sai=AMfl-YQZ-s6Sux0uTDuFWsGgvMIfufmpS1uy0VnBhQALSw2wLzG7rNpDNQKHhampo_uuKoxSjvu95s2o0itt8fPSIYNm5k_vUjqSxqqtKoPyjt2TAu1Ni7YRY5rKQdSv5PL9JuzAXINMcFO4uJIFN03jntFY2Wdn__XLS5QhgGowM7tSlL-lzESfKyZ3U6u92JBIG4v-KRIt7XMdvpoLsFWWbHXbsxWlat9JPOV8NHRhXJwUEeU4M11qNHCK4Qsz_WsUCdD-3JK6nqsEfC-xp8de9X88LAyWYFk&sig=Cg0ArKJSzDT6CD9uLijj&fbs_aeid=%5Bgw_fbsaeid%5D&adurl=https://www.mediafire.com/upgrade/get_plan.php%3Fpid%3Dultra_50_monthly

Search URL Search Domain Scan URL

URL: https://adssettings.google.com/whythisad?source=display&reasons=AUJjZ_6BCbjaFR6gtgo7D5MNDQKeAwTHYgIVNT1rhIE2DAXw637nbDxjH0gn1HPRFMtPSqHhVzKW0F-PdQr_uxEXQi6YZcsn0hA8QESYKa3ZFY7HXN-XDSBPi1A0KIAkh1KcKI6YS1TEryHnLCWAgT1yl0uc6tDcTzHGYKFgYwCtOAnJ1QNtmTuNZWvggvhwvMZaKiann9XyLQMrMzFLQPVtJ1h8NadbXq1TFpB1tItpXU_f5PTmv63at8eN4Srq5uL6EYF65cuxLf4A_H1fdm8H9RgZOhcIa2l-H7ncKMFBsMTOXRY-rfN0be9Mbpt0bBhnLhAC_vZZSJIbTpTJq8KFkvbRCwpOO2tzHiT5mxAPWqxI4xaWzra3YKWrvHblgHxbQSB4UuMDGilt_DFTWTkKRC3Spx6aZTynlGjFq7aAvEbBbPM9EVWw0x5Wxnwc6UzLE8gkbjZsQEaayZ_ZycHROuJDWMI6fiIx3Ea7gTrdpaCErQJ74hurr8PRsi1ORhe35n2besB2zSfcOiUQC8vnKofc0nzgcXdo2-RhURQoZlXZ3A8dyyfNZrUYZeI5tXungQbgV3cEqoS-RxiKRXZktviCZAqMFTnUNTKKqbwSMXFRxkPkHvYLHt_nb5KfCK-2bwu3N-zQXzXUzSe_CRIY_2Nm0xxUNf6t2emlh5hvqWFgLpC3ZGaR3G1A4a0QVOm_8BPnPaqlfqoR3lEzMZurkXTcpfHoBH15FctXPvSrai1MqxicQBvIrx2ZwHKJqsug-mJ2_BpVyV7CpS7LERkw0q1tFlgD3xsErVCkEPpPT8jhJ4TXh-8Ho9Rp0QpEwMCpWI2r4ESMVdWcBB9Vg0Z0VWn5x7dtnbD7dKKadDXvZlCWw3wuDecT71zcemicgENwk1Rqdi6l-zc_FeQtsgqk5Jryr59CmD7FWYCIrUvJAsb4mwgr8PJdlZnkYyie0WEv__loAm3n95-H5OyrNCFOkHAA38aAb_b7jB7H6P0TKyjIGs7k2FPDlH4O9tVbNLDqP2JmEZ03HFt-btSEu5JvXifhzzCw9pwWN0b8fwyz7ZkMfD6WLNt0M7Th32AQZ0Qu9m1BITy6aawN5SBVATgL73IVRCCo1EqQqVZ9dlymq1LVNHDucqsYlTICyWS5vnjIYILOlDXYr7LhcGoX6ykO2kuhXv0--G5y9AcLng6g8DBQQrh0S6Pob5QMphqB247swx1ua2z3hKMnmdpemWJgFnTHXfguvQMp_OXxaGRkCgXDG1qyfPqeCdsbfFxWLSYokIrFACE9oJE4OkoCqU1nbvI67nnVPdM-xenJMdsopdVvwcd545y8jxxi9yu6qEoWwawKiYMqxlBaGKKD77klwStZz-yJ5r3ri7LoBqry31f8PVRAwsWW2WoxYjX7aYQ9Y9qV34XGIks61nmN0OgyI3Xg90nubIsW0G_de84GovNMZFnPUG-kIOFHr1pTy_hJvTybwhGXaonaV7w84lfnJCUDYP-Z67HzYZAFqTDOr731qfXmLSwQJS5SSxWLcEWUJD_G5Il72O9HcmkUlbWjFVCQ6tkS-8OzwDegtjmUHUPRMnjjaMWOiqCvfxpHV59H7rbUAWM-JnvWUApFwiBeDxG64HgePVmYsMK5NUBfgmVMTExmzgcHNmqfjyRyHPsKFwFXqqtUYvsoSSAlA6ln_vuXFjsbH2ZcQiQVWRRRdByKfY0a4RnxBAkRfbB4yEJhMsF2YPrAcNqmTofH9L25nVoyLoCbiEQ6h8z8SoGngU7lRjGeDi-ES7sdW0wRAo4FkvT8E1ggvCLQtb9ewKAM4eiICd2Xz9C9O4gQ3vQsyRicCOxdye92zIcjNZmv_jSnbo0y9CcVXUJcGWF7XrV1cF1Y1wmaULYnJr6wd9ZvsRNhYyxImgOSlxK9-wVuG30oYT2e_WdgSUlNji5WLZam5JrJKA8PKNJFWJDBYySSjdyQSa6Gj6XkBJXaaiqUDbwWLV_h4w&opi=122715837

Search URL Search Domain Scan URL

URL: https://googleads.g.doubleclick.net/pcs/click?xai=AKAOjsubUyk99rN82W2ujKnC9nhgdnsf_pVX3uXZgufhDbSb7Dyx-0_tDjBiVMSWbKq9zBLBzpRYm4R72OPF7zIUu_B4wkQXxhSYg2tcGM3Sjei9Ceel4jHiMTM7pS-h_F_NqfOXGtXsndkzqxEFvQt4K2QvPGMnPFLOIYkOQ0ts9qddOuzDKKFsq3SpnYhkMjCOBsHtKEzClvOur9Evfd5LhVEcHIYzBiQCqGCssF-pForKym1ZfOKPYkwDsE505y3KNNYlSWIs69kNzgOeE9geej0OxecXHPoPhutQ63Ihes3w4lZPm9_sbvZpdZDTZFXqSkTKOXjKQjXY6oxg0Z6jPI9caSUbHEGVd3or-K7d-VAi5CERWE6ru1rFkNBOFIJ1HIXQ4HCdt13b_MLn1PJ_438Ups_c8CNsoRTtmA&sai=AMfl-YTatFnLxh-Pc9YBVG7uyz4hYqi4hdGghe4bISyViShyQMoRnvwiLHCeDzs__PNcv-9F_UKf1AxuzQ-RWP8WxElnihnkLaabXvai_vsPXJtU9-uwt6_nPVxSvPaN-ZhhXwO9l-ME1ZRjsutTUo-wqSgZ3au6kDgJ6vnx7njMju8rnJZ-fheFb6YX7Pm1_jUKx9--eauXYbYrSoSc0sQjJzmdpJOd3ZYH4a_U1cjNeES8ZY6eJsu-Fwn88c3FGDfuU4T3MHne_Oqkw3k6KC5N-uq-iUfFO_E&sig=Cg0ArKJSzHZ6Ih2KDvM5&fbs_aeid=%5Bgw_fbsaeid%5D&adurl=https://www.mediafire.com/upgrade/get_plan.php%3Fpid%3Dultra_50_monthly

Search URL Search Domain Scan URL

URL: https://adssettings.google.com/whythisad?source=display&reasons=AUJjZ_5PWYDg4vBX1v8xOf9NgpMQ8VmrDNC9pgxvzTwreuRUF-23krqKSQ0qPQ-ZkNSURjriVtGsQUda5tB35c804UsoFYTVEpKI1bLtkADzdFGpmItNxH1HwSngm7XuiCm03Z8gYywA8sT5YAZcAWaJ6BoElGR3kgMybzsdoaha9Eu0XENY2XEEsh1dag3w3Tgfhr5zBRxPXZbV_gzaU3nps9oCx5qaUdK-Lxtj7lIsTHjnZmrW-ghH-gO_zVHKTTJRqNYAdn0l0RQIrUrHhEHiZ69t_bEX22iFLwmvxXFtWPW0UucDAqSRI9BHfpsYTxF_d25NQHKg6Q9NfDhrEg6dzCEIpp3AybBxfwYrw2vVR_Sl9ngT0rkXuDTZ3njONo-96eNvcncbUqehfhs2d64vpInmH6SjEAbY-7Zr1lYimQqWiEBzHTq5burGoaIFJF19nNirGiAe010UjiSnWcSI7-sqArlvljp41qFwxUaH9WQIZCLmH7WGvdmdouOi9B65rXsBak7y7TKiCHfejzgTm4HOG0x25bVgJZgdey6HRiyYaHxi4cPdhgW8V3tl9Y5G6gpW61xC6oyAvxVEIyduZJfA96UDGdXhbg6NkMD636CS3U94wb5NCoBD7mBjQcuS77UCZ1Rs606-NqIY9iHdJttP9hdOfMyJ8yyfYNsnG26-jq1l4WM5kID3QirbluxIVJJXVnbJ9dc0v9h3RGoggIs-D2FAxKW8GW23MfoWb1f2Ymhnla8cznr_v8kXMQeEezH1lOaSDMbrtlRT8ayHdD6iFEwEYkrriWeEIgZY4gqEnlBrluhlO8LO5PByV6Rp6oHAci97BLpMTKqLAK8aBl7BHxE4zE0-xDr4NCezP_LZ6PLawH8wo9JL048widpxlWQuTIabNuDo51wujDAw4tNq5NNf0ba_Gpy38z8ufLCLw7qyo9uTitDgPwwguLc-TZfHmotqAxg98ccnzMY8HbV6Xy2ot2APKLIJp0_e5wTjT7JNI8qYcbrffpVcTr7-hOZBx0qMv4fQhh5ZBAlW9HkASOCOqatW5OFl2AOuBFNRFbUZG-pWtZl8BiraE7laevs9bHtCozx5NOToIWhPdezPL_Zf5XDMNWNJR542AM8zWUNM9j9mtGPnT-bTRNhwrjz7OQ72SxuZcwi4iPKG8y43--P7ME89-USmRjIazUU5P846GO926o3JYFeg8ZH2pI28GjXG-vHjfqzZGCsGvEdAnN86uXoCa2fK2PlLUHeLzvY6JqX38EJfDwkIJ5B7GyNasbB3pw5fFFJ9F7GgehcrPkA1ZEhxAuJN9NScsVjHOjlsM6JGUcCrBoNH6lyRSIObF458VxhfDuzgTQP7GRSuB3lOdlDe5lS5U2dZ4XknFbi3neMMP1psUG9fXCZJlqht4kO6fdEBTQt8pBQhD3Yhv6y3viqOWiFoc_8a05qLqpZjacYnb34wkEsxdEWwVyuogpOIhizSwiz2SSGvbr1y8xrkShYldDqQwlVOohk0ThCSUhMA4mntcxA1JhZ7PzYy-A-70iqPJTok5JwXeyvoy-RAqcTdYLB1yDShGFmnaM6hEw7AFlytPFeAg8EcgogwLh5c9SGQQ_bXLpDc-nG6oJA9kYAfRxRVr3wvoe6raHSfWsbj43KP1jGfU4_E5pC_rMy8JIkX__vHtXar2IlzlzPew3rzccBjoHsU8OwSdT6V5L86HV2f9kpBY0wzKN9lOucrWFYmH2_-k6YzdIshOEOQYXFGg-guuGQGbwMyxQ94a1_l-IDyawB2npSKtRd8c16mls6kLHrUBdI4HQ9RxPd1Xam3q-ou1ON4Pyqum8RHPM4YFiAUvvWigva_-LOqbpZux0qPNQpl3yzE1QmHVZp9BYUgH00sCdhzBmJQ8bCnHj7zdNAZbUf-WQEhX9u7fp71PDj4uCBQo2Nms5W46HxP4NRMisootzbEfH8&opi=122715837

Search URL Search Domain Scan URL

URL: https://googleads.g.doubleclick.net/pcs/click?xai=AKAOjsu_1kvjAp_ULJjzUQkZwtW45g-il8Jz2yqzCGv0p4GE81DNXlVdLIICnuYSiwfpeNZQC2UNP16VPBdU3C2ilxWfL5YT6oX0-htWWgvDBoPDDqW9JnLL3XvzUJ5Gx5WUYPgb0EZdfnGgSCnTGo4CRL1KSjR11RAOr3cNU7YLHz3Btn1vC3fvOgia0NqQgN_5sLe4KE-K7zKQMmgdg9adnT38mfilqc_2d35noPZVYKQBBw0ykZFTUMg6noSPwiYB5L44fdDgig6aBrWiOKjihKYgf0BhI6893A8NX7l7yEVds0GzDiRu_SI6dbkzc-l8RurX-5_h-h-Q6Z8iR9cZV8jhpZJvzG_QK3IVkLnv8mTWJ3gJ1uFcq_rudVGnPdHqsWLuZqsxWdMEcfW209U_rCt3y5HqqTH5qk9IqA&sai=AMfl-YSsXFzRlVVR1lAuzhNDLiqRuU48Ihq-U6E6M4ZH_1ioscwE89_s9ebliFZBtkLq8pRdIUKFXuEbxnJjZp8JJ2KtZWWRLk5_DL7vEarm3GX5lIt1JTPUYJw--0Dn6Ddc1g4kOMXDlhSa9w7UECzx8mGzafAO_CAbLQPS95hw9-5lAJL0NRviwCh6sDKOvxzUNm_KuFuB7Zun4DxczHuxzxnlHV5Z0wKi3nn0UVruUgmowj0C9N8HdYsDZj9Vq_Ye-SniMMfTH-HRo4MlClrzleaOhEkK7j8&sig=Cg0ArKJSzGGOuR7MY2xf&fbs_aeid=%5Bgw_fbsaeid%5D&adurl=https://www.mediafire.com/upgrade/get_plan.php%3Fpid%3Dpremium_annual_free%26utm_source%3Dhouse_ad_360%26utm_medium%3Dwebsite%26utm_content%3Dtrial%26utm_campaign%3Dv01_300x250%26mf_source%3Dhouse_ad_360%26mf_medium%3Dwebsite%26mf_content%3Dtrial%26mf_campaign%3Dv01_300x250

Search URL Search Domain Scan URL

URL: https://adssettings.google.com/whythisad?source=display&reasons=AUJjZ_7XqGvJgoNLxjGQS8SMCPdrXeW0Moxait0yhH9s6Vuwph-N4k3O-KJBw4xPj1H5H4BD8xj7SSWkwaAF7CQYWEUg63cGEcpEaKJBpzDtkM1CqWjRwyuQ0ml9KaL2IydJnjj37EVcWwsNBtz31XSNnKaQHbtg5GT14HHfsq8he3M8O1lHhx-x8R-x67IEd2_0Cpqucb87_9HSwpWkCsV759uK58VvqzDl2g2UyVqbNb_rMtlqO1vzxTUjtrcC0sFoBZec3_CwfwP89ziwdg9dsSuSZDHHHzOpaauHYLwu88r44tmfv69Ox44Q2sv4Vn-aVJEUYUJA51SsAFV8NoDlAEWtPouHHyy1s-DR3WqeE7xUwVusF3xpO5lw8CK-Gv0XLi1bCv-S4dSSleb92L4Q0T331ovXYQL9N6oZgcf4dZ4B8R1P1Qb-hnGTzX9JnLY_lEyfhJuewKYww1RoQKnSIwE6aCI3XBhy7ADxDYnjH8RFXX2Z6jhrTnOVjThKF5e7snHcsoMT6GxmzL4tzqAD8oNcTnJFUr-17dwxMzGOMAGgBPmioibHs7JCKQOVXeea2_jUYo-M8kJbSqZmBau9BcEkLd3mjoI9vvYEn2ND1Ckvi3b6ctcR1ONH2HXU9pwGJq7dZIfc4MgwoQN92vqOlaA4LkQ6S72TG3ijh-3rbDaCRRzOvBkHcrEHvCeAQw0rWqU6bdbru1XI579LzpsX-NNfUTDY1FCKDoyZNaxtX0TICInYqpcH1S7ZYleuStGJIVr1LxVqEnfhBdetyZLgqwdntct78kWNsjqx4_8eWp_D8XRgvI3fUrCpDuRZKKcc8GGojiobevruhqvZU858fZjd3k4Wy73ZrRdFyeibsmtpTpB_h2zBkP7ZnoqPgyz_Wp1ra1LfmmklXHsURywuGrYm6_Xrvr4CUl2u5PgwE5A4RixRLDRjokH1NHr3S_fRuCY80LglEJkqrSJUayylXUPVTIz2rFVJnMhZi1o8W20wH676FYACzXcPP2qIof82Aymx85d3p9ocdYM4-_bTW0oJawndv6ZK2YiWP0_PKiKfY0mlD6Tv8BpVZgpn18bCizWbnYDy4X62TXtlqkhCn-4kRtqMqYNf1fWqGEWP3Sn4kdLwA702zdJ3uMDlfBBjOLxRW7Y_DsXXHzENKtSkHds4iYz5bFiIRdeO7Qlu1RDyh3SCAEykkljNPWgEumewrMRn5d42tQ96Q1hTUAMHEL3no6wIFutAYvBIf1xrOFXWKlutsj0nA5bQsVakZH2G1BppVlTBeyyyUaAxDVXG4Fl2kXh_XEoqxOcmBJ3LsP5mj7EU7jRutWMYmxZn-WsrVp18wwuLiILqek9Y6KqnXf4kWhhYI6an-jp9ydEvmENZuArFEeF0PFkhmOM0VzoLH5eRG5HGL5js7CPlrz7yeQfAeARFptZaRnnIg_AsGSOyE5zJKaNGKR527NzKaEwe8fQhUc-mJ8L7nIuHBfaxhre6m2ljLqM9X9MSeubcVMzzMof70uOtbp1gDuJH0Hq7KDLhrzWk_zcPHD6ovktdcBGiDy8VD5jSz7_kYVgqrEu2GVFbWTyR4dfdkbmNSP-5sClszTibkEc38u6sEpJyI5UMB6fldeLszyLwQSLwbKzxgTPs1GGYpjuGdzIdsNLRjtjDbZT6DmqosToSELKtbgiJlNWJCbGuHlBoJBOEzfTwndgXE084Kbxv5b3Pevt3ZQ1iICfmo0ecL4b2w_h6wbkUACPhXa8P2XQD4oMDNZuypO1ksI3d7IOw1ofx0zjuVDqxhpnqw8cmheVB3fsLtjq_1NiXColGk_3jLbMP0lVyyP7oQPO2a_J4ZmeMYuuN9kqiz-26zTJMFk-ZYQuUQbzaN8MtUiDcc9Q23Yhob1r9M13KEbAH4ilxMF1hszHRziT5s0N6TENANE093VZTp9FprRPhoNY4OnfoE9s_fJ8&opi=122715837

Search URL Search Domain Scan URL

URL: https://googleads.g.doubleclick.net/pcs/click?xai=AKAOjsvQe8lrTlOe20xFkTaXZxPmWwoQRl5KuDwGqs3-D63_EiEb5dzRE_EkC28N_-HhlJNdp__tetENI7yzYrBhTTvnlDpQZvGdbdZ7DUk7r_J4sJCU9-XbPDPB4GQEMu5l3v4hY3iAzhYZCoGfWflVHqbHm8BgbjGz4LyQW2euOCp17S0FP7xotffVkLSmHXOs_yfaEAjdwKj3HElmT8HUH9TmWdRDFgIjxdSzn0NvdYjEQOUjdVcRnB_8OpZW_07kzpKvdaNFwg7kWjHcLbY3kEoOjXkXTmQeQ69FmOkm-LmUXr8Pc6ondch1pRoBbvTM0-9hDB-8Bhk7oo3gox4r3NzO1zLv-sBbzemftN-emvkpbVUwElJ72R6UbHOg5gcGuydvOM_TPC-DmFdtUmy__j-ep42dJvzwC5aslw&sai=AMfl-YTGroLS-aj2CZGVpdU2DJfejtFS06QNyR1AIMb72hJLAsJxgWQ9MoN4FvuJB6G5OybYGw86J9J-SE4_90c35Ua5WYVgKnVDVoK9wbrewGFPw7qS5ThCk4TV-TdYt5S2NWyHjsf9PoCaP2GehNVenFLqleL074CieHsRGktuQlipv-zaakK-vzdBZaVH6odnICkfCR7EHJN6FGWY_fDsQWzvaDw9Xz3quBMG9-PFsocmZYCpHiEoxC2nfQyJ1ltUP8AjWUxMPYQClPwyJ0OIbp6ugn0mFIqo&sig=Cg0ArKJSzOuqSymjso62&fbs_aeid=%5Bgw_fbsaeid%5D&adurl=https://www.mediafire.com/upgrade/get_plan.php%3Fpid%3Dultra_50_monthly

Search URL Search Domain Scan URL

URL: https://adssettings.google.com/whythisad?source=display&reasons=AUJjZ_75AgVAna7ZjBmXvZWO1tLC2BgsZkrVDYjbCa59SVyJZCtO1DZ4Y_h1LFWDyWhkuV204cj1RCVq9fHv_7A6_QHdKu65EDW3B0yv17hfH_4UIcrmoSDqDyoN8O9JdY8359jeMJZq8z6KiYiN_ropK1tnfDC9z-l3r1iAvrN5aXfyjksGBw2Azg0uGFr-ugP_1OE4ZxzHhEerjQMdwqVot7S9ZRZ_TZEte51dmPmeVC2zvxiVAcXSSBFOazg-4QNqLf5GUlUKrEhmDeabtNFJSeL1TkNfxJh1N3mOZFA_VnCQ4za9Uh-Q-feoc1sTVtRPCQa0jLDNwaJiaxoQdS2Y02PthXOXYWDZusVNIuXABRnernI2f-ZjqgHkOATgvGZq88Lj9BE3GQ82YOvK9CDT2cb0jY1eXRCVyWtgYFd698WLGTQjo1U5bks7VTScUSbA35CxDkRbldM-wSoa_N_s52wlN4i41UUO8_W09UFDNxl7yrFX1mdaMHmYfsEdMguZqJiHVDtgZaTvuiz28rzY3K9kDlKA5z3PNiPR4MURAs8LG6lqfenxSoAy_KiOZq01Go_Jzt-WeoZJMZIuGPqnJetyDW_W5jtIeBEnZDW3rHIxUq-CPG1ttDnZDQBCpb6_TxkhkP2tQkNwx4uAN3LRGxIJ0OLt4eDSu4u5YThXnMmd83g2XLDIoZ6_9b7k8QY7b9cFRbyH18bkvuSJsmVOUObWtYcJ1w5fGuRYR6xeKeGVAolZBhZQ4QDeTA3e3PlyTc5sX1Mggw6Hl5oE3z6o-1Jro58vVrbZtkd8qCmmP94hpBqwLRmklrcuLS1f5zctKCFhJBTyNn8iPXuqALEXXDzM0BafE9l3p_x4otnZS-oHAh3P3AceEE30AE2Lj0EW7sTGhGjQmTCHEWHiyZx1tJboYiBJ9cDEV3_MWf5eKVcZX0zw0vJrW_NuGH5uDLo9s4XE9QT1ICGMAX5-05E6l9Wpm0md64uGLArLevcfyz7BOg7JOTfuJpd1rNAJhVPzzvBYyylrd8yysR_4LcVu-pK7hnOgKUKwUtPCkMHMux9YDqNxgWN_VUtL1DhM9Z2SCa7wcS2mbyZhg9iAiiAgyflI3kAfYZgIA6ZkcqCC_cqgv28fzM-6CgDy23QwJaBk3kuBoyFiBGReUnB3aVaPut7up0zL5is5KRdtWUHYPm93_x7wTBGhFROsLhgddqg7XN7TAHfYRqoZcsxLhkMHb16SOK2fI1WLLhrh79u3NUFh9nk8i2N_CMing9oLQEHQy8abtmvbZNWLsG7nszSK9IxB_Z-a1swcH_i6TTlKRXbAS3G7xk8SA2g02okDNboWlxXCHW-g54NYOI-V031DjGuDnGLIv3RLUvIrWbqbdPGF0raapO9h4yB3A45BhiTDOLmkMGbCnuS3l8muNzHx1oj5v9-E59hEqrzj9whRnpRY7rUpbxog-_U-u1HXdZTYrbZ6b10bFEzlSzqIzh21c1eU2XcBvGmMiThAtXRAyp_xhqnrAWK0zikzkqCRD9xgxFaddcRlzJ3FRyCMVVa9VRPIWHSQ2I6cc_CNdMoZQK9nHkNIhrA-m2R7SDOVDcwJ30pp8b__X99yqHFbBpRHT-CYSAxp0Lu4n2wZHvuCqFJ7QKwdl6L8pfvVeehg_npNJqQw1xpgiOvyajBWkEvFXk6XtrGCf3YZL20dKEzMXPH1uhwN1f5CIbpB6k0qzIyutmQBWEEv6_DCTgQ4p4IzFGEqkd3c1eyB3TdiAKWaHlTJQtPrWMcPzhgdSg0ByiFjjGZAx4G6inZ6gRcRMRncG3LZilaWCy34Zw0vlvxtd0WRDIQ7qe1KhHhI7ZW_0iSZJXFJwmuYsllxlpykV_hM8L1KDiPKuB7VXsMxyUOSMgnjcrgXOTw4pJZdlGWGOVg6HaGVsQOeD0DnIiW0MFUdl3e8tLZaBqoxKUGMeSlAVZz-x8s&opi=122715837

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 31

https://www.mediafire.com/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
https://www.mediafire.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/d39f91d70ce1/main.js

Request Chain 107

https://oajs.openx.net/esp?url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fqxgu7p6f5ea5fve%2FMinecraft%2BDungeons%2Bv1.17.0.0.zip%2Ffile&rid=esp HTTP 302
https://oajs.openx.net/esp?url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fqxgu7p6f5ea5fve%2FMinecraft%2BDungeons%2Bv1.17.0.0.zip%2Ffile&rid=esp&cc=1

Request Chain 164

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEDeIPrQH2xUMbP0WW8_1jlQ&google_cver=1

Request Chain 166

https://match.adsrvr.org/track/cmf/openx?oxid=d4302114-168f-700d-d2eb-9de1a2d29643&gdpr=0 HTTP 302
https://match.adsrvr.org/track/cmb/openx?oxid=d4302114-168f-700d-d2eb-9de1a2d29643&gdpr=0 HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072971&val=15c528ed-4f5e-4918-8ca0-b3e31751f8dc&ttd_puid=d4302114-168f-700d-d2eb-9de1a2d29643&gdpr=0&gdpr_consent=

Request Chain 167

https://ups.analytics.yahoo.com/ups/58934/cms HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-QMXVFHVE2p.JAO_9Uz_1XcyUWZFiDlrTIFM-~A

Request Chain 168

https://ad.turn.com/r/cs?pid=9&gdpr=0 HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537073061&val=4408571704014064884&gdpr=0&gdpr_consent=&us_privacy=

Request Chain 173

https://id5-sync.com/i/457/8.gif?o=api&id5id=ID5*soDvnHT7lNlBNmzlrcJFgoKmng7naInlu4BUi2xvFQz__2lECktaAAEBCmlECkoAcC7AU3PVxeZOeREPLdr8Kw&gdpr_consent=&gdpr=false&gpp=DBABJg%7EBFoAAEA.QA&gpp_sid= HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=8h9u11h&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=8h9u11h&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
https://id5-sync.com/k/264.gif?puid=766c71ed-5734-4f6e-a0bf-9bf96284fcea&ttl=%%TTL%%

Request Chain 177

https://id5-sync.com/i/457/8.gif?o=api&id5id=ID5*43CfjiUL5MsQxhz3_DI1kNNW7hy2mPn36nAkmT2fZR7__2lECkxaAAEBCmlECkoAcC6nIsB-HkbXtHHN9GoCCg&gdpr_consent=&gdpr=false&gpp=DBABJg%7EBFoAAEA.QA&gpp_sid= HTTP 302
https://rtb.gumgum.com/getuid/id5?r=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F441%2F7%2F2.gif%3Fpuid%3D%5BUID%5D%26gdpr%3D0%26gdpr_consent%3D%26gpp%3DDBABJg%7EBFoAAEA.QA%26gpp_sid%3D&gdpr=0&gdpr_consent= HTTP 302
https://id5-sync.com/c/457/441/7/2.gif?puid=u_e5a9b008-d27d-474a-a11a-f5dda15da3c9&gdpr=0&gdpr_consent=&gpp=DBABJg~BFoAAEA.QA&gpp_sid= HTTP 302
https://match.prod.bidr.io/cookie-sync/id5?us_privacy= HTTP 303
https://match.prod.bidr.io/cookie-sync/id5?us_privacy=&_bee_ppp=1 HTTP 303
https://id5-sync.com/k/155.gif?puid=AAEjI07SiBUAAAIMnCGOvA&id5AccountNum=155&numCascadesAllowed=9 HTTP 302
https://ice.360yield.com/match?publisher_dsp_id=313&dsp_callback=1&external_user_id=ID5-c515pU5KcJCDskx8d5srUxNApzbdV0xqNYoivdrLpQ&r=https%3A%2F%2Fid5-sync.com%2Fcq%2F457%2F124%2F5%2F4.gif%3Fpuid%3D%7BPUB_USER_ID%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP 302
https://ice.360yield.com/ul_cb/match?publisher_dsp_id=313&dsp_callback=1&external_user_id=ID5-c515pU5KcJCDskx8d5srUxNApzbdV0xqNYoivdrLpQ&r=https%3A%2F%2Fid5-sync.com%2Fcq%2F457%2F124%2F5%2F4.gif%3Fpuid%3D%7BPUB_USER_ID%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP 302
https://id5-sync.com/cq/457/124/5/4.gif?puid=1cec6150-05c4-4fe8-bc6b-dd3e2eb99cae&gdpr=0&gdpr_consent=&gdpr=0&gdpr_consent= HTTP 302
https://csync.loopme.me/?redirect=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F821%2F4%2F5.gif%3Fpuid%3D%7Bdevice_id%7D%26gdpr%3D0%26gdpr_consent%3D

Request Chain 198

https://c1.adform.net/serving/cookie/match?party=14&cid=140AEBBA-51AC-4910-8B0A-192900D0CE33&gdpr=0&gdpr_consent= HTTP 302
https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=140AEBBA-51AC-4910-8B0A-192900D0CE33&gdpr=0&gdpr_consent=

Request Chain 199

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:123768C091264034ADD91CF9B0FB5C24

Request Chain 200

https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=140AEBBA-51AC-4910-8B0A-192900D0CE33&redir=true&gdpr=0&gdpr_consent= HTTP 302
https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=140AEBBA-51AC-4910-8B0A-192900D0CE33&redir=true&gdpr=0&gdpr_consent=&dcc=t

Request Chain 203

https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid= HTTP 303
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFFakkwN1NpQlVBQUFJTW5DR092QQ&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&bee_sync_partners=sas%2Cdtech%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1 HTTP 302
https://match.prod.bidr.io/cookie-sync/adx?gdpr=0&gdpr_consent=&gpp=&gpp_sid=&bee_sync_partners=sas%2Cdtech%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1 HTTP 303
https://rtb-csync.smartadserver.com/redir?partneruserid=AAEjI07SiBUAAAIMnCGOvA&partnerid=127&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26bee_sync_partners%3Ddtech%252Cpp%252Cpm%26bee_sync_current_partner%3Dsas%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D2%26userid%3DSMART_USER_ID&gdpr=0 HTTP 302
https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=dtech%2Cpp%2Cpm&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=2&userid=57042088526515756&gdpr=0&gdpr_consent= HTTP 303
https://tracookiepixel.xyz/log?c_uid=None&cust_id=None&bdsp_uid=AAEjI07SiBUAAAIMnCGOvA&key=af004bf9e3af8f9275b3bf8945e895b6446bf14bb0f1b0b93afc00ed40ac348c&gdpr=0

Request Chain 205

https://dpm.demdex.net/ibs:dpid=19566&dpuuid=140AEBBA-51AC-4910-8B0A-192900D0CE33 HTTP 302
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=19566&dpuuid=140AEBBA-51AC-4910-8B0A-192900D0CE33

Request Chain 206

https://idsync.rlcdn.com/420486.gif?partner_uid=140AEBBA-51AC-4910-8B0A-192900D0CE33 HTTP 307
https://idsync.rlcdn.com/1000.gif?memo=CIbVGRIwCiwIARCMowEaJDE0MEFFQkJBLTUxQUMtNDkxMC04QjBBLTE5MjkwMEQwQ0UzMxAAGg0Iz5SQygYSBQjoBxAAQgBKAA HTTP 307
https://pippio.com/api/sync?pid=5324&it=1&iv=58e7722cf22f7c33c6632d853e10963344ce4f8bcf5b0c3e6738a77e108d63b7791426b5417dce21&_=2 HTTP 307
https://px.ads.linkedin.com/db_sync?pid=10339&puuid=58e7722cf22f7c33c6632d853e10963344ce4f8bcf5b0c3e6738a77e108d63b7791426b5417dce21&rand=05706163 HTTP 302
https://px.ads.linkedin.com/db_sync?pid=10339&puuid=58e7722cf22f7c33c6632d853e10963344ce4f8bcf5b0c3e6738a77e108d63b7791426b5417dce21&rand=05706163&expected_cookie=ab7eeb2f-3222-4a96-bb78-330696d1e995

Request Chain 207

https://pixel.onaudience.com/?partner=214&mapped=140AEBBA-51AC-4910-8B0A-192900D0CE33&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid= HTTP 302
https://ib.adnxs.com/setuid?entity=145&code=NrGB8F9IYWVTMabYWjnXWWnh&gdpr=0

Request Chain 208

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=MTQwQUVCQkEtNTFBQy00OTEwLThCMEEtMTkyOTAwRDBDRTMz&gdpr=0&gdpr_consent=&google_cm HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEC4BqQFOx1BY2NfB4kdcnnY&google_cver=1

Request Chain 209

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=FArrulGsSRCLChkpANDOMw%3D%3D&gdpr=0&gdpr_consent=&google_cm HTTP 302
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_gid=CAESEPptBhDw7GHPI4YnBqHjGDM&google_cver=1

Request Chain 210

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEC4BqQFOx1BY2NfB4kdcnnY&google_cver=1

Request Chain 211

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=766c71ed-5734-4f6e-a0bf-9bf96284fcea&gdpr=0&gdpr_consent=

Request Chain 218

https://ups.analytics.yahoo.com/ups/58917/cms?uid=140AEBBA-51AC-4910-8B0A-192900D0CE33&gpp=&gpp_sid=&us_privacy=&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQwNjQmdGw9NDMyMDA=&piggybackCookie=y-MgHH_rZE2oDIKPUJDe20L6l8eQ0ClIqYt6Mgz2w-~A&gdpr=0

Request Chain 219

https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=140AEBBA-51AC-4910-8B0A-192900D0CE33&redir=true&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid= HTTP 302
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-6JJX4VRE2uWhx.z.linNL65pNIJiWeE-~A&gdpr=0&us_privacy=

Request Chain 224

https://ib.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid= HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA%3D%26piggybackCookie%3D%24UID%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3D%26gpp%3D%26gpp_sid%3D HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=6401843043709241418&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=

Request Chain 225

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=0&gdpr_consent= HTTP 302
https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=0&gdpr_consent=&_test=aUQKUQAK4KUI9wBL

Request Chain 228

https://uipglob.semasio.net/pubmatic/1/info?sType=sync&sExtCookieId=140AEBBA-51AC-4910-8B0A-192900D0CE33&sInitiator=external&gdpr=0&gdpr_consent= HTTP 302
https://uipglob.semasio.net/pubmatic/1/info2?sType=sync&sExtCookieId=140AEBBA-51AC-4910-8B0A-192900D0CE33&sInitiator=external&gdpr=0&gdpr_consent= HTTP 302
https://sg.semasio.net/sync/1/15927723?&gdpr=0&gdpr_consent=&sInitiator=external&sExtCookieId=140AEBBA-51AC-4910-8B0A-192900D0CE33

Request Chain 231

https://pixel.tapad.com/idsync/ex/receive?partner_id=3371&partner_device_id=140AEBBA-51AC-4910-8B0A-192900D0CE33 HTTP 302
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3371&partner_device_id=140AEBBA-51AC-4910-8B0A-192900D0CE33 HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=933b3f62-7a84-4772-abbb-49692189fe48%252C%252C&gdpr=0&gdpr_consent= HTTP 302
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=766c71ed-5734-4f6e-a0bf-9bf96284fcea&ttd_puid=933b3f62-7a84-4772-abbb-49692189fe48%2C%2C

225 HTTP transactions
8 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3 200 Primary Request file Show response
www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/ 323 KB
86 KB 270ms
204ms Document
text/html 104.17.147.83
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.147.83 , Ascension Island, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eaba66df290e6c1b2b72cb836057ccf826b613e87d5c2df691ab35a543d5477e

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36

Response headers

access-control-allow-methods: OPTIONS, POST, GET
access-control-allow-origin: https://www.mediafire.com
alt-svc: h3=":443"; ma=86400
cache-control: no-cache, no-store, must-revalidate, max-age=0, post-check=0, pre-check=0
cf-cache-status: DYNAMIC
cf-ray: 9aff37da7876e661-DEN
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Thu, 18 Dec 2025 14:05:58 GMT
expires: 0
pragma: no-cache
priority: u=0,i
server: cloudflare
server-timing: cfCacheStatus;desc="DYNAMIC" cfOrigin;dur=0,cfEdge;dur=162 cfExtPri
strict-transport-security: max-age=0
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
x-mf-env: liveApi
x-mf-fe: mf1
x-robots-tag: noindex, nofollow

GET
H3 200 min.js Show response
cmp.gatekeeperconsent.com/ 292 KB
68 KB 97ms
47ms Script
text/plain 104.21.42.32
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cmp.gatekeeperconsent.com/min.js
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.42.32 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 40da4ae433e14daa5df80415b34c6efdd032eafa2f88a64ca9ea1de06bb963a6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-encoding: zstd
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=HQT%2FyTVCJa7orbbvylo7g%2FNgATqj5%2BX%2BiYXo%2BIYdiwrZgrNnaNnRrt3MUu3jlQi8ybsN%2BXNaA8Y0LV%2B6iGWQJEgWT75vok01xvZ%2BUtOUNnysjLL2GrlM"}]}
cf-ray: 9aff37dc6e95638c-DEN
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 18 Dec 2025 14:05:59 GMT
content-type: text/plain;charset=UTF-8
vary: accept-encoding
server: cloudflare
priority: u=1,i=?0

GET
H3 200 cmp.min.js Show response
the.gatekeeperconsent.com/ 8 KB
3 KB 100ms
50ms Script
application/javascript 172.67.199.186
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://the.gatekeeperconsent.com/cmp.min.js
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.199.186 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e0ff1aa498c3e7899a1ba72cea996bea56b397a6e93864cff709ce8d1776e5ea

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex, follow
content-encoding: gzip
cf-cache-status: HIT
age: 89
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=6bEumNgqkcX9VNfjxUJ30ODnR5oXN4IAZ980YQiThJIeTT0xL%2FttC1%2Be02OLTRDYAWHZ0dfSOxrZbWduHGu0zym9TcHJanEd%2BaR0ElcrvK4m3e3O46SW"}]}
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 18 Dec 2025 14:05:59 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding
last-modified: Thu, 18 Dec 2025 14:04:29 GMT
priority: u=1,i=?0
cache-control: max-age=300, public
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray: 9aff37dc6ac821f7-DEN
server: cloudflare

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 282 KB
103 KB 409ms
149ms Script
application/javascript 142.251.167.97
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-829541-1

Requested by

Host: www.mediafire.com
URL: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.167.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

35a3d8d8e7109f2d46270c753c02cae885cc215994ed070e90e293332847d4db

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: zstd
expires: Thu, 18 Dec 2025 14:05:59 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 18 Dec 2025 14:05:59 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 18 Dec 2025 12:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 104848
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 tag Show response
btloader.com/ 89 KB
28 KB 323ms
54ms Script
application/javascript 172.66.171.133
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.66.171.133 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e06078ef50b4908a9fb589760b5607670430d6d96ec7e884e45320af25d252c8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex, nofollow
cache-control: public, max-age=300, stale-if-error=3600, stale-while-revalidate=300
content-encoding: gzip
cf-cache-status: HIT
etag: "e9cd5f90041b88993b17eb49d056a936"
via: 1.1 google
cf-ray: 9aff37def8a1b3ad-DEN
accept-ranges: bytes
access-control-allow-origin: *
date: Thu, 18 Dec 2025 14:05:59 GMT
content-type: application/javascript
last-modified: Thu, 18 Dec 2025 13:11:39 GMT
server: cloudflare
vary: Accept-Encoding

GET
H3 200 sa.min.js Show response
www.ezojs.com/ezoic/ 168 KB
53 KB 192ms
103ms Script
application/javascript 172.67.170.144
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://www.ezojs.com/ezoic/sa.min.js
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.170.144 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 07f587c4be8547c249b2af0d68d74f659b495f6739329c0a8f0b643adba285f5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex, follow
content-encoding: gzip
cf-cache-status: HIT
etag: W/"748eaf6c3929880bccec86ca0f30f88e"
age: 391
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=KC4tyVrisItW1CkBy579aEYB%2FWrBYOKKcds3lJj95swOomC4gmO7aPVZHovD7XMcLv3YN%2FLTgMx01VTvpzj6gWQZx%2F5D0g55YZEE"}]}
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 18 Dec 2025 14:05:59 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding
priority: u=3,i=?0
cache-control: public, max-age=600, stale-while-revalidate=3600
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray: 9aff37de6eb3e652-DEN
server: cloudflare

GET
H2 200 element.js Show response
translate.google.com/translate_a/ 77 KB
28 KB 386ms
138ms Script
text/javascript 142.250.31.138
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://translate.google.com/translate_a/element.js?cb=googFooterTranslate

Requested by

Host: www.mediafire.com
URL: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.31.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bj-in-f138.1e100.net

Software

ESF /

Resource Hash

71ddaebb5ce9f7c12b5e1b6d7d3ba74fe9410f4d6818b8451142350f93e202b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 18 Dec 2025 14:05:59 GMT
x-xss-protection: 0
content-type: text/javascript; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
server: ESF
x-frame-options: SAMEORIGIN

GET
H2 200 vcd15cbe7772f49c399c6a5babf22c1241717689176015 Show response
static.cloudflareinsights.com/beacon.min.js/ 19 KB
7 KB 289ms
50ms Script
text/javascript 104.16.79.73
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.79.73 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Origin: https://www.mediafire.com
Referer: https://www.mediafire.com/

Response headers

cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"2024.6.1"
cross-origin-resource-policy: cross-origin
cf-ray: 9aff37df48e4e771-DEN
access-control-allow-origin: *
date: Thu, 18 Dec 2025 14:05:59 GMT
content-type: text/javascript;charset=UTF-8
last-modified: Thu, 06 Jun 2024 15:52:56 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 consent_modules.json Show response
privacy.gatekeeperconsent.com/ 28 B
498 B 195ms
104ms XHR
application/json 172.67.199.186
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://privacy.gatekeeperconsent.com/consent_modules.json
Requested by: Host: the.gatekeeperconsent.com
URL: https://the.gatekeeperconsent.com/cmp.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.199.186 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6629ab62a2d10bab5922a792f6f2602e0b821f1bc12ac2708c4daf5ea2e19437

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cache-control: max-age=15780000, public
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-encoding: zstd
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=nRsm9s7dPN25EtaS3wqF8hYECYkeYQAhSh6KuQhNmI0aEkEYlAZE%2BfYPzB4JPcAbBypyRHxQWhZDnNOlQW1NdOB1QZMaI6y3rsR2GJALtOyiU3tkgJbGSlvRkg%3D%3D"}]}
cf-ray: 9aff37de6f10e669-DEN
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 18 Dec 2025 14:05:59 GMT
content-type: application/json;charset=UTF-8
vary: accept-encoding
server: cloudflare
priority: u=1,i

GET
H2 200 amplitude-8.5.0-min.gz.js Show response
cdn.amplitude.com/libs/ 68 KB
22 KB 421ms
160ms Script
application/javascript 3.167.88.108
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.amplitude.com/libs/amplitude-8.5.0-min.gz.js
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.167.88.108 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-167-88-108.iad55.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2450e5580136f94bda7ccf95e3167b57e15b05b513a430967943a50036fa47a4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Origin: https://www.mediafire.com
Referer: https://www.mediafire.com/

Response headers

access-control-max-age: 3000
content-encoding: gzip
etag: "660c3b546f2a131de50b69b91f26c636"
x-amz-version-id: NY8_7uBz3xoXYJBVsMSBAGHOz8ixMBS3
age: 144280
access-control-allow-methods: GET, HEAD
x-cache: Hit from cloudfront
x-amz-cf-id: cHTby3ayPZG-eWRTQCLy0Mmb3MnTeg1pvrh2UKCOGvP2J21dGVhXhA==
date: Tue, 16 Dec 2025 22:01:20 GMT
content-type: application/javascript
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method
last-modified: Fri, 13 Aug 2021 22:37:42 GMT
cache-control: max-age=31536000
via: 1.1 eafa30ac9eebc826d698b6b51868b24a.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 22154
x-amz-cf-pop: IAD55-P6
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 382 KB
121 KB 367ms
262ms Script
application/javascript 142.251.167.97
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-53LP4T

Requested by

Host: www.mediafire.com
URL: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.167.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

201271ae2f01482cacd243a748e622a077400b431eacc56775527fc8f8ab36da

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: zstd
expires: Thu, 18 Dec 2025 14:05:59 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 18 Dec 2025 14:05:59 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 18 Dec 2025 12:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 124221
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 mf_logo_full_color.svg
static.mediafire.com/images/backgrounds/header/ 3 KB
2 KB 174ms
169ms Image
image/svg+xml 104.17.147.83
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://static.mediafire.com/images/backgrounds/header/mf_logo_full_color.svg
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.147.83 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8539c91ae0a82f8cab27d481ea38ac4e66d1e5b36701fe295bcba4399b9255bd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"5813cfb2-d1d"
age: 222
access-control-allow-methods: OPTIONS, POST, GET
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Thu, 18 Dec 2025 14:05:59 GMT
content-type: image/svg+xml
last-modified: Fri, 28 Oct 2016 22:22:42 GMT
vary: Accept-Encoding
priority: u=3,i
x-mf-fe: mf2
cf-ray: 9aff37de0a20e661-DEN
access-control-allow-origin: *
server: cloudflare

GET
H3 200 file-zip-v3.png
static.mediafire.com/images/filetype/ 2 KB
2 KB 90ms
85ms Image
image/png 104.17.147.83
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://static.mediafire.com/images/filetype/file-zip-v3.png
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.147.83 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4448e430d3c53bad548a5d135e1c7e2f9593e806ba47892640d430ea752e979e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cf-cache-status: HIT
etag: "62deda56-750"
age: 3204
access-control-allow-methods: OPTIONS, POST, GET
expires: Sat, 17 Jan 2026 13:12:35 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Thu, 18 Dec 2025 14:05:59 GMT
content-type: image/png
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
vary: Accept-Encoding
priority: u=3,i
cache-control: max-age=2592000
x-mf-fe: mf2
cf-ray: 9aff37de0a23e661-DEN
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1872
server: cloudflare

GET
H3 200 icons_sprite.svg
www.mediafire.com/images/icons/svg_light/ 36 KB
8 KB 182ms
181ms Image
image/svg+xml 104.17.147.83
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://www.mediafire.com/images/icons/svg_light/icons_sprite.svg
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.147.83 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7ba1bc2084def769e77a7dbf97cd91d68fe6c6d55b5d183a7d36630da8da2b02

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"62deda56-90ab"
age: 13432
access-control-allow-methods: OPTIONS, POST, GET
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Thu, 18 Dec 2025 14:05:59 GMT
content-type: image/svg+xml
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
vary: Accept-Encoding
priority: u=3,i
cf-ray: 9aff37de0a1ce661-DEN
x-mf-fe: mf2
access-control-allow-origin: *
server: cloudflare

GET
H3 200 apps_list_sprite-v6.png
static.mediafire.com/images/backgrounds/download/ 8 KB
8 KB 174ms
170ms Image
image/png 104.17.147.83
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://static.mediafire.com/images/backgrounds/download/apps_list_sprite-v6.png
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.147.83 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dc54b817820f14ce6395ba2a037f37d4bb0af75d5b017336140793fbe2f7f738

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cf-cache-status: HIT
etag: "62deda56-1fd1"
age: 12921
access-control-allow-methods: OPTIONS, POST, GET
expires: Sat, 17 Jan 2026 09:15:52 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Thu, 18 Dec 2025 14:05:59 GMT
content-type: image/png
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
vary: Accept-Encoding
priority: u=3,i
cache-control: max-age=2592000
cf-ray: 9aff37de0a21e661-DEN
x-mf-fe: mf1
accept-ranges: bytes
access-control-allow-origin: *
content-length: 8145
server: cloudflare

GET
H3 200 arrow_dropdown.svg
www.mediafire.com/images/icons/svg_dark/ 315 B
505 B 178ms
177ms Image
image/svg+xml 104.17.147.83
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://www.mediafire.com/images/icons/svg_dark/arrow_dropdown.svg
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.147.83 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 82b94716473aa225e715e117802145c5d2d725aa1ba9d476d61a5d3da16a8c26

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"62deda56-13b"
age: 13751
access-control-allow-methods: OPTIONS, POST, GET
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Thu, 18 Dec 2025 14:05:59 GMT
content-type: image/svg+xml
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
vary: Accept-Encoding
priority: u=3,i
cf-ray: 9aff37de0a1fe661-DEN
x-mf-fe: mf2
access-control-allow-origin: *
server: cloudflare

GET
H3 200 check_circle_green.svg
static.mediafire.com/images/icons/svg_dark/ 444 B
568 B 66ms
66ms Image
image/svg+xml 104.17.147.83
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://static.mediafire.com/images/icons/svg_dark/check_circle_green.svg
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.147.83 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 03c8d2dc7d985c3004ff2cd6d8148dd03560f37ed15efdf6c2d7f4d771d0e599

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"62deda56-1bc"
age: 3273
access-control-allow-methods: OPTIONS, POST, GET
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Thu, 18 Dec 2025 14:05:59 GMT
content-type: image/svg+xml
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
vary: Accept-Encoding
priority: u=1,i
x-mf-fe: mf2
cf-ray: 9aff37de0a30e661-DEN
access-control-allow-origin: *
server: cloudflare

GET
H3 200 fb_16x16.png
static.mediafire.com/images/backgrounds/download/social/ 181 B
452 B 148ms
148ms Image
image/png 104.17.147.83
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://static.mediafire.com/images/backgrounds/download/social/fb_16x16.png
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.147.83 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 720671166ac43aba99e3952b0b9341ab4e0fee1fd891db54e2a07f05db653142

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cf-cache-status: HIT
etag: "62deda56-b5"
age: 3273
access-control-allow-methods: OPTIONS, POST, GET
expires: Sat, 17 Jan 2026 13:11:25 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Thu, 18 Dec 2025 14:05:59 GMT
content-type: image/png
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
vary: Accept-Encoding
priority: u=1,i
cache-control: max-age=2592000
x-mf-fe: mf2
cf-ray: 9aff37de0a2fe661-DEN
accept-ranges: bytes
access-control-allow-origin: *
content-length: 181
server: cloudflare

GET
H3 200 footerIcons.png
static.mediafire.com/images/backgrounds/footer/social/ 583 B
855 B 135ms
134ms Image
image/png 104.17.147.83
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://static.mediafire.com/images/backgrounds/footer/social/footerIcons.png
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.147.83 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f917a9105c311331b1d40f4d2bdbf11233c1c465616c1a9c46232f451463b061

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cf-cache-status: HIT
etag: "62deda56-247"
age: 3281
access-control-allow-methods: OPTIONS, POST, GET
expires: Sat, 17 Jan 2026 13:11:17 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Thu, 18 Dec 2025 14:05:59 GMT
content-type: image/png
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
vary: Accept-Encoding
priority: u=3,i
cache-control: max-age=2592000
x-mf-fe: mf2
cf-ray: 9aff37de2a8be661-DEN
accept-ranges: bytes
access-control-allow-origin: *
content-length: 583
server: cloudflare

GET
H3 200 infinity.js.aspx Show response
cdn.econventa.com/Scripts/ 164 KB
48 KB 173ms
50ms Script
text/javascript 104.26.8.66
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.econventa.com/Scripts/infinity.js.aspx?guid=5ff0fb62-0643-4ff1-aaee-c737f9ffc0e0
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.26.8.66 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 67d3cd0a6c5665fee59c9057c8a28ea10d282d87ff7d49011484b0de73c3589f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cache-control: max-age=1200, no-transform
content-encoding: gzip
cf-cache-status: HIT
accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version
age: 453
cf-ray: 9aff37defe26e66b-DEN
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 18 Dec 2025 14:05:59 GMT
content-type: text/javascript
vary: Accept-Encoding
server: cloudflare
last-modified: Thu, 18 Dec 2025 13:58:25 GMT
priority: u=3,i=?0

GET
H3 200 like.php Show response
www.facebook.com/plugins/ Frame 8819 65 KB
23 KB 269ms
136ms Document
text/html 157.240.229.35
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://www.facebook.com/plugins/like.php?href=http://www.facebook.com/MediaFire&width=193&layout=button_count&action=like&show_faces=false&share=true&height=30&appId=124578887583575

Requested by

Host: www.mediafire.com
URL: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.229.35 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-02-iad3.facebook.com

Software

Resource Hash

f2928df8646974c32274b7b51b1884eda8710320be73109e1ce3f16d3b4267ff

Security Headers

Name	Value
Content-Security-Policy	default-src blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'nonce-IatmIBMN' blob: 'self' connect.facebook.net 'wasm-unsafe-eval' https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com .instagram.com https://.google-analytics.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com https://fonts.gstatic.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net .carriersignal.info blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com .tenor.co .tenor.com .giphy.com https://trustly.one/ https://.trustly.one/ https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co .tenor.com https://.giphy.com;child-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net accounts.meta.com .accounts.meta.com https://trustly.one/ https://.trustly.one/ https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net .google.com .doubleclick.net;manifest-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;object-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.mediafire.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: private, no-cache, no-store, must-revalidate
content-encoding: zstd
content-security-policy: default-src blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'nonce-IatmIBMN' blob: 'self' connect.facebook.net 'wasm-unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com *.instagram.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;child-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net accounts.meta.com *.accounts.meta.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;manifest-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;object-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
content-type: text/html; charset="utf-8"
cross-origin-opener-policy: unsafe-none
cross-origin-resource-policy: cross-origin
date: Thu, 18 Dec 2025 14:05:59 GMT
document-policy: force-load-at-top include-js-call-stacks-in-crash-reports
expires: Sat, 01 Jan 2000 00:00:00 GMT
origin-agent-cluster: ?1
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self "https://www.fbsbx.com"), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
pragma: no-cache
priority: u=0,i
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7585198972524318469&cpp=C3&cv=1031263692&st=1766066759596"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7585198972524318469&cpp=C3&cv=1031263692&st=1766066759596", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
strict-transport-security: max-age=15552000; preload
vary: Accept-Encoding
x-content-type-options: nosniff
x-fb-connection-quality: GOOD; q=0.7, rtt=90, rtx=0, c=23, mss=1232, tbw=4919, tp=8, tpl=0, uplat=49, ullat=0
x-fb-debug: yn0BxSgrE7UxGg6u4TZ15eWqh/R9BgZcbLKOVXvNEQ+lUNk+Fsjco+B3qM7Ipvsaa6WCOyFj5mqhDbp4uTxzWw==
x-xss-protection: 0

GET
H3 200 world.svg
static.mediafire.com/images/backgrounds/download/additional_content/ 143 KB
53 KB 96ms
95ms Image
image/svg+xml 104.17.147.83
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://static.mediafire.com/images/backgrounds/download/additional_content/world.svg
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.147.83 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4342feac38021c4fe3069eba0edf1c2e1b4345e2b548b0afb7ab21b7369b3bc8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"62deda56-23ce2"
age: 3281
access-control-allow-methods: OPTIONS, POST, GET
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Thu, 18 Dec 2025 14:05:59 GMT
content-type: image/svg+xml
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
vary: Accept-Encoding
priority: u=3,i
x-mf-fe: mf1
cf-ray: 9aff37deabb8e661-DEN
access-control-allow-origin: *
server: cloudflare

GET
H3 200 continent-eu.svg
static.mediafire.com/images/backgrounds/download/additional_content/ 23 KB
9 KB 97ms
95ms Image
image/svg+xml 104.17.147.83
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://static.mediafire.com/images/backgrounds/download/additional_content/continent-eu.svg
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.147.83 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cbb99c4149249b280f1d3d924d9bdd29a4a14cba1e71775fb3bdbdf13ebd5a48

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"62deda56-5ca3"
age: 6581
access-control-allow-methods: OPTIONS, POST, GET
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Thu, 18 Dec 2025 14:05:59 GMT
content-type: image/svg+xml
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
vary: Accept-Encoding
priority: u=3,i
x-mf-fe: mf2
cf-ray: 9aff37deabbde661-DEN
access-control-allow-origin: *
server: cloudflare

GET
H3 200 rou.svg
static.mediafire.com/images/flags_svg/ 258 B
419 B 115ms
113ms Image
image/svg+xml 104.17.147.83
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://static.mediafire.com/images/flags_svg/rou.svg
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.147.83 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c010fbcd71b8c861c815493ff57eaccbddf13b0d612b9f2e897f6905c84f115e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"62deda56-102"
access-control-allow-methods: OPTIONS, POST, GET
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Thu, 18 Dec 2025 14:05:59 GMT
content-type: image/svg+xml
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
vary: Accept-Encoding
priority: u=3,i
x-mf-fe: mf2
cf-ray: 9aff37deabbfe661-DEN
access-control-allow-origin: *
server: cloudflare

GET
H3 200 flag.svg
static.mediafire.com/images/backgrounds/download/additional_content/ 234 B
470 B 97ms
96ms Image
image/svg+xml 104.17.147.83
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://static.mediafire.com/images/backgrounds/download/additional_content/flag.svg
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.147.83 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f52a0c7d9fa7ae8e45916c491ae7193f9a1e289f128f05264122c53d8da970db

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"62deda56-ea"
age: 3188
access-control-allow-methods: OPTIONS, POST, GET
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Thu, 18 Dec 2025 14:05:59 GMT
content-type: image/svg+xml
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
vary: Accept-Encoding
priority: u=3,i
x-mf-fe: mf2
cf-ray: 9aff37deabc0e661-DEN
access-control-allow-origin: *
server: cloudflare

GET
H3 200 mf_round.svg
static.mediafire.com/images/backgrounds/download/additional_content/ 1 KB
1 KB 81ms
80ms Image
image/svg+xml 104.17.147.83
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://static.mediafire.com/images/backgrounds/download/additional_content/mf_round.svg
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.147.83 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f1a67642fc97b508ce07cf6df329022bf5184a1c573044dc021e0d6e64688c64

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"62deda56-5b1"
age: 3170
access-control-allow-methods: OPTIONS, POST, GET
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Thu, 18 Dec 2025 14:05:59 GMT
content-type: image/svg+xml
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
vary: Accept-Encoding
priority: u=3,i
x-mf-fe: mf2
cf-ray: 9aff37deabc1e661-DEN
access-control-allow-origin: *
server: cloudflare

GET
H3 200 browser_chrome.svg
static.mediafire.com/images/backgrounds/download/additional_content/ 8 KB
2 KB 92ms
91ms Image
image/svg+xml 104.17.147.83
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://static.mediafire.com/images/backgrounds/download/additional_content/browser_chrome.svg
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.147.83 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1c6ba1010c2cc88c59de9e9584728da124770fa399643ffc1beffcec54b84be7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"62deda56-1e24"
age: 3146
access-control-allow-methods: OPTIONS, POST, GET
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Thu, 18 Dec 2025 14:05:59 GMT
content-type: image/svg+xml
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
vary: Accept-Encoding
priority: u=3,i
x-mf-fe: mf2
cf-ray: 9aff37deabc2e661-DEN
access-control-allow-origin: *
server: cloudflare

POST
H2 200 saa.go Show response
g.ezoic.net/ 10 KB
4 KB 948ms
141ms XHR
text/javascript 54.85.8.229
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/saa.go
Requested by: Host: www.ezojs.com
URL: https://www.ezojs.com/ezoic/sa.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.85.8.229 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-85-8-229.compute-1.amazonaws.com
Software: /
Resource Hash: 434ea950c425da5ed95264e6812df0898ff05f4e7710c85262a4ab95463d8b39

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex
access-control-max-age: 1728000
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
content-encoding: br
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, PUT, OPTIONS
expires: Wed, 17 Dec 2025 14:06:00 GMT
access-control-allow-origin: https://www.mediafire.com
date: Thu, 18 Dec 2025 14:06:00 GMT
content-type: text/javascript
vary: Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
access-control-allow-headers: Content-Type

GET
H3 200 boise.js Show response
go.ezodn.com/detroitchicago/ 824 B
901 B 103ms
50ms Script
application/javascript 172.67.142.121
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://go.ezodn.com/detroitchicago/boise.js?gcb=195-15&cb=5
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.142.121 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a4fafcd389d58bbd82e49d9a68e81e9dc8384330ff14ec3283a4d0d11812047b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex, follow
content-encoding: br
cf-cache-status: HIT
age: 1485611
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=rWPfDz%2FCG1i52d2Bpg5p9A%2B5kcJX%2BRy8EABLeg3SOBtCqiwaokt9KNePiecu0sLG%2BaaqPsLDSASYz70LbnSvlGgEDwsBp1ax2EM%3D"}]}
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 18 Dec 2025 14:06:00 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding
last-modified: Mon, 01 Dec 2025 09:25:46 GMT
priority: u=3,i=?0
cache-control: public, max-age=31536000
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray: 9aff37e61a23e671-DEN
accept-ranges: bytes
content-length: 426
server: cloudflare

GET
H3 200 abilene.js Show response
go.ezodn.com/parsonsmaize/ 11 KB
4 KB 101ms
48ms Script
application/javascript 172.67.142.121
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://go.ezodn.com/parsonsmaize/abilene.js?gcb=195-15&cb=b20dfef28c
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.142.121 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a0b48c90ffcf364c0dd708cff0e99df141053389a98e94e7497aff8b6c64f0c7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex, follow
content-encoding: br
cf-cache-status: HIT
age: 581433
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=QEJlWmm9BAvEzTbR3uTNZahwFVImoOvtfZRC%2FPf4eMHE465sjHPmPphnaosWNea5LsbV91CHz8zh5k5DViwBoJFfWTzCAbT9r0E%3D"}]}
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 18 Dec 2025 14:06:00 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding
last-modified: Thu, 11 Dec 2025 20:35:27 GMT
priority: u=3,i=?0
cache-control: public, max-age=31536000
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray: 9aff37e61a24e671-DEN
server: cloudflare

GET
H3 200 identity.js Show response
www.ezojs.com/ 311 KB
90 KB 47ms
46ms Script
application/javascript 172.67.170.144
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://www.ezojs.com/identity.js
Requested by: Host: www.ezojs.com
URL: https://www.ezojs.com/ezoic/sa.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.170.144 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fd8a52778087b5522a4f942fcd7ab19be79094b8ab9c847c2d89220583bfbb47

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex, follow
content-encoding: gzip
cf-cache-status: HIT
etag: W/"53a2c8d18485a44e93d3164fd23a0d60"
age: 473
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=b2cX7X4suirHlVQMecYG3QO2FaoaCJ1cFTMVnru1EfaX3P32uzCqcOgtyi7bZRrhpxK1Z11pAo4oVtidb54WolAhveKNGmo8jTwB"}]}
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 18 Dec 2025 14:06:00 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding
priority: u=3,i=?0
cache-control: public, max-age=900, stale-while-revalidate=3600
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray: 9aff37e5cf24e652-DEN
server: cloudflare

GET
H2 200 ezintegration
g.ezoic.net/ 43 B
122 B 94ms
93ms Image
image/gif 54.85.8.229
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://g.ezoic.net/ezintegration?d=www.mediafire.com&ts=1766066759584
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.85.8.229 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-85-8-229.compute-1.amazonaws.com
Software: /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

expires: Wed, 17 Dec 2025 14:06:00 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
content-length: 43
date: Thu, 18 Dec 2025 14:06:00 GMT
x-middleton-display: integration_verify
content-type: image/gif
vary: Accept-Encoding

GET
H3

200

main.js Show response
www.mediafire.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/d39f91d70ce1/ Frame E9FD
Redirect Chain

https://www.mediafire.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
https://www.mediafire.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/d39f91d70ce1/main.js?

10 KB
5 KB

60ms
59ms

Script
application/javascript

104.17.147.83
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://www.mediafire.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/d39f91d70ce1/main.js?

Requested by

Host: www.mediafire.com
URL: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file

Protocol

Server

104.17.147.83 , Ascension Island, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

37573f5eed801a0681606ee7c007523f9d37d1e00051f1990820000cbc2ef7f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer

Response headers

cache-control: max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public
content-encoding: gzip
x-content-type-options: nosniff
cf-ray: 9aff37e6a8f8e661-DEN
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 18 Dec 2025 14:06:00 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare
priority: u=3,i=?0

Redirect headers

cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public
location: /cdn-cgi/challenge-platform/h/g/scripts/jsd/d39f91d70ce1/main.js?
cf-ray: 9aff37e60f3be661-DEN
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
content-length: 0
server-timing: cfExtPri
date: Thu, 18 Dec 2025 14:06:00 GMT
vary: Accept-Encoding
server: cloudflare
priority: u=3,i=?0

GET
H3 200 FEppCFCt76d.png
static.xx.fbcdn.net/rsrc.php/v4/yD/r/ Frame 8819 299 B
441 B 310ms
77ms Image
image/png 57.144.172.128
FACEBOOK

General

Check archive.org

Download Go to Show image

Full URL

https://static.xx.fbcdn.net/rsrc.php/v4/yD/r/FEppCFCt76d.png

Requested by

Host: www.facebook.com
URL: https://www.facebook.com/plugins/like.php?href=http://www.facebook.com/MediaFire&width=193&layout=button_count&action=like&show_faces=false&share=true&height=30&appId=124578887583575

Protocol

Security

QUIC, , AES_128_GCM

Server

57.144.172.128 Southfield, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-det1.fbcdn.net

Software

Resource Hash

d65f4b2e8eee94ddc7f762d098de19558d879a3b597c8913b4d075532e3ed4b4

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.facebook.com/

Response headers

content-md5: OIlAxCmR79nrM/Ez4ygGlg==
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Fri, 18 Dec 2026 12:13:13 GMT
alt-svc: h3=":443"; ma=86400
date: Thu, 18 Dec 2025 14:06:00 GMT
content-type: image/png
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
x-fb-debug: AtmLveV31ndwhM09PuDS9EHbGIF/S0UfIiX9IlnK3hPA/wNgrGdhZpPuy8xR7kND+U2t25tacaeNYZALMEwLNQ==
priority: u=1,i
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
x-fb-connection-quality: GOOD; q=0.7, rtt=91, rtx=0, c=23, mss=1232, tbw=5077, tp=11, tpl=0, uplat=0, ullat=-1
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
access-control-allow-origin: *
content-length: 299
origin-agent-cluster: ?1

GET
H3 200 prebid10.10.0.js Show response
www.mediafire.com/js/ 274 KB
95 KB 67ms
65ms Script
application/x-javascript 104.17.147.83
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://www.mediafire.com/js/prebid10.10.0.js
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.147.83 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0bc3c746aed9eb9ac58d8113eff08e529535bfaec00a68fd00d793e8bb69d712

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"6914c3f4-44602"
age: 1951
access-control-allow-methods: OPTIONS, POST, GET
expires: Sat, 17 Jan 2026 13:31:18 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Thu, 18 Dec 2025 14:06:00 GMT
content-type: application/x-javascript
last-modified: Wed, 12 Nov 2025 17:29:24 GMT
vary: Accept-Encoding
priority: u=3,i=?0
cache-control: max-age=2592000
cf-ray: 9aff37e62f8ce661-DEN
x-mf-fe: mf1
access-control-allow-origin: *
server: cloudflare

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 107 KB
34 KB 338ms
93ms Script
text/javascript 172.253.62.154
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: www.mediafire.com
URL: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.62.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bc-in-f154.1e100.net

Software

cafe /

Resource Hash

0719900cf69736fcd3b31d30a354e459fdd31ba403b7f499146a675244bbefd0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: br
etag: 996 / 20440 / m202512040101 / config-hash: 12178190345071183149
x-content-type-options: nosniff
expires: Thu, 18 Dec 2025 14:06:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 18 Dec 2025 14:06:00 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 34368
x-xss-protection: 0
server: cafe

GET
H3 200 gYQW3E8LzCt.js Show response
static.xx.fbcdn.net/rsrc.php/v4iEpO4/yi/l/en_US-j/ Frame 8819 533 KB
140 KB 304ms
79ms XHR
application/x-javascript 57.144.172.128
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v4iEpO4/yi/l/en_US-j/gYQW3E8LzCt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

57.144.172.128 Southfield, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-det1.fbcdn.net

Software

Resource Hash

8a52d5f4aa2f1dda86673e8348b776ed50da97bb045647cb34e4118b46957df8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.facebook.com/

Response headers

content-md5: KYi/xukBfHWini6KUdfnvw==
content-encoding: zstd
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Wed, 16 Dec 2026 21:44:02 GMT
alt-svc: h3=":443"; ma=86400
date: Thu, 18 Dec 2025 14:06:00 GMT
content-type: application/x-javascript; charset=utf-8
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
x-fb-debug: Tge/hSPqufWjv6yDrg4uMkLY3qy1U4KpRBt89LST7zAdBwOVWVDkCM+bmh5IOvJ7nMboCPK12zK7W0wR+hvcrg==
priority: u=1,i
vary: Origin
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
x-fb-connection-quality: GOOD; q=0.7, rtt=69, rtx=0, c=23, mss=1232, tbw=5038, tp=10, tpl=0, uplat=0, ullat=-1
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
access-control-allow-origin: https://www.facebook.com
content-length: 142900
origin-agent-cluster: ?1

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
110 B 292ms
79ms Fetch
image/gif 104.20.47.80
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=2&e=0.9040078201330239
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.47.80 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 462004
x-goog-stored-content-encoding: identity
expires: Fri, 19 Dec 2025 14:06:00 GMT
x-goog-stored-content-length: 43
date: Thu, 18 Dec 2025 14:06:00 GMT
content-type: image/gif
vary: accept-encoding
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH8-sCmg1Zb6o0oOvulTNK1T2AoyyoaNKi_PGA5iJaaVy0v7GqbzieOx8PXbGN9_TCDlvU7S5l0U
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9aff37e7aa1f6429-DEN
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico Show response
ad.doubleclick.net/ 1 KB
129 B 293ms
82ms Fetch
image/x-icon 142.251.16.149
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.31710924597478074

Requested by

Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f149.1e100.net

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Fri, 19 Dec 2025 14:06:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 18 Dec 2025 14:06:00 GMT
content-type: image/x-icon
vary: Accept-Encoding
last-modified: Tue, 08 May 2012 13:08:06 GMT
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
627 B 290ms
79ms Fetch
image/gif 104.20.47.80
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.3560466679748002
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.47.80 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 462004
x-goog-stored-content-encoding: identity
expires: Fri, 19 Dec 2025 14:06:00 GMT
x-goog-stored-content-length: 43
date: Thu, 18 Dec 2025 14:06:00 GMT
content-type: image/gif
vary: accept-encoding
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH8-sCmg1Zb6o0oOvulTNK1T2AoyyoaNKi_PGA5iJaaVy0v7GqbzieOx8PXbGN9_TCDlvU7S5l0U
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9aff37e7aa1d6429-DEN
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H2 200 dns Show response
ab.dns-finder.com/meta/ 2 B
233 B 291ms
80ms Fetch
text/plain 34.36.200.111
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://ab.dns-finder.com/meta/dns
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.36.200.111 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 111.200.36.34.bc.googleusercontent.com
Software: /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cache-control: private, max-age=180, stale-if-error=180, stale-while-revalidate=180
access-control-expose-headers: X-Resolver
x-resolver: default
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
date: Thu, 18 Dec 2025 14:06:00 GMT
content-type: text/plain; charset=utf-8
vary: Origin

GET
H2 200 trustedIframe.html Show response
btloader.com/ Frame DF5D 6 KB
2 KB 151ms
63ms Document
text/html 172.66.171.133
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://btloader.com/trustedIframe.html?o=5678961798414336&upapi=true
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.66.171.133 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 76b14705bcd5752ac05035c95c7f53bfe8e65dda03bc77662e0aff067e3258e7

Request headers

Referer: https://www.mediafire.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36

Response headers

cache-control: public, max-age=3600, stale-while-revalidate=3600
cf-ray: 9aff37e6fcfe7b1c-DEN
content-encoding: br
content-type: text/html
date: Thu, 18 Dec 2025 14:06:00 GMT
server: cloudflare
vary: accept-encoding

GET
H3 200 Tag.engine Show response
econventa.com/ 2 KB
4 KB 177ms
146ms Script
application/json 104.26.8.66
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://econventa.com/Tag.engine?time=600&id=5ff0fb62-0643-4ff1-aaee-c737f9ffc0e0&rand=72854&ver=async&referrerUrl=&fingerPrint=123&abr=false&stdTime=-600&fpe=1&bw=1600&bh=1200&res=1600x1200&curl=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fqxgu7p6f5ea5fve%2FMinecraft%2BDungeons%2Bv1.17.0.0.zip%2Ffile&kw=online%20storage%2Cfree%20storage%2Ccloud%20storage%2Ccollaboration%2Cbackup%20file%20sharing%2Cshare%20files%2Cphoto%20backup%2Cphoto%20sharing%2Cftp%20replacement%2Ccross%20platform%2Cremote%20access%2Cmobile%20access%2Csend%20large%20files%2Crecover%20files%2Cfile%20versioning%2Cundelete%2Cwindows%2Cpc%2Cmac%2Cos%20x%2Clinux%2Ciphone
Requested by: Host: cdn.econventa.com
URL: https://cdn.econventa.com/Scripts/infinity.js.aspx?guid=5ff0fb62-0643-4ff1-aaee-c737f9ffc0e0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.26.8.66 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 897dbeef38e4efaf33f6bc7bfc99ef5a2b897a93844423bd2e09f3b74b4ebf11

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version
cf-ray: 9aff37e73f22e66b-DEN
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 18 Dec 2025 14:06:00 GMT
content-type: application/json
vary: Accept-Encoding
server: cloudflare
priority: u=3,i=?0

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
123 B 406ms
174ms Fetch 3.235.176.233
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: www.mediafire.com
URL: https://www.mediafire.com/js/prebid10.10.0.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.235.176.233 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-235-176-233.compute-1.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.mediafire.com/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://www.mediafire.com
access-control-allow-credentials: true

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
123 B 400ms
175ms Fetch 3.235.176.233
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: www.mediafire.com
URL: https://www.mediafire.com/js/prebid10.10.0.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.235.176.233 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-235-176-233.compute-1.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.mediafire.com/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://www.mediafire.com
access-control-allow-credentials: true

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
123 B 401ms
176ms Fetch 3.235.176.233
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: www.mediafire.com
URL: https://www.mediafire.com/js/prebid10.10.0.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.235.176.233 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-235-176-233.compute-1.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.mediafire.com/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://www.mediafire.com
access-control-allow-credentials: true

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
123 B 400ms
175ms Fetch 3.235.176.233
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: www.mediafire.com
URL: https://www.mediafire.com/js/prebid10.10.0.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.235.176.233 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-235-176-233.compute-1.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.mediafire.com/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://www.mediafire.com
access-control-allow-credentials: true

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
124 B 397ms
173ms Fetch 3.235.176.233
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: www.mediafire.com
URL: https://www.mediafire.com/js/prebid10.10.0.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.235.176.233 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-235-176-233.compute-1.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.mediafire.com/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://www.mediafire.com
access-control-allow-credentials: true

POST
H2 204 ortb Show response
a.ads.rmbl.ws/v1/sites/152/ 0
209 B 396ms
167ms Fetch 38.70.189.70
RUMBLE

General

Check archive.org

Download Go to

Full URL: https://a.ads.rmbl.ws/v1/sites/152/ortb?pid=41501
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/js/prebid10.10.0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 38.70.189.70 Toronto, Canada, ASN399647 (RUMBLE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.mediafire.com/

Response headers

expires: Sat, 26 Jul 1997 05:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-origin: https://www.mediafire.com
date: Thu, 18 Dec 2025 14:06:01 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: nginx
access-control-allow-credentials: true

POST
H2 204 ortb Show response
a.ads.rmbl.ws/v1/sites/152/ 0
209 B 334ms
130ms Fetch 38.70.189.70
RUMBLE

General

Check archive.org

Download Go to

Full URL: https://a.ads.rmbl.ws/v1/sites/152/ortb?pid=41501
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/js/prebid10.10.0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 38.70.189.70 Toronto, Canada, ASN399647 (RUMBLE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.mediafire.com/

Response headers

expires: Sat, 26 Jul 1997 05:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-origin: https://www.mediafire.com
date: Thu, 18 Dec 2025 14:06:01 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: nginx
access-control-allow-credentials: true

POST
H2 204 ortb Show response
a.ads.rmbl.ws/v1/sites/152/ 0
209 B 370ms
167ms Fetch 38.70.189.70
RUMBLE

General

Check archive.org

Download Go to

Full URL: https://a.ads.rmbl.ws/v1/sites/152/ortb?pid=41501
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/js/prebid10.10.0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 38.70.189.70 Toronto, Canada, ASN399647 (RUMBLE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.mediafire.com/

Response headers

expires: Sat, 26 Jul 1997 05:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-origin: https://www.mediafire.com
date: Thu, 18 Dec 2025 14:06:01 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: nginx
access-control-allow-credentials: true

POST
H2 204 ortb Show response
a.ads.rmbl.ws/v1/sites/152/ 0
209 B 332ms
130ms Fetch 38.70.189.70
RUMBLE

General

Check archive.org

Download Go to

Full URL: https://a.ads.rmbl.ws/v1/sites/152/ortb?pid=41501
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/js/prebid10.10.0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 38.70.189.70 Toronto, Canada, ASN399647 (RUMBLE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.mediafire.com/

Response headers

expires: Sat, 26 Jul 1997 05:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-origin: https://www.mediafire.com
date: Thu, 18 Dec 2025 14:06:01 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: nginx
access-control-allow-credentials: true

POST
H2 204 ortb Show response
a.ads.rmbl.ws/v1/sites/152/ 0
210 B 329ms
127ms Fetch 38.70.189.70
RUMBLE

General

Check archive.org

Download Go to

Full URL: https://a.ads.rmbl.ws/v1/sites/152/ortb?pid=41501
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/js/prebid10.10.0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 38.70.189.70 Toronto, Canada, ASN399647 (RUMBLE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.mediafire.com/

Response headers

expires: Sat, 26 Jul 1997 05:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-origin: https://www.mediafire.com
date: Thu, 18 Dec 2025 14:06:01 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: nginx
access-control-allow-credentials: true

POST
H3 200 9aff37da7876e661 Show response
www.mediafire.com/cdn-cgi/challenge-platform/h/g/jsd/oneshot/d39f91d70ce1/0.06444021376341322:1766063467:jWt4UmLQCqvf7wqIVv3ax19zcwFDq0ZkXSOnUDfaRpM/ Frame E9FD 0
1 KB 64ms
53ms XHR
text/plain 104.17.147.83
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://www.mediafire.com/cdn-cgi/challenge-platform/h/g/jsd/oneshot/d39f91d70ce1/0.06444021376341322:1766063467:jWt4UmLQCqvf7wqIVv3ax19zcwFDq0ZkXSOnUDfaRpM/9aff37da7876e661
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.147.83 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer

Response headers

cf-ray: 9aff37e90eede661-DEN
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
content-length: 0
cf-chl-out-s: f2RtLzlEQ2Tjfc97EgxEfGrnYuEfAtvoOcO8fSnCdiwpmRPNqpN/+OcKZbDk79G/mPP3f8pBd88LCRrLPz64RvLZq0PPMO29QnFfxily2rDdkGjeudzMT1HqjWbjoCpTH+U/yPNsENopnn1frULsChDaXufcFlZ+dQ0KlH+BU7s6nrpgPqgI0g4cxj+rdLEykE0knRoCilGJKss7onbtCh+qeKy9U6bzzEyGBvGiKMy482ZZbZ1sdTHHbzputBSb6QBjdFLEFpYWwpT1n6wJKRqlTRSIZNop7k329u3TVyJVi/N5CWiod2Qjz++JLr6zcdkTSvG5OGAsWLiBM083YvG/tntFElVUtO74jQya+Otsg4IhmfUIAGr0l2BVdE0R2Z03P9zVlyNptNi5dECv+hOektMB0rXmZBW75NgPmi2UQLIWLzmVoGlK2LRa0xlu+/U35o2aDu3ykm3NsKpZgtIAlU91cbhnSSJwekMAN0jsD+mMyL4AzeeCIE8+rUwK4FYzkffgdR3B4sCWEudkHiC9dOJ2ADJrIWqGYZvBq5Hyi8lNIip5RScHFixeQPOGt7rZEsvOLkPReSELCHh6vVE4oPW8sxx0KsEre9PDi5ER9ebapsZUf/5k68kJbGFJ2K5rd+0qVoFuzGYOimA/gxD7v9qnahE9Fd2fYgcf5Ld3uIPUSrg28RMPk6ux6j0d1aHgFffoS96pWtgCEyW2hQ==$8b4gtzhO8vgKylxlfazM1A==
date: Thu, 18 Dec 2025 14:06:01 GMT
content-type: text/plain; charset=UTF-8
server: cloudflare
priority: u=1,i

POST
H2 204 exd
api.btloader.com/ 0
0 179ms
83ms Fetch 130.211.23.194
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://api.btloader.com/exd?tid=rgiPUoms-JZiF75B50-9b31c82bda&sid=hCxMIQElFx-oN3JVXxuwQ-9b31c82bda&cv=2.1.172-2-g720cec0&upapi=true
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.23.194 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 194.23.211.130.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

via: 1.1 google
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 18 Dec 2025 14:06:01 GMT
vary: Origin

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 51 KB
21 KB 385ms
108ms Script
text/javascript 172.253.62.113
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-829541-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.62.113 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bc-in-f113.1e100.net

Software

Golfe2 /

Resource Hash

f1a61277e3f902f50ab42015d8b07218db9b7601bb0967e54a52bfdcb4fa7e81

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
age: 5579
report-to: {"group":"ascnsrsgac:225:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:225:0"}],}
x-content-type-options: nosniff
expires: Thu, 18 Dec 2025 14:33:02 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 18 Dec 2025 12:33:02 GMT
last-modified: Tue, 15 Jul 2025 00:44:26 GMT
content-type: text/javascript
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:225:0
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsgac:225:0
content-length: 20737
server: Golfe2

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
309 B 489ms
214ms Fetch 207.65.37.179
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL

https://hbopenbid.pubmatic.com/translator?source=prebid-client&gzip=1

Requested by

Host: www.mediafire.com
URL: https://www.mediafire.com/js/prebid10.10.0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

207.65.37.179 , United States, ASN62713 (AS-PUBMATIC, US),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.mediafire.com/

Response headers

strict-transport-security: max-age=16070400; includeSubDomains
cache-control: no-cache, no-store, must-revalidate, no-store, no-cache, private
access-control-allow-credentials: true
observe-browsing-topics: ?1
pmfcgi-resp: TRUE
access-control-allow-origin: https://www.mediafire.com
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 18 Dec 2025 14:06:01 GMT
server: nginx

POST
H2 200 / Show response
api.amplitude.com/ 7 B
137 B 461ms
178ms XHR
text/html 44.245.196.41
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://api.amplitude.com/

Requested by

Host: cdn.amplitude.com
URL: https://cdn.amplitude.com/libs/amplitude-8.5.0-min.gz.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

44.245.196.41 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-44-245-196-41.us-west-2.compute.amazonaws.com

Software

Resource Hash

aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Referer: https://www.mediafire.com/

Response headers

strict-transport-security: max-age=15768000
access-control-allow-origin: *
content-length: 7
date: Thu, 18 Dec 2025 14:06:01 GMT
content-type: text/html;charset=utf-8

GET
H2 200 m=el_main_css
www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.2f3WBw8L4SI.L.W.O/am=AAQD/d=0/rs=AN8SPfrXXtxuFpMMBoYgp93jo68L3iC3ZQ/ 22 KB
5 KB 365ms
116ms Stylesheet
text/css 142.250.31.94
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.2f3WBw8L4SI.L.W.O/am=AAQD/d=0/rs=AN8SPfrXXtxuFpMMBoYgp93jo68L3iC3ZQ/m=el_main_css

Requested by

Host:
URL: /_/translate_http/_/js/k=translate_http.tr.en_US.4m87Xm8lYNM.O/am=AAQD/d=1/rs=AN8SPfoECJOHoZ5LunL-4y0EIZMse2QYcw/m=el_conf

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.31.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bj-in-f94.1e100.net

Software

sffe /

Resource Hash

fb1bd700eb83832fc2ca14c9fd537e5facad95f3bd15632db0c4b1c5a5bd7e20

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
age: 50350
report-to: {"group":"rosetta","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/rosetta"}]}
x-content-type-options: nosniff
expires: Fri, 18 Dec 2026 00:06:51 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 18 Dec 2025 00:06:51 GMT
last-modified: Wed, 15 Oct 2025 01:09:54 GMT
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=31536000
cross-origin-opener-policy: same-origin; report-to="rosetta"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/rosetta
accept-ranges: bytes
access-control-allow-origin: *
content-length: 4155
x-xss-protection: 0
server: sffe

GET
H2 200 m=el_main Show response
translate.googleapis.com/_/translate_http/_/js/k=translate_http.tr.en_US.4m87Xm8lYNM.O/am=AAAQ/d=1/exm=el_conf/ed=1/rs=AN8SPfoBqgfvalA3jH1uGPITv4a4G5SAPQ/ 362 KB
103 KB 364ms
115ms Script
text/javascript 64.233.180.95
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://translate.googleapis.com/_/translate_http/_/js/k=translate_http.tr.en_US.4m87Xm8lYNM.O/am=AAAQ/d=1/exm=el_conf/ed=1/rs=AN8SPfoBqgfvalA3jH1uGPITv4a4G5SAPQ/m=el_main

Requested by

Host:
URL: /_/translate_http/_/js/k=translate_http.tr.en_US.4m87Xm8lYNM.O/am=AAQD/d=1/rs=AN8SPfoECJOHoZ5LunL-4y0EIZMse2QYcw/m=el_conf

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

64.233.180.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

on-in-f95.1e100.net

Software

sffe /

Resource Hash

380a7fdd97951f66163f9480d41090539e8e23ff8f6fc30512914ea8dae8055b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
age: 16703
report-to: {"group":"rosetta","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/rosetta"}]}
x-content-type-options: nosniff
expires: Fri, 18 Dec 2026 09:27:38 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 18 Dec 2025 09:27:38 GMT
last-modified: Sat, 13 Dec 2025 04:11:49 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=31536000
cross-origin-opener-policy: same-origin; report-to="rosetta"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/rosetta
accept-ranges: bytes
access-control-allow-origin: *
content-length: 105328
x-xss-protection: 0
server: sffe

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 504 KB
163 KB 91ms
90ms Script
application/javascript 142.251.167.97
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-K68XP6D85D&cx=c&gtm=4e5ca1

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-53LP4T

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.167.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

d8b4c94297f5f90128ea1aac11dd2aeaf04567f962b55ca59b4f43ce7a5b657c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
content-encoding: zstd
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Thu, 18 Dec 2025 14:06:01 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 166697
date: Thu, 18 Dec 2025 14:06:01 GMT
x-xss-protection: 0
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Google Tag Manager
access-control-allow-headers: Cache-Control

GET
H3 200 mulvane.js Show response
go.ezodn.com/parsonsmaize/ 1 KB
994 B 54ms
53ms Script
application/javascript 172.67.142.121
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://go.ezodn.com/parsonsmaize/mulvane.js?gcb=195-15&cb=e75e48eec0
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.142.121 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9b41253384e2818bd0f76171d6ffd723d4c85c5e1a69da74f174489cb52a40ce

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex, follow
content-encoding: br
cf-cache-status: HIT
age: 1485611
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=iYxCQm57eKhJHOI%2BzuaGdSZxlsoH3CzP84Gv5UFUlzj7DYDfHBVT1RoJWOL9385muSgoIFVQTwHhXIGdJaaf8ZS8m09YAPr2W34%3D"}]}
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 18 Dec 2025 14:06:01 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding
last-modified: Mon, 01 Dec 2025 09:25:46 GMT
priority: u=3,i=?0
cache-control: public, max-age=31536000
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray: 9aff37ea0a90e671-DEN
accept-ranges: bytes
content-length: 522
server: cloudflare

GET
H3 200 birmingham.js Show response
go.ezodn.com/detroitchicago/ 752 B
857 B 49ms
48ms Script
application/javascript 172.67.142.121
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://go.ezodn.com/detroitchicago/birmingham.js?gcb=195-15&cb=539c47377c
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.142.121 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 30be558393bd8b0585c806a6eaed6d6f5b51d1ca63c0113061dfe35eaa128ce3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex, follow
content-encoding: br
cf-cache-status: HIT
age: 1485611
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=f1aSOzgidw53IFkXpb8ADEMRM0PHGiqBa4ldCqns%2BR%2BTIR3UjwUCPWw%2BQHa4CKX1SOhV2%2BA3msCNHwGbmyjwmUSda3y7g1CD200%3D"}]}
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 18 Dec 2025 14:06:01 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding
last-modified: Mon, 01 Dec 2025 09:25:46 GMT
priority: u=3,i=?0
cache-control: public, max-age=31536000
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray: 9aff37ea0a91e671-DEN
accept-ranges: bytes
content-length: 380
server: cloudflare

GET
H3 200 ezoicanalytics.js Show response
go.ezodn.com/ 2 KB
1 KB 50ms
49ms Script
application/javascript 172.67.142.121
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://go.ezodn.com/ezoicanalytics.js?cb=1&dcb=195-15&shcb=34
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.142.121 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e814d50a228f54aecf40d8a58e41d48ce1dfc4376fd5fbedc28078fe0a8c5526

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex, follow
content-encoding: br
cf-cache-status: HIT
age: 80719
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=0RpoigLp1Gol6HlkFS7IMdGavPChw0zsixhlGon6O%2FrUVEMfY3d%2FhVUKfIRltMo1vlhrWw1Z1ovsCS%2FPZvzFBTGXEyu4NI%2Fb%2F94%3D"}]}
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 18 Dec 2025 14:06:01 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding
last-modified: Wed, 17 Dec 2025 15:40:41 GMT
priority: u=3,i=?0
cache-control: public, max-age=86400
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray: 9aff37ea0a92e671-DEN
server: cloudflare

OPTIONS
H2 200 ezconfig
g.ezoic.net/detroitchicago/ Frame 0
0 375ms
125ms Preflight 54.85.8.229
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/detroitchicago/ezconfig
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.85.8.229 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-85-8-229.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.mediafire.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET, POST, PUT, OPTIONS
access-control-allow-origin: https://www.mediafire.com
access-control-max-age: 1728000
content-length: 0
date: Thu, 18 Dec 2025 14:06:01 GMT
vary: Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers

OPTIONS
H2 200 ezconfig
g.ezoic.net/detroitchicago/ Frame 0
0 371ms
125ms Preflight 54.85.8.229
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/detroitchicago/ezconfig
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.85.8.229 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-85-8-229.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.mediafire.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET, POST, PUT, OPTIONS
access-control-allow-origin: https://www.mediafire.com
access-control-max-age: 1728000
content-length: 0
date: Thu, 18 Dec 2025 14:06:01 GMT
vary: Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers

GET
H2 200 id5-api.js Show response
cdn.id5-sync.com/api/1.0/ 112 KB
33 KB 214ms
56ms Script
text/javascript 104.20.23.13
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/id5-api.js

Requested by

Host: www.ezojs.com
URL: https://www.ezojs.com/identity.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.23.13 , Ascension Island, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d17e84af7ba998526041e90409fec0d80e0bf436fecd99cd94ea4124f1047141

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-amz-id-2: XZdFtvlT86c9N7B9v+rt6wpFpPKGWEpg0rqJVNq+LvChHtDUM8+ZIYZgkDnsLJS645zcSVHQYhU=
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: public, max-age=3600
content-encoding: br
cf-cache-status: HIT
etag: W/"9d3ef6e0b1008a729462806417366a8e"
age: 1532
x-amz-request-id: 28MY16YEDN7JGNX0
cf-ray: 9aff37eb7c8a9da4-DEN
date: Thu, 18 Dec 2025 14:06:01 GMT
content-type: text/javascript;charset=utf-8
last-modified: Tue, 04 Nov 2025 08:00:55 GMT
vary: accept-encoding
server: cloudflare
x-amz-server-side-encryption: AES256

POST
H2 200 ezconfig Show response
g.ezoic.net/detroitchicago/ 49 B
121 B 201ms
198ms Fetch
application/json 54.85.8.229
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/detroitchicago/ezconfig
Requested by: Host: www.ezojs.com
URL: https://www.ezojs.com/identity.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.85.8.229 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-85-8-229.compute-1.amazonaws.com
Software: /
Resource Hash: 50a63bf06dcdc62ce03de6a07d10770dc80cfa47ef2b63db1e9f6a5fbd786a7d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Content-Type: application/json
Referer: https://www.mediafire.com/

Response headers

access-control-max-age: 1728000
content-encoding: gzip
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, PUT, OPTIONS
access-control-allow-origin: https://www.mediafire.com
content-length: 73
date: Thu, 18 Dec 2025 14:06:01 GMT
content-type: application/json
vary: Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
access-control-allow-headers: Content-Type

POST
H2 200 ezconfig Show response
g.ezoic.net/detroitchicago/ 46 B
77 B 203ms
200ms Fetch
application/json 54.85.8.229
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/detroitchicago/ezconfig
Requested by: Host: www.ezojs.com
URL: https://www.ezojs.com/identity.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.85.8.229 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-85-8-229.compute-1.amazonaws.com
Software: /
Resource Hash: 2c0e177d62a1ded5f5d3f7d5d2a8f700ccec93441f79a92d0021a6433f5e2474

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Content-Type: application/json
Referer: https://www.mediafire.com/

Response headers

access-control-max-age: 1728000
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, PUT, OPTIONS
access-control-allow-origin: https://www.mediafire.com
content-length: 46
date: Thu, 18 Dec 2025 14:06:01 GMT
content-type: application/json
vary: Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
access-control-allow-headers: Content-Type

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
163 B 104ms
103ms Fetch
image/gif 104.20.47.80
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.9547382759860155
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.47.80 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 462005
x-goog-stored-content-encoding: identity
expires: Fri, 19 Dec 2025 14:06:01 GMT
x-goog-stored-content-length: 43
date: Thu, 18 Dec 2025 14:06:01 GMT
content-type: image/gif
vary: accept-encoding
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH8-sCmg1Zb6o0oOvulTNK1T2AoyyoaNKi_PGA5iJaaVy0v7GqbzieOx8PXbGN9_TCDlvU7S5l0U
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9aff37eada4d6429-DEN
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H2 404 0 Show response
www.mediafiredls.com/onclick/ 5 B
510 B 246ms
102ms XHR
text/plain 172.67.73.78
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://www.mediafiredls.com/onclick/0

Requested by

Host: www.mediafire.com
URL: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.73.78 , Ascension Island, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c6c094bc0054f9cbe34102ff49f86b3928b5ac09f3d2ac87e170d0500675921f

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-encoding: br
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=xHBLTlxndTOSS3USlEJKwNpw%2FabEtQhpAdLqQHIgWuG%2FLUPcyTXanO66NZ2xODnQ7%2F%2BEycUXhMYBTmP%2BbL8zvPC4SoZnnXEDmrf9WVmopZQn22g%3D"}]}
referrer-policy: same-origin
cf-ray: 9aff37eb7ca8e771-DEN
expires: Thu, 01 Jan 1970 00:00:01 GMT
access-control-allow-origin: *
date: Thu, 18 Dec 2025 14:06:01 GMT
content-type: text/plain
vary: accept-encoding
server: cloudflare
x-frame-options: SAMEORIGIN

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202512040101/ 611 KB
193 KB 95ms
94ms Script
text/javascript 172.253.62.154
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202512040101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.62.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bc-in-f154.1e100.net

Software

cafe /

Resource Hash

9d6d7342264129047aedc4df11db9bdf238eec8fed367c7289ab11ca6ef6ccbe

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: br
etag: 11880664601459717268
age: 2242
x-content-type-options: nosniff
expires: Fri, 18 Dec 2026 13:28:39 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 18 Dec 2025 13:28:39 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 197457
x-xss-protection: 0
server: cafe

POST
H2 200 analytics Show response
g.ezoic.net/ezais/ 14 KB
4 KB 407ms
197ms Fetch
text/plain 54.85.8.229
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/ezais/analytics?cb=1
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/ezoicanalytics.js?cb=1&dcb=195-15&shcb=34
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.85.8.229 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-85-8-229.compute-1.amazonaws.com
Software: /
Resource Hash: d41fd802a0f89defab4c3631640e3f93c3c958ad25d546137d14a0ef89f25e29

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex
access-control-max-age: 1728000
content-encoding: br
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, PUT, OPTIONS
access-control-allow-origin: https://www.mediafire.com
date: Thu, 18 Dec 2025 14:06:01 GMT
content-type: text/plain; charset=utf-8
vary: Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
access-control-allow-headers: Content-Type

GET
H3 200 gpt
securepubads.g.doubleclick.net/pagead/managed/dict/m202512040101/ 64 KB
22 KB 91ms
90ms Other
text/plain 172.253.62.154
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/dict/m202512040101/gpt

Requested by

Host: www.mediafire.com
URL: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.62.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bc-in-f154.1e100.net

Software

cafe /

Resource Hash

8d23693251d0923a21dba7083e1e3a58a18123b146cebbcefb828e1caa7c3aa3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 4740477158928784528
age: 808
x-content-type-options: nosniff
expires: Thu, 25 Dec 2025 13:52:33 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 18 Dec 2025 13:52:33 GMT
content-type: text/plain; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=604800, stale-while-revalidate=7200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 22756
x-xss-protection: 0
server: cafe
use-as-dictionary: match="/gampad/ads", id="m202512040101"

POST
H2 204 collect
analytics.google.com/g/ 0
0 467ms
205ms Fetch
text/plain 142.251.167.100
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-K68XP6D85D&gtm=45je5ca1v887485693z86304663za20gzb6304663zd6304663&_p=1766066759305&_gaz=1&gcd=13l3l3l3l1l1&npa=0&_ng=1&dma=0&tcfd=10000&cid=1935627807.1766066762&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&tag_exp=103116026~103200004~104527907~104528501~104684208~104684211~105391253~115583767~115938465~115938468~116184927~116184929~116251938~116251940&sid=1766066761&sct=1&seg=0&dl=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fqxgu7p6f5ea5fve%2FMinecraft%2BDungeons%2Bv1.17.0.0.zip%2Ffile&dt=Minecraft%20Dungeons%20v1.17.0.0&en=page_view&_fv=1&_nsi=1&_ss=1&up.page_url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fqxgu7p6f5ea5fve%2FMinecraft%2BDungeons%2Bv1.17.0.0.zip%2Ffile&tfd=2818
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-K68XP6D85D&cx=c&gtm=4e5ca1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.251.167.100 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: ww-in-f100.1e100.net
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:170:0
report-to: {"group":"ascnsrsggc:170:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:170:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.mediafire.com
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:170:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 18 Dec 2025 14:06:01 GMT
content-type: text/plain
server: Golfe2

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
550 B 567ms
233ms Ping
text/plain 142.251.163.155
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&_ng=1&tid=G-K68XP6D85D&cid=1935627807.1766066762&gtm=45je5ca1v887485693z86304663za20gzb6304663zd6304663&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=0&tag_exp=103116026~103200004~104527907~104528501~104684208~104684211~105391253~115583767~115938465~115938468~116184927~116184929~116251938~116251940
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-K68XP6D85D&cx=c&gtm=4e5ca1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.251.163.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: wv-in-f155.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:138:0
report-to: {"group":"ascnsrsggc:138:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:138:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.mediafire.com
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:138:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 18 Dec 2025 14:06:01 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
111 B 48ms
46ms Fetch
image/gif 104.20.47.80
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=2&e=0.4634674355528826
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.47.80 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 462005
x-goog-stored-content-encoding: identity
expires: Fri, 19 Dec 2025 14:06:01 GMT
x-goog-stored-content-length: 43
date: Thu, 18 Dec 2025 14:06:01 GMT
content-type: image/gif
vary: accept-encoding
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH8-sCmg1Zb6o0oOvulTNK1T2AoyyoaNKi_PGA5iJaaVy0v7GqbzieOx8PXbGN9_TCDlvU7S5l0U
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9aff37ec3e1c6429-DEN
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico Show response
ad.doubleclick.net/ 1 KB
129 B 77ms
76ms Fetch
image/x-icon 142.251.16.149
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.79849368796207

Requested by

Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f149.1e100.net

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Fri, 19 Dec 2025 14:06:01 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 18 Dec 2025 14:06:01 GMT
content-type: image/x-icon
vary: Accept-Encoding
last-modified: Tue, 08 May 2012 13:08:06 GMT
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 id5-api-js Show response
api.id5-sync.com/analytics/457/ 1 KB
690 B 648ms
214ms Fetch
application/json 141.95.98.64
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://api.id5-sync.com/analytics/457/id5-api-js

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.64 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ns3216658.ip-141-95-98.eu

Software

Resource Hash

765f83c7926b6d40e400c50545979ba50d5d4e993ba1852028bb56b819da2f24

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: max-age=300
access-control-expose-headers: Access-Control-Allow-Origin
content-encoding: gzip
access-control-allow-origin: *
date: Thu, 18 Dec 2025 14:06:02 GMT
content-type: application/json
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding

GET
H2 200 esp.js Show response
oa.openxcdn.net/ 24 KB
8 KB 386ms
101ms Script
application/javascript 34.102.146.192
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://oa.openxcdn.net/esp.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202512040101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.146.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 192.146.102.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-goog-metageneration: 1
content-encoding: gzip
x-goog-hash: crc32c=f21hYg==, md5=31VCuIvA42jGmZdUpbniug==
etag: "df5542b88bc0e368c6999754a5b9e2ba"
age: 1371818
x-goog-stored-content-encoding: gzip
expires: Wed, 02 Dec 2026 17:02:24 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 7927
date: Tue, 02 Dec 2025 17:02:24 GMT
last-modified: Thu, 27 May 2021 18:30:51 GMT
content-type: application/javascript
x-guploader-uploadid: AOCedOFjeVWXj22M29txi6KMHFgRivB1B0dqbGJM191NBSUOZSWjW2tTmJ9yiGBG1ntg8L3I
cache-control: no-transform
x-goog-storage-class: MULTI_REGIONAL
accept-ranges: bytes
x-goog-generation: 1622140251693895
content-length: 7927
server: UploadServer

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16589/ 43 KB
13 KB 511ms
173ms Script
text/javascript 3.167.69.51
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202512040101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.167.69.51 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-167-69-51.iad61.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 3733ce04a5c4dbb8b07b847650fd68e82f93ab8abf6b35ca294d6d40130f06c0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

vary: Accept-Encoding
cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"a01b40a9ecb8db243294facf32753015"
age: 37256
via: 1.1 21478ed02559c3de2f3f6b7052aaf6ca.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: xuHt5oKLiy8T34UEh3j089GV8TBA3JGCR4y9U6HrpQThJTqDl9HuBg==
date: Thu, 18 Dec 2025 03:45:07 GMT
content-type: text/javascript
last-modified: Thu, 16 Oct 2025 16:30:59 GMT
server: AmazonS3
x-amz-cf-pop: IAD61-P6
x-amz-server-side-encryption: AES256

GET
H2 200 pubcid.min.js Show response
cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/ 382 B
991 B 388ms
102ms Script
application/javascript 104.16.175.226
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/pubcid.min.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202512040101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.175.226 , Ascension Island, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6b9ae1fa0d1fc51ee0ad3feb565083bee200289c71bb346020f9b3d80cf73636

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

access-control-expose-headers: *
content-encoding: br
cf-cache-status: HIT
etag: W/"17e-goBKDsAq4SrgyL37A4bNh/aMb7I"
age: 7401
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bp0O7gO6NWgfzbgTDEBRKtRg3DQ4KSCnvDxxospUUVdzhGP7VLm5vurbWzImjIHhAZTDfbNCo0WGK35t4ol5cNqvcFIvREJhHmAAPTQJEYWrXCAV3rFyRn3ngYHeHhdhaNs%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
x-jsd-version-type: branch
alt-svc: h3=":443"; ma=86400
x-cache: HIT, HIT
date: Thu, 18 Dec 2025 14:06:02 GMT
content-type: application/javascript; charset=utf-8
x-served-by: cache-fra-eddf8230081-FRA, cache-sjc10076-SJC
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy: cross-origin
cf-ray: 9aff37eefce71f2a-DEN
accept-ranges: bytes
access-control-allow-origin: *
content-length: 237
server: cloudflare
x-jsd-version: master

GET
H2 200 publishertag.ids.js Show response
static.criteo.net/js/ld/ 42 KB
13 KB 512ms
173ms Script
text/javascript 74.119.117.47
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.ids.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202512040101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.47 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

89ec2a5152f4f214a0fe49725345dc70848ed05f13cf20646d372d339477a11d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: max-age=86400, public
timing-allow-origin: *
content-encoding: gzip
cross-origin-resource-policy: cross-origin
expires: Fri, 19 Dec 2025 14:06:02 GMT
access-control-allow-origin: *
date: Thu, 18 Dec 2025 14:06:02 GMT
content-type: text/javascript
vary: x-geo-country
server: nginx

GET
H2 200 encrypted-tag-g.js Show response
invstatic101.creativecdn.com/encrypted-signals/ 3 KB
3 KB 427ms
173ms Script
text/javascript 34.96.70.87
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202512040101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.70.87 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 87.70.96.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 2e5f5cb912c0619933ea6c3ad8ac1466a005f792e3338d96a8432d144c63520f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

etag: 861bdaf24bda5c0db45c6ebe1c94a9eb
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2729
date: Thu, 18 Dec 2025 14:06:02 GMT
content-type: text/javascript; charset=utf-8
last-modified: Wed, 05 Feb 2025 14:45:21 GMT
server: Google Frontend
x-cloud-trace-context: ec50257a3a0f8dd683cec31037e746c9

GET
H2 200 connectId-gpt.js Show response
connectid.analytics.yahoo.com/ 9 KB
9 KB 876ms
236ms Script
application/javascript 3.161.213.35
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://connectid.analytics.yahoo.com/connectId-gpt.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202512040101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.161.213.35 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-3-161-213-35.yul62.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

56351c084d8d56437d41f1e58b7eb184b563871e88bab60f6b15486c39f13996

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

etag: "faa388a163b1b6d0377ee77a861591e5"
age: 1817
x-cache: Hit from cloudfront
x-amz-cf-id: vRLbpsDkwsT1R-dBM59j2m56evdyxnTMcRlKufbeqKmoBw-HDaXaCw==
date: Thu, 18 Dec 2025 13:35:46 GMT
content-type: application/javascript
last-modified: Mon, 22 Apr 2024 18:18:45 GMT
x-amz-expiration: expiry-date="Mon, 23 Apr 2029 00:00:00 GMT", rule-id="webapp-standard-lifecycle"
content-security-policy: default-src 'self'
cache-control: max-age=3600
via: 1.1 95a3dd023df73736e8ea01cca5036ec0.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 8729
x-amz-cf-pop: YUL62-P1
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 69 KB
10 KB 489ms
489ms Fetch
text/plain 172.253.62.154
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2358420873576341&correlator=2891197377443781&eid=31095251%2C83321072&output=ldjh&gdfp_req=1&vrg=202512040101&ptt=17&impl=fifs&gdpr=0&gpp=DBABJg~BFoAAEA.QA&iu_parts=183096492%2CMediaFire-Desktop-BottomAnchor&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=1&didk=2948972594&dids=div-gpt-ad-1705004453725-0&adfs=117266756&sfv=1-0-45&eri=5&sc=1&cookie_enabled=1&abxe=1&dt=1766066761779&adxs=436&adys=1110&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fqxgu7p6f5ea5fve%2FMinecraft%2BDungeons%2Bv1.17.0.0.zip%2Ffile&vis=1&psz=728x-1&msz=728x-1&fws=512&ohw=0&a3p=EhkKCnB1YmNpZC5vcmcYp-CgjrMzSABSAghkEhwKDWNyd2RjbnRybC5uZXQYp-CgjrMzSABSAghkEhgKCXlhaG9vLmNvbRio4KCOszNIAFICCGQSFAoFb3BlbngYp-CgjrMzSABSAghkEh0KDmVzcC5jcml0ZW8uY29tGKfgoI6zM0gAUgIIZBIXCghydGJob3VzZRio4KCOszNIAFICCGQ.&psd=WzMxLFtdXQ..&dlt=1766066758992&idt=2718&prev_scp=dkey_present%3Dfalse%26buildnumber%3D121958%26dladtemplate%3D59%26button_delay%3Ddisabled&adks=3109985067&frm=20&eoidce=1&pb_szs=728x90

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202512040101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.62.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bc-in-f154.1e100.net

Software

cafe /

Resource Hash

d2e2a717e9987b93944c340c64626c3022ce76a066dac2dcfbc89721d091e8be

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: dcb
google-lineitem-id: 6949855565
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 18 Dec 2025 14:06:02 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: 138510914669
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.mediafire.com
content-length: 10305
x-xss-protection: 0
server: cafe

GET
H3 200 container.html Show response
e578d51024a06ed55fe9f1aed02895c2.safeframe.googlesyndication.com/safeframe/1-0-45/html/ Frame 115F 7 KB
3 KB 295ms
76ms Document
text/html 172.253.63.132
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://e578d51024a06ed55fe9f1aed02895c2.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202512040101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f132.1e100.net

Software

sffe /

Resource Hash

f1a68bf826c55985468304f4284a09cb8a68e82503d764166e611a7c58a85a4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.mediafire.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 3121
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 18 Dec 2025 14:06:02 GMT
expires: Thu, 18 Dec 2025 14:06:02 GMT
last-modified: Thu, 08 May 2025 23:15:48 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 68 KB
10 KB 453ms
453ms Fetch
text/plain 172.253.62.154
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2358420873576341&correlator=3232137385217500&eid=31095251%2C83321072&output=ldjh&gdfp_req=1&vrg=202512040101&ptt=17&impl=fifs&gdpr=0&gpp=DBABJg~BFoAAEA.QA&iu_parts=183096492%2CMediaFire-Zone1&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=2&didk=2298854458&dids=div-gpt-ad-1583943974201-0&adfs=1414773351&sfv=1-0-45&eri=5&sc=1&cookie_enabled=1&abxe=1&dt=1766066761838&adxs=552&adys=10&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fqxgu7p6f5ea5fve%2FMinecraft%2BDungeons%2Bv1.17.0.0.zip%2Ffile&vis=1&psz=728x-1&msz=728x-1&fws=0&ohw=0&a3p=EhkKCnB1YmNpZC5vcmcYp-CgjrMzSABSAghkEhwKDWNyd2RjbnRybC5uZXQYp-CgjrMzSABSAghkEhgKCXlhaG9vLmNvbRio4KCOszNIAFICCGQSFAoFb3BlbngYp-CgjrMzSABSAghkEh0KDmVzcC5jcml0ZW8uY29tGKfgoI6zM0gAUgIIZBIXCghydGJob3VzZRio4KCOszNIAFICCGQ.&psd=WzMxLFtdXQ..&dlt=1766066758992&idt=2718&prev_scp=dkey_present%3Dfalse%26buildnumber%3D121958%26dladtemplate%3D59%26button_delay%3Ddisabled&adks=630197753&frm=20&eoidce=1&pb_szs=728x90

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202512040101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.62.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bc-in-f154.1e100.net

Software

cafe /

Resource Hash

4ed0719b39b5e9dbf49b0d73fd43c80564daf8f673a770f4849606acc60f895e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: dcb
google-lineitem-id: 6949855565
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 18 Dec 2025 14:06:02 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: 138510914669
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.mediafire.com
content-length: 10057
x-xss-protection: 0
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 68 KB
10 KB 438ms
437ms Fetch
text/plain 172.253.62.154
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2358420873576341&correlator=3989213546894342&eid=31095251%2C83321072&output=ldjh&gdfp_req=1&vrg=202512040101&ptt=17&impl=fifs&gdpr=0&gpp=DBABJg~BFoAAEA.QA&iu_parts=183096492%2CMediaFire-Zone2&enc_prev_ius=%2F0%2F1&prev_iu_szs=336x280%7C300x250&ifi=3&didk=2784911678&dids=div-gpt-ad-1583943910909-0&adfs=2337275817&sfv=1-0-45&eri=5&sc=1&cookie_enabled=1&abxe=1&dt=1766066761841&adxs=320&adys=120&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fqxgu7p6f5ea5fve%2FMinecraft%2BDungeons%2Bv1.17.0.0.zip%2Ffile&vis=1&psz=336x-1&msz=336x-1&fws=0&ohw=0&a3p=EhkKCnB1YmNpZC5vcmcYp-CgjrMzSABSAghkEhwKDWNyd2RjbnRybC5uZXQYp-CgjrMzSABSAghkEhgKCXlhaG9vLmNvbRio4KCOszNIAFICCGQSFAoFb3BlbngYp-CgjrMzSABSAghkEh0KDmVzcC5jcml0ZW8uY29tGKfgoI6zM0gAUgIIZBIXCghydGJob3VzZRio4KCOszNIAFICCGQ.&psd=WzMxLFtdXQ..&dlt=1766066758992&idt=2718&prev_scp=dkey_present%3Dfalse%26buildnumber%3D121958%26dladtemplate%3D59%26button_delay%3Ddisabled&adks=3841872593&frm=20&eoidce=1&pb_szs=336x280%7C300x250

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202512040101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.62.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bc-in-f154.1e100.net

Software

cafe /

Resource Hash

80dd8320a523b27ed8fb4c5900051dd5cf309c1750a92df9961bddf8ddebb931

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: dcb
google-lineitem-id: 5967615577
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 18 Dec 2025 14:06:02 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: 138402949850
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.mediafire.com
content-length: 10063
x-xss-protection: 0
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 68 KB
10 KB 429ms
429ms Fetch
text/plain 172.253.62.154
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2358420873576341&correlator=399606046886737&eid=31095251%2C83321072&output=ldjh&gdfp_req=1&vrg=202512040101&ptt=17&impl=fifs&gdpr=0&gpp=DBABJg~BFoAAEA.QA&iu_parts=183096492%2CMediaFire-Zone3&enc_prev_ius=%2F0%2F1&prev_iu_szs=336x280%7C300x250&ifi=4&didk=3528871077&dids=div-gpt-ad-1583943842379-0&adfs=610958074&sfv=1-0-45&eri=5&sc=1&cookie_enabled=1&abxe=1&dt=1766066761845&adxs=320&adys=420&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fqxgu7p6f5ea5fve%2FMinecraft%2BDungeons%2Bv1.17.0.0.zip%2Ffile&vis=1&psz=336x280&msz=336x0&fws=0&ohw=0&a3p=EhkKCnB1YmNpZC5vcmcYp-CgjrMzSABSAghkEhwKDWNyd2RjbnRybC5uZXQYp-CgjrMzSABSAghkEhgKCXlhaG9vLmNvbRio4KCOszNIAFICCGQSFAoFb3BlbngYp-CgjrMzSABSAghkEh0KDmVzcC5jcml0ZW8uY29tGKfgoI6zM0gAUgIIZBIXCghydGJob3VzZRio4KCOszNIAFICCGQ.&psd=WzMxLFtdXQ..&dlt=1766066758992&idt=2718&prev_scp=dkey_present%3Dfalse%26buildnumber%3D121958%26dladtemplate%3D59%26button_delay%3Ddisabled&adks=1870779098&frm=20&eoidce=1&pb_szs=336x280%7C300x250

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202512040101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.62.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bc-in-f154.1e100.net

Software

cafe /

Resource Hash

02ca6454edfe1b231c57113c25911b6aec4af5ea6060aeed24f6652ddba826b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: dcb
google-lineitem-id: 6949855565
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 18 Dec 2025 14:06:02 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: 138510757059
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.mediafire.com
content-length: 10021
x-xss-protection: 0
server: cafe

GET
H2 200 olathe.js Show response
g.ezoic.net/parsonsmaize/ 2 KB
977 B 93ms
86ms Script
application/javascript 54.85.8.229
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/parsonsmaize/olathe.js?gcb=195-15&cb=30
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.85.8.229 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-85-8-229.compute-1.amazonaws.com
Software: /
Resource Hash: 3cefef7fc952707c97375ef3fa95a8c45a96eda7845d02bc1c28bf3570c0cfba

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex, follow
cache-control: max-age=31536000, public
content-encoding: br
date: Thu, 18 Dec 2025 14:06:01 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding

GET
H2 200 et.js Show response
g.ezoic.net/porpoiseant/ 1 KB
602 B 187ms
181ms Script
application/javascript 54.85.8.229
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/porpoiseant/et.js?gcb=195-15&cb=3
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.85.8.229 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-85-8-229.compute-1.amazonaws.com
Software: /
Resource Hash: 0f67393986c012dbf48aa3149e2874bd84ed5f466362ad1ac31305f697f1da7b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex, follow
cache-control: max-age=31536000, public
content-encoding: br
content-length: 571
date: Thu, 18 Dec 2025 14:06:02 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding

GET
H2 200 reno.js Show response
g.ezoic.net/detroitchicago/ 2 KB
601 B 173ms
167ms Script
application/javascript 54.85.8.229
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/detroitchicago/reno.js?gcb=195-15&cb=45171a0f72
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.85.8.229 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-85-8-229.compute-1.amazonaws.com
Software: /
Resource Hash: 6896b59e8034378b31284eea779e568986c0337a8eb3e648efbf52fd8d5d3781

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex, follow
cache-control: max-age=31536000, public
content-encoding: br
content-length: 570
date: Thu, 18 Dec 2025 14:06:02 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding

GET
H2 200 overlandpark.js Show response
g.ezoic.net/detroitchicago/ 1 KB
542 B 142ms
136ms Script
application/javascript 54.85.8.229
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/detroitchicago/overlandpark.js?gcb=195-15&cb=301bbdaf04
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.85.8.229 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-85-8-229.compute-1.amazonaws.com
Software: /
Resource Hash: 8b3a000db28359e0512e1484988806b9cdaeb457e29ef6b82bfe097e6eed3231

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex, follow
cache-control: max-age=31536000, public
content-encoding: br
content-length: 488
date: Thu, 18 Dec 2025 14:06:02 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding

GET
H2 200 denver.js Show response
g.ezoic.net/detroitchicago/ 2 KB
1 KB 142ms
137ms Script
application/javascript 54.85.8.229
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/detroitchicago/denver.js?gcb=195-15&cb=4ff75c6f00
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.85.8.229 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-85-8-229.compute-1.amazonaws.com
Software: /
Resource Hash: 3b9ffd186b78d9ad93b8f8f63b927976df2c98d29ecf5186c18b80d645cfd134

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex, follow
cache-control: max-age=31536000, public
content-encoding: br
date: Thu, 18 Dec 2025 14:06:02 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding

GET
H2 200 wichita.js Show response
g.ezoic.net/detroitchicago/ 2 KB
982 B 143ms
138ms Script
application/javascript 54.85.8.229
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/detroitchicago/wichita.js?gcb=195-15&cb=e49d8d9bca
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.85.8.229 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-85-8-229.compute-1.amazonaws.com
Software: /
Resource Hash: b837449c7254dd5887b620b7903bb4dbafbf2424ae3eb25e7a9f3471ff105365

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex, follow
cache-control: max-age=31536000, public
content-encoding: br
date: Thu, 18 Dec 2025 14:06:02 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding

GET
H2 200 vitals.js Show response
g.ezoic.net/tardisrocinante/ 11 KB
4 KB 184ms
179ms Script
application/javascript 54.85.8.229
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/tardisrocinante/vitals.js?gcb=15&cb=5
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.85.8.229 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-85-8-229.compute-1.amazonaws.com
Software: /
Resource Hash: 6fca1361d81b8d8d05afbe947e257aef026891372b45e0d2de123a907a4ed1af

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex, follow
cache-control: max-age=31536000, public
content-encoding: br
date: Thu, 18 Dec 2025 14:06:02 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding

GET
H2 200 drake.js Show response
g.ezoic.net/beardeddragon/ 4 KB
1 KB 145ms
141ms Script
application/javascript 54.85.8.229
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/beardeddragon/drake.js?gcb=15&cb=1b0a0a9dcc
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.85.8.229 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-85-8-229.compute-1.amazonaws.com
Software: /
Resource Hash: a5e87590d9232e0b0be4c640eeb47cb4f4299af754f195c802d49fe380ea1870

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex, follow
cache-control: max-age=31536000, public
content-encoding: br
date: Thu, 18 Dec 2025 14:06:02 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding

GET
H2 200 chanute.js Show response
g.ezoic.net/parsonsmaize/ 20 KB
5 KB 193ms
189ms Script
application/javascript 54.85.8.229
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/parsonsmaize/chanute.js?a=a&cb=17&dcb=195-15&shcb=34
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.85.8.229 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-85-8-229.compute-1.amazonaws.com
Software: /
Resource Hash: 0b3b8cb2ae1a42f0149d74ef25b25925bd0b8cc8182c00d212776525d9f03d7b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex, follow
cache-control: max-age=31536000, public
content-encoding: br
date: Thu, 18 Dec 2025 14:06:02 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding

GET
H2 200 jellyfish.js Show response
g.ezoic.net/porpoiseant/ 27 KB
7 KB 187ms
184ms Script
application/javascript 54.85.8.229
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/porpoiseant/jellyfish.js?a=a&cb=20&dcb=195-15&shcb=34
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.85.8.229 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-85-8-229.compute-1.amazonaws.com
Software: /
Resource Hash: 44a75c7db0985f0e6452d20e605e3150d12088ba4adde1ca903095fed62f8e78

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex, follow
cache-control: max-age=31536000, public
content-encoding: br
date: Thu, 18 Dec 2025 14:06:02 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding

GET
DATA 200
OK truncated Show response
/ Frame 1B8E 2 KB
2 KB Document
text/html

General

Check archive.org

Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0dcae222606cf25659d185a62f2fcd41caf42f6dd3d9dda50eda1f281e304065

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36

Response headers

Content-Type: text/html;charset=UTF-8

GET
H3 200 24px.svg
fonts.gstatic.com/s/i/productlogos/translate/v14/ 6 KB
3 KB 218ms
77ms Image
image/svg+xml 172.253.122.94
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://fonts.gstatic.com/s/i/productlogos/translate/v14/24px.svg

Requested by

Host: www.mediafire.com
URL: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f94.1e100.net

Software

sffe /

Resource Hash

ab5c23a05e39deed14d9d8262b0dce9f024f86105a27196cad37d14a3f516e09

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
age: 31423
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Fri, 18 Dec 2026 05:22:19 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 18 Dec 2025 05:22:19 GMT
last-modified: Wed, 20 Apr 2022 14:24:23 GMT
content-type: image/svg+xml
vary: Accept-Encoding
cache-control: public, max-age=31536000
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 3340
x-xss-protection: 0
server: sffe

GET
H2 200 googlelogo_color_42x16dp.png
www.gstatic.com/images/branding/googlelogo/1x/ 910 B
1 KB 79ms
76ms Image
image/png 142.250.31.94
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://www.gstatic.com/images/branding/googlelogo/1x/googlelogo_color_42x16dp.png

Requested by

Host: www.mediafire.com
URL: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.31.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bj-in-f94.1e100.net

Software

sffe /

Resource Hash

6318394f737c66f0e2ccfcd88e3935c6667633a1b95fa29fba2b75431d55eef2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

age: 6128
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
x-content-type-options: nosniff
expires: Fri, 18 Dec 2026 12:23:54 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 18 Dec 2025 12:23:54 GMT
last-modified: Thu, 02 Nov 2023 22:48:00 GMT
content-type: image/png
vary: Origin
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
content-length: 910
x-xss-protection: 0
server: sffe

GET
H2 200 translate_24dp.png
www.gstatic.com/images/branding/product/2x/ 2 KB
2 KB 80ms
79ms Image
image/png 142.250.31.94
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://www.gstatic.com/images/branding/product/2x/translate_24dp.png

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.2f3WBw8L4SI.L.W.O/am=AAQD/d=0/rs=AN8SPfrXXtxuFpMMBoYgp93jo68L3iC3ZQ/m=el_main_css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.31.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bj-in-f94.1e100.net

Software

sffe /

Resource Hash

4dac0026fbfa2615dce30c0af12830863fe885f84387a0147b9e338f548d5d82

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.2f3WBw8L4SI.L.W.O/am=AAQD/d=0/rs=AN8SPfrXXtxuFpMMBoYgp93jo68L3iC3ZQ/m=el_main_css

Response headers

age: 6128
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
x-content-type-options: nosniff
expires: Fri, 18 Dec 2026 12:23:54 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 18 Dec 2025 12:23:54 GMT
last-modified: Thu, 14 Oct 2021 09:08:00 GMT
content-type: image/png
vary: Origin
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
content-length: 1842
x-xss-protection: 0
server: sffe

GET
H2 200 sdk.js Show response
solutions.cdn.optable.co/ezoic/ 51 KB
16 KB 185ms
43ms Script
text/javascript 34.8.255.148
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL

https://solutions.cdn.optable.co/ezoic/sdk.js

Requested by

Host: www.ezojs.com
URL: https://www.ezojs.com/identity.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.8.255.148 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

148.255.8.34.bc.googleusercontent.com

Software

UploadServer /

Resource Hash

012001f5484f2f61e04ea3ac14ef735fd12c896e60d7f78aab18d0682cfdeb1e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-goog-metageneration: 1
content-encoding: gzip
x-goog-hash: crc32c=TZ7GGQ==, md5=4Fu+SV+HVfvEJCMlPx8gpw==
etag: "e05bbe495f8755fbc42423253f1f20a7"
age: 2988
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 15780
date: Thu, 18 Dec 2025 13:16:14 GMT
last-modified: Thu, 11 Dec 2025 22:08:55 GMT
content-type: text/javascript
x-guploader-uploadid: AHVrFxMsiA0h6IddRfIoGU9Pnrn-87t6gmAZS6-xyX-3HriZ71Rhuhe6XVKZKxoj2NNvHH4-
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public,max-age=86400,no-transform
x-goog-storage-class: STANDARD
via: 1.1 google
accept-ranges: bytes
x-goog-generation: 1765490935335560
content-length: 15780
server: UploadServer

POST
H2 200 ezconfig Show response
g.ezoic.net/detroitchicago/ 29 B
83 B 178ms
175ms Fetch
application/json 54.85.8.229
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/detroitchicago/ezconfig
Requested by: Host: www.ezojs.com
URL: https://www.ezojs.com/identity.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.85.8.229 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-85-8-229.compute-1.amazonaws.com
Software: /
Resource Hash: 893719087a8bc6dcdfabc4e1d54fd6d724953d40da2ad369f8b4fb5f689394d7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Content-Type: application/json
Referer: https://www.mediafire.com/

Response headers

access-control-max-age: 1728000
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, PUT, OPTIONS
access-control-allow-origin: https://www.mediafire.com
content-length: 29
date: Thu, 18 Dec 2025 14:06:02 GMT
content-type: application/json
vary: Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
access-control-allow-headers: Content-Type

POST
H2 200 imp.gif
g.ezoic.net/detroitchicago/ 43 B
205 B 200ms
194ms Ping
image/gif 54.85.8.229
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/detroitchicago/imp.gif?ez_orig=1
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/parsonsmaize/abilene.js?gcb=195-15&cb=b20dfef28c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.85.8.229 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-85-8-229.compute-1.amazonaws.com
Software: /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://www.mediafire.com/

Response headers

access-control-max-age: 1728000, 1728000
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, PUT, OPTIONS, HEAD, PUT, POST, GET, OPTIONS
expires: Wed, 17 Dec 2025 14:06:02 GMT
access-control-allow-origin: https://www.mediafire.com, https://www.mediafire.com
content-length: 43
date: Thu, 18 Dec 2025 14:06:02 GMT
x-middleton-display: imp_sol
content-type: image/gif
vary: Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
access-control-allow-headers: Content-Type, Content-Type

GET
H2 200 omaha.js Show response
g.ezoic.net/detroitchicago/ 1 KB
624 B 206ms
206ms Script
application/javascript 54.85.8.229
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/detroitchicago/omaha.js?gcb=195-15&cb=8f3688675f
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.85.8.229 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-85-8-229.compute-1.amazonaws.com
Software: /
Resource Hash: 032e1fdc72c9c669bbd7dcb841fc1cdcd7a9148a5802dd668c508efd0c11d7a0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-robots-tag: noindex, follow
cache-control: max-age=31536000, public
content-encoding: br
content-length: 593
date: Thu, 18 Dec 2025 14:06:02 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding

GET
H2

200

esp Show response
oajs.openx.net/
Redirect Chain

https://oajs.openx.net/esp?url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fqxgu7p6f5ea5fve%2FMinecraft%2BDungeons%2Bv1.17.0.0.zip%2Ffile&rid=esp
https://oajs.openx.net/esp?url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fqxgu7p6f5ea5fve%2FMinecraft%2BDungeons%2Bv1.17.0.0.zip%2Ffile&rid=esp&cc=1

85 B
193 B

85ms
84ms

Fetch
application/json

34.120.135.53
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://oajs.openx.net/esp?url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fqxgu7p6f5ea5fve%2FMinecraft%2BDungeons%2Bv1.17.0.0.zip%2Ffile&rid=esp&cc=1
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file
Protocol: H2
Server: 34.120.135.53 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 53.135.120.34.bc.googleusercontent.com
Software: / Express
Resource Hash: 4f8c10a8abdbbc4e77253d84a9f98c4ab302f160323509d29f6edb36d62974b7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

etag: W/"55-K6zbzsMnjyZrt3yFwbs9J9uTdwo"
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://www.mediafire.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 85
date: Thu, 18 Dec 2025 14:06:02 GMT
content-type: application/json; charset=utf-8
x-powered-by: Express
vary: Origin

Redirect headers

location: /esp?url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fqxgu7p6f5ea5fve%2FMinecraft%2BDungeons%2Bv1.17.0.0.zip%2Ffile&rid=esp&cc=1
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://www.mediafire.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Thu, 18 Dec 2025 14:06:02 GMT
x-powered-by: Express
vary: Origin

GET
H2 200 bounce Show response
id5-sync.com/ 29 B
526 B 804ms
361ms Fetch
text/plain 162.19.138.83
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/bounce

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.83 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ns31532338.ip-162-19-138.eu

Software

Resource Hash

aca701811d62eb608d12b174231be1ceae3449fe0f4bc847469ff22aab8ca9a5

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://www.mediafire.com
p3p: CP="CAO PSA OUR"
date: Thu, 18 Dec 2025 14:06:02 GMT
content-type: text/plain;charset=utf-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H2 200 v1 Show response
lbs.eu-1-id5-sync.com/lbs/ 54 B
162 B 844ms
409ms Fetch
application/json 162.19.223.45
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://lbs.eu-1-id5-sync.com/lbs/v1
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.19.223.45 , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS
Software: /
Resource Hash: 79e3db8a438fe11f7184ca47a9e981ea23c0f5a35ec172a241899e3ee09a7d0d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

access-control-allow-origin: https://www.mediafire.com
content-length: 54
date: Thu, 18 Dec 2025 14:06:02 GMT
content-type: application/json
vary: Origin

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
327 B 859ms
426ms Fetch
application/json 162.19.138.116
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.116 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ns31533567.ip-162-19-138.eu

Software

Resource Hash

d071b93b496cb74804524f495fa83e809ae18683a6a784d27b93e05abc722822

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://www.mediafire.com
content-encoding: gzip
date: Thu, 18 Dec 2025 14:06:02 GMT
content-type: application/json;charset=UTF-8
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding

GET
H2 200 config Show response
na.edge.optable.co/ 221 B
336 B 259ms
75ms Fetch
application/json 34.54.78.238
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://na.edge.optable.co/config?osdk=web-v0.45.0&sid=MApdZoIhTLnlzCwrJEA5Zg&t=ezoic&o=ez-mediafire-com&cookies=no&passport=
Requested by: Host: solutions.cdn.optable.co
URL: https://solutions.cdn.optable.co/ezoic/sdk.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.54.78.238 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 238.78.54.34.bc.googleusercontent.com
Software: /
Resource Hash: f9182a2ae7741a28c9914d19885f60ae4bf0a696f36a5a25f928f3cf088c7200

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Accept: application/json
Referer: https://www.mediafire.com/

Response headers

access-control-expose-headers: X-Optable-Visitor
content-encoding: gzip
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://www.mediafire.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 246
date: Thu, 18 Dec 2025 14:06:02 GMT
content-type: application/json; charset=utf-8
vary: Origin, Accept-Encoding

GET
H2 200 config Show response
na.edge.optable.co/ 221 B
520 B 258ms
74ms Fetch
application/json 34.54.78.238
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://na.edge.optable.co/config?osdk=web-v0.45.0&sid=Kkw2dVMuXqUc8keYzv6dfw&t=ezoic&o=ez-mediafire-com&ro=true&cookies=no&passport=
Requested by: Host: solutions.cdn.optable.co
URL: https://solutions.cdn.optable.co/ezoic/sdk.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.54.78.238 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 238.78.54.34.bc.googleusercontent.com
Software: /
Resource Hash: e13eb219765a0567323a2891012ee42ee6a2749858f6074dd5b4f1c6aacbd888

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Accept: application/json
Referer: https://www.mediafire.com/

Response headers

access-control-expose-headers: X-Optable-Visitor
content-encoding: gzip
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://www.mediafire.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 246
date: Thu, 18 Dec 2025 14:06:02 GMT
content-type: application/json; charset=utf-8
vary: Origin, Accept-Encoding

GET
H2 200 id5-api.js Show response
cdn.id5-sync.com/api/1.0/ 112 KB
0 1ms
1ms Script
text/javascript 104.20.23.13
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Requested by: Host: solutions.cdn.optable.co
URL: https://solutions.cdn.optable.co/ezoic/sdk.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.23.13 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d17e84af7ba998526041e90409fec0d80e0bf436fecd99cd94ea4124f1047141

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-amz-id-2: XZdFtvlT86c9N7B9v+rt6wpFpPKGWEpg0rqJVNq+LvChHtDUM8+ZIYZgkDnsLJS645zcSVHQYhU=
cache-control: public, max-age=3600
content-encoding: br
cf-cache-status: HIT
etag: W/"9d3ef6e0b1008a729462806417366a8e"
age: 1532
x-amz-request-id: 28MY16YEDN7JGNX0
cf-ray: 9aff37eb7c8a9da4-DEN
date: Thu, 18 Dec 2025 14:06:01 GMT
content-type: text/javascript;charset=utf-8
last-modified: Tue, 04 Nov 2025 08:00:55 GMT
vary: accept-encoding
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 3B26 0
0 105ms
103ms Fetch
image/gif 172.253.62.154
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuqE5PQYE2TOam1WngUQ6MpD2Htu-4wY6Lx2My9TPQ0JqUd7OPd3y3HEjCNg-fITxXySMHasm7Uke8DXk3Je_qomlKQLuLeQ24Px3xwdKJGWLIK36o6rcGFAXF1C_Hb9kbsaD-ZRZ2_eWCktBINRJsq1Zvgih-lxV5H6rtq0IpI5Yw6SQrgzJOr5i1U1Ium5Tj-NvuRHsR32Wb18GC1z1Ab_Xqag8K8dattPwZwqckUsKxya93mrz6DcsuyPp_WrdNrBKOvUsx-Zc-a3hgvrGmzwWV8qbCq2JIBy59HgAKcMGYcLmVtmmLmP7s_5gIQncUrQHYvBaipt1xeMelIAMfxFycKsZCMnV7nyfXdcgGWN7QhZlAhFhzvF3atPOAGKHRJVBstajBXTVgFF6Tci_UX_cY3BE72_vXc9BOV8IaZzysD9p7R5GcxofHN7iz95eRn410Nt4-yEw&sai=AMfl-YQG7P-4f-agxDwVdmnidK-4mnSADG0TU3tP3-qoubqlEt2my-GUpgOka3Vxfh0yoK1ID4O1S51BEVJvQTVbGtSgLN2HnhJfL7ZAVM-IPWRAamM2oOCgeyYOI4RVNmZv3xpN-3PHplTMS2rTSbaDOxGk3-QD4HYriON4CYmRUq_XWL7FtA10yBYFFlhpP6ujEpWbqcs9Rb5_vuD5DA7rbuPeUn_3o4023WDO1PVj5rtXQn9vTGh5Wn0E_RC5lGLiT1RZwzU2ZF9AkGXcEPbFP91TjZSb0_Q&sig=Cg0ArKJSzI0lmE9Fm8izEAE&uach_m=%5BUACH%5D&adurl=

Requested by

Host: www.mediafire.com
URL: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.62.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bc-in-f154.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Thu, 18 Dec 2025 14:06:02 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Thu, 18 Dec 2025 14:06:02 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20251211/r20110914/ Frame 3B26 21 KB
8 KB 681ms
401ms Script
text/javascript 172.253.115.132
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20251211/r20110914/abg_lite_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202512040101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f132.1e100.net

Software

cafe /

Resource Hash

bd04667d5d5feb14319f345a1a8e7486d8ab5aea560fb8be53cae5f6bc9d0e20

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: br
etag: 11386605814003084292
age: 8683
x-content-type-options: nosniff
expires: Thu, 01 Jan 2026 11:41:19 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 18 Dec 2025 11:41:19 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 8505
x-xss-protection: 0
server: cafe

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20251211/r20110914/client/ Frame 3B26 3 KB
2 KB 638ms
359ms Script
text/javascript 172.253.115.132
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20251211/r20110914/client/window_focus_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202512040101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f132.1e100.net

Software

cafe /

Resource Hash

fec5a361dec923efe92848ca27b02b158b164380a9eaf6cc1625e08e0d9c101e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: br
etag: 6020003950853699975
age: 8011
x-content-type-options: nosniff
expires: Thu, 01 Jan 2026 11:52:31 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 18 Dec 2025 11:52:31 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 1241
x-xss-protection: 0
server: cafe

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 3B26 227 KB
70 KB 341ms
78ms Script
text/javascript 172.253.122.156
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202512040101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f156.1e100.net

Software

cafe /

Resource Hash

04ed00928d15a800e1ee9d6dc81c7a5d96e60322e2f6ae495dd4cad9a9c1ebbc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: br
etag: 4275280797838870707
age: 614
x-content-type-options: nosniff
expires: Thu, 18 Dec 2025 14:55:48 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 18 Dec 2025 13:55:48 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 71554
x-xss-protection: 0
server: cafe

GET
H2 200 6238814545860611895
tpc.googlesyndication.com/simgad/ Frame 3B26 16 KB
16 KB 636ms
359ms Image
image/png 172.253.115.132
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/6238814545860611895

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202512040101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f132.1e100.net

Software

sffe /

Resource Hash

fcfe9df48de61a9691e374f987442cb286b29df9c4a8b0177b97076fe443ef52

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
x-content-type-options: nosniff
expires: Fri, 18 Dec 2026 14:06:02 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Thu, 18 Dec 2025 14:06:02 GMT
content-type: image/png
last-modified: Tue, 18 Mar 2025 13:13:41 GMT
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
content-length: 16395
x-xss-protection: 0
server: sffe

GET
DATA 200
OK truncated
/ Frame 3B26 211 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 67f7d0e0a582d352f71f2106000e4f4b37498412be20d819d49b94e9dd0cce86

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 87D9 0
0 107ms
106ms Fetch
image/gif 172.253.62.154
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvdEJ07OujOQKPN0ftiYZfOXlAcMlM4X5KWuoRqJMilLdw3PZ5-N5Ms-kZfNh5O1DBf5bD7p5qUoH1fBOazwuJoZmwczF7_TWrdq03pSFKt8F6iKC1AEBFPDXdmuE6Dtg99YVzB3LicTh_qhgrxw7SUfWx0VkD9wdIrMhRc1llhCSAW340--2l4LIWeLpZ-7uhLtYtWbIomPKSYST4jp8sq-RboLcQ7lOUAIQOOKNolOmQlgh95BAisLkIrmbO4vJ2p6fRNFQT6PFs67lE26IFTBJdHJ0Id_2cUtG5aw4qpWHynu4AkNwv7O4xuthVHjhMvvxgB8Do8Ypcy8yqrISgV5ZAdB_wla-9jVC5TA8f-4nLsz4MsYZ28j0vnM7Ic9Ec1-VTiK0Q5aVrKQEt7mvXfFuOiizp_D7-wekjSJB_zTWCyhN_Rue0bYg&sai=AMfl-YQEWDoDersJinLQgMWCu7As7V9ppH5SnqFYAi0tRZuMe0PgmPMQOVLUIIkrzKiXCSy82OudZbq_71jITTRJSOveuesqiqHyqaZYQp18gC5VO1HIC6rRRrO_cFVv9OuyubitC7_UCB3iMdy_JDrDHBM_mmsPrI1XAdDxV8rKvi-t8Q3sWPzRR-pU7-7GVQfsdXPw_sJL03v2RE4oWbBxJ5Ykw4hPuXfPf3D2oRG1IvhB8dxdvXOcSVweqpStnOMaiDoItnevR7KGwZaFl-p9U7mt-xq00F4&sig=Cg0ArKJSzIstAQt-rKzXEAE&uach_m=%5BUACH%5D&adurl=

Requested by

Host: www.mediafire.com
URL: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.62.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bc-in-f154.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Thu, 18 Dec 2025 14:06:02 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Thu, 18 Dec 2025 14:06:02 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20251211/r20110914/ Frame 87D9 21 KB
0 653ms
652ms Script
text/javascript 172.253.115.132
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20251211/r20110914/abg_lite_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202512040101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f132.1e100.net

Software

cafe /

Resource Hash

bd04667d5d5feb14319f345a1a8e7486d8ab5aea560fb8be53cae5f6bc9d0e20

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: br
etag: 11386605814003084292
age: 8683
x-content-type-options: nosniff
expires: Thu, 01 Jan 2026 11:41:19 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 18 Dec 2025 11:41:19 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 8505
x-xss-protection: 0
server: cafe

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20251211/r20110914/client/ Frame 87D9 3 KB
0 605ms
605ms Script
text/javascript 172.253.115.132
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20251211/r20110914/client/window_focus_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202512040101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f132.1e100.net

Software

cafe /

Resource Hash

fec5a361dec923efe92848ca27b02b158b164380a9eaf6cc1625e08e0d9c101e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: br
etag: 6020003950853699975
age: 8011
x-content-type-options: nosniff
expires: Thu, 01 Jan 2026 11:52:31 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 18 Dec 2025 11:52:31 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 1241
x-xss-protection: 0
server: cafe

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 87D9 227 KB
0 302ms
302ms Script
text/javascript 172.253.122.156
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202512040101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f156.1e100.net

Software

cafe /

Resource Hash

04ed00928d15a800e1ee9d6dc81c7a5d96e60322e2f6ae495dd4cad9a9c1ebbc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: br
etag: 4275280797838870707
age: 614
x-content-type-options: nosniff
expires: Thu, 18 Dec 2025 14:55:48 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 18 Dec 2025 13:55:48 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 71554
x-xss-protection: 0
server: cafe

GET
H2 200 16298801869159861559
tpc.googlesyndication.com/simgad/ Frame 87D9 12 KB
13 KB 1089ms
851ms Image
image/png 172.253.115.132
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/16298801869159861559

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202512040101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f132.1e100.net

Software

sffe /

Resource Hash

7ec07fca39de3ece6668edebbfe6002dcb9639a0f412d3af35fc7a63d3597d0f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
x-content-type-options: nosniff
expires: Fri, 18 Dec 2026 14:06:02 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Thu, 18 Dec 2025 14:06:02 GMT
content-type: image/png
last-modified: Tue, 18 Mar 2025 13:14:54 GMT
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
content-length: 12778
x-xss-protection: 0
server: sffe

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 9033 0
0 97ms
96ms Fetch
image/gif 172.253.62.154
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstk4RHGGEoyoVA1TbMk-QxHVwVJc3Al7iFLMtToPcoKlj8-8xaiCN9ZdzEZqMqObNkTWr62Se4l4Tal7Bs1wYtlOyEpumNGVMuB7QIRDyMOLAvODCGYc7wV25P6PWrRTo64fkK6XjEmeKGLn2kfK6VjPQyZY7OoMc67yIJeoRyKH4UyjHWtSg3E4qx1ZlWPwbENFIgvKN13k_3Ot4zTkgtUpoDpfiCpyS7MEip1iKMSExXfV3qGnjanwcjVnE6l27tdZO4p90EAYDDTFPhARzOSeyQAvMQrkqrbqoT2Cn-dUxflwaFCK-BKQOZMO39SR4I6Wu5_VwbWjZrgYor3W4A7ojAEssu2_FA65jvO2QK_3bGSWId4i0XqlWS-EonZr2AoJXdvgFkKLibYSXTjUXalkZCCDWnVnwvobDmvsKKzKz10rERQLIsPMQ&sai=AMfl-YR5nh5eXHRdwKcb3uwpIH8iwJzawt0OjrwjR_pCc8zbHLYdhc7NPgw6MQ_KVVBB73I-cDogQmCSqrCMPtZsWjv4fUSPEbTaAnc4U3U0NC6eauv2ySi4FZEMMZrWGGRWTpVVq9ba-5ZlAocC2ZIS9GI0peMxgi3m5VN_Fv4BuKNHhJZ8JuYgE_h1CNkeyH2lSpgQMw9MSMOVn8tDUWBWUTYZC6y5jzCFte0vKBhU8xl1nrAnGGIXc6fC9e5Ig-i8BPW-9NI2bHv00utiZOWTEieaqDSqlGA&sig=Cg0ArKJSzJyEv9SjhjV3EAE&uach_m=%5BUACH%5D&adurl=

Requested by

Host: www.mediafire.com
URL: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.62.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bc-in-f154.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Thu, 18 Dec 2025 14:06:02 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Thu, 18 Dec 2025 14:06:02 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20251211/r20110914/ Frame 9033 21 KB
0 397ms
397ms Script
text/javascript 172.253.115.132
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20251211/r20110914/abg_lite_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202512040101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f132.1e100.net

Software

cafe /

Resource Hash

bd04667d5d5feb14319f345a1a8e7486d8ab5aea560fb8be53cae5f6bc9d0e20

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: br
etag: 11386605814003084292
age: 8683
x-content-type-options: nosniff
expires: Thu, 01 Jan 2026 11:41:19 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 18 Dec 2025 11:41:19 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 8505
x-xss-protection: 0
server: cafe

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20251211/r20110914/client/ Frame 9033 3 KB
0 344ms
344ms Script
text/javascript 172.253.115.132
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20251211/r20110914/client/window_focus_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202512040101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f132.1e100.net

Software

cafe /

Resource Hash

fec5a361dec923efe92848ca27b02b158b164380a9eaf6cc1625e08e0d9c101e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: br
etag: 6020003950853699975
age: 8011
x-content-type-options: nosniff
expires: Thu, 01 Jan 2026 11:52:31 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 18 Dec 2025 11:52:31 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 1241
x-xss-protection: 0
server: cafe

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 9033 227 KB
0 244ms
244ms Script
text/javascript 172.253.122.156
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202512040101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f156.1e100.net

Software

cafe /

Resource Hash

04ed00928d15a800e1ee9d6dc81c7a5d96e60322e2f6ae495dd4cad9a9c1ebbc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: br
etag: 4275280797838870707
age: 614
x-content-type-options: nosniff
expires: Thu, 18 Dec 2025 14:55:48 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 18 Dec 2025 13:55:48 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 71554
x-xss-protection: 0
server: cafe

GET
H2 200 17687385720995561243
tpc.googlesyndication.com/simgad/ Frame 9033 72 KB
72 KB 1025ms
850ms Image
image/png 172.253.115.132
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/17687385720995561243

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202512040101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f132.1e100.net

Software

sffe /

Resource Hash

24e5456c9094314514ad27b449e8879f29ed5a574c6ede18eb6c3fcac10c3fe9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
x-content-type-options: nosniff
expires: Fri, 18 Dec 2026 14:06:02 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Thu, 18 Dec 2025 14:06:02 GMT
content-type: image/png
last-modified: Thu, 01 Sep 2022 13:07:23 GMT
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
content-length: 73308
x-xss-protection: 0
server: sffe

GET
DATA 200
OK truncated
/ Frame 87D9 215 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: af4f8dc7357322f551fc81793bba94d32fc6fae031b56a126ead43709da0a8b6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 9033 210 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fe4e0d62dd44972bab23d30702b6b506ac113c190df4c044af84b108c33858db

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame BA03 0
0 378ms
377ms Fetch
image/gif 172.253.62.154
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsveOI4H_qybYjNUDHRUlophnv1GaVWr2hNXVZheZeLh9dKb5bhMWYsPTBmZUiAIuKjP-nhjlAHZ22CT2590-sexIPW4T_vKPPKpKrZ5oM9YDKZaX_wfugIKMmTKNUyVqC0P9W3TzydkuUKcz82kCklrn8mDOr9rdW8ZH2qrFtYddsA758SZjUsZQxxQllHLl-g8jMH2y6G_4k8S2BLW13NVPz4jPble-6E1-ITZfWHS9CHPvXmvRUknkQANSodQB1JpJ3aQGHepEwcfvkrCNXENoagy_KylHBF6W6yiF_9SS6A4EREeFuQzH00-mRX6J0fr8GS4VVCinl1vags1VRCnqfCn96hC0lcLCjdhehQMSfV6i7b12TOROkrVIET-jItKg-VToRTPcw9fZv2JcM2o5bF5ixz96Rsplqauf5syUi3cJIrn0F9s-w&sai=AMfl-YS_JYsoZHTxL31PzxA82hQb1p1NB62XXs4XUPb3w_JY3OlC7YoEv5FhSj6mrOh01xdOlVFRolINnqxade6E2A_KhMl-vov1-ANJbV0wSaYfyKsXHe4ytLUuDrtFJR4hcYGMmxfuzam-LFp8pRdYnPgK84nbqqm1E1iM3Gdg89xmHRPyBlYcOovhjp_QOb-kcUTzJBvD-82BwMyHKkxv4rXDHrZS-RQ881BijjfuzYvIJUwz7bfe8XkoJ4fyA4P3Yq4odp-OB_jQJJsfJCeWh1wm0p0M7Icj&sig=Cg0ArKJSzEmQMOrg02TOEAE&uach_m=%5BUACH%5D&adurl=

Requested by

Host: www.mediafire.com
URL: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.62.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bc-in-f154.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Thu, 18 Dec 2025 14:06:02 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 6238814545860611895
tpc.googlesyndication.com/simgad/ Frame BA03 16 KB
0 436ms
436ms Image
image/png 172.253.115.132
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/6238814545860611895

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202512040101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f132.1e100.net

Software

sffe /

Resource Hash

fcfe9df48de61a9691e374f987442cb286b29df9c4a8b0177b97076fe443ef52

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
x-content-type-options: nosniff
expires: Fri, 18 Dec 2026 14:06:02 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Thu, 18 Dec 2025 14:06:02 GMT
content-type: image/png
last-modified: Tue, 18 Mar 2025 13:13:41 GMT
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
content-length: 16395
x-xss-protection: 0
server: sffe

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20251211/r20110914/ Frame BA03 21 KB
0 402ms
402ms Script
text/javascript 172.253.115.132
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20251211/r20110914/abg_lite_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202512040101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f132.1e100.net

Software

cafe /

Resource Hash

bd04667d5d5feb14319f345a1a8e7486d8ab5aea560fb8be53cae5f6bc9d0e20

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: br
etag: 11386605814003084292
age: 8683
x-content-type-options: nosniff
expires: Thu, 01 Jan 2026 11:41:19 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 18 Dec 2025 11:41:19 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 8505
x-xss-protection: 0
server: cafe

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20251211/r20110914/client/ Frame BA03 3 KB
0 346ms
346ms Script
text/javascript 172.253.115.132
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20251211/r20110914/client/window_focus_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202512040101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f132.1e100.net

Software

cafe /

Resource Hash

fec5a361dec923efe92848ca27b02b158b164380a9eaf6cc1625e08e0d9c101e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: br
etag: 6020003950853699975
age: 8011
x-content-type-options: nosniff
expires: Thu, 01 Jan 2026 11:52:31 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 18 Dec 2025 11:52:31 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 1241
x-xss-protection: 0
server: cafe

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame BA03 227 KB
0 197ms
196ms Script
text/javascript 172.253.122.156
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202512040101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f156.1e100.net

Software

cafe /

Resource Hash

04ed00928d15a800e1ee9d6dc81c7a5d96e60322e2f6ae495dd4cad9a9c1ebbc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: br
etag: 4275280797838870707
age: 614
x-content-type-options: nosniff
expires: Thu, 18 Dec 2025 14:55:48 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 18 Dec 2025 13:55:48 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 71554
x-xss-protection: 0
server: cafe

POST
H2 200 encrypt Show response
esp.rtbhouse.com/ 305 B
570 B 982ms
819ms Fetch
application/json 35.190.39.111
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://esp.rtbhouse.com/encrypt
Requested by: Host: invstatic101.creativecdn.com
URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.39.111 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 111.39.190.35.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: be4d42256c1ac1973db1401ebaf87e5b2d8977a18a704ef159731a792d258848

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://www.mediafire.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: POST
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 305
date: Thu, 18 Dec 2025 14:06:02 GMT
content-type: application/json
x-cloud-trace-context: 6ea1873615f0b0f6002c893e6b433d04
server: Google Frontend
access-control-allow-headers: X-Requested-With

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
163 B 52ms
50ms Fetch
image/gif 104.20.47.80
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=2&e=0.9021022669914118
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.47.80 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 462006
x-goog-stored-content-encoding: identity
expires: Fri, 19 Dec 2025 14:06:02 GMT
x-goog-stored-content-length: 43
date: Thu, 18 Dec 2025 14:06:02 GMT
content-type: image/gif
vary: accept-encoding
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH8-sCmg1Zb6o0oOvulTNK1T2AoyyoaNKi_PGA5iJaaVy0v7GqbzieOx8PXbGN9_TCDlvU7S5l0U
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9aff37f1ed116429-DEN
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico Show response
ad.doubleclick.net/ 1 KB
129 B 85ms
84ms Fetch
image/x-icon 142.251.16.149
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.20641375848818466

Requested by

Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f149.1e100.net

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Fri, 19 Dec 2025 14:06:02 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 18 Dec 2025 14:06:02 GMT
content-type: image/x-icon
vary: Accept-Encoding
last-modified: Tue, 08 May 2012 13:08:06 GMT
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
111 B 93ms
91ms Fetch
image/gif 104.20.47.80
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.020471315413189917
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.47.80 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 462006
x-goog-stored-content-encoding: identity
expires: Fri, 19 Dec 2025 14:06:02 GMT
x-goog-stored-content-length: 43
date: Thu, 18 Dec 2025 14:06:02 GMT
content-type: image/gif
vary: accept-encoding
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH8-sCmg1Zb6o0oOvulTNK1T2AoyyoaNKi_PGA5iJaaVy0v7GqbzieOx8PXbGN9_TCDlvU7S5l0U
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9aff37f1ed286429-DEN
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H2 200 dns Show response
ab.dns-finder.com/meta/ 2 B
0 0ms
0ms Fetch
text/plain 34.36.200.111
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://ab.dns-finder.com/meta/dns
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.36.200.111 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 111.200.36.34.bc.googleusercontent.com
Software: /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cache-control: private, max-age=180, stale-if-error=180, stale-while-revalidate=180
access-control-expose-headers: X-Resolver
x-resolver: default
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
date: Thu, 18 Dec 2025 14:06:00 GMT
content-type: text/plain; charset=utf-8
vary: Origin

GET
DATA 200
OK truncated
/ Frame BA03 215 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ceac53f13f45fafda6347a7b257f1778440b96641bbc76b76e9925f96c37ca16

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 235 B
617 B 1024ms
532ms XHR
application/json 34.234.102.22
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://bcp.crwdcntrl.net/6/map?xcid=16589

Requested by

Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.234.102.22 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-234-102-22.compute-1.amazonaws.com

Software

Resource Hash

e8204c03ec389eba2ff9bcedccf9dbeb8c5d080daedcfc844b971df9c17d0c3e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://www.mediafire.com/

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains
cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://www.mediafire.com
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 235
date: Thu, 18 Dec 2025 14:06:03 GMT
content-type: application/json;charset=utf-8

GET
H2 200 pd Show response
google-bidout-d.openx.net/w/1.0/ Frame 5339 480 B
754 B 921ms
86ms Document
text/html 35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Requested by: Host: oa.openxcdn.net
URL: https://oa.openxcdn.net/esp.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 8fc0ee7d93e336fc05824e41e02a633c4e5eac4b6c076d21af68d61956ef8e32

Request headers

Referer: https://www.mediafire.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-encoding: br
content-length: 365
content-type: text/html
date: Thu, 18 Dec 2025 14:06:02 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 84.17.63.56

GET
H2 400 fed Show response
ups.analytics.yahoo.com/ups/58813/ 0
413 B 1121ms
292ms XHR
application/json 69.147.92.11
YAHOO

General

Check archive.org

Download Go to

Full URL

https://ups.analytics.yahoo.com/ups/58813/fed?gpp=DBABJg~BFoAAEA.QA&gpp_sid=-1&gdpr=false&gdpr_consent=&v=1&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fqxgu7p6f5ea5fve%2FMinecraft%2BDungeons%2Bv1.17.0.0.zip%2Ffile

Requested by

Host: connectid.analytics.yahoo.com
URL: https://connectid.analytics.yahoo.com/connectId-gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

69.147.92.11 Ashburn, United States, ASN14777 (YAHOO, US),

Reverse DNS

e1.ycpi.vip.dca.yahoo.com

Software

ATS /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

strict-transport-security: max-age=31536000
age: 0
access-control-allow-credentials: true
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
access-control-allow-origin: https://www.mediafire.com
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Thu, 18 Dec 2025 14:06:03 GMT
content-type: application/json
vary: Origin
server: ATS

POST
H3 204 ping
pagead2.googlesyndication.com/pagead/ 0
0 1185ms
385ms Fetch
text/html 172.253.122.156
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://pagead2.googlesyndication.com/pagead/ping?e=1
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202512040101/pubads_impl.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.253.122.156 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: bh-in-f156.1e100.net
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://www.mediafire.com/

Response headers

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
163 B 1149ms
1149ms Fetch
image/gif 104.20.47.80
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.12427275446130581
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.47.80 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 462007
x-goog-stored-content-encoding: identity
expires: Fri, 19 Dec 2025 14:06:03 GMT
x-goog-stored-content-length: 43
date: Thu, 18 Dec 2025 14:06:03 GMT
content-type: image/gif
vary: accept-encoding
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH8-sCmg1Zb6o0oOvulTNK1T2AoyyoaNKi_PGA5iJaaVy0v7GqbzieOx8PXbGN9_TCDlvU7S5l0U
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9aff37faadc16429-DEN
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
111 B 973ms
971ms Fetch
image/gif 104.20.47.80
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=2&e=0.9884928607785061
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.47.80 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 462007
x-goog-stored-content-encoding: identity
expires: Fri, 19 Dec 2025 14:06:03 GMT
x-goog-stored-content-length: 43
date: Thu, 18 Dec 2025 14:06:03 GMT
content-type: image/gif
vary: accept-encoding
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH8-sCmg1Zb6o0oOvulTNK1T2AoyyoaNKi_PGA5iJaaVy0v7GqbzieOx8PXbGN9_TCDlvU7S5l0U
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9aff37faadc36429-DEN
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico Show response
ad.doubleclick.net/ 1 KB
129 B 474ms
473ms Fetch
image/x-icon 142.251.16.149
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.9042409684656131

Requested by

Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f149.1e100.net

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Fri, 19 Dec 2025 14:06:03 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 18 Dec 2025 14:06:03 GMT
content-type: image/x-icon
vary: Accept-Encoding
last-modified: Tue, 08 May 2012 13:08:06 GMT
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

POST
H2 200 v3 Show response
id5-sync.com/gm/ 2 KB
2 KB 823ms
819ms XHR
application/json 162.19.138.83
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/gm/v3

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.83 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ns31532338.ip-162-19-138.eu

Software

Resource Hash

3c89e90d50156e5ba33e943ff9771abf103cff86253493c4eb389c99867166e3

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://www.mediafire.com/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://www.mediafire.com
p3p: CP="CAO PSA OUR"
date: Thu, 18 Dec 2025 14:06:03 GMT
content-type: application/json
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame B491 12 KB
5 KB 597ms
222ms Document
text/html 74.119.117.62
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=www.mediafire.com&gdpr=0&gdpr_consent=&gpp=DBABJg~BFoAAEA.QA&gpp_sid=

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.ids.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.62 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

0a9466aa25af983e06e08780120919a48911d83ae9b160263827abcaf384e3d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://www.mediafire.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 18 Dec 2025 14:06:03 GMT
server: Kestrel
server-processing-duration-in-ticks: 386999
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding
x-robots-tag: noindex

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3B26 0
0 337ms
337ms Fetch
image/gif 172.253.122.156
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=fle-fetch-start2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f156.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 18 Dec 2025 14:06:03 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3B26 0
0 322ms
321ms Fetch
image/gif 172.253.122.156
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f156.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 18 Dec 2025 14:06:03 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 3B26 0
0 142ms
141ms Fetch
image/gif 172.253.62.154
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvJP8AAqp4hdEa0Bm3hF36uMdzzOFHvSFRABs-prXsP4oAJyAi8qpaU18l59mINyacAxEB-pZE9l12Jtqn-j_SGVucZMobmMzajDerZQoc-E1FVlrRFa4QRE3STOMBS2GkXv1e3tNgS-LYWlxxmn2LdJe9vbj7unAovzjZQlfe1f-82skRiBRNKoMDGnIdidgrLrshV2Z34mKlcZ4quPLCSmwHE9OVGTbE3XTyQeLsToo4QzUsiwWab8tPZvFC1w_Vq-GEx_cQuJ7p71bIJDSlvgd1K3VtCLKi8IbPcqxGNeEspdMvEblsfiWBEoN7UpHGlVBqqPD-PYxbq8I-e_Cn324XQHL9k0iYaRK2-4L2HWeO_oviupGiszwZ3KDd3wQ_NGeyP-0bkE7wQx1m7jSiG04Onspfd95Yii4p9FaLi2YVx1b6-tCoGLoYAi0nE-avIXz7XRViEIN_u&sai=AMfl-YRHTHxYwSTDQOt8ormqXaHfam6oKLBum_8wHj38rFnBjCxKvTqbPTPRuOanbayAABppu6bQmvgmIRiNYw2qpePgRIuXpG3O2y0DdwITIS30Zqwk6WOrAzFCZNqwr1X-BmDr_nlkY2KtDM9DkBnwDKtRRh7YuwQ16TK2BWgBkz6hzhkYtG47C9ncxa-9mWE_mFtXZXAzMtEoetoAFfHwp7Q-GC7bdfLlJ_crCInoHhBzrxJr3RzAcbt5dsHS3cnKWFfp9otwCCjs8zl4zPzxX_9iqkvICmc&sig=Cg0ArKJSzDhLd9vUoz2QEAE&uach_m=%5BUACH%5D&adurl=

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.62.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bc-in-f154.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Thu, 18 Dec 2025 14:06:03 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Thu, 18 Dec 2025 14:06:03 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9033 0
0 368ms
112ms Fetch
image/gif 172.253.122.156
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=fle-fetch-start2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f156.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 18 Dec 2025 14:06:04 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9033 0
0 357ms
112ms Fetch
image/gif 172.253.122.156
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f156.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 18 Dec 2025 14:06:04 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 9033 0
0 92ms
91ms Fetch
image/gif 172.253.62.154
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsu67lSkSlBwlJC_Q8j_s07GLOms5l9RX1TCh7AcdOmaCUtNLyS42J3eDLyU6lbMRqD5-MHUauHkczRE8bmHadIFYIrNZMCHkRaLdvPTuZ3aEJV2eYxkZbis8ISUnzr-9deMED5NRbzQSW4-BpEVYlyFn09x4HlZ0zoeRya7vuEcmTLEGOHoDP00bUIXABgdWkqjRXkWE3SJtHrAc_KFgBq0QkNcWvasJrE9zQTFl6EOVzIbqzsWdvvZJ4nVNZ-3gh-D9Q0gxd1I4oQoQo-4kRQSsBJvC0zGKSi2ZByrXSzY3XuD6JJzaWxHgtJxq3U_AqQv560E9Fc53mHDw3mLmzTouZALSaWMHL23RO_vrqq6XmaGh4x8iXByyDXGYgr0tHXTs6xvc5cLXoezX9TmO4G6GaocKO7xEg7q9LGrWQr-jvATps5vgEmsNd-J&sai=AMfl-YRME7_q0tDPwj4zzeKAaTjHDrCFgCWdZnFkpU-5vnPEyD_igdA_vcCa-30xgOtBu21hFmSFsNw0tFi7JYZ1czx6pTwOJXeM5ANZhT0V_yfh_fPlGs8MJwEDjXo0CcS9_A3YG2ycImaWBQ34i42Z4m1q330FoV2XXlpRNJYRY3EDPotE7GD9KRu5LIB8r7_K-N6cab6bz1lExXVxb6sFYBxg3VSvwqw586uDrJRq4t9pvU4qC12Ud9d42rU3hGZrspTTs5ZP8gvWo1WJahZkeMJvXTLhc5E&sig=Cg0ArKJSzD8aiNwCVp98EAE&uach_m=%5BUACH%5D&adurl=

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.62.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bc-in-f154.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Thu, 18 Dec 2025 14:06:03 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Thu, 18 Dec 2025 14:06:03 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame BA03 0
0 447ms
89ms Fetch
image/gif 172.253.122.156
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=fle-fetch-start2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f156.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 18 Dec 2025 14:06:04 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame BA03 0
0 439ms
94ms Fetch
image/gif 172.253.122.156
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f156.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 18 Dec 2025 14:06:04 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame BA03 0
0 90ms
90ms Fetch
image/gif 172.253.62.154
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuPXPIvLF3zyFsxv2Vry1EHYGd3CyQf3lBGYpZyaXlZJOSK0cM1XDSO7dyx1-mXvBpzYUT4B8tEVV-x3AXHdDRS9I2ZDuhvT1kg8kD5cbutIz6NJ3x8ZiS4ltZvRZXtb2y9jtcZX7_98g1_PoRlwQuQSUFFFX4u92216l-XdYGZd4WikFH2irdj08Sp2BB3T-uVvr0HF6zPkFIx9wAbbajARm2RM1r6e_0goQHkaf7OIXcdmusM0Kl6dt5OAOHxsWnN5dcA2FMI7rF3ZoL_CUSvLR-LlUKgLkwngfAKqGD6OukG4ODAhSiLJoTOgv82P4SxtARG2LQC8tleKoaK1fdeEDr_1dV0TgAw0g1Fv6uCHMODJsqC0Z7bVtdtz0BHwK5j1fduCDi_2rHm-wR2lwJvA_xYlZtHZOyQbJuFzkhmkoDsn1cWZWaLS7wc&sai=AMfl-YTdcSwkPFrvhoukMcUVWUTn5SlsxcsUrXvkpSS1tiWIx88ammHqWNXiWGgZ0qCKscEtlcgL9V6HTKYG-x4DuYzs9WdAwTwq3P5Hd04vTEc645rhvq1xD1xTiRJ4lYa0mI2PfSF5U2wo7tPWk9R8rZOAvDAHvdGogCVY4S2TFsfrSenGcvTgkzsoyH1KK0TjU4ITOlFdlydzt8g1zsPmrvhocIeyU_UNVnaH1frbXzbVP-uLVo2QK3xTCzRPbbgLRn_ZP1X2HZ45PRyrVUZuJIUzVqQTtQbt&sig=Cg0ArKJSzJfQPhrQHRw6EAE&uach_m=%5BUACH%5D&adurl=

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.62.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bc-in-f154.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Thu, 18 Dec 2025 14:06:03 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Thu, 18 Dec 2025 14:06:03 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 87D9 0
0 453ms
118ms Fetch
image/gif 172.253.122.156
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=fle-fetch-start2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f156.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 18 Dec 2025 14:06:04 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 87D9 0
0 442ms
114ms Fetch
image/gif 172.253.122.156
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f156.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 18 Dec 2025 14:06:04 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 87D9 0
0 96ms
95ms Fetch
image/gif 172.253.62.154
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjst6FZVqVOYPrT93WeCa2rZeDGZwMTbsWMkc17m6UMsToIkj2vfYtJ_keoYjDzD0-8ReyH1qS7UvNSCNUA2IFRATt8GfjuWjTIgHiIVbk9YRU3t2SPUgtJMb-Tm2t1C_jd9JfcUTlFN215O0Ln09pa8W0kRMCXGdrN5-cseb18_lveL7qCbCmAqndbggjmAaEiRoPxSOL67OfMBbMjcyDbaJqdDqC9Ejd4qsIDzmop6Z5527qHBtay4IR4gdCRt814DjtxTmFTrVzW2CPU0KF27xjUb4urUCmjHVKWwzSD12BVJx5Y8p_z7dLQL47XjwGP5tfmEX6G9gTAuct_czzHEi-1JukkmVqpOtiDi7iLDTMUWJi3wSjzSDKs1K6e2-r38fx_pYqwH9pOAxJ471nw0GPFUGcvrb1-MvMhmjaBMo2XYw30MAEKRBvOyr&sai=AMfl-YRYi9P2eMoDpK6MDm04xJ9tUmOtiY1LHC7bKDWL4NK25Rl8iajII4VJiS78R925AtyT2BCidnI3f7KQexJoK30f20G2VKJb_yTsirorfou4lHYVBFrpQLSN39K-3TtByBKbFwL8q7pv8zEv9fDswRLIauZx4lC7gu_GbREtDzU8rXoaoLcthvYQ6FFdJ-xLlQKao2diEz-1SYGvoZiAPEW53zBeMR72H0L4nK-sXB3ISfB3OmtYB6cbFEaLRiQ-myJRxPokfM438Rv4UrSCFycwT7g0Dnc&sig=Cg0ArKJSzICF85IjN4tNEAE&uach_m=%5BUACH%5D&adurl=

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.62.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bc-in-f154.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Thu, 18 Dec 2025 14:06:03 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Thu, 18 Dec 2025 14:06:03 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 5339
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEDeIPrQH2xUMbP0WW8_1jlQ&google_cver=1

43 B
136 B

96ms
90ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEDeIPrQH2xUMbP0WW8_1jlQ&google_cver=1
Requested by: Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://google-bidout-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 84.17.63.56
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 18 Dec 2025 14:06:03 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: no-cache, must-revalidate
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEDeIPrQH2xUMbP0WW8_1jlQ&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 295
date: Thu, 18 Dec 2025 14:06:04 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame 5339 170 B
409 B 371ms
215ms Image
image/png 142.251.179.154
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=Zjg1ZmYyZGUtZGZmOC0yZWE5LWM3MGItYzc1ODY4MzA1ODIz

Requested by

Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.179.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

pd-in-f154.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://google-bidout-d.openx.net/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 18 Dec 2025 14:06:04 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 5339
Redirect Chain

https://match.adsrvr.org/track/cmf/openx?oxid=d4302114-168f-700d-d2eb-9de1a2d29643&gdpr=0
https://match.adsrvr.org/track/cmb/openx?oxid=d4302114-168f-700d-d2eb-9de1a2d29643&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072971&val=15c528ed-4f5e-4918-8ca0-b3e31751f8dc&ttd_puid=d4302114-168f-700d-d2eb-9de1a2d29643&gdpr=0&gdpr_consent=

43 B
97 B

112ms
111ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072971&val=15c528ed-4f5e-4918-8ca0-b3e31751f8dc&ttd_puid=d4302114-168f-700d-d2eb-9de1a2d29643&gdpr=0&gdpr_consent=
Requested by: Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://google-bidout-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 84.17.63.56
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 18 Dec 2025 14:06:04 GMT
content-type: image/gif
vary: Accept

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?id=537072971&val=15c528ed-4f5e-4918-8ca0-b3e31751f8dc&ttd_puid=d4302114-168f-700d-d2eb-9de1a2d29643&gdpr=0&gdpr_consent=
content-length: 335
date: Thu, 18 Dec 2025 14:06:04 GMT
server: Kestrel

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 5339
Redirect Chain

https://ups.analytics.yahoo.com/ups/58934/cms
https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-QMXVFHVE2p.JAO_9Uz_1XcyUWZFiDlrTIFM-~A

43 B
97 B

171ms
170ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-QMXVFHVE2p.JAO_9Uz_1XcyUWZFiDlrTIFM-~A
Requested by: Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://google-bidout-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 84.17.63.56
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 18 Dec 2025 14:06:03 GMT
content-type: image/gif
vary: Accept

Redirect headers

strict-transport-security: max-age=31536000
location: https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-QMXVFHVE2p.JAO_9Uz_1XcyUWZFiDlrTIFM-~A
age: 0
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Thu, 18 Dec 2025 14:06:04 GMT
content-type: text/html
server: ATS

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 5339
Redirect Chain

https://ad.turn.com/r/cs?pid=9&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537073061&val=4408571704014064884&gdpr=0&gdpr_consent=&us_privacy=

43 B
97 B

85ms
81ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073061&val=4408571704014064884&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://google-bidout-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 84.17.63.56
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 18 Dec 2025 14:06:04 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://us-u.openx.net/w/1.0/sd?id=537073061&val=4408571704014064884&gdpr=0&gdpr_consent=&us_privacy=
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Thu, 18 Dec 2025 14:06:03 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3B26 0
0 123ms
123ms Fetch
image/gif 172.253.122.156
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f156.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 18 Dec 2025 14:06:03 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9033 0
0 216ms
111ms Fetch
image/gif 172.253.122.156
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f156.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 18 Dec 2025 14:06:04 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame BA03 0
0 295ms
93ms Fetch
image/gif 172.253.122.156
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f156.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 18 Dec 2025 14:06:04 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 87D9 0
0 408ms
115ms Fetch
image/gif 172.253.122.156
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f156.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 18 Dec 2025 14:06:04 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2

404

264.gif
id5-sync.com/k/
Redirect Chain

https://id5-sync.com/i/457/8.gif?o=api&id5id=ID5*soDvnHT7lNlBNmzlrcJFgoKmng7naInlu4BUi2xvFQz__2lECktaAAEBCmlECkoAcC7AU3PVxeZOeREPLdr8Kw&gdpr_consent=&gdpr=false&gpp=DBABJg%7EBFoAAEA.QA&gpp_sid=
https://match.adsrvr.org/track/cmf/generic?ttd_pid=8h9u11h&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmb/generic?ttd_pid=8h9u11h&ttd_tpi=1&gdpr=0&gdpr_consent=
https://id5-sync.com/k/264.gif?puid=766c71ed-5734-4f6e-a0bf-9bf96284fcea&ttl=%%TTL%%

43 B
43 B

207ms
207ms

Image
text/html

162.19.138.83
OVH OVH SAS

General

Check archive.org

Download Go to Show image

Full URL

https://id5-sync.com/k/264.gif?puid=766c71ed-5734-4f6e-a0bf-9bf96284fcea&ttl=%%TTL%%

Requested by

Host: www.mediafire.com
URL: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file

Protocol

Server

162.19.138.83 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ns31532338.ip-162-19-138.eu

Software

Resource Hash

5f789ccae156b160492d89a6146b1974d15128790b74abb995d8e89fa44cde5e

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
content-encoding: gzip
date: Thu, 18 Dec 2025 14:06:04 GMT
content-type: text/html;charset=utf-8
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding

Redirect headers

location: https://id5-sync.com/k/264.gif?puid=766c71ed-5734-4f6e-a0bf-9bf96284fcea&ttl=%%TTL%%
content-length: 199
date: Thu, 18 Dec 2025 14:06:04 GMT
server: Kestrel

POST
H2 200 v3 Show response
id5-sync.com/gm/ 2 KB
3 KB 379ms
378ms XHR
application/json 162.19.138.83
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/gm/v3

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.83 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ns31532338.ip-162-19-138.eu

Software

Resource Hash

af9a29c74549115b55d144b669ff05dee9da36402330d4698784646cd4a9f2dc

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://www.mediafire.com/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://www.mediafire.com
p3p: CP="CAO PSA OUR"
date: Thu, 18 Dec 2025 14:06:04 GMT
content-type: application/json
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers

GET
H3 200 favicon.ico Show response
ad.doubleclick.net/ 1 KB
129 B 78ms
78ms Fetch
image/x-icon 142.251.16.149
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.5418917370788676

Requested by

Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f149.1e100.net

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Fri, 19 Dec 2025 14:06:03 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 18 Dec 2025 14:06:03 GMT
content-type: image/x-icon
vary: Accept-Encoding
last-modified: Tue, 08 May 2012 13:08:06 GMT
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 json Show response
gum.criteo.com/sid/ Frame B491 433 B
897 B 91ms
91ms Fetch
application/json 74.119.117.62
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=publishertagids&domain=www.mediafire.com&sn=ChromeSyncframe&so=0&topUrl=www.mediafire.com

Requested by

Host: gum.criteo.com
URL: https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=www.mediafire.com&gdpr=0&gdpr_consent=&gpp=DBABJg~BFoAAEA.QA&gpp_sid=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.62 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

0dd80ebc680bd180ebd89db806f8e4d0b7206e61728c5e07f10f0bf382ad972d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=www.mediafire.com&gdpr=0&gdpr_consent=&gpp=DBABJg~BFoAAEA.QA&gpp_sid=

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
server-processing-duration-in-ticks: 1226967
expires: 0
date: Thu, 18 Dec 2025 14:06:03 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

GET

/
csync.loopme.me/
Redirect Chain

https://id5-sync.com/i/457/8.gif?o=api&id5id=ID5*43CfjiUL5MsQxhz3_DI1kNNW7hy2mPn36nAkmT2fZR7__2lECkxaAAEBCmlECkoAcC6nIsB-HkbXtHHN9GoCCg&gdpr_consent=&gdpr=false&gpp=DBABJg%7EBFoAAEA.QA&gpp_sid=
https://rtb.gumgum.com/getuid/id5?r=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F441%2F7%2F2.gif%3Fpuid%3D%5BUID%5D%26gdpr%3D0%26gdpr_consent%3D%26gpp%3DDBABJg%7EBFoAAEA.QA%26gpp_sid%3D&gdpr=0&gdpr_consent=
https://id5-sync.com/c/457/441/7/2.gif?puid=u_e5a9b008-d27d-474a-a11a-f5dda15da3c9&gdpr=0&gdpr_consent=&gpp=DBABJg~BFoAAEA.QA&gpp_sid=
https://match.prod.bidr.io/cookie-sync/id5?us_privacy=
https://match.prod.bidr.io/cookie-sync/id5?us_privacy=&_bee_ppp=1
https://id5-sync.com/k/155.gif?puid=AAEjI07SiBUAAAIMnCGOvA&id5AccountNum=155&numCascadesAllowed=9
https://ice.360yield.com/match?publisher_dsp_id=313&dsp_callback=1&external_user_id=ID5-c515pU5KcJCDskx8d5srUxNApzbdV0xqNYoivdrLpQ&r=https%3A%2F%2Fid5-sync.com%2Fcq%2F457%2F124%2F5%2F4.gif%3Fpuid%3...
https://ice.360yield.com/ul_cb/match?publisher_dsp_id=313&dsp_callback=1&external_user_id=ID5-c515pU5KcJCDskx8d5srUxNApzbdV0xqNYoivdrLpQ&r=https%3A%2F%2Fid5-sync.com%2Fcq%2F457%2F124%2F5%2F4.gif%3F...
https://id5-sync.com/cq/457/124/5/4.gif?puid=1cec6150-05c4-4fe8-bc6b-dd3e2eb99cae&gdpr=0&gdpr_consent=&gdpr=0&gdpr_consent=
https://csync.loopme.me/?redirect=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F821%2F4%2F5.gif%3Fpuid%3D%7Bdevice_id%7D%26gdpr%3D0%26gdpr_consent%3D

0
0

GET
H2 200 targeting Show response
na.edge.optable.co/v2/ 386 B
504 B 66ms
65ms Fetch
application/json 34.54.78.238
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://na.edge.optable.co/v2/targeting?id=__passport__&id=id5%3AID5*lOJ71FKZAJFnVPiti6DRyqTECkbBCh2tneLAw0oNgUT__2lECkxaAAEBCmlECkoAcC7jWg-2HOmWj3-AIWEo9g&ab_test_id=all&osdk=web-v0.45.0&sid=MApdZoIhTLnlzCwrJEA5Zg&t=ezoic&o=ez-mediafire-com&cookies=no&passport=eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InY6M2NENWFJaFVBQXM4Q2JSN1RpaXdtYyIsIm5ldyI6dHJ1ZSwiZXhwIjoxNzY4NjU4NzYyfQ.PiFxn8kH-g3lkR5qfGZ1SPgkxJB3dSaGWMmPmbeV8lQRDBBI-jiqY5O720hrcxaxU1jPRAQHNMnq7je0zfAPzw
Requested by: Host: solutions.cdn.optable.co
URL: https://solutions.cdn.optable.co/ezoic/sdk.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.54.78.238 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 238.78.54.34.bc.googleusercontent.com
Software: /
Resource Hash: bebf06b6a6e41615e394a03873af6c9da1bda463d97f0e5503491fa1a5e0e177

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Accept: application/json
Referer: https://www.mediafire.com/

Response headers

access-control-expose-headers: X-Optable-Visitor
content-encoding: gzip
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://www.mediafire.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 411
date: Thu, 18 Dec 2025 14:06:04 GMT
content-type: application/json; charset=utf-8
vary: Origin, Accept-Encoding

GET
H3 200 favicon.ico Show response
ad.doubleclick.net/ 1 KB
129 B 76ms
76ms Fetch
image/x-icon 142.251.16.149
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.2908897040762788

Requested by

Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f149.1e100.net

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Fri, 19 Dec 2025 14:06:04 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 18 Dec 2025 14:06:04 GMT
content-type: image/x-icon
vary: Accept-Encoding
last-modified: Tue, 08 May 2012 13:08:06 GMT
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
163 B 45ms
45ms Fetch
image/gif 104.20.47.80
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=2&e=0.9693817796368569
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.47.80 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 462008
x-goog-stored-content-encoding: identity
expires: Fri, 19 Dec 2025 14:06:04 GMT
x-goog-stored-content-length: 43
date: Thu, 18 Dec 2025 14:06:04 GMT
content-type: image/gif
vary: accept-encoding
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH8-sCmg1Zb6o0oOvulTNK1T2AoyyoaNKi_PGA5iJaaVy0v7GqbzieOx8PXbGN9_TCDlvU7S5l0U
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9aff37fdee5d6429-DEN
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

OPTIONS
H3 204 witness
na.edge.optable.co/ Frame 0
0 126ms
69ms Preflight 34.54.78.238
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://na.edge.optable.co/witness?osdk=web-v0.45.0&sid=MApdZoIhTLnlzCwrJEA5Zg&t=ezoic&o=ez-mediafire-com&cookies=no&passport=eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InY6M2NENWFJaFVBQXM4Q2JSN1RpaXdtYyIsIm5ldyI6ZmFsc2UsImV4cCI6MTc2ODY1ODc2NH0.fFXWnA-BjC3CIOnjhzl_SpyuIKxrqb_xGVbMwqLAkRrigzYAGggyJzj-eeabzs3uVLzT6bZLKl0O-4YiXLlUIg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.54.78.238 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 238.78.54.34.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.mediafire.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin,Content-Length,Content-Type,X-Forwarded-For,X-Optable-Visitor
access-control-allow-methods: GET,POST,PUT,PATCH,DELETE,HEAD
access-control-allow-origin: https://www.mediafire.com
access-control-max-age: 43200
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 18 Dec 2025 14:06:04 GMT
vary: Origin Access-Control-Request-Method Access-Control-Request-Headers
via: 1.1 google

POST
H3 200 witness Show response
na.edge.optable.co/ 222 B
267 B 56ms
54ms Fetch
application/json 34.54.78.238
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://na.edge.optable.co/witness?osdk=web-v0.45.0&sid=MApdZoIhTLnlzCwrJEA5Zg&t=ezoic&o=ez-mediafire-com&cookies=no&passport=eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InY6M2NENWFJaFVBQXM4Q2JSN1RpaXdtYyIsIm5ldyI6ZmFsc2UsImV4cCI6MTc2ODY1ODc2NH0.fFXWnA-BjC3CIOnjhzl_SpyuIKxrqb_xGVbMwqLAkRrigzYAGggyJzj-eeabzs3uVLzT6bZLKl0O-4YiXLlUIg
Requested by: Host: solutions.cdn.optable.co
URL: https://solutions.cdn.optable.co/ezoic/sdk.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.54.78.238 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 238.78.54.34.bc.googleusercontent.com
Software: /
Resource Hash: 1030f5b751dc8b44ec6d068c5c293be1618219fb8b6cfb4ebe65d868af591e36

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Content-Type: application/json
Referer: https://www.mediafire.com/

Response headers

access-control-expose-headers: X-Optable-Visitor
content-encoding: gzip
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://www.mediafire.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 247
date: Thu, 18 Dec 2025 14:06:04 GMT
content-type: application/json; charset=utf-8
vary: Origin, Accept-Encoding

POST
H3 200 witness Show response
na.edge.optable.co/ 222 B
267 B 59ms
55ms Fetch
application/json 34.54.78.238
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://na.edge.optable.co/witness?osdk=web-v0.45.0&sid=Kkw2dVMuXqUc8keYzv6dfw&t=ezoic&o=ez-mediafire-com&ro=true&cookies=no&passport=eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InY6M2NENWFJaFVBQXM4Q2JSN1RpaXdtYyIsIm5ldyI6ZmFsc2UsImV4cCI6MTc2ODY1ODc2NH0.fFXWnA-BjC3CIOnjhzl_SpyuIKxrqb_xGVbMwqLAkRrigzYAGggyJzj-eeabzs3uVLzT6bZLKl0O-4YiXLlUIg
Requested by: Host: solutions.cdn.optable.co
URL: https://solutions.cdn.optable.co/ezoic/sdk.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.54.78.238 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 238.78.54.34.bc.googleusercontent.com
Software: /
Resource Hash: f0c8316566a9655e5c0690d100df3081b3ab4a24692875353bc0961fe94f0829

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Content-Type: application/json
Referer: https://www.mediafire.com/

Response headers

access-control-expose-headers: X-Optable-Visitor
content-encoding: gzip
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://www.mediafire.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 247
date: Thu, 18 Dec 2025 14:06:04 GMT
content-type: application/json; charset=utf-8
vary: Origin, Accept-Encoding

OPTIONS
H3 204 witness
na.edge.optable.co/ Frame 0
0 109ms
54ms Preflight 34.54.78.238
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://na.edge.optable.co/witness?osdk=web-v0.45.0&sid=Kkw2dVMuXqUc8keYzv6dfw&t=ezoic&o=ez-mediafire-com&ro=true&cookies=no&passport=eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InY6M2NENWFJaFVBQXM4Q2JSN1RpaXdtYyIsIm5ldyI6ZmFsc2UsImV4cCI6MTc2ODY1ODc2NH0.fFXWnA-BjC3CIOnjhzl_SpyuIKxrqb_xGVbMwqLAkRrigzYAGggyJzj-eeabzs3uVLzT6bZLKl0O-4YiXLlUIg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.54.78.238 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 238.78.54.34.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.mediafire.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin,Content-Length,Content-Type,X-Forwarded-For,X-Optable-Visitor
access-control-allow-methods: GET,POST,PUT,PATCH,DELETE,HEAD
access-control-allow-origin: https://www.mediafire.com
access-control-max-age: 43200
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 18 Dec 2025 14:06:04 GMT
vary: Origin Access-Control-Request-Method Access-Control-Request-Headers
via: 1.1 google

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 3B26 42 B
65 B 145ms
144ms Fetch
image/gif 172.253.122.156
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvJzB6KFWaqBI21vE4gLCtXjFxDX0tM1zRb_YZqR0c11Zoa2j3ICS_E7qpeMCxdNGp9tlFwIFzuWmS4ozBQRtZrW3rQ_tcqZ4NeYooVUOFDo_DXg0wzfvfikxrWrlJb42cXIajURZ_qAOqaWsLP5_c-EZWbsvtLj0nD6lqkBDaOW7XBqYYbLMxxtXM&sig=Cg0ArKJSzIhUp2rnFiGmEAE&id=lidar2&mcvt=1000&p=1110,436,1200,1164&tm=1019.3999977111816&tu=19.599998474121094&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20251210&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=3&adk=3109985067&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=6199956300&rst=1766066762321&rpt=1353&isd=0&lsd=0&met=mue&wmsd=0&pbe=0&fle=0&vae=0&spb=0&sfl=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f156.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Thu, 18 Dec 2025 14:06:04 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 9033 42 B
65 B 150ms
141ms Fetch
image/gif 172.253.122.156
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstZ-iG60Cw3-V_E4XOZRfPifbnLUFbZvxuX6WCUdR2HjxAJfYJMZ_NPc2aRdgmk2TcNSLUaBa_RA68XVZn1F5nLKWop_u8zplbzUM_I4eNMZPRUXOSNciXiq6IxM_lYD7u0OAkj6buuktiLCC8ZoKqC84lyYqNWhinScFRxc2NQPXo3WTVIrWgqwqA&sig=Cg0ArKJSzG5A97wTAj8GEAE&id=lidar2&mcvt=1000&p=120,320,400,656&tm=1093.7999992370605&tu=93.5999984741211&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20251210&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=3&adk=3841872593&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=6199956300&rst=1766066762430&rpt=1287&isd=0&lsd=0&met=mue&wmsd=0&pbe=0&fle=0&vae=0&spb=0&sfl=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f156.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Thu, 18 Dec 2025 14:06:04 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame BA03 42 B
65 B 149ms
138ms Fetch
image/gif 172.253.122.156
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvH8U2f9PaC6HHlHxTYjJ3yMitkFjBQV-SRxv0nAZF84o-vKPR6tUbiDb4eJFw27GlYrAH0vwejc6z6uRtExtR1-OIKlBmvtxy8AAeUVb-DajLGcRLHrwPqXPewmK6bksLdsWGAj8UfgshivuvWLhXy6xeXr-C4H28wHRWpcnItMyY_Xs2L7NPengU&sig=Cg0ArKJSzBZ29WZsc_VwEAE&id=lidar2&mcvt=1007&p=10,552,100,1280&tm=1060.900001525879&tu=53.900001525878906&mtos=1007,1007,1007,1007,1007&tos=1007,0,0,0,0&v=20251210&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=3&adk=630197753&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=6199956300&rst=1766066762481&rpt=1275&isd=0&lsd=0&met=mue&wmsd=0&pbe=0&fle=0&vae=0&spb=0&sfl=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f156.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Thu, 18 Dec 2025 14:06:04 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 87D9 42 B
65 B 148ms
137ms Fetch
image/gif 172.253.122.156
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstUwqIOl9tNrrW397aXeDgVZT_7GMFmgvkjKZASrvhzZ0TS5LJOviNHPUupi4YAWzF93tjEhxNK7PjWyitAm7MO5bhnm3JGe-qPo9igHcLHXo9FCfE07c5df_l7y1OaJfGOyW5fxsYdhnNC3mBNS96jynpInDjDLWH5CtAWmLLzoyo3JYEuICDNIyI&sig=Cg0ArKJSzJ02Jf_d4GpTEAE&id=lidar2&mcvt=1011&p=420,320,670,620&tm=1021.0999984741211&tu=9.799999237060547&mtos=1011,1011,1011,1011,1011&tos=1011,0,0,0,0&v=20251210&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=3&adk=1870779098&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=6199956300&rst=1766066762369&rpt=1432&isd=0&lsd=0&met=mue&wmsd=0&pbe=0&fle=0&vae=0&spb=0&sfl=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f156.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Thu, 18 Dec 2025 14:06:04 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame B83B 21 KB
7 KB 357ms
173ms Document
text/html 23.221.241.44
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158936&gdpr=0&gdpr_consent=
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/js/prebid10.10.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.221.241.44 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-221-241-44.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 5b6ceeffb380eae16e91dcf08a3493068aa5b7bd6f4c3f4ad7b4daa188d5c2cb

Request headers

Referer: https://www.mediafire.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=43068
content-encoding: gzip
content-length: 7259
content-type: text/html
date: Thu, 18 Dec 2025 14:06:05 GMT
expires: Fri, 19 Dec 2025 02:03:53 GMT
last-modified: Mon, 29 Sep 2025 15:12:50 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H3 200 favicon.ico Show response
ad.doubleclick.net/ 1 KB
129 B 84ms
83ms Fetch
image/x-icon 142.251.16.149
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.9834847381797973

Requested by

Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f149.1e100.net

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

content-encoding: gzip
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Fri, 19 Dec 2025 14:06:04 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 18 Dec 2025 14:06:04 GMT
content-type: image/x-icon
vary: Accept-Encoding
last-modified: Tue, 08 May 2012 13:08:06 GMT
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
111 B 45ms
44ms Fetch
image/gif 104.20.47.80
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=2&e=0.6866708151752963
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.47.80 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 462008
x-goog-stored-content-encoding: identity
expires: Fri, 19 Dec 2025 14:06:04 GMT
x-goog-stored-content-length: 43
date: Thu, 18 Dec 2025 14:06:04 GMT
content-type: image/gif
vary: accept-encoding
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH8-sCmg1Zb6o0oOvulTNK1T2AoyyoaNKi_PGA5iJaaVy0v7GqbzieOx8PXbGN9_TCDlvU7S5l0U
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9aff3800bd8f6429-DEN
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H2 200 geo Show response
ut.pubmatic.com/ Frame B83B 39 B
147 B 588ms
230ms XHR
application/json 8.28.7.105
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL

https://ut.pubmatic.com/geo?pubid=158936

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158936&gdpr=0&gdpr_consent=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

8.28.7.105 , United States, ASN62713 (AS-PUBMATIC, US),

Reverse DNS

Software

Resource Hash

c9f013481117e8e4017a5b2aa8bca599ce890b736ee4e2f75fbd48b9483405bb

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

strict-transport-security: max-age=16070400; includeSubDomains
access-control-allow-origin: *
cache-control: max-age=172800
content-length: 39
date: Thu, 18 Dec 2025 14:06:05 GMT
content-type: application/json

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
163 B 47ms
46ms Fetch
image/gif 104.20.47.80
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=2&e=0.24482565123026878
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.47.80 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 462009
x-goog-stored-content-encoding: identity
expires: Fri, 19 Dec 2025 14:06:05 GMT
x-goog-stored-content-length: 43
date: Thu, 18 Dec 2025 14:06:05 GMT
content-type: image/gif
vary: accept-encoding
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: ABgVH8-sCmg1Zb6o0oOvulTNK1T2AoyyoaNKi_PGA5iJaaVy0v7GqbzieOx8PXbGN9_TCDlvU7S5l0U
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9aff3803ce356429-DEN
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H2 200 geo Show response
ut.pubmatic.com/ Frame B83B 39 B
0 492ms
492ms XHR
application/json 8.28.7.105
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://ut.pubmatic.com/geo?pubid=158936
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158936&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.105 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: c9f013481117e8e4017a5b2aa8bca599ce890b736ee4e2f75fbd48b9483405bb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

access-control-allow-origin: *
cache-control: max-age=172800
content-length: 39
date: Thu, 18 Dec 2025 14:06:05 GMT
content-type: application/json

GET
H2 200 country Show response
api.btloader.com/ 37 B
153 B 93ms
83ms Fetch
application/json 130.211.23.194
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://api.btloader.com/country?o=5678961798414336
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.23.194 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 194.23.211.130.bc.googleusercontent.com
Software: /
Resource Hash: b8f0ca68362cf245f891fc09ddfa50806d195e78e196cf96ac5d9cf72be2577a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cache-control: private, max-age=300, stale-while-revalidate=600, stale-if-error=600
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37
date: Thu, 18 Dec 2025 14:06:05 GMT
content-type: application/json
vary: Origin

POST
H2 204 pv
api.btloader.com/ 0
0 296ms
280ms Fetch 130.211.23.194
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://api.btloader.com/pv?nlf=false&tid=rgiPUoms-JZiF75B50-9b31c82bda&sid=hCxMIQElFx-oN3JVXxuwQ-9b31c82bda&cv=2.1.172-2-g720cec0&upapi=true
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.23.194 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 194.23.211.130.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

via: 1.1 google
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 18 Dec 2025 14:06:05 GMT
vary: Origin

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame B83B 2 KB
3 KB 424ms
147ms Script
text/html 8.28.7.81
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL

https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=4017284&p=158936&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158936&gdpr=0&gdpr_consent=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

8.28.7.81 , United States, ASN62713 (AS-PUBMATIC, US),

Reverse DNS

Software

Resource Hash

ce0ce825dde97636b8539cec2bafd1b2d823369118c534a6b06da8080a5d900e

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

strict-transport-security: max-age=16070400; includeSubDomains
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 18 Dec 2025 14:06:06 GMT
content-type: text/html; charset=UTF-8

GET
H2

200

match Show response
c1.adform.net/serving/cookie/ Frame 8689
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=14&cid=140AEBBA-51AC-4910-8B0A-192900D0CE33&gdpr=0&gdpr_consent=
https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=140AEBBA-51AC-4910-8B0A-192900D0CE33&gdpr=0&gdpr_consent=

35 B
590 B

175ms
173ms

Document
image/gif

185.167.164.38
ADFORM Adform A/S

General

Check archive.org

Download Go to

Full URL

https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=140AEBBA-51AC-4910-8B0A-192900D0CE33&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158936&gdpr=0&gdpr_consent=

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

185.167.164.38 , Denmark, ASN198622 (ADFORM Adform A/S, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36

Response headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-type: image/gif
date: Thu, 18 Dec 2025 14:06:07 GMT
expires: -1
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

Redirect headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-length: 0
date: Thu, 18 Dec 2025 14:06:07 GMT
expires: -1
location: https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=140AEBBA-51AC-4910-8B0A-192900D0CE33&gdpr=0&gdpr_consent=
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame B89E
Redirect Chain

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:123768C091264034ADD91CF9B0FB5C24

42 B
576 B

189ms
182ms

Document
image/gif

207.65.32.88
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL

https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:123768C091264034ADD91CF9B0FB5C24

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158936&gdpr=0&gdpr_consent=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

207.65.32.88 , United States, ASN62713 (AS-PUBMATIC, US),

Reverse DNS

Software

nginx /

Resource Hash

1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400; includeSubDomains

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Thu, 18 Dec 2025 14:06:07 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx
strict-transport-security: max-age=16070400; includeSubDomains

Redirect headers

access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
cache-control: no-cache
content-length: 142
content-type: text/html
date: Thu, 18 Dec 2025 14:06:07 GMT
expires: Wed, 17 Dec 2025 14:06:07 GMT
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:123768C091264034ADD91CF9B0FB5C24
server: openresty
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff

GET
H/1.1

200

dcm Show response
s.amazon-adsystem.com/ Frame 21B5
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=140AEBBA-51AC-4910-8B0A-192900D0CE33&redir=true&gdpr=0&gdpr_consent=
https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=140AEBBA-51AC-4910-8B0A-192900D0CE33&redir=true&gdpr=0&gdpr_consent=&dcc=t

43 B
853 B

201ms
200ms

Document
image/gif

98.82.157.231
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=140AEBBA-51AC-4910-8B0A-192900D0CE33&redir=true&gdpr=0&gdpr_consent=&dcc=t

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158936&gdpr=0&gdpr_consent=

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

98.82.157.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-98-82-157-231.compute-1.amazonaws.com

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Thu, 18 Dec 2025 14:06:07 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: 06GHT894E278R9NW7XK1

Redirect headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Date: Thu, 18 Dec 2025 14:06:07 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Location: https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=140AEBBA-51AC-4910-8B0A-192900D0CE33&redir=true&gdpr=0&gdpr_consent=&dcc=t
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: H5XC0XMH51015C70YE9H

GET
H2 200 141 Show response
match.deepintent.com/usersync/ Frame ECB7 0
339 B 795ms
186ms Document
image/gif 38.91.45.7
COGENT-174

General

Check archive.org

Download Go to

Full URL: https://match.deepintent.com/usersync/141?gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158936&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 38.91.45.7 Ashburn, United States, ASN174 (COGENT-174, US),
Reverse DNS
Software: a /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36

Response headers

content-length: 0
content-type: image/gif
date: Thu, 18 Dec 2025 14:06:07 GMT
p3p: policyref='http://cdn.deepintent.com/p3p.xml', CP='NON CUR DEV TAI'
server: a

GET
H/1.1 200
OK u Show response
user-sync.fwmrm.net/ad/ Frame 185B 43 B
504 B 733ms
126ms Document
image/gif 3.144.50.131
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://user-sync.fwmrm.net/ad/u?mode=user-register&dspid=64&dspuid=140AEBBA-51AC-4910-8B0A-192900D0CE33&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&_fw_is_lat=&_fw_atts=&_fw_coppa=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158936&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 3.144.50.131 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-144-50-131.us-east-2.compute.amazonaws.com
Software: /
Resource Hash: 2ddeade3a8991666b89f2a0c3aaba4508852838488781e260d45bc886f1172a5

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36

Response headers

Cache-Control: no-store
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Thu, 18 Dec 2025 14:06:07 GMT
Expires: 0
Keep-Alive: timeout=300
P3P: policyref="https://www.freewheel.tv/w3c/p3p.xml",CP="ALL DSP COR NID"
Pragma: no-cache
X-Fw-Request-Id: umo0fe7_1766066767412137614

GET

log
tracookiepixel.xyz/ Frame 7CFB
Redirect Chain

https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFFakkwN1NpQlVBQUFJTW5DR092QQ&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&bee_sync_partners=sas%2Cdtech%2Cpp%2Cpm&be...
https://match.prod.bidr.io/cookie-sync/adx?gdpr=0&gdpr_consent=&gpp=&gpp_sid=&bee_sync_partners=sas%2Cdtech%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1
https://rtb-csync.smartadserver.com/redir?partneruserid=AAEjI07SiBUAAAIMnCGOvA&partnerid=127&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26bee_sync_partners%3Ddtech%252Cpp%25...
https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=dtech%2Cpp%2Cpm&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=2&userid=57042088526515756&gdpr=0&gdpr_consent=
https://tracookiepixel.xyz/log?c_uid=None&cust_id=None&bdsp_uid=AAEjI07SiBUAAAIMnCGOvA&key=af004bf9e3af8f9275b3bf8945e895b6446bf14bb0f1b0b93afc00ed40ac348c&gdpr=0

0
0

GET
H2 200 140AEBBA-51AC-4910-8B0A-192900D0CE33 Show response
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame 6CF5 179 KB
179 KB 788ms
188ms Document
image/gif 54.81.14.247
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://pr-bh.ybp.yahoo.com/sync/pubmatic/140AEBBA-51AC-4910-8B0A-192900D0CE33?gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158936&gdpr=0&gdpr_consent=

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.81.14.247 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-81-14-247.compute-1.amazonaws.com

Software

ATS /

Resource Hash

bcb502a62b191fd44c1ce1a1dc4fca39d2cd32157242a56a22702e5be8709aa0

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36

Response headers

age: 0
content-length: 43
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
content-type: image/gif
date: Thu, 18 Dec 2025 14:06:07 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-frame-options: DENY

GET
H2

200

demconf.jpg
dpm.demdex.net/ Frame B83B
Redirect Chain

https://dpm.demdex.net/ibs:dpid=19566&dpuuid=140AEBBA-51AC-4910-8B0A-192900D0CE33
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=19566&dpuuid=140AEBBA-51AC-4910-8B0A-192900D0CE33

42 B
717 B

183ms
182ms

Image
image/gif

52.45.156.78
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=19566&dpuuid=140AEBBA-51AC-4910-8B0A-192900D0CE33

Requested by

Host: www.mediafire.com
URL: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file

Protocol

Server

52.45.156.78 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-45-156-78.compute-1.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-va6-1-v082-0fb1f6869.edge-va6.demdex.com 3 ms
content-encoding: gzip
pragma: no-cache
x-content-type-options: nosniff
x-tid: MlErADU+Q+I=
expires: Thu, 01 Jan 1970 00:00:00 UTC
content-length: 59
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Thu, 18 Dec 2025 14:06:07 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
location: https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=19566&dpuuid=140AEBBA-51AC-4910-8B0A-192900D0CE33
dcs: dcs-prod-va6-2-v082-09e705885.edge-va6.demdex.com 0 ms
pragma: no-cache
x-tid: N+SV6CtVSg8=
expires: Thu, 01 Jan 1970 00:00:00 UTC
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Thu, 18 Dec 2025 14:06:07 GMT

GET
H2

200

db_sync
px.ads.linkedin.com/ Frame B83B
Redirect Chain

https://idsync.rlcdn.com/420486.gif?partner_uid=140AEBBA-51AC-4910-8B0A-192900D0CE33
https://idsync.rlcdn.com/1000.gif?memo=CIbVGRIwCiwIARCMowEaJDE0MEFFQkJBLTUxQUMtNDkxMC04QjBBLTE5MjkwMEQwQ0UzMxAAGg0Iz5SQygYSBQjoBxAAQgBKAA
https://pippio.com/api/sync?pid=5324&it=1&iv=58e7722cf22f7c33c6632d853e10963344ce4f8bcf5b0c3e6738a77e108d63b7791426b5417dce21&_=2
https://px.ads.linkedin.com/db_sync?pid=10339&puuid=58e7722cf22f7c33c6632d853e10963344ce4f8bcf5b0c3e6738a77e108d63b7791426b5417dce21&rand=05706163
https://px.ads.linkedin.com/db_sync?pid=10339&puuid=58e7722cf22f7c33c6632d853e10963344ce4f8bcf5b0c3e6738a77e108d63b7791426b5417dce21&rand=05706163&expected_cookie=ab7eeb2f-3222-4a96-bb78-330696d1e995

0
146 B

106ms
104ms

Image
text/plain

150.171.22.12
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://px.ads.linkedin.com/db_sync?pid=10339&puuid=58e7722cf22f7c33c6632d853e10963344ce4f8bcf5b0c3e6738a77e108d63b7791426b5417dce21&rand=05706163&expected_cookie=ab7eeb2f-3222-4a96-bb78-330696d1e995
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file
Protocol: H2
Server: 150.171.22.12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: 4D53DF61E0BB4DDDB50D53E8179EC615 Ref B: BY1AA1072317062 Ref C: 2025-12-18T14:06:08Z
x-li-fabric: prod-lor1
x-li-uuid: AAZGOnZboaXY4d0H9HN83w==
x-li-proto: http/2
alt-svc: h3=":443"; ma=86400
x-cache: CONFIG_NOCACHE
content-length: 0
date: Thu, 18 Dec 2025 14:06:07 GMT

Redirect headers

linkedin-action: 1
x-li-pop: afd-prod-lor1-x
location: /db_sync?pid=10339&puuid=58e7722cf22f7c33c6632d853e10963344ce4f8bcf5b0c3e6738a77e108d63b7791426b5417dce21&rand=05706163&expected_cookie=ab7eeb2f-3222-4a96-bb78-330696d1e995
x-msedge-ref: Ref A: 02AD4CBD38B9448298BAF89ECE2AE5B6 Ref B: BY1AA1072317062 Ref C: 2025-12-18T14:06:07Z
x-li-fabric: prod-lor1
x-li-uuid: AAZGOnZYh8b/wBY9htXFEQ==
x-li-proto: http/2
alt-svc: h3=":443"; ma=86400
x-cache: CONFIG_NOCACHE
content-length: 0
date: Thu, 18 Dec 2025 14:06:07 GMT

GET

setuid
ib.adnxs.com/ Frame B83B
Redirect Chain

https://pixel.onaudience.com/?partner=214&mapped=140AEBBA-51AC-4910-8B0A-192900D0CE33&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=
https://ib.adnxs.com/setuid?entity=145&code=NrGB8F9IYWVTMabYWjnXWWnh&gdpr=0

0
0

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame B83B
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=MTQwQUVCQkEtNTFBQy00OTEwLThCMEEtMTkyOTAwRDBDRTMz&gdpr=0&gdpr_consent=&google_cm
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEC4BqQFOx1BY2NfB4kdcnnY&google_cver=1

42 B
300 B

694ms
185ms

Image
image/gif

207.65.32.88
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL

https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEC4BqQFOx1BY2NfB4kdcnnY&google_cver=1

Requested by

Host: www.mediafire.com
URL: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file

Protocol

Server

207.65.32.88 , United States, ASN62713 (AS-PUBMATIC, US),

Reverse DNS

Software

nginx /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

strict-transport-security: max-age=16070400; includeSubDomains
cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 18 Dec 2025 14:06:07 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

cache-control: no-cache, must-revalidate
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEC4BqQFOx1BY2NfB4kdcnnY&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 379
date: Thu, 18 Dec 2025 14:06:06 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame B83B
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=FArrulGsSRCLChkpANDOMw%3D%3D&gdpr=0&gdpr_consent=&google_cm
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_gid=CAESEPptBhDw7GHPI4YnBqHjGDM&google_cver=1

21 KB
21 KB

268ms
266ms

Image
text/html

23.221.241.44
AKAMAI-AS

General

Check archive.org

Download Go to Show image

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_gid=CAESEPptBhDw7GHPI4YnBqHjGDM&google_cver=1
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file
Protocol: H2
Server: 23.221.241.44 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-221-241-44.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: max-age=43067
content-encoding: gzip
expires: Fri, 19 Dec 2025 02:03:53 GMT
accept-ranges: bytes
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 7259
date: Thu, 18 Dec 2025 14:06:06 GMT
last-modified: Mon, 29 Sep 2025 15:12:50 GMT
content-type: text/html
server: Apache
vary: Accept-Encoding

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_gid=CAESEPptBhDw7GHPI4YnBqHjGDM&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 362
date: Thu, 18 Dec 2025 14:06:06 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame B83B
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEC4BqQFOx1BY2NfB4kdcnnY&google_cver=1

42 B
98 B

865ms
168ms

Image
image/gif

207.65.32.88
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL

https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEC4BqQFOx1BY2NfB4kdcnnY&google_cver=1

Requested by

Host: www.mediafire.com
URL: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file

Protocol

Server

207.65.32.88 , United States, ASN62713 (AS-PUBMATIC, US),

Reverse DNS

Software

nginx /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

strict-transport-security: max-age=16070400; includeSubDomains
cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 18 Dec 2025 14:06:07 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

cache-control: no-cache, must-revalidate
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEC4BqQFOx1BY2NfB4kdcnnY&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 379
date: Thu, 18 Dec 2025 14:06:06 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame B83B
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=766c71ed-5734-4f6e-a0bf-9bf96284fcea&gdpr=0&gdpr_consent=

42 B
570 B

699ms
187ms

Image
image/gif

207.65.32.88
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL

https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=766c71ed-5734-4f6e-a0bf-9bf96284fcea&gdpr=0&gdpr_consent=

Requested by

Host: www.mediafire.com
URL: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file

Protocol

Server

207.65.32.88 , United States, ASN62713 (AS-PUBMATIC, US),

Reverse DNS

Software

nginx /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

strict-transport-security: max-age=16070400; includeSubDomains
cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 18 Dec 2025 14:06:07 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=766c71ed-5734-4f6e-a0bf-9bf96284fcea&gdpr=0&gdpr_consent=
content-length: 355
date: Thu, 18 Dec 2025 14:06:06 GMT
server: Kestrel

GET
DATA 200
OK truncated
/ Frame 6CF5 3 KB
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 04d05978fdb111358073ab0524e5c1fafc0826615c206987618416b8bd8a4747

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 6CF5 5 KB
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e4222715b556e7d99622c83e620d2f8e090047e56adb07923047f95828d561f2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 6CF5 155 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7808605ddd1f0eaa454aa444293d2f0260943e51e53838fca46506e6a69fe521

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

POST
H2 204 collect
analytics.google.com/g/ 0
0 169ms
167ms Fetch
text/plain 142.251.167.100
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-K68XP6D85D&gtm=45je5ca1v887485693za20gzb6304663zd6304663&_p=1766066759305&gcd=13l3l3l3l1l1&npa=0&_ng=1&dma=0&tcfd=10000&cid=1935627807.1766066762&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=AEIAAAQ&tag_exp=103116026~103200004~104527907~104528501~104684208~104684211~105391253~115583767~115938465~115938468~116184927~116184929~116251938~116251940&sid=1766066761&sct=1&seg=0&dl=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fqxgu7p6f5ea5fve%2FMinecraft%2BDungeons%2Bv1.17.0.0.zip%2Ffile&dt=Minecraft%20Dungeons%20v1.17.0.0&_s=2&tfd=8698
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-K68XP6D85D&cx=c&gtm=4e5ca1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.251.167.100 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: ww-in-f100.1e100.net
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://www.mediafire.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:170:0
report-to: {"group":"ascnsrsggc:170:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:170:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.mediafire.com
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:170:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 18 Dec 2025 14:06:07 GMT
content-type: text/plain
server: Golfe2

GET SPug
simage4.pubmatic.com/AdServer/ Frame B83B 0
0

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame B83B 2 KB
3 KB 170ms
169ms Script
text/html 8.28.7.81
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL

https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=80686218&p=158936&s=0&a=0&ptask=ALL&np=0&fp=0&rp=1&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158936&gdpr=0&gdpr_consent=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

8.28.7.81 , United States, ASN62713 (AS-PUBMATIC, US),

Reverse DNS

Software

Resource Hash

eac2aabc9f8268462f0432e402dde959ea32117c4d598f438abf96afcb1f11ce

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

strict-transport-security: max-age=16070400; includeSubDomains
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 18 Dec 2025 14:06:09 GMT
content-type: text/html; charset=UTF-8

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame B987
Redirect Chain

https://ups.analytics.yahoo.com/ups/58917/cms?uid=140AEBBA-51AC-4910-8B0A-192900D0CE33&gpp=&gpp_sid=&us_privacy=&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQwNjQmdGw9NDMyMDA=&piggybackCookie=y-MgHH_rZE2oDIKPUJDe20L6l8eQ0ClIqYt6Mgz2w-~A&gdpr=0

42 B
436 B

86ms
83ms

Document
image/gif

207.65.32.88
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL

https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQwNjQmdGw9NDMyMDA=&piggybackCookie=y-MgHH_rZE2oDIKPUJDe20L6l8eQ0ClIqYt6Mgz2w-~A&gdpr=0

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158936&gdpr=0&gdpr_consent=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

207.65.32.88 , United States, ASN62713 (AS-PUBMATIC, US),

Reverse DNS

Software

nginx /

Resource Hash

1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400; includeSubDomains

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Thu, 18 Dec 2025 14:06:09 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx
strict-transport-security: max-age=16070400; includeSubDomains

Redirect headers

age: 0
content-length: 0
content-type: text/html
date: Thu, 18 Dec 2025 14:06:09 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQwNjQmdGw9NDMyMDA=&piggybackCookie=y-MgHH_rZE2oDIKPUJDe20L6l8eQ0ClIqYt6Mgz2w-~A&gdpr=0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
referrer-policy: no-referrer-when-downgrade
server: ATS
strict-transport-security: max-age=31536000
x-content-type-options: nosniff

GET
H2

200

SPug Show response
image4.pubmatic.com/AdServer/ Frame 7EFD
Redirect Chain

https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=140AEBBA-51AC-4910-8B0A-192900D0CE33&redir=true&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-6JJX4VRE2uWhx.z.linNL65pNIJiWeE-~A&gdpr=0&us_privacy=

0
287 B

97ms
82ms

Document
text/plain

207.65.37.182

General

Check archive.org

Download Go to

Full URL

https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-6JJX4VRE2uWhx.z.linNL65pNIJiWeE-~A&gdpr=0&us_privacy=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158936&gdpr=0&gdpr_consent=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

207.65.37.182 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400; includeSubDomains

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
date: Thu, 18 Dec 2025 14:06:09 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx
strict-transport-security: max-age=16070400; includeSubDomains

Redirect headers

age: 0
content-length: 0
content-type: text/html
date: Thu, 18 Dec 2025 14:06:09 GMT
location: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-6JJX4VRE2uWhx.z.linNL65pNIJiWeE-~A&gdpr=0&us_privacy=
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
referrer-policy: no-referrer-when-downgrade
server: ATS
strict-transport-security: max-age=31536000
x-content-type-options: nosniff

GET pixel-pubmatic
www.temu.com/api/adx/cm/ Frame 358C 0
0

GET generic
sync.ipredictive.com/d/sync/cookie/ Frame A6E6 0
0

GET current
pubmatic-match.dotomi.com/match/bounce/ Frame EF43 0
0

GET sync
sync.srv.stackadapt.com/ Frame 3467 0
0

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 5678
Redirect Chain

https://ib.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA%3D%26piggybackCookie%3D%24UID%26gdpr%3D0%26gdpr_consent...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=6401843043709241418&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=

42 B
299 B

87ms
86ms

Document
image/gif

207.65.32.88
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL

https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=6401843043709241418&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158936&gdpr=0&gdpr_consent=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

207.65.32.88 , United States, ASN62713 (AS-PUBMATIC, US),

Reverse DNS

Software

nginx /

Resource Hash

1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400; includeSubDomains

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Thu, 18 Dec 2025 14:06:09 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx
strict-transport-security: max-age=16070400; includeSubDomains

Redirect headers

accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
access-control-allow-origin: *
an-x-request-uuid: 69c72921-7f15-467b-b01c-7bb0820058e8
cache-control: no-store, no-cache, private
content-length: 0
content-type: text/html; charset=utf-8
date: Thu, 18 Dec 2025 14:06:09 GMT
expires: Sat, 15 Nov 2008 16:00:00 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=6401843043709241418&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
pragma: no-cache
server: nginx/1.25.5
x-proxy-origin: 84.17.63.56; 84.17.63.56; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
x-xss-protection: 0

GET
H2

200

b9pj45k4
sync-tm.everesttech.net/ct/upi/pid/ Frame C13E
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=0&gdpr_con...
https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=0&gdpr_...

0
0

42ms
41ms

Document
image/png

151.101.2.49

General

Check archive.org

Download Go to

Full URL: https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=0&gdpr_consent=&_test=aUQKUQAK4KUI9wBL
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158936&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.2.49 -, , ASN (),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 1644
cache-control: no-cache
content-length: 85
content-type: image/png
date: Thu, 18 Dec 2025 14:06:09 GMT
pragma: no-cache
server: Jetty(9.4.35.v20201120)
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 4020
x-robots-tag: noindex
x-served-by: cache-den-kden1300038-DEN
x-timer: S1766066770.689151,VS0,VE0

Redirect headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: no-cache
content-length: 0
date: Thu, 18 Dec 2025 14:06:09 GMT
location: https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=0&gdpr_consent=&_test=aUQKUQAK4KUI9wBL
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
pragma: no-cache
server: Jetty(9.4.35.v20201120)
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-robots-tag: noindex
x-served-by: cache-den-kden1300038-DEN
x-timer: S1766066770.562623,VS0,VE44

GET CookieSyncPubMatic&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=
rtb.adentifi.com/ Frame E5B0 0
0

GET
H2 204 pubmatic
tr.blismedia.com/v1/api/sync/ Frame 4DE3 0
0 219ms
81ms Document
text/plain 34.96.105.8

General

Check archive.org

Download Go to

Full URL: https://tr.blismedia.com/v1/api/sync/pubmatic
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158936&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.105.8 -, , ASN (),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 18 Dec 2025 14:06:09 GMT
via: 1.1 google

GET

15927723
sg.semasio.net/sync/1/ Frame B83B
Redirect Chain

https://uipglob.semasio.net/pubmatic/1/info?sType=sync&sExtCookieId=140AEBBA-51AC-4910-8B0A-192900D0CE33&sInitiator=external&gdpr=0&gdpr_consent=
https://uipglob.semasio.net/pubmatic/1/info2?sType=sync&sExtCookieId=140AEBBA-51AC-4910-8B0A-192900D0CE33&sInitiator=external&gdpr=0&gdpr_consent=
https://sg.semasio.net/sync/1/15927723?&gdpr=0&gdpr_consent=&sInitiator=external&sExtCookieId=140AEBBA-51AC-4910-8B0A-192900D0CE33

0
0

GET g.pixel
aa.agkn.com/adscores/ Frame B83B 0
0

GET
H2 200 qmap
sync.crwdcntrl.net/ Frame B83B 49 B
268 B 447ms
216ms Image
image/gif 54.90.8.2

General

Check archive.org

Download Go to Show image

Full URL

https://sync.crwdcntrl.net/qmap?c=240&tp=PUBM&tpid=140AEBBA-51AC-4910-8B0A-192900D0CE33&gdpr=0&gdpr_consent=

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.90.8.2 -, , ASN (),

Reverse DNS

Software

Resource Hash

2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains
cache-control: no-cache
pragma: no-cache
expires: 0
access-control-allow-origin: *
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 49
date: Thu, 18 Dec 2025 14:06:09 GMT
content-type: image/gif

GET
H3

200

receive
pixel.tapad.com/idsync/ex/ Frame B83B
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_id=3371&partner_device_id=140AEBBA-51AC-4910-8B0A-192900D0CE33
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3371&partner_device_id=140AEBBA-51AC-4910-8B0A-192900D0CE33
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=933b3f62-7a84-4772-abbb-49692189fe48%252C%252C&gdpr=0&gdpr_consent=
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=766c71ed-5734-4f6e-a0bf-9bf96284fcea&ttd_puid=933b3f62-7a84-4772-abbb-49692189fe48%2C%2C

95 B
123 B

86ms
85ms

Image
image/png

34.111.113.62

General

Check archive.org

Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=766c71ed-5734-4f6e-a0bf-9bf96284fcea&ttd_puid=933b3f62-7a84-4772-abbb-49692189fe48%2C%2C

Protocol

Server

34.111.113.62 -, , ASN (),

Reverse DNS

Software

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

strict-transport-security: max-age=31536000
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 95
date: Thu, 18 Dec 2025 14:06:09 GMT
content-type: image/png

Redirect headers

location: https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=766c71ed-5734-4f6e-a0bf-9bf96284fcea&ttd_puid=933b3f62-7a84-4772-abbb-49692189fe48%2C%2C
content-length: 359
date: Thu, 18 Dec 2025 14:06:09 GMT
server: Kestrel

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: csync.loopme.me
URL: https://csync.loopme.me/?redirect=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F821%2F4%2F5.gif%3Fpuid%3D%7Bdevice_id%7D%26gdpr%3D0%26gdpr_consent%3D

Domain: tracookiepixel.xyz
URL: https://tracookiepixel.xyz/log?c_uid=None&cust_id=None&bdsp_uid=AAEjI07SiBUAAAIMnCGOvA&key=af004bf9e3af8f9275b3bf8945e895b6446bf14bb0f1b0b93afc00ed40ac348c&gdpr=0

Domain: ib.adnxs.com
URL: https://ib.adnxs.com/setuid?entity=145&code=NrGB8F9IYWVTMabYWjnXWWnh&gdpr=0

Domain: simage4.pubmatic.com
URL: https://simage4.pubmatic.com/AdServer/SPug?partnerID=158936&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=

Domain: www.temu.com
URL: https://www.temu.com/api/adx/cm/pixel-pubmatic?id=140AEBBA-51AC-4910-8B0A-192900D0CE33&gdpr=0&gdpr_consent=&us_privacy=

Domain: sync.ipredictive.com
URL: https://sync.ipredictive.com/d/sync/cookie/generic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=${ADELPHIC_CUID}&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=

Domain: pubmatic-match.dotomi.com
URL: https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=140AEBBA-51AC-4910-8B0A-192900D0CE33&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=

Domain: sync.srv.stackadapt.com
URL: https://sync.srv.stackadapt.com/sync?nid=11&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=

Domain: rtb.adentifi.com
URL: https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=

Domain: sg.semasio.net
URL: https://sg.semasio.net/sync/1/15927723?&gdpr=0&gdpr_consent=&sInitiator=external&sExtCookieId=140AEBBA-51AC-4910-8B0A-192900D0CE33

Domain: aa.agkn.com
URL: https://aa.agkn.com/adscores/g.pixel?sid=9212308278&puid=140AEBBA-51AC-4910-8B0A-192900D0CE33

Verdicts & Comments Add Verdict or Comment

358 JavaScript Window variables

These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.

117 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip	1969-12-31 23:59:59	Name: g36FastPopSessionRequestNumber Value: 1
.mediafire.com/	1970-01-21 20:10:26	Name: ukey Value: iuafhq0u4p4nj956fqopqz29vowjdtrf
.mediafire.com/	1970-01-21 11:17:38	Name: conv_tracking_data-2 Value: %7B%22mf_source%22%3A%22regular_download-59%22%2C%22mf_content%22%3A%22Free%22%2C%22mf_medium%22%3A%22linux%5C%2FChrome%22%2C%22mf_campaign%22%3A%22qxgu7p6f5ea5fve%22%2C%22mf_term%22%3A%222ab0a916bb51a1e18e7eafdcdf1e7d55%22%7D
.mediafire.com/	1970-01-21 10:34:28	Name: __cf_bm Value: LIAujNQdTap6vNtFURv8JawZ3.6PTQWBclrQdH0oEa8-1766066758-1.0.1.1-pySjfzPidgNmz.qFSTR_h22R9sXD7FD.IMmEw5DqQYrtC5M7JbrI6ZYBj8hTZSHKbFDQn6tWKMKKMMrPLumFILD5zOk9q8BhlMqMLNEOI_s
www.mediafire.com/	1970-01-21 19:20:02	Name: gppChoices Value: DBABJg~BFoAAEA.QA
www.mediafire.com/	1970-01-21 10:44:31	Name: chkout_src Value: eyJ0ZW1wbGF0ZUlkIjoiNTkifQ%3D%3D
.mediafire.com/	1970-01-21 10:37:19	Name: ezovuuidtime_484470 Value: 1766066760
.mediafire.com/	1970-01-21 10:34:28	Name: lp_484470 Value: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file
.mediafire.com/	1970-01-21 10:34:28	Name: ezovuuid_484470 Value: 7c0338ea-2abb-451a-46b6-7e6b7cc07152
.mediafire.com/	1970-01-21 10:34:28	Name: ezoref_484470 Value:
.mediafire.com/	1970-01-21 10:37:19	Name: active_template::484470 Value: orig_site.1766066760
www.mediafire.com/	1970-01-21 10:37:19	Name: ezstandaloneuser Value: false
econventa.com/	1969-12-31 23:59:59	Name: IKSR Value: %7B%7D
econventa.com/	1969-12-31 23:59:59	Name: INF_DFL8 Value: false
econventa.com/	1970-01-21 20:10:26	Name: IUID Value: 59368a64-1cec-465d-8223-b0bf5d8b7f5f
econventa.com/	1969-12-31 23:59:59	Name: ISSH Value: 801D0E
econventa.com/	1969-12-31 23:59:59	Name: VMI Value:
econventa.com/	1970-01-21 20:10:26	Name: IPLH Value: %23%7B%7D
econventa.com/	1970-01-21 20:10:26	Name: IPLH_Q Value: %23%5B%5D
econventa.com/	1970-01-21 20:10:26	Name: CHN Value: %23%5B%5D
econventa.com/	1970-01-21 20:10:26	Name: MSSH Value: %23%7B%7D
econventa.com/	1970-01-21 20:10:26	Name: MSRH Value: %23%7B%7D
econventa.com/	1970-01-21 20:10:26	Name: ILP Value: null
econventa.com/	1970-01-21 20:10:26	Name: ILPLU Value: %2301%2F01%2F0001%2000%3A00%3A00
econventa.com/	1970-01-21 20:10:26	Name: ILEALC Value: %2301%2F01%2F0001%2000%3A00%3A00
econventa.com/	1970-01-21 10:34:41	Name: ILMPF Value: %23False
econventa.com/	1970-01-21 20:10:26	Name: IPMPLU Value: %2301%2F01%2F0001%2000%3A00%3A00
econventa.com/	1970-01-21 20:10:26	Name: IPMUID Value: %23
econventa.com/	1970-01-21 20:10:26	Name: BSWUID Value: %23
econventa.com/	1970-01-21 20:10:26	Name: IBL Value: %23%5B%5D
econventa.com/	1970-01-21 20:10:26	Name: IOPT Value: %23%5B%5D
econventa.com/	1970-01-21 20:10:26	Name: IPLSH Value: %23%7B%7D
econventa.com/	1970-01-21 20:10:26	Name: IPLSH_Q Value: %23%5B%5D
econventa.com/	1970-01-21 20:10:26	Name: IZH Value: %23%7B%7D
econventa.com/	1970-01-21 20:10:26	Name: IZH_Q Value: %23%5B%5D
econventa.com/	1970-01-21 20:10:26	Name: IMCH Value: %23%7B%7D
econventa.com/	1970-01-21 20:10:26	Name: IMCH_Q Value: %23%5B%5D
econventa.com/	1970-01-21 20:10:26	Name: IMH Value: %23%7B%7D
econventa.com/	1970-01-21 20:10:26	Name: IMH_Q Value: %23%5B%5D
econventa.com/	1970-01-21 20:10:26	Name: ISH Value: %23%7B%22101%22%3A%5B%7B%22SId%22%3A%22801D0E%22%2C%22D%22%3A%2225%2F12%2F18T14%3A6%3A0%22%7D%5D%7D
econventa.com/	1970-01-21 20:10:26	Name: ISH_Q Value: %23%5B101%5D
econventa.com/	1970-01-21 20:10:26	Name: ISPH Value: %23%7B%7D
econventa.com/	1970-01-21 20:10:26	Name: ISPH_Q Value: %23%5B%5D
econventa.com/	1970-01-21 20:10:26	Name: ICH Value: %23%7B%7D
econventa.com/	1970-01-21 20:10:26	Name: ICH_Q Value: %23%5B%5D
.mediafire.com/	1970-01-21 19:20:02	Name: cf_clearance Value: 1q5XrUekRk1SlLycV9PAs8hRVt8rNlVScLf6fn3se7A-1766066761-1.2.1.1-sp.i0vPFpUSeHEOi8Kofasu7rMxZdpUkHhdpnCYMfbvRB.vjjSpjSUr1GNLuQUFjx5RanOee5ZSGjEd4HSsduilkURyMMe40iACqLog1.U58vMapftxT356NAkI_1oCZkUwsUjwqJV54VosUaFIcHS.Xzk_OQmdZSopzXazXmy6ckwU9ZK_YMMvixRRYJDwPL8FIv8ozfQGD3MO431YftlXd2gVg5QW12hJ6BW9m9rM
.mediafire.com/	1970-01-21 19:20:02	Name: amp_28916b Value: 8XCGZkbOj7Lu-1qSKzRbh8...1jcosgbf6.1jcosgbf8.0.1.1
.mediafire.com/	1970-01-21 20:10:26	Name: _ga Value: GA1.2.1935627807.1766066762
.mediafire.com/	1970-01-21 10:35:53	Name: _gid Value: GA1.2.1614063198.1766066762
.mediafire.com/	1970-01-21 10:34:26	Name: _gat_gtag_UA_829541_1 Value: 1
.mediafire.com/	1970-01-21 10:34:28	Name: ezopvc_484470 Value: 2
www.mediafire.com/	1970-01-21 20:10:26	Name: ezds Value: ffid%3D1%2Cw%3D1600%2Ch%3D1200
www.mediafire.com/	1970-01-21 20:10:26	Name: ezohw Value: w%3D1600%2Ch%3D1200
www.mediafire.com/	1970-01-21 11:17:38	Name: _ez_optable_enabled_90 Value: true
.mediafire.com/	1970-01-21 19:56:02	Name: __gads Value: ID=ac074e0c6271e503:T=1766066761:RT=1766066761:S=ALNI_MZzJuUtSqGK-FIcKZS0mYOubvhNrQ
.mediafire.com/	1970-01-21 19:56:02	Name: __gpi Value: UID=0000131cecd8d747:T=1766066761:RT=1766066761:S=ALNI_MabLR73roB2BwVaehQPqslOEGLT-g
.mediafire.com/	1970-01-21 14:53:38	Name: __eoi Value: ID=1b62efa762943833:T=1766066761:RT=1766066761:S=AA-AfjYUnL1EofK5VWV-a1wsFABv
.openx.net/	1970-01-21 19:20:02	Name: i Value: 079c1e4d-bf08-4ffa-883d-5509c6f5a5be\|1766066762
.mediafire.com/	1970-01-21 20:10:26	Name: _ga_K68XP6D85D Value: GS2.1.s1766066761$o1$g0$t1766066762$j59$l0$h0
.doubleclick.net/	1970-01-21 20:10:26	Name: IDE Value: AHWqTUn4y_czEaJ3kg0ewJ2naiuo1Opz6NgHBPbD2olftqQtf3XnV-vwVTB69NUYycI
.openx.net/	1970-01-21 10:56:02	Name: pd Value: v2\|1766066763\|gyvMkWxhhE
.crwdcntrl.net/	1970-01-21 17:03:14	Name: _cc_id Value: 883ba6743d6551edf5871e887b9f440c
.yahoo.com/	1970-01-21 19:20:24	Name: A3 Value: d=AQABBEsKRGkCEAHve4UfqQtr9JzMxfTtPc0FEgEBAQFbRWlNadws0iMA_eMDAA&S=AQAAAgO5no1fbU9aWsX5bbr-4c4
.mediafire.com/	1970-01-21 10:34:26	Name: lotame_domain_check Value: mediafire.com
.mediafire.com/	1970-01-21 17:03:14	Name: _cc_id Value: 883ba6743d6551edf5871e887b9f440c
.mediafire.com/	1970-01-21 10:44:31	Name: panoramaId_expiry Value: 1766671563511
.mediafire.com/	1970-01-21 10:44:31	Name: panoramaId Value: a47bb5dce1889997aa1579b1bbe4185ca02c7076eba53c80b386921e6ead934c
.mediafire.com/	1970-01-21 10:44:31	Name: panoramaIdType Value: panoDevice
.mediafire.com/	1970-01-21 19:20:02	Name: connectId Value: {"ttl":86400000,"lastUsed":1766066763890,"lastSynced":1766066763890}
.criteo.com/	1970-01-21 19:56:02	Name: uid Value: 897d7d8d-44a8-4418-8fbb-6367c8e9d119
.criteo.com/	1970-01-21 19:56:02	Name: cto_bundle Value: 7q99dF9BVFVQTzdUR2Q4JTJGcTA1cWFuYnZXZnI1RmRtWnVZSmFQQ1RVZUZVUTVUcTg2JTJGZ0dPWVZiaEFlUXdtTHNzakdSY1VqQmtTbnhveDFQQjhZJTJGS3NrdXhCNlNwcVJGSlhRWWRNazRmRkF1amFSR0tUSFdORUZyS20wVHVQMmdzOWU3JTJGSzVETG9zZXJaYklWRkpUV2YwNjJOUSUzRCUzRA
.analytics.yahoo.com/	1970-01-21 19:20:02	Name: IDSYNC Value: 19h2~2t7q
.turn.com/	1970-01-21 14:53:38	Name: uid Value: 4408571704014064884
.id5-sync.com/	1970-01-21 12:44:02	Name: id5 Value: 62a92d8c-9375-7a1e-a291-e335aa672265#1766066762714#3
.adsrvr.org/	1970-01-21 19:20:02	Name: TDID Value: 766c71ed-5734-4f6e-a0bf-9bf96284fcea
.gumgum.com/	1970-01-21 19:20:02	Name: vst Value: u_e5a9b008-d27d-474a-a11a-f5dda15da3c9
.bidr.io/	1970-01-21 20:02:56	Name: bito Value: AAEjI07SiBUAAAIMnCGOvA
.bidr.io/	1970-01-21 20:02:56	Name: bitoIsSecure Value: ok
.pubmatic.com/	1970-01-21 19:20:02	Name: KADUSERCOOKIE Value: 140AEBBA-51AC-4910-8B0A-192900D0CE33
.pubmatic.com/	1970-01-21 12:44:02	Name: chkChromeAb67Sec Value: 1
.pubmatic.com/	1970-01-21 10:35:53	Name: pi Value: 158936:2
.pubmatic.com/	1970-01-21 12:44:02	Name: DPSync4 Value: 1767225600%3A219_197%7C1768608000%3A102%7C1766620800%3A164
.pubmatic.com/	1970-01-21 12:44:02	Name: SyncRTB4 Value: 1767225600%3A201_21_281_166_71_220_13_54_250_231
.adsrvr.org/	1970-01-21 19:20:02	Name: TDCPM Value: CAESFwoIcHVibWF0aWMSCwiUr7nrk5LfPhAFGAEgASgCMgsI6qO8mKqS3z4QBTgBWghwdWJtYXRpY2AC
.360yield.com/	1970-01-21 12:44:02	Name: tuuid Value: 1cec6150-05c4-4fe8-bc6b-dd3e2eb99cae
.360yield.com/	1970-01-21 12:44:02	Name: tuuid_lu Value: 1766066766
.simpli.fi/	1970-01-21 19:21:29	Name: suid Value: 123768C091264034ADD91CF9B0FB5C24
.rlcdn.com/	1970-01-21 19:20:02	Name: rlas3 Value: +t9FLgyRDQDeNksYccaCTSHvZ7AvRS6g22vy19Z8cOY=
.fwmrm.net/	1970-01-21 14:53:38	Name: _uid Value: umo0fe7_7585836931704774280
.adform.net/	1970-01-21 11:19:05	Name: C Value: 1
.demdex.net/	1970-01-21 14:53:38	Name: demdex Value: 53934818342730664500318593983619282439
.360yield.com/	1970-01-21 12:44:02	Name: um Value: !313,IWFzFw.P721R1osd0tG9cOf3ZFtlwkvLPdJLJEkVpjEt5MJZwgfAQbPD0e75NYKjp6C0JPWxdp9Gtk0iqbqG8JpVS5x39y5Dd.mXWuIq8WO0KcEx,1773842767
.360yield.com/	1970-01-21 12:44:02	Name: umeh Value: !313,0,1828274767,-1
.deepintent.com/	1970-01-21 20:10:26	Name: CDIUSER Value: di_668cad3a2861a485a980d
.deepintent.com/	1970-01-21 20:10:26	Name: CDIPARTNERS Value: %7B%221%22%3A%2220251218%22%7D
.rlcdn.com/	1970-01-21 12:00:50	Name: pxrc Value: CM+UkMoGEgUI6AcQABIFCOhHEAA=
.adform.net/	1970-01-21 12:00:50	Name: uid Value: 354236161351170007
.pubmatic.com/	1970-01-21 11:17:38	Name: KRTBCOOKIE_148 Value: 19421-uid:123768C091264034ADD91CF9B0FB5C24&KRTB&23486-uid:123768C091264034ADD91CF9B0FB5C24&KRTB&23489-uid:123768C091264034ADD91CF9B0FB5C24&KRTB&23539-uid:123768C091264034ADD91CF9B0FB5C24
.pubmatic.com/	1970-01-21 11:17:38	Name: PugT Value: 1766066767
.pubmatic.com/	1970-01-21 12:44:02	Name: KRTBCOOKIE_80 Value: 16514-CAESEC4BqQFOx1BY2NfB4kdcnnY&KRTB&22987-CAESEC4BqQFOx1BY2NfB4kdcnnY&KRTB&23025-CAESEC4BqQFOx1BY2NfB4kdcnnY&KRTB&23386-CAESEC4BqQFOx1BY2NfB4kdcnnY
.dpm.demdex.net/	1970-01-21 14:53:38	Name: dpm Value: 53934818342730664500318593983619282439
.pubmatic.com/	1970-01-21 12:44:02	Name: KRTBCOOKIE_377 Value: 6810-766c71ed-5734-4f6e-a0bf-9bf96284fcea&KRTB&22918-766c71ed-5734-4f6e-a0bf-9bf96284fcea&KRTB&22926-766c71ed-5734-4f6e-a0bf-9bf96284fcea&KRTB&23031-766c71ed-5734-4f6e-a0bf-9bf96284fcea
.amazon-adsystem.com/	1970-01-21 15:15:14	Name: ad-id Value: A8euAR4VrE4VvSYlar7Ed14
.amazon-adsystem.com/	1970-01-21 20:10:26	Name: ad-privacy Value: 0
.id5-sync.com/	1970-01-21 12:44:02	Name: 3pi Value: 441#1766066764945#1693834483#u_e5a9b008-d27d-474a-a11a-f5dda15da3c9\|155#1766066765930#699538553#AAEjI07SiBUAAAIMnCGOvA\|124#1766066767329#489358066
.pippio.com/	1970-01-21 19:20:02	Name: did Value: INzdLGQOFbfq0w0z
.pippio.com/	1970-01-21 19:20:02	Name: didts Value: 1766066767
.pippio.com/	1970-01-21 12:00:50	Name: nnls Value:
.pippio.com/	1970-01-21 12:00:50	Name: pxrc Value: CM+UkMoGEgYIgr0rEAA=
.smartadserver.com/	1970-01-21 12:44:02	Name: pid Value: 57042088526515756
.smartadserver.com/	1970-01-21 20:04:41	Name: TestIfCookieP Value: ok
.smartadserver.com/	1970-01-21 11:17:38	Name: csync Value: 127:AAEjI07SiBUAAAIMnCGOvA
.linkedin.com/	1970-01-21 12:44:02	Name: li_sugr Value: ab7eeb2f-3222-4a96-bb78-330696d1e995
.linkedin.com/	1970-01-21 19:20:02	Name: bcookie Value: "v=2&0d294021-c3ec-4dc6-84ac-d9e2dd381751"
.linkedin.com/	1970-01-21 10:35:53	Name: lidc Value: "b=OGST04:s=O:r=O:a=O:p=O:g=3665:u=1:x=1:i=1766066767:t=1766153167:v=2:sig=AQHaiNyc7FhKk4AIVzplABXMo7YVViXF"
.onaudience.com/	1970-01-21 19:20:02	Name: cookie Value: 3457f0134ce244eb
.onaudience.com/	1970-01-21 10:35:53	Name: done_redirects271 Value: 1

6 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	URL: https://www.mediafire.com/file/qxgu7p6f5ea5fve/Minecraft+Dungeons+v1.17.0.0.zip/file(Line 1366) Message: document.domain mutation is ignored because the surrounding agent cluster is origin-keyed.
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'bluetooth'.
network	error	URL: https://www.mediafiredls.com/onclick/0 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://ups.analytics.yahoo.com/ups/58813/fed?gpp=DBABJg~BFoAAEA.QA&gpp_sid=-1&gdpr=false&gdpr_consent=&v=1&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fqxgu7p6f5ea5fve%2FMinecraft%2BDungeons%2Bv1.17.0.0.zip%2Ffile Message: Failed to load resource: the server responded with a status of 400 ()
network	error	URL: https://id5-sync.com/k/264.gif?puid=766c71ed-5734-4f6e-a0bf-9bf96284fcea&ttl=%%TTL%% Message: Failed to load resource: the server responded with a status of 404 ()
other	error	URL: chrome-error://chromewebdata/ Message: Refused to display 'https://pr-bh.ybp.yahoo.com/' in a frame because it set 'X-Frame-Options' to 'deny'.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=0
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.ads.rmbl.ws
aa.agkn.com
ab.dns-finder.com
ad-delivery.net
ad.doubleclick.net
ad.turn.com
ads.pubmatic.com
analytics.google.com
api.amplitude.com
api.btloader.com
api.id5-sync.com
bcp.crwdcntrl.net
btloader.com
btlr.sharethrough.com
c1.adform.net
cdn.amplitude.com
cdn.econventa.com
cdn.id5-sync.com
cdn.jsdelivr.net
cm.g.doubleclick.net
cmp.gatekeeperconsent.com
connectid.analytics.yahoo.com
csync.loopme.me
dpm.demdex.net
e578d51024a06ed55fe9f1aed02895c2.safeframe.googlesyndication.com
econventa.com
esp.rtbhouse.com
fonts.gstatic.com
g.ezoic.net
go.ezodn.com
google-bidout-d.openx.net
gum.criteo.com
hbopenbid.pubmatic.com
ib.adnxs.com
id5-sync.com
idsync.rlcdn.com
image2.pubmatic.com
image4.pubmatic.com
image6.pubmatic.com
invstatic101.creativecdn.com
lb.eu-1-id5-sync.com
lbs.eu-1-id5-sync.com
match.adsrvr.org
match.deepintent.com
na.edge.optable.co
oa.openxcdn.net
oajs.openx.net
pagead2.googlesyndication.com
pippio.com
pixel.tapad.com
pr-bh.ybp.yahoo.com
privacy.gatekeeperconsent.com
pubmatic-match.dotomi.com
px.ads.linkedin.com
rtb.adentifi.com
s.amazon-adsystem.com
securepubads.g.doubleclick.net
sg.semasio.net
simage2.pubmatic.com
simage4.pubmatic.com
solutions.cdn.optable.co
static.cloudflareinsights.com
static.criteo.net
static.mediafire.com
static.xx.fbcdn.net
stats.g.doubleclick.net
sync-tm.everesttech.net
sync.crwdcntrl.net
sync.ipredictive.com
sync.srv.stackadapt.com
tags.crwdcntrl.net
the.gatekeeperconsent.com
tpc.googlesyndication.com
tr.blismedia.com
tracookiepixel.xyz
translate.google.com
translate.googleapis.com
um.simpli.fi
ups.analytics.yahoo.com
us-u.openx.net
user-sync.fwmrm.net
ut.pubmatic.com
www.ezojs.com
www.facebook.com
www.google-analytics.com
www.googletagmanager.com
www.gstatic.com
www.mediafire.com
www.mediafiredls.com
www.temu.com
aa.agkn.com
csync.loopme.me
ib.adnxs.com
pubmatic-match.dotomi.com
rtb.adentifi.com
sg.semasio.net
simage4.pubmatic.com
sync.ipredictive.com
sync.srv.stackadapt.com
tracookiepixel.xyz
www.temu.com
104.16.175.226
104.16.79.73
104.17.147.83
104.20.23.13
104.20.47.80
104.21.42.32
104.26.8.66
107.178.254.65
130.211.23.194
141.95.98.64
142.250.31.138
142.250.31.94
142.251.16.149
142.251.163.155
142.251.167.100
142.251.167.97
142.251.179.154
150.171.22.12
151.101.2.49
157.240.229.35
162.19.138.116
162.19.138.83
162.19.223.45
172.253.115.132
172.253.122.156
172.253.122.94
172.253.62.113
172.253.62.154
172.253.63.132
172.66.171.133
172.67.142.121
172.67.170.144
172.67.199.186
172.67.73.78
185.167.164.38
207.65.32.88
207.65.37.179
207.65.37.182
23.221.241.44
3.144.50.131
3.161.213.35
3.167.69.51
3.167.88.108
3.235.176.233
34.102.146.192
34.111.113.62
34.120.135.53
34.234.102.22
34.36.200.111
34.54.78.238
34.8.255.148
34.85.181.204
34.96.105.8
34.96.70.87
35.190.39.111
35.244.154.8
35.244.159.8
35.71.131.137
38.70.189.70
38.91.45.7
44.245.196.41
52.223.40.198
52.45.156.78
54.81.14.247
54.85.8.229
54.90.8.2
57.144.172.128
64.233.180.95
68.67.160.75
69.147.92.11
69.147.92.12
69.194.242.12
74.119.117.47
74.119.117.62
8.28.7.105
8.28.7.81
98.82.157.231
012001f5484f2f61e04ea3ac14ef735fd12c896e60d7f78aab18d0682cfdeb1e
02ca6454edfe1b231c57113c25911b6aec4af5ea6060aeed24f6652ddba826b1
032e1fdc72c9c669bbd7dcb841fc1cdcd7a9148a5802dd668c508efd0c11d7a0
03c8d2dc7d985c3004ff2cd6d8148dd03560f37ed15efdf6c2d7f4d771d0e599
04d05978fdb111358073ab0524e5c1fafc0826615c206987618416b8bd8a4747
04ed00928d15a800e1ee9d6dc81c7a5d96e60322e2f6ae495dd4cad9a9c1ebbc
0719900cf69736fcd3b31d30a354e459fdd31ba403b7f499146a675244bbefd0
07f587c4be8547c249b2af0d68d74f659b495f6739329c0a8f0b643adba285f5
0a9466aa25af983e06e08780120919a48911d83ae9b160263827abcaf384e3d4
0b3b8cb2ae1a42f0149d74ef25b25925bd0b8cc8182c00d212776525d9f03d7b
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0bc3c746aed9eb9ac58d8113eff08e529535bfaec00a68fd00d793e8bb69d712
0dcae222606cf25659d185a62f2fcd41caf42f6dd3d9dda50eda1f281e304065
0dd80ebc680bd180ebd89db806f8e4d0b7206e61728c5e07f10f0bf382ad972d
0f67393986c012dbf48aa3149e2874bd84ed5f466362ad1ac31305f697f1da7b
1030f5b751dc8b44ec6d068c5c293be1618219fb8b6cfb4ebe65d868af591e36
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002
1c6ba1010c2cc88c59de9e9584728da124770fa399643ffc1beffcec54b84be7
201271ae2f01482cacd243a748e622a077400b431eacc56775527fc8f8ab36da
2450e5580136f94bda7ccf95e3167b57e15b05b513a430967943a50036fa47a4
24e5456c9094314514ad27b449e8879f29ed5a574c6ede18eb6c3fcac10c3fe9
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
2c0e177d62a1ded5f5d3f7d5d2a8f700ccec93441f79a92d0021a6433f5e2474
2ddeade3a8991666b89f2a0c3aaba4508852838488781e260d45bc886f1172a5
2e5f5cb912c0619933ea6c3ad8ac1466a005f792e3338d96a8432d144c63520f
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef
30be558393bd8b0585c806a6eaed6d6f5b51d1ca63c0113061dfe35eaa128ce3
35a3d8d8e7109f2d46270c753c02cae885cc215994ed070e90e293332847d4db
3733ce04a5c4dbb8b07b847650fd68e82f93ab8abf6b35ca294d6d40130f06c0
37573f5eed801a0681606ee7c007523f9d37d1e00051f1990820000cbc2ef7f2
380a7fdd97951f66163f9480d41090539e8e23ff8f6fc30512914ea8dae8055b
3b9ffd186b78d9ad93b8f8f63b927976df2c98d29ecf5186c18b80d645cfd134
3c89e90d50156e5ba33e943ff9771abf103cff86253493c4eb389c99867166e3
3cefef7fc952707c97375ef3fa95a8c45a96eda7845d02bc1c28bf3570c0cfba
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
40da4ae433e14daa5df80415b34c6efdd032eafa2f88a64ca9ea1de06bb963a6
4342feac38021c4fe3069eba0edf1c2e1b4345e2b548b0afb7ab21b7369b3bc8
434ea950c425da5ed95264e6812df0898ff05f4e7710c85262a4ab95463d8b39
4448e430d3c53bad548a5d135e1c7e2f9593e806ba47892640d430ea752e979e
44a75c7db0985f0e6452d20e605e3150d12088ba4adde1ca903095fed62f8e78
4dac0026fbfa2615dce30c0af12830863fe885f84387a0147b9e338f548d5d82
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4ed0719b39b5e9dbf49b0d73fd43c80564daf8f673a770f4849606acc60f895e
4f8c10a8abdbbc4e77253d84a9f98c4ab302f160323509d29f6edb36d62974b7
50a63bf06dcdc62ce03de6a07d10770dc80cfa47ef2b63db1e9f6a5fbd786a7d
544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9
56351c084d8d56437d41f1e58b7eb184b563871e88bab60f6b15486c39f13996
5b6ceeffb380eae16e91dcf08a3493068aa5b7bd6f4c3f4ad7b4daa188d5c2cb
5f789ccae156b160492d89a6146b1974d15128790b74abb995d8e89fa44cde5e
6318394f737c66f0e2ccfcd88e3935c6667633a1b95fa29fba2b75431d55eef2
6629ab62a2d10bab5922a792f6f2602e0b821f1bc12ac2708c4daf5ea2e19437
67d3cd0a6c5665fee59c9057c8a28ea10d282d87ff7d49011484b0de73c3589f
67f7d0e0a582d352f71f2106000e4f4b37498412be20d819d49b94e9dd0cce86
6896b59e8034378b31284eea779e568986c0337a8eb3e648efbf52fd8d5d3781
6b9ae1fa0d1fc51ee0ad3feb565083bee200289c71bb346020f9b3d80cf73636
6fca1361d81b8d8d05afbe947e257aef026891372b45e0d2de123a907a4ed1af
71ddaebb5ce9f7c12b5e1b6d7d3ba74fe9410f4d6818b8451142350f93e202b3
720671166ac43aba99e3952b0b9341ab4e0fee1fd891db54e2a07f05db653142
765f83c7926b6d40e400c50545979ba50d5d4e993ba1852028bb56b819da2f24
76b14705bcd5752ac05035c95c7f53bfe8e65dda03bc77662e0aff067e3258e7
7808605ddd1f0eaa454aa444293d2f0260943e51e53838fca46506e6a69fe521
79e3db8a438fe11f7184ca47a9e981ea23c0f5a35ec172a241899e3ee09a7d0d
7ba1bc2084def769e77a7dbf97cd91d68fe6c6d55b5d183a7d36630da8da2b02
7ec07fca39de3ece6668edebbfe6002dcb9639a0f412d3af35fc7a63d3597d0f
80dd8320a523b27ed8fb4c5900051dd5cf309c1750a92df9961bddf8ddebb931
82b94716473aa225e715e117802145c5d2d725aa1ba9d476d61a5d3da16a8c26
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8539c91ae0a82f8cab27d481ea38ac4e66d1e5b36701fe295bcba4399b9255bd
893719087a8bc6dcdfabc4e1d54fd6d724953d40da2ad369f8b4fb5f689394d7
897dbeef38e4efaf33f6bc7bfc99ef5a2b897a93844423bd2e09f3b74b4ebf11
89ec2a5152f4f214a0fe49725345dc70848ed05f13cf20646d372d339477a11d
8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f
8a52d5f4aa2f1dda86673e8348b776ed50da97bb045647cb34e4118b46957df8
8b3a000db28359e0512e1484988806b9cdaeb457e29ef6b82bfe097e6eed3231
8d23693251d0923a21dba7083e1e3a58a18123b146cebbcefb828e1caa7c3aa3
8fc0ee7d93e336fc05824e41e02a633c4e5eac4b6c076d21af68d61956ef8e32
9b41253384e2818bd0f76171d6ffd723d4c85c5e1a69da74f174489cb52a40ce
9d6d7342264129047aedc4df11db9bdf238eec8fed367c7289ab11ca6ef6ccbe
a0b48c90ffcf364c0dd708cff0e99df141053389a98e94e7497aff8b6c64f0c7
a4fafcd389d58bbd82e49d9a68e81e9dc8384330ff14ec3283a4d0d11812047b
a5e87590d9232e0b0be4c640eeb47cb4f4299af754f195c802d49fe380ea1870
ab5c23a05e39deed14d9d8262b0dce9f024f86105a27196cad37d14a3f516e09
aca701811d62eb608d12b174231be1ceae3449fe0f4bc847469ff22aab8ca9a5
aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
af4f8dc7357322f551fc81793bba94d32fc6fae031b56a126ead43709da0a8b6
af9a29c74549115b55d144b669ff05dee9da36402330d4698784646cd4a9f2dc
b837449c7254dd5887b620b7903bb4dbafbf2424ae3eb25e7a9f3471ff105365
b8f0ca68362cf245f891fc09ddfa50806d195e78e196cf96ac5d9cf72be2577a
bcb502a62b191fd44c1ce1a1dc4fca39d2cd32157242a56a22702e5be8709aa0
bd04667d5d5feb14319f345a1a8e7486d8ab5aea560fb8be53cae5f6bc9d0e20
be4d42256c1ac1973db1401ebaf87e5b2d8977a18a704ef159731a792d258848
bebf06b6a6e41615e394a03873af6c9da1bda463d97f0e5503491fa1a5e0e177
c010fbcd71b8c861c815493ff57eaccbddf13b0d612b9f2e897f6905c84f115e
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
c6c094bc0054f9cbe34102ff49f86b3928b5ac09f3d2ac87e170d0500675921f
c9f013481117e8e4017a5b2aa8bca599ce890b736ee4e2f75fbd48b9483405bb
cbb99c4149249b280f1d3d924d9bdd29a4a14cba1e71775fb3bdbdf13ebd5a48
ce0ce825dde97636b8539cec2bafd1b2d823369118c534a6b06da8080a5d900e
ceac53f13f45fafda6347a7b257f1778440b96641bbc76b76e9925f96c37ca16
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d071b93b496cb74804524f495fa83e809ae18683a6a784d27b93e05abc722822
d17e84af7ba998526041e90409fec0d80e0bf436fecd99cd94ea4124f1047141
d2e2a717e9987b93944c340c64626c3022ce76a066dac2dcfbc89721d091e8be
d41fd802a0f89defab4c3631640e3f93c3c958ad25d546137d14a0ef89f25e29
d65f4b2e8eee94ddc7f762d098de19558d879a3b597c8913b4d075532e3ed4b4
d8b4c94297f5f90128ea1aac11dd2aeaf04567f962b55ca59b4f43ce7a5b657c
d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8
dc54b817820f14ce6395ba2a037f37d4bb0af75d5b017336140793fbe2f7f738
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
e06078ef50b4908a9fb589760b5607670430d6d96ec7e884e45320af25d252c8
e0ff1aa498c3e7899a1ba72cea996bea56b397a6e93864cff709ce8d1776e5ea
e13eb219765a0567323a2891012ee42ee6a2749858f6074dd5b4f1c6aacbd888
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4222715b556e7d99622c83e620d2f8e090047e56adb07923047f95828d561f2
e814d50a228f54aecf40d8a58e41d48ce1dfc4376fd5fbedc28078fe0a8c5526
e8204c03ec389eba2ff9bcedccf9dbeb8c5d080daedcfc844b971df9c17d0c3e
eaba66df290e6c1b2b72cb836057ccf826b613e87d5c2df691ab35a543d5477e
eac2aabc9f8268462f0432e402dde959ea32117c4d598f438abf96afcb1f11ce
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0c8316566a9655e5c0690d100df3081b3ab4a24692875353bc0961fe94f0829
f1a61277e3f902f50ab42015d8b07218db9b7601bb0967e54a52bfdcb4fa7e81
f1a67642fc97b508ce07cf6df329022bf5184a1c573044dc021e0d6e64688c64
f1a68bf826c55985468304f4284a09cb8a68e82503d764166e611a7c58a85a4b
f2928df8646974c32274b7b51b1884eda8710320be73109e1ce3f16d3b4267ff
f52a0c7d9fa7ae8e45916c491ae7193f9a1e289f128f05264122c53d8da970db
f917a9105c311331b1d40f4d2bdbf11233c1c465616c1a9c46232f451463b061
f9182a2ae7741a28c9914d19885f60ae4bf0a696f36a5a25f928f3cf088c7200
fb1bd700eb83832fc2ca14c9fd537e5facad95f3bd15632db0c4b1c5a5bd7e20
fcfe9df48de61a9691e374f987442cb286b29df9c4a8b0177b97076fe443ef52
fd8a52778087b5522a4f942fcd7ab19be79094b8ab9c847c2d89220583bfbb47
fe4e0d62dd44972bab23d30702b6b506ac113c190df4c044af84b108c33858db
fec5a361dec923efe92848ca27b02b158b164380a9eaf6cc1625e08e0d9c101e

www.mediafire.com Open in urlscan Pro 104.17.147.83 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

225 Requests

89 %HTTPS

0 %IPv6

60 Domains

90 Subdomains

71 IPs

6 Countries

2166 kBTransfer

7204 kBSize

117 Cookies

17 Outgoing links

Redirected requests

225 HTTP transactions Everything HTML Script Fetch XHR CSS Image Font Expand all 8 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.mediafire.com Open in urlscan Pro
104.17.147.83 Public Scan

Screenshot
Live screenshot

Full Image

225
Requests

89 %
HTTPS

0 %
IPv6

60
Domains

90
Subdomains

71
IPs

6
Countries

2166 kB
Transfer

7204 kB
Size

117
Cookies

225 HTTP transactions
8 data transactions