www.mediafire.com
104.17.147.83 Public Scan Open in urlscan Pro

Go To Rescan
Add Verdict Report

URL:
https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file 13yr old
Submission Tags: hybridanalysis
Submission: On May 14 via api (May 14th 2026, 9:33:18 am UTC) from US — Scanned from CA

Summary HTTP 329 Redirects Links 16 Behaviour Indicators

Summary

This website contacted 84 IPs in 4 countries across 68 domains to perform 329 HTTP transactions. The main IP is 104.17.147.83, located in Ascension Island and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is www.mediafire.com. The Cisco Umbrella rank of the primary domain is 50328. 13yr old
TLS certificate: Issued by Sectigo Public Server Authentication ... on August 5th 2025. Valid for: 1yr.

This is the only time www.mediafire.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 19	104.17.147.83 104.17.147.83	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
3	172.67.199.186 172.67.199.186	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
3	192.178.155.97 192.178.155.97	15169 (GOOGLE) (GOOGLE - Google LLC)
2	104.20.20.189 104.20.20.189	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
3	104.21.63.106 104.21.63.106	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	172.253.139.102 172.253.139.102	15169 (GOOGLE) (GOOGLE - Google LLC)
1	104.16.80.73 104.16.80.73	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	3.170.42.102 3.170.42.102	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2	172.67.69.81 172.67.69.81	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	57.144.172.1 57.144.172.1	32934 (FACEBOOK) (FACEBOOK - Facebook)
11	172.66.148.140 172.66.148.140	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
7	192.178.155.149 192.178.155.149	15169 (GOOGLE) (GOOGLE - Google LLC)
2	34.36.200.111 34.36.200.111	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM - Google LLC)
2	172.66.171.133 172.66.171.133	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	44.254.178.46 44.254.178.46	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2	57.144.172.128 57.144.172.128	32934 (FACEBOOK) (FACEBOOK - Facebook)
3	130.211.23.194 130.211.23.194	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM - Google LLC)
20	104.21.87.79 104.21.87.79	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
19	54.85.8.229 54.85.8.229	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
3	172.253.63.94 172.253.63.94	15169 (GOOGLE) (GOOGLE - Google LLC)
3	142.251.16.95 142.251.16.95	15169 (GOOGLE) (GOOGLE - Google LLC)
1	142.251.163.101 142.251.163.101	15169 (GOOGLE) (GOOGLE - Google LLC)
2	104.20.23.13 104.20.23.13	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	172.67.73.78 172.67.73.78	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
3	216.239.32.181 216.239.32.181	15169 (GOOGLE) (GOOGLE - Google LLC)
1	142.251.16.157 142.251.16.157	15169 (GOOGLE) (GOOGLE - Google LLC)
2	64.233.180.94 64.233.180.94	15169 (GOOGLE) (GOOGLE - Google LLC)
1	142.251.163.94 142.251.163.94	15169 (GOOGLE) (GOOGLE - Google LLC)
32	192.178.155.155 192.178.155.155	15169 (GOOGLE) (GOOGLE - Google LLC)
1	108.138.64.116 108.138.64.116	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	23.222.201.103 23.222.201.103	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
1	172.253.63.95 172.253.63.95	15169 (GOOGLE) (GOOGLE - Google LLC)
3	104.21.3.76 104.21.3.76	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	135.125.170.95 135.125.170.95	16276 (OVH OVH SAS) (OVH OVH SAS)
5	135.125.170.98 135.125.170.98	16276 (OVH OVH SAS) (OVH OVH SAS)
6	74.119.117.62 74.119.117.62	19750 (AS-CRITEO) (AS-CRITEO - Criteo Corp.)
2	151.101.1.229 151.101.1.229	54113 (FASTLY) (FASTLY - Fastly)
2	37.19.206.161 37.19.206.161	60068 (CDN77 Dat...) (CDN77 Datacamp Limited)
2	156.146.43.72 156.146.43.72	60068 (CDN77 Dat...) (CDN77 Datacamp Limited)
2	69.147.92.12 69.147.92.12	14777 (YAHOO) (YAHOO - Yahoo Holdings Inc.)
2	50.16.131.99 50.16.131.99	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
2	172.66.148.159 172.66.148.159	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	34.107.165.188 34.107.165.188	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM - Google LLC)
1	52.2.73.27 52.2.73.27	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
2	8.28.7.81 8.28.7.81	62713 (AS-PUBMATIC) (AS-PUBMATIC - PubMatic)
2	151.101.194.132 151.101.194.132	54113 (FASTLY) (FASTLY - Fastly)
2	15.197.193.217 15.197.193.217	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	3.237.175.195 3.237.175.195	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
5 20	142.251.111.155 142.251.111.155	15169 (GOOGLE) (GOOGLE - Google LLC)
1	34.102.146.192 34.102.146.192	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM - Google LLC)
1	18.239.6.97 18.239.6.97	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	74.119.117.47 74.119.117.47	19750 (AS-CRITEO) (AS-CRITEO - Criteo Corp.)
1	34.96.70.87 34.96.70.87	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM - Google LLC)
1	3.167.37.97 3.167.37.97	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
3	142.251.163.132 142.251.163.132	15169 (GOOGLE) (GOOGLE - Google LLC)
1	52.91.215.149 52.91.215.149	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1 2	34.120.107.143 34.120.107.143	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM - Google LLC)
1	35.190.39.111 35.190.39.111	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM - Google LLC)
2	192.178.155.157 192.178.155.157	15169 (GOOGLE) (GOOGLE - Google LLC)
4	34.98.64.218 34.98.64.218	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM - Google LLC)
1 1	52.223.40.198 52.223.40.198	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1 1	69.194.242.12 69.194.242.12	26120 (RHYTHMONE) (RHYTHMONE - RhythmOne)
5	64.233.180.132 64.233.180.132	15169 (GOOGLE) (GOOGLE - Google LLC)
1	142.251.167.155 142.251.167.155	15169 (GOOGLE) (GOOGLE - Google LLC)
1	142.251.153.119 142.251.153.119	15169 (GOOGLE) (GOOGLE - Google LLC)
26	142.251.167.157 142.251.167.157	15169 (GOOGLE) (GOOGLE - Google LLC)
1	192.178.155.154 192.178.155.154	15169 (GOOGLE) (GOOGLE - Google LLC)
4	172.67.68.154 172.67.68.154	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	35.190.34.69 35.190.34.69	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM - Google LLC)
5	142.251.167.132 142.251.167.132	15169 (GOOGLE) (GOOGLE - Google LLC)
2 2	159.127.42.73 159.127.42.73	26762 (CNVR-US-EAST) (CNVR-US-EAST - Conversant)
1 1	172.104.105.5 172.104.105.5	63949 (AKAMAI-LI...) (AKAMAI-LINODE-AP Akamai Connected Cloud)
1 1	74.119.117.57 74.119.117.57	19750 (AS-CRITEO) (AS-CRITEO - Criteo Corp.)
2 2	64.202.112.127 64.202.112.127	23352 (SERVERCEN...) (SERVERCENTRAL - DEFT.COM)
3 3	69.194.240.13 69.194.240.13	26120 (RHYTHMONE) (RHYTHMONE - RhythmOne)
3 3	100.26.96.211 100.26.96.211	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
10	64.233.180.154 64.233.180.154	15169 (GOOGLE) (GOOGLE - Google LLC)
2	172.253.139.157 172.253.139.157	15169 (GOOGLE) (GOOGLE - Google LLC)
2	172.253.63.155 172.253.63.155	15169 (GOOGLE) (GOOGLE - Google LLC)
3 5	104.18.27.193 104.18.27.193	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
2 3	68.67.181.102 68.67.181.102	29990 (ASN-APPNEXUS) (ASN-APPNEXUS - Xandr Inc.)
3	23.48.203.240 23.48.203.240	20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.)
2 2	100.31.225.118 100.31.225.118	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1 2	151.101.2.132 151.101.2.132	54113 (FASTLY) (FASTLY - Fastly)
1 1	20.157.93.108 20.157.93.108	8069 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation)
1 1	34.149.50.64 34.149.50.64	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM - Google LLC)
1	3.170.19.129 3.170.19.129	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	18.154.227.73 18.154.227.73	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
19	3.162.3.14 3.162.3.14	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1 4	192.184.68.228 192.184.68.228	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1	13.226.238.59 13.226.238.59	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2 2	35.244.154.8 35.244.154.8	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM - Google LLC)
1	107.178.254.65 107.178.254.65	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM - Google LLC)
1	207.65.32.88 207.65.32.88	62713 (AS-PUBMATIC) (AS-PUBMATIC - PubMatic)
1	216.19.192.2 216.19.192.2	26667 (RUBICONPR...) (RUBICONPROJECT - Magnite)
329	84

19 104.17.147.83 (Ascension Island) 1 redirects

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

www.mediafire.com 13yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools
static.mediafire.com 8yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

3 172.67.199.186 (Ascension Island)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

cmp.gatekeeperconsent.com 1yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools
the.gatekeeperconsent.com 3yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools
privacy.gatekeeperconsent.com 3yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

3 192.178.155.97 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: yuiadrs-in-f97.1e100.net

www.googletagmanager.com 13yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 104.20.20.189 (Ascension Island)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

btloader.com 6yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools
cdn.btloader.com 2yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

3 104.21.63.106 (Ascension Island)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

www.ezojs.com 9yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 172.253.139.102 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: yuiadsk-in-f102.1e100.net

translate.google.com 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 104.16.80.73 (Ascension Island)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

static.cloudflareinsights.com 7yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 3.170.42.102 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-3-170-42-102.iad61.r.cloudfront.net

cdn.amplitude.com 9yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 172.67.69.81 (Ascension Island)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

cdn.econventa.com 1yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools
econventa.com 1yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 57.144.172.1 (Southfield, United States)

ASN32934 (FACEBOOK - Facebook, Inc., US)
PTR: edge-star-mini-shv-01-det1.facebook.com

www.facebook.com 11yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

11 172.66.148.140 (Ascension Island)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

ad-delivery.net 9yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

7 192.178.155.149 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: yuiadrs-in-f149.1e100.net

ad.doubleclick.net 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 34.36.200.111 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US)
PTR: 111.200.36.34.bc.googleusercontent.com

ab.dns-finder.com 8mo old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 172.66.171.133 (Ascension Island)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

btloader.com 6yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools
cdn.api.btloader.com 2mo old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 44.254.178.46 (Boardman, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-44-254-178-46.us-west-2.compute.amazonaws.com

api.amplitude.com 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 57.144.172.128 (Southfield, United States)

ASN32934 (FACEBOOK - Facebook, Inc., US)
PTR: xx-fbcdn-shv-01-det1.fbcdn.net

static.xx.fbcdn.net 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

3 130.211.23.194 (United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US)
PTR: 194.23.211.130.bc.googleusercontent.com

api.btloader.com 6yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

20 104.21.87.79 (Ascension Island)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

go.ezodn.com 6yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

19 54.85.8.229 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-54-85-8-229.compute-1.amazonaws.com

g.ezoic.net 11yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

3 172.253.63.94 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: bi-in-f94.1e100.net

www.gstatic.com 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

3 142.251.16.95 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: bl-in-f95.1e100.net

translate.googleapis.com 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 142.251.163.101 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: wv-in-f101.1e100.net

www.google-analytics.com 13yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 104.20.23.13 (Ascension Island)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

cdn.id5-sync.com 7yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 172.67.73.78 (Ascension Island)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

www.mediafiredls.com 2yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

3 216.239.32.181 (United States)

ASN15169 (GOOGLE - Google LLC, US)

analytics.google.com 9yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 142.251.16.157 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: bl-in-f157.1e100.net

stats.g.doubleclick.net 9yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 64.233.180.94 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: on-in-f94.1e100.net

www.google.ca 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 142.251.163.94 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: wv-in-f94.1e100.net

fonts.gstatic.com 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

32 192.178.155.155 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: yuiadrs-in-f155.1e100.net

securepubads.g.doubleclick.net 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools
ep1.adtrafficquality.google 2yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 108.138.64.116 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-108-138-64-116.iad12.r.cloudfront.net

d-code.liadm.com 3yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 23.222.201.103 (Ashburn, United States)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a23-222-201-103.deploy.static.akamaitechnologies.com

link.rubiconproject.com 1yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 172.253.63.95 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: bi-in-f95.1e100.net

translate-pa.googleapis.com 5yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

3 104.21.3.76 (Ascension Island)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

ads.bidsystem.ai 10mo old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 135.125.170.95 (France)

ASN16276 (OVH OVH SAS, FR)
PTR: ns31890042.ip-135-125-170.eu

lbs.eu-1-id5-sync.com 4yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

5 135.125.170.98 (France)

ASN16276 (OVH OVH SAS, FR)
PTR: ns31890040.ip-135-125-170.eu

lb.eu-1-id5-sync.com 4yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools
id5-sync.com 9yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

6 74.119.117.62 (United States)

ASN19750 (AS-CRITEO - Criteo Corp., US)

gum.criteo.com 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 151.101.1.229 (United States)

ASN54113 (FASTLY - Fastly, Inc., US)

cdn.jsdelivr.net 13yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 37.19.206.161 (Ashburn, United States)

ASN60068 (CDN77 Datacamp Limited, GB)
PTR: unn-37-19-206-161.datapacket.com

lexicon.33across.com 5yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 156.146.43.72 (Miami, United States)

ASN60068 (CDN77 Datacamp Limited, GB)
PTR: 156-146-43-72.bunnyinfra.net

id.a-mx.com 5yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 69.147.92.12 (Ashburn, United States)

ASN14777 (YAHOO - Yahoo Holdings Inc., US)
PTR: e2.ycpi.vip.dca.yahoo.com

ups.analytics.yahoo.com 7yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 50.16.131.99 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-50-16-131-99.compute-1.amazonaws.com

d9.flashtalking.com 11yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 172.66.148.159 (Ascension Island)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

id.hadron.ad.gt 4yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 34.107.165.188 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US)
PTR: 188.165.107.34.bc.googleusercontent.com

api.rlcdn.com 8yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 52.2.73.27 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-52-2-73-27.compute-1.amazonaws.com

id.crwdcntrl.net 6yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 8.28.7.81 (United States)

ASN62713 (AS-PUBMATIC - PubMatic, Inc., US)

image6.pubmatic.com 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 151.101.194.132 (United States)

ASN54113 (FASTLY - Fastly, Inc., US)

at.teads.tv 5yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 15.197.193.217 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: a12b7a488abeaa9e4.awsglobalaccelerator.com

match.adsrvr.org 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 3.237.175.195 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-3-237-175-195.compute-1.amazonaws.com

carbon-cdn.ccgateway.net 8yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

20 142.251.111.155 (United States) 5 redirects

ASN15169 (GOOGLE - Google LLC, US)
PTR: bk-in-f155.1e100.net

cm.g.doubleclick.net 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 34.102.146.192 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US)
PTR: 192.146.102.34.bc.googleusercontent.com

oa.openxcdn.net 7yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 18.239.6.97 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-18-239-6-97.yul62.r.cloudfront.net

tags.crwdcntrl.net 13yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 74.119.117.47 (United States)

ASN19750 (AS-CRITEO - Criteo Corp., US)

static.criteo.net 13yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 34.96.70.87 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US)
PTR: 87.70.96.34.bc.googleusercontent.com

invstatic101.creativecdn.com 4yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 3.167.37.97 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-3-167-37-97.iad61.r.cloudfront.net

connectid.analytics.yahoo.com 4yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

3 142.251.163.132 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: wv-in-f132.1e100.net

409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com 1mo old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 52.91.215.149 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-52-91-215-149.compute-1.amazonaws.com

privacy-location-edge.ccgateway.net 5yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 34.120.107.143 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US)
PTR: 143.107.120.34.bc.googleusercontent.com

oajs.openx.net 6yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 35.190.39.111 (United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US)
PTR: 111.39.190.35.bc.googleusercontent.com

esp.rtbhouse.com 4yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 192.178.155.157 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: yuiadrs-in-f157.1e100.net

ep1.adtrafficquality.google 2yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

4 34.98.64.218 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US)
PTR: 218.64.98.34.bc.googleusercontent.com

google-bidout-d.openx.net 7yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools
us-u.openx.net 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 52.223.40.198 (United States) 1 redirects

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: a6370ebea231e0c9a.awsglobalaccelerator.com

match.adsrvr.org 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 69.194.242.12 (United States) 1 redirects

ASN26120 (RHYTHMONE - RhythmOne, LLC, US)

ad.turn.com 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

5 64.233.180.132 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: pe-in-f132.1e100.net

ep2.adtrafficquality.google 2yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 142.251.167.155 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: ww-in-f155.1e100.net

pagead2.googlesyndication.com 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 142.251.153.119 (United States)

ASN15169 (GOOGLE - Google LLC, US)

www.google.com 13yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

26 142.251.167.157 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: ww-in-f157.1e100.net

pagead2.googlesyndication.com 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 192.178.155.154 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: yuiadrs-in-f154.1e100.net

securepubads.g.doubleclick.net 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

4 172.67.68.154 (Ascension Island)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

bid.2trk.info 4yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools
cdn.2trk.info 5yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 35.190.34.69 (United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US)
PTR: 69.34.190.35.bc.googleusercontent.com

ban.jackery.com 2yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

5 142.251.167.132 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: ww-in-f132.1e100.net

tpc.googlesyndication.com 13yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 159.127.42.73 (United States) 2 redirects

ASN26762 (CNVR-US-EAST - Conversant, LLC, US)
PTR: iad02-nessy-float1.dotomi.com

dclk-match.dotomi.com 8yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 172.104.105.5 (Tokyo, Japan) 1 redirects

ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG)
PTR: li1715-5.members.linode.com

a.c.appier.net 9yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 74.119.117.57 (United States) 1 redirects

ASN19750 (AS-CRITEO - Criteo Corp., US)

dis.criteo.com 13yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 64.202.112.127 (United States) 2 redirects

ASN23352 (SERVERCENTRAL - DEFT.COM, US)
PTR: ny.outbrain.com

b1sync.outbrain.com 2yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

3 69.194.240.13 (United States) 3 redirects

ASN26120 (RHYTHMONE - RhythmOne, LLC, US)

sync.1rx.io 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools
sync.targeting.unrulymedia.com 6yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

3 100.26.96.211 (Ashburn, United States) 3 redirects

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-100-26-96-211.compute-1.amazonaws.com

eb2.3lift.com 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

10 64.233.180.154 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: on-in-f154.1e100.net

www.googleadservices.com 13yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 172.253.139.157 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: yuiadsk-in-f157.1e100.net

www.googletagservices.com 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 172.253.63.155 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: bi-in-f155.1e100.net

googleads.g.doubleclick.net 9yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

5 104.18.27.193 (Ascension Island) 3 redirects

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

dsum-sec.casalemedia.com 12yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

3 68.67.181.102 (North Bergen, United States) 2 redirects

ASN29990 (ASN-APPNEXUS - Xandr Inc., US)
PTR: 1040.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

ib.adnxs.com 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

3 23.48.203.240 (Ashburn, United States)

ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)
PTR: a23-48-203-240.deploy.static.akamaitechnologies.com

servedby.flashtalking.com 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 100.31.225.118 (Ashburn, United States) 2 redirects

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-100-31-225-118.compute-1.amazonaws.com

match.360yield.com 7yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 151.101.2.132 (United States) 1 redirects

ASN54113 (FASTLY - Fastly, Inc., US)

sync.teads.tv 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 20.157.93.108 (Washington, United States) 1 redirects

ASN8069 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)

www.temu.com 5yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 34.149.50.64 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US)
PTR: 64.50.149.34.bc.googleusercontent.com

s.seedtag.com 8yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 3.170.19.129 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-3-170-19-129.iad61.r.cloudfront.net

ajs-assets.ftstatic.com 4yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 18.154.227.73 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-18-154-227-73.iad55.r.cloudfront.net

agen-assets.ftstatic.com 4yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

19 3.162.3.14 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-3-162-3-14.yul62.r.cloudfront.net

cdn.flashtalking.com 13yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

4 192.184.68.228 (United States) 1 redirects

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)

secure.quantserve.com 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools
pixel.quantserve.com 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 13.226.238.59 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-13-226-238-59.iad61.r.cloudfront.net

rules.quantcount.com 9yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 35.244.154.8 (Kansas City, United States) 2 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US)
PTR: 8.154.244.35.bc.googleusercontent.com

idsync.rlcdn.com 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 107.178.254.65 (United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US)
PTR: 65.254.178.107.bc.googleusercontent.com

pippio.com 12yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 207.65.32.88 (United States)

ASN62713 (AS-PUBMATIC - PubMatic, Inc., US)

image2.pubmatic.com 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 216.19.192.2 (United States)

ASN26667 (RUBICONPROJECT - Magnite, Inc., US)

pixel.rubiconproject.com 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

	Apex Domain Subdomains	Transfer
61	doubleclick.net 5 redirects ad.doubleclick.net — Cisco Umbrella Rank: 206 10yr old stats.g.doubleclick.net — Cisco Umbrella Rank: 175 9yr old securepubads.g.doubleclick.net — Cisco Umbrella Rank: 300 10yr old cm.g.doubleclick.net — Cisco Umbrella Rank: 290 10yr old googleads.g.doubleclick.net — Cisco Umbrella Rank: 68 9yr old	293 KB
35	googlesyndication.com 409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com 1mo old pagead2.googlesyndication.com — Cisco Umbrella Rank: 149 10yr old tpc.googlesyndication.com — Cisco Umbrella Rank: 218 13yr old	162 KB
24	flashtalking.com d9.flashtalking.com — Cisco Umbrella Rank: 1712 11yr old servedby.flashtalking.com — Cisco Umbrella Rank: 1046 10yr old cdn.flashtalking.com — Cisco Umbrella Rank: 1376 13yr old	209 KB
20	ezodn.com go.ezodn.com — Cisco Umbrella Rank: 15707 6yr old	868 KB
19	ezoic.net g.ezoic.net — Cisco Umbrella Rank: 13949 11yr old	87 KB
19	mediafire.com 1 redirects www.mediafire.com — Cisco Umbrella Rank: 50328 13yr old static.mediafire.com — Cisco Umbrella Rank: 76490 8yr old	276 KB
11	ad-delivery.net ad-delivery.net — Cisco Umbrella Rank: 1326 9yr old	2 KB
10	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 98 13yr old	62 KB
9	adtrafficquality.google ep1.adtrafficquality.google — Cisco Umbrella Rank: 360 2yr old ep2.adtrafficquality.google — Cisco Umbrella Rank: 367 2yr old	75 KB
7	criteo.com 1 redirects gum.criteo.com — Cisco Umbrella Rank: 476 10yr old dis.criteo.com — Cisco Umbrella Rank: 741 13yr old	9 KB
7	btloader.com btloader.com — Cisco Umbrella Rank: 1162 6yr old cdn.btloader.com — Cisco Umbrella Rank: 1695 2yr old cdn.api.btloader.com — Cisco Umbrella Rank: 1680 2mo old api.btloader.com — Cisco Umbrella Rank: 1413 6yr old	34 KB
6	openx.net 1 redirects oajs.openx.net — Cisco Umbrella Rank: 2207 6yr old google-bidout-d.openx.net — Cisco Umbrella Rank: 2161 7yr old us-u.openx.net — Cisco Umbrella Rank: 649 10yr old	2 KB
5	casalemedia.com 3 redirects dsum-sec.casalemedia.com — Cisco Umbrella Rank: 749 12yr old	4 KB
5	google.com translate.google.com — Cisco Umbrella Rank: 1218 10yr old analytics.google.com — Cisco Umbrella Rank: 169 9yr old www.google.com — Cisco Umbrella Rank: 4 13yr old	29 KB
4	quantserve.com 1 redirects secure.quantserve.com — Cisco Umbrella Rank: 2426 10yr old pixel.quantserve.com — Cisco Umbrella Rank: 1468 10yr old	14 KB
4	2trk.info bid.2trk.info — Cisco Umbrella Rank: 100415 4yr old cdn.2trk.info — Cisco Umbrella Rank: 61830 5yr old	40 KB
4	teads.tv 1 redirects at.teads.tv — Cisco Umbrella Rank: 4791 5yr old sync.teads.tv — Cisco Umbrella Rank: 1234 10yr old	2 KB
4	eu-1-id5-sync.com lbs.eu-1-id5-sync.com — Cisco Umbrella Rank: 1196 4yr old lb.eu-1-id5-sync.com — Cisco Umbrella Rank: 970 4yr old	1 KB
4	id5-sync.com cdn.id5-sync.com — Cisco Umbrella Rank: 859 7yr old id5-sync.com Failed — Cisco Umbrella Rank: 554 9yr old	65 KB
4	googleapis.com translate.googleapis.com — Cisco Umbrella Rank: 813 10yr old translate-pa.googleapis.com — Cisco Umbrella Rank: 1272 5yr old	122 KB
4	gstatic.com www.gstatic.com — Cisco Umbrella Rank: 9 10yr old fonts.gstatic.com — Cisco Umbrella Rank: 27 10yr old	11 KB
3	adnxs.com 2 redirects ib.adnxs.com — Cisco Umbrella Rank: 330 10yr old	3 KB
3	3lift.com 3 redirects eb2.3lift.com — Cisco Umbrella Rank: 514 10yr old	1 KB
3	adsrvr.org 1 redirects match.adsrvr.org — Cisco Umbrella Rank: 404 10yr old	1 KB
3	pubmatic.com image6.pubmatic.com — Cisco Umbrella Rank: 933 10yr old image2.pubmatic.com — Cisco Umbrella Rank: 998 10yr old	921 B
3	rlcdn.com 2 redirects api.rlcdn.com — Cisco Umbrella Rank: 1171 8yr old idsync.rlcdn.com — Cisco Umbrella Rank: 657 10yr old	1 KB
3	yahoo.com ups.analytics.yahoo.com — Cisco Umbrella Rank: 531 7yr old connectid.analytics.yahoo.com — Cisco Umbrella Rank: 2148 4yr old	9 KB
3	bidsystem.ai ads.bidsystem.ai — Cisco Umbrella Rank: 28127 10mo old	39 KB
3	ezojs.com www.ezojs.com — Cisco Umbrella Rank: 16795 9yr old	201 KB
3	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 44 13yr old	431 KB
3	gatekeeperconsent.com cmp.gatekeeperconsent.com — Cisco Umbrella Rank: 22159 1yr old the.gatekeeperconsent.com — Cisco Umbrella Rank: 20561 3yr old privacy.gatekeeperconsent.com — Cisco Umbrella Rank: 26689 3yr old	4 KB
2	ftstatic.com ajs-assets.ftstatic.com — Cisco Umbrella Rank: 1704 4yr old agen-assets.ftstatic.com — Cisco Umbrella Rank: 1591 4yr old	32 KB
2	360yield.com 2 redirects match.360yield.com — Cisco Umbrella Rank: 2390 7yr old	921 B
2	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 422 10yr old	86 KB
2	1rx.io 2 redirects sync.1rx.io — Cisco Umbrella Rank: 612 10yr old	2 KB
2	outbrain.com 2 redirects b1sync.outbrain.com — Cisco Umbrella Rank: 862 2yr old	1 KB
2	dotomi.com 2 redirects dclk-match.dotomi.com — Cisco Umbrella Rank: 2635 8yr old	807 B
2	ccgateway.net carbon-cdn.ccgateway.net — Cisco Umbrella Rank: 5718 8yr old privacy-location-edge.ccgateway.net — Cisco Umbrella Rank: 6936 5yr old	8 KB
2	crwdcntrl.net id.crwdcntrl.net — Cisco Umbrella Rank: 2642 6yr old tags.crwdcntrl.net — Cisco Umbrella Rank: 1060 13yr old	14 KB
2	ad.gt id.hadron.ad.gt — Cisco Umbrella Rank: 2368 4yr old	271 B
2	a-mx.com id.a-mx.com — Cisco Umbrella Rank: 1368 5yr old	933 B
2	33across.com lexicon.33across.com — Cisco Umbrella Rank: 1658 5yr old	3 KB
2	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 274 13yr old	2 KB
2	rubiconproject.com link.rubiconproject.com — Cisco Umbrella Rank: 9235 1yr old pixel.rubiconproject.com — Cisco Umbrella Rank: 473 10yr old	2 KB
2	google.ca www.google.ca — Cisco Umbrella Rank: 5731 10yr old	126 B
2	fbcdn.net static.xx.fbcdn.net — Cisco Umbrella Rank: 977 10yr old	817 B
2	dns-finder.com ab.dns-finder.com — Cisco Umbrella Rank: 1580 8mo old	215 B
2	econventa.com cdn.econventa.com — Cisco Umbrella Rank: 80623 1yr old econventa.com — Cisco Umbrella Rank: 71963 1yr old	50 KB
2	amplitude.com cdn.amplitude.com — Cisco Umbrella Rank: 2085 9yr old api.amplitude.com — Cisco Umbrella Rank: 4121 10yr old	22 KB
1	pippio.com pippio.com — Cisco Umbrella Rank: 1128 12yr old	572 B
1	quantcount.com rules.quantcount.com — Cisco Umbrella Rank: 2526 9yr old	634 B
1	seedtag.com 1 redirects s.seedtag.com — Cisco Umbrella Rank: 1097 8yr old	1017 B
1	temu.com 1 redirects www.temu.com — Cisco Umbrella Rank: 764 5yr old	559 B
1	unrulymedia.com 1 redirects sync.targeting.unrulymedia.com — Cisco Umbrella Rank: 1366 6yr old	583 B
1	appier.net 1 redirects a.c.appier.net — Cisco Umbrella Rank: 3263 9yr old	800 B
1	jackery.com ban.jackery.com — Cisco Umbrella Rank: 526907 2yr old	5 KB
1	turn.com 1 redirects ad.turn.com — Cisco Umbrella Rank: 1009 10yr old	442 B
1	rtbhouse.com esp.rtbhouse.com — Cisco Umbrella Rank: 1970 4yr old	551 B
1	creativecdn.com invstatic101.creativecdn.com — Cisco Umbrella Rank: 1811 4yr old	3 KB
1	criteo.net static.criteo.net — Cisco Umbrella Rank: 909 13yr old	15 KB
1	openxcdn.net oa.openxcdn.net — Cisco Umbrella Rank: 1913 7yr old	8 KB
1	liadm.com d-code.liadm.com — Cisco Umbrella Rank: 4088 3yr old	47 KB
1	mediafiredls.com www.mediafiredls.com — Cisco Umbrella Rank: 75980 2yr old	506 B
1	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 73 13yr old	21 KB
1	facebook.com www.facebook.com — Cisco Umbrella Rank: 132 11yr old	7 KB
1	cloudflareinsights.com static.cloudflareinsights.com — Cisco Umbrella Rank: 316 7yr old	11 KB
0	yieldmo.com Failed ads.yieldmo.com Failed 13yr old
0	moloco.com Failed pixelfnt-us.dsp-api.moloco.com Failed 10mo old
329	68

	Domain	Requested by
31	securepubads.g.doubleclick.net	securepubads.g.doubleclick.net go.ezodn.com www.mediafire.com
27	pagead2.googlesyndication.com	go.ezodn.com ep2.adtrafficquality.google 409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net
20	cm.g.doubleclick.net	5 redirects securepubads.g.doubleclick.net google-bidout-d.openx.net 409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com googleads.g.doubleclick.net
20	go.ezodn.com	www.ezojs.com www.mediafire.com go.ezodn.com
19	cdn.flashtalking.com	ajs-assets.ftstatic.com cdn.flashtalking.com
19	g.ezoic.net	www.ezojs.com www.mediafire.com go.ezodn.com
11	ad-delivery.net	btloader.com go.ezodn.com
11	static.mediafire.com	www.mediafire.com
10	www.googleadservices.com	pagead2.googlesyndication.com www.googleadservices.com
8	www.mediafire.com	1 redirects www.mediafire.com go.ezodn.com
7	ad.doubleclick.net	btloader.com go.ezodn.com
6	gum.criteo.com	static.criteo.net gum.criteo.com
5	dsum-sec.casalemedia.com	3 redirects googleads.g.doubleclick.net
5	tpc.googlesyndication.com	409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com
5	ep2.adtrafficquality.google	securepubads.g.doubleclick.net ep2.adtrafficquality.google googleads.g.doubleclick.net
4	ep1.adtrafficquality.google	go.ezodn.com ep2.adtrafficquality.google 409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com
3	pixel.quantserve.com	1 redirects
3	servedby.flashtalking.com	409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com
3	ib.adnxs.com	2 redirects googleads.g.doubleclick.net
3	cdn.2trk.info	ban.jackery.com
3	eb2.3lift.com	3 redirects
3	us-u.openx.net	google-bidout-d.openx.net
3	409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
3	match.adsrvr.org	1 redirects
3	lb.eu-1-id5-sync.com	cdn.id5-sync.com
3	ads.bidsystem.ai	go.ezodn.com
3	analytics.google.com	www.googletagmanager.com go.ezodn.com
3	translate.googleapis.com	go.ezodn.com
3	www.gstatic.com	www.mediafire.com www.gstatic.com
3	api.btloader.com	btloader.com go.ezodn.com
3	www.ezojs.com	www.mediafire.com www.ezojs.com
3	www.googletagmanager.com	www.mediafire.com www.googletagmanager.com
2	idsync.rlcdn.com	2 redirects
2	sync.teads.tv	1 redirects
2	match.360yield.com	2 redirects
2	googleads.g.doubleclick.net	409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com pagead2.googlesyndication.com
2	www.googletagservices.com	www.googleadservices.com
2	sync.1rx.io	2 redirects
2	b1sync.outbrain.com	2 redirects
2	dclk-match.dotomi.com	2 redirects
2	oajs.openx.net	1 redirects www.mediafire.com
2	at.teads.tv
2	image6.pubmatic.com
2	id.hadron.ad.gt
2	d9.flashtalking.com	go.ezodn.com
2	ups.analytics.yahoo.com	go.ezodn.com google-bidout-d.openx.net 409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com
2	id.a-mx.com
2	lexicon.33across.com
2	cdn.jsdelivr.net	securepubads.g.doubleclick.net
2	id5-sync.com	cdn.id5-sync.com go.ezodn.com
2	www.google.ca	www.mediafire.com
2	cdn.id5-sync.com	www.ezojs.com
2	static.xx.fbcdn.net	www.facebook.com
2	ab.dns-finder.com	btloader.com
2	btloader.com	www.mediafire.com btloader.com
1	pixel.rubiconproject.com
1	image2.pubmatic.com
1	pippio.com
1	rules.quantcount.com	secure.quantserve.com
1	secure.quantserve.com	go.ezodn.com
1	agen-assets.ftstatic.com	ajs-assets.ftstatic.com
1	ajs-assets.ftstatic.com	servedby.flashtalking.com
1	s.seedtag.com	1 redirects
1	www.temu.com	1 redirects
1	sync.targeting.unrulymedia.com	1 redirects
1	dis.criteo.com	1 redirects
1	a.c.appier.net	1 redirects
1	ban.jackery.com	409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com
1	bid.2trk.info	www.mediafire.com
1	www.google.com	ep2.adtrafficquality.google 409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com
1	ad.turn.com	1 redirects
1	google-bidout-d.openx.net	oa.openxcdn.net
1	esp.rtbhouse.com	go.ezodn.com
1	privacy-location-edge.ccgateway.net	go.ezodn.com
1	connectid.analytics.yahoo.com	securepubads.g.doubleclick.net
1	invstatic101.creativecdn.com	securepubads.g.doubleclick.net
1	static.criteo.net	securepubads.g.doubleclick.net
1	tags.crwdcntrl.net	securepubads.g.doubleclick.net
1	oa.openxcdn.net	securepubads.g.doubleclick.net
1	carbon-cdn.ccgateway.net	link.rubiconproject.com
1	id.crwdcntrl.net
1	api.rlcdn.com
1	lbs.eu-1-id5-sync.com	cdn.id5-sync.com
1	translate-pa.googleapis.com
1	link.rubiconproject.com
1	d-code.liadm.com
1	fonts.gstatic.com	www.mediafire.com
1	stats.g.doubleclick.net	www.googletagmanager.com
1	www.mediafiredls.com	www.mediafire.com
1	www.google-analytics.com	www.googletagmanager.com
1	econventa.com	cdn.econventa.com
1	api.amplitude.com	cdn.amplitude.com
1	cdn.api.btloader.com	btloader.com
1	cdn.btloader.com	btloader.com
1	www.facebook.com	www.mediafire.com
1	cdn.econventa.com	www.mediafire.com
1	cdn.amplitude.com	www.mediafire.com
1	privacy.gatekeeperconsent.com	the.gatekeeperconsent.com
1	static.cloudflareinsights.com	www.mediafire.com
1	translate.google.com	www.mediafire.com
1	the.gatekeeperconsent.com	www.mediafire.com
1	cmp.gatekeeperconsent.com	www.mediafire.com
0	ads.yieldmo.com Failed	409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com
0	pixelfnt-us.dsp-api.moloco.com Failed	409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com
329	104

This site contains links to these domains. Also see Links.

Domain
download2295.mediafire.com
blog.mediafire.com
www.fast.io
mediafire.zendesk.com
translate.google.com
twitter.com
www.facebook.com
adclick.g.doubleclick.net
ck.2trk.info
adssettings.google.com

Subject Issuer	Validity	Valid
*.mediafire.com Sectigo Public Server Authentication CA DV R36	`2025-08-05` - `2026-07-30`	1yr	crt.sh
gatekeeperconsent.com WE1	`2026-04-04` - `2026-07-03`	3mo	crt.sh
*.google-analytics.com WR2	`2026-04-20` - `2026-07-13`	3mo	crt.sh
btloader.com WE1	`2026-04-01` - `2026-06-30`	3mo	crt.sh
www.ezojs.com WE1	`2026-04-12` - `2026-07-11`	3mo	crt.sh
*.google.com WR2	`2026-04-20` - `2026-07-13`	3mo	crt.sh
cloudflareinsights.com WE1	`2026-04-17` - `2026-07-16`	3mo	crt.sh
cdn.amplitude.com Amazon RSA 2048 M01	`2025-10-15` - `2026-11-13`	1yr	crt.sh
econventa.com WE1	`2026-05-08` - `2026-08-06`	3mo	crt.sh
*.facebook.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2026-02-20` - `2026-05-21`	3mo	crt.sh
ad-delivery.net WE1	`2026-04-26` - `2026-07-25`	3mo	crt.sh
*.doubleclick.net WR2	`2026-04-20` - `2026-07-13`	3mo	crt.sh
ab.dns-finder.com WR3	`2026-04-01` - `2026-06-30`	3mo	crt.sh
*.amplitude.com Amazon RSA 2048 M04	`2025-12-02` - `2026-12-30`	1yr	crt.sh
api.btloader.com WR3	`2026-05-01` - `2026-07-30`	3mo	crt.sh
ezodn.com WE1	`2026-04-01` - `2026-06-30`	3mo	crt.sh
ezoic.net E8	`2026-05-09` - `2026-08-07`	3mo	crt.sh
*.gstatic.com WR2	`2026-04-20` - `2026-07-13`	3mo	crt.sh
upload.video.google.com WR2	`2026-04-20` - `2026-07-13`	3mo	crt.sh
id5-sync.com WE1	`2026-03-16` - `2026-06-14`	3mo	crt.sh
mediafiredls.com WE1	`2026-04-28` - `2026-07-27`	3mo	crt.sh
*.g.doubleclick.net WR2	`2026-04-20` - `2026-07-13`	3mo	crt.sh
*.google.ca WR2	`2026-04-20` - `2026-07-13`	3mo	crt.sh
*.liadm.com Amazon RSA 2048 M04	`2025-09-30` - `2026-10-28`	1yr	crt.sh
*.rubiconproject.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2026-03-25` - `2026-09-30`	6mo	crt.sh
bidsystem.ai WE1	`2026-03-26` - `2026-06-24`	3mo	crt.sh
eu-1-id5-sync.com R12	`2026-05-01` - `2026-07-30`	3mo	crt.sh
*.criteo.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2026-03-26` - `2026-06-26`	3mo	crt.sh
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2025 Q2	`2025-06-02` - `2026-07-04`	1yr	crt.sh
*.33across.com Sectigo Public Server Authentication CA DV R36	`2025-09-12` - `2026-09-30`	1yr	crt.sh
id.a-mx.com E8	`2026-04-19` - `2026-07-18`	3mo	crt.sh
*.pubgw.ads.yahoo.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2026-04-20` - `2026-06-10`	2mo	crt.sh
*.flashtalking.com Amazon RSA 2048 M04	`2025-06-30` - `2026-07-29`	1yr	crt.sh
id.hadron.ad.gt WE1	`2026-05-03` - `2026-08-01`	3mo	crt.sh
*.rlcdn.com Sectigo Public Server Authentication CA DV R36	`2026-02-05` - `2027-03-05`	1yr	crt.sh
*.crwdcntrl.net Amazon RSA 2048 M04	`2025-08-09` - `2026-09-07`	1yr	crt.sh
*.pubmatic.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2026-02-18` - `2027-03-19`	1yr	crt.sh
*.teads.tv Thawte TLS RSA CA G1	`2026-03-29` - `2026-10-13`	7mo	crt.sh
*.adsrvr.org GlobalSign GCC R3 DV TLS CA 2020	`2026-03-04` - `2027-04-02`	1yr	crt.sh
ccgateway.net E7	`2026-03-03` - `2026-06-01`	3mo	crt.sh
oa.openxcdn.net WR3	`2026-04-18` - `2026-07-17`	3mo	crt.sh
*.criteo.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2026-03-09` - `2026-06-05`	3mo	crt.sh
invstatic101.creativecdn.com WR3	`2026-03-26` - `2026-06-24`	3mo	crt.sh
connectid.analytics.yahoo.com GlobalSign ECC OV SSL CA 2018	`2026-01-12` - `2026-07-09`	6mo	crt.sh
esp.rtbhouse.com WR3	`2026-05-08` - `2026-08-06`	3mo	crt.sh
adtrafficquality.google WR2	`2026-04-20` - `2026-07-13`	3mo	crt.sh
*.openx.net RapidSSL TLS RSA CA G1	`2025-08-12` - `2026-08-19`	1yr	crt.sh
2trk.info WE1	`2026-04-05` - `2026-07-04`	3mo	crt.sh
ban.jackery.com WR3	`2026-04-24` - `2026-07-23`	3mo	crt.sh
tpc.googlesyndication.com WR2	`2026-04-20` - `2026-07-13`	3mo	crt.sh
*.googleadservices.com WR2	`2026-04-20` - `2026-07-13`	3mo	crt.sh
servedby.flashtalking.com R12	`2026-05-08` - `2026-08-06`	3mo	crt.sh
*.ftstatic.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2026-03-10` - `2026-09-24`	7mo	crt.sh
quantserve.com R13	`2026-04-15` - `2026-07-14`	3mo	crt.sh

This page contains 22 frames:

Primary Page: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file
Frame ID: 2B05AD5C22DB6685331249CC2B3DF914
Requests: 200 HTTP requests in this frame

Frame: https://www.mediafire.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/883a1f27d85f/main.js
Frame ID: 9A55801BA76F3444E8DD4BA76702924F
Requests: 2 HTTP requests in this frame

Frame: https://www.facebook.com/plugins/like.php?href=http://www.facebook.com/MediaFire&width=193&layout=button_count&action=like&show_faces=false&share=true&height=30&appId=124578887583575
Frame ID: 6073B0222EAD9CCBCB14941DA665CE3E
Requests: 3 HTTP requests in this frame

Frame: https://cdn.btloader.com/cchecker.html?upapi=true
Frame ID: B4C493C962B673E28D8767D835C7D467
Requests: 1 HTTP requests in this frame

Frame: https://btloader.com/trustedIframe.html?o=5678961798414336&upapi=true
Frame ID: 14B1E427FD202FC65F235F2B3B6B02C8
Requests: 1 HTTP requests in this frame

Frame: https://translate-pa.googleapis.com/v1/supportedLanguages?client=te&display_language=en-US&key=AIzaSyBWDj0QJvVIx8XOhRegXX5_SrRWxhT5Hs4&callback=callback
Frame ID: BE363CB76EF962C0EBC3630A54929B1B
Requests: 1 HTTP requests in this frame

Frame: https://cm.g.doubleclick.net/partnerpixels?gdpr=0&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F28rrtqxs0afdpk3%2FGambonanza-v1.0.16-full-apkvision.apk%2Ffile
Frame ID: B57E8BF3C6AFDDDA55FA95D81979A61E
Requests: 1 HTTP requests in this frame

Frame: https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html
Frame ID: D967994E3AAECFE4087E8B2EC0658155
Requests: 1 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=www.mediafire.com&gdpr=0&gdpr_consent=
Frame ID: CF9C9DF04182D04B48114280B4D76244
Requests: 2 HTTP requests in this frame

Frame: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Frame ID: 095093532D08765BCD0DF32F0248C692
Requests: 6 HTTP requests in this frame

Frame: https://ep2.adtrafficquality.google/sodar/sodar2/254/runner.html
Frame ID: D63B293438B98D2EE21DC4F0365B46A5
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 7AEB7ACAFD3B916C2782E2A1379E2DDC
Requests: 2 HTTP requests in this frame

Frame: https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html
Frame ID: D33CC754B37AB43DB5670B865B28AF44
Requests: 14 HTTP requests in this frame

Frame: https://ban.jackery.com/rtgban?bannerparamv1=size=160::cmpId=64763::bmpclickURL=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCS8JR4pYFapKZOPeL8LAP8Oad6QnPlantgwHns7mozAzAjbcBEAEg9PnGJWD96KKB8APIAQngAgCoAwHIAwKqBOgCT9AkqdFGlZ83gcu9nQTdCxS8YXcXoht8kC_0H9WxhOQiVHeQ1q211WOLnFSjU-V-lee8EtzRyHfE5HMqRFKuSRNMHlu5rU-fdcqXYKzVc9hbxPRicOQPnOpIoy6BlHejyk8a02UWfdRdXd_JCDoOWWzPJh3HhU7G7MLY-XyOZSWinz1VeMOCLO5pvfuZa26mEQHiqbkiGWWSx7zzedUL8fayFUDMPGOJPkS23aJOqCAvPj9ZAlU285gV1Z2_m4TgOZOQiNvjlLPCMbxFLOZKHHHE1KXKKS9KA8qRBxf5vi9uJlCEa-wPArWc9d6-4OuJYj9EUAM1_rUnP7azcKEno8LrakbDL9GMHfX1n0z0EfmtTFUhuKmqmkIZq2vOSsD-5mcBsia6EtGjZWSx1o6s2caWYXbJpkRsxpDXi2l6mUfkk95wJ9iqg9sApsgFfKqOZpLLqWmenrZh9iwk9Eav8d5AOg9KbrEV4AQBgAazuuS9pdr733GgBiGoB5PYsQKoB5TYsQKoB5XYsQKoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7ECqAetvrECqAe_07EC2AcA0gguCIBhEAEyCIqCgICAgIAIOg-AQIDAgICAgKiAAqiDgBBIvf3BOljIx9vMvLiUA_oLAggBgAwBqg0CQ0HiDRMIlvvbzLy4lAMV9wUcAB1wcyed6g0TCLv83My8uJQDFfcFHAAdcHMnnYgO____________AdAVAYAXAbIXEBgMKgozMzQ1MzgzNzc0UAGqGBcJAQAAAAZqGEESCjMzNDUzODM3NzQYAQ%26num%3D1%26sig%3DAOD64_17ao8IIbxS2oWrOWbBft5CRZXXqw%26client%3Dca-pub-6396844742497208%26adurl%3Dhttps%3A%2F%2Fban.jackery.com%2Fclick%3FrequiredParamsv1%3DH4sIAAAAAAAA_31TbW_aMBD-K1GlSq2ozfk1NvtEadetL4wV1pd9QQaSNU0gaUgAIf_4XdJ-aLdpupz9-FHuzj4_PtCeafAawA_6Qw-t3eSrqoxcdjLok-8DT5hX0mophRVGGmWVtqYNAyrQQTNjwYQm9MIPPWtH5XWLZRM-bKFpmKKeES2sNlKGkksbcjCeq7fKjQ1bl17LUAtf5Ovp9tlN6zVWUp6JkFqQmI2B4BrzgxKMSpw8O4GP5q3nwDUBRZh8DQ9xl4ohi4W9DKdtESJIcxoG0EPHgUIPjf7hvuHfOXbsfHx-UT6ml-yeFZvTHw-nc57m39TU-Mm4s-gUi12n6iw2CAWC8QQBV5260yx-4gLLIjz92kAGxmjcllUWubOG-7vtGHs2Hl0_YofCUMgZKEWEcIxIZTmZhS4mPBI2jhzEds7xt5t8n2SZ6yoKwdEDY5-C62RV74Kd0Xj646BfFFl0H82ukqqrsLtCB0dXXyY31ydBlqRRcBHN0_w4GDyV-TLqMmkoNBaMXezK5C3Ej_e_JrW4vd29XA3S_fPdaDM6f9miEp6qqlgfiv4h_4zfdruly2iRuDgpIzrPl8jFSRbhxE1ZVi-7Nbh4UaQCmQu3nOUrt9o7ssF2U6ZJXGcZcUW6SdZJvqKI3hK0yqnKOmpuEVq5oXOcXkX1T9m9b_l_L7PVb5NX0FA1ivdMdkF1G3UFYHuM91B_Qz-9Gw3aRzFs1fbhpCh_ykCjeilHNWLKg99RaS0HfQMAAA%253Bdurl155%3D::bamt=agWW4gAODJIAHAX3ACdzcHTob1_pi71zlTC6iQ::mode=4::label=::ul15=
Frame ID: 4CAA9DA970AE20B56CD96D69C662F907
Requests: 4 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: B65D45A1B1AEEBF77BDEBF5CAA1E9491
Requests: 9 HTTP requests in this frame

Frame: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.html
Frame ID: 6A21600D82161AD23041333B9E10686F
Requests: 8 HTTP requests in this frame

Frame: https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html
Frame ID: A358DDF92D42D3249127DAEA9D128E9A
Requests: 24 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CI__1AIQoIHhnQIYwuGB4gEwAQ&v=APEucNXLP7JnI5hsBi9LCRRPX3AEFH9O2vWuThz1Thb3R3YP5cpNUfpBm5LFoAeWSglnMgkqJmilODxsu2jkyFRh2WxMB_9IKYIPYy6cc3KG1tl-UVOfXqw
Frame ID: 36EEAC19FA757A25E2631E671DADFA47
Requests: 5 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 441A169E3721D1F7D3D542DC7873C43E
Requests: 9 HTTP requests in this frame

Frame: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.html
Frame ID: 93353E4BDACE8B39C34F970DCAE4E362
Requests: 8 HTTP requests in this frame

Frame: https://ep2.adtrafficquality.google/sodar/Klz6NWr5.html
Frame ID: C9FA5D7B6FA18A3BFF3E1FC7122467F7
Requests: 3 HTTP requests in this frame

Frame: https://cdn.flashtalking.com/118908/3176836/index.html
Frame ID: 7D278E7542D211A5BC94CDBE5F81C7B3
Requests: 19 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Gambonanza-v1.0.16-full-apkvision

Detected technologies

Onsen UI (Mobile frameworks) Expand

Overall confidence: 100%
Detected patterns

(/.*onsen.*min\.js|.*angular-onsenui\.min\.js)

Snowplow Analytics (Analytics) Expand

Overall confidence: 50%
Detected patterns

sp\.js

Amplitude (Analytics) Expand

Overall confidence: 100%
Detected patterns

cdn\.(?:segment.+)?amplitude(?:\.com|-plugins)

AppNexus (Advertising) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Cloudflare Browser Insights (Analytics) Expand

Overall confidence: 100%
Detected patterns

static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

DoubleClick Ad Exchange (AdX) (Advertising) Expand

Overall confidence: 100%
Detected patterns

tpc\.googlesyndication\.com/safeframe

DoubleClick Floodlight (Advertising) Expand

Overall confidence: 100%
Detected patterns

\.doubleclick\.net

Google AdSense (Advertising) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js
google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag managers) Expand

Overall confidence: 100%
Detected patterns

\.googletagmanager\.com/
googletagmanager\.com/gtm\.js

OpenX (Advertising) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

PubMatic (Advertising) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.pubmatic\.com

Quantcast Measure (Analytics) Expand

Overall confidence: 100%
Detected patterns

\.quantserve\.com/quant\.js

Rubicon Project (Advertising) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

cdn\.jsdelivr\.net

33Across (Advertising) Expand

Overall confidence: 100%
Detected patterns

\.33across\.com/

Cloudflare Bot Management (Security) Expand

Overall confidence: 100%
Detected patterns

Ezoic (Analytics) Expand

Overall confidence: 100%
Detected patterns

\.ezo(?:js|ic|dn)\.(?:com|net)

Google Publisher Tag (Advertising) Expand

Overall confidence: 100%
Detected patterns

securepubads\.g\.doubleclick.net/tag/js/gpt\.js

ID5 (Advertising) Expand

Overall confidence: 100%
Detected patterns

^https://(?:cdn\.)?id5-sync\.com/

LiveIntent (Email) Expand

Overall confidence: 100%
Detected patterns

\.liadm\.com

Teads (Advertising) Expand

Overall confidence: 100%
Detected patterns

teads\.tv

theTradeDesk (Advertising) Expand

Overall confidence: 100%
Detected patterns

\.adsrvr\.org/

Page Statistics

329
Requests

89 %
HTTPS

0 %
IPv6

68
Domains

104
Subdomains

84
IPs

4
Countries

3387 kB
Transfer

12956 kB
Size

127
Cookies

16 Outgoing links

These are links going to different origins than the main page.

URL: https://download2295.mediafire.com/o1vupk1o7lfgX3TmusZPreNX8eM8b-6Pctm9yOP3sCgjiZln_VV7_H9HCBi-xR50jUjl-qSm4bsuQmAbbKeBmYaSu-jFWYdjkGvifIz5HeFWKQAqd6uShBVQgtwCnOx4bQW2V0T3LksQYs2DCJXLCXLnrQ2lw1BWmvxvw8GCmJVw/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk
Title: Download (105.21MB)

Search URL Search Domain Scan URL

URL: http://blog.mediafire.com/
Title: Company Blog

Search URL Search Domain Scan URL

URL: https://www.fast.io/?utm_source=mfftr_file
Title: Cloud Storage for Teams

Search URL Search Domain Scan URL

URL: https://www.fast.io/alternatives?utm_source=mfftr_file
Title: Compare

Search URL Search Domain Scan URL

URL: https://www.fast.io/alternatives/dropbox?utm_source=mfftr_file
Title: Dropbox Alternative

Search URL Search Domain Scan URL

URL: https://www.fast.io/alternatives/box?utm_source=mfftr_file
Title: Box.com Alternative

Search URL Search Domain Scan URL

URL: https://www.fast.io/alternatives/google-drive?utm_source=mfftr_file
Title: Google Drive Alternative

Search URL Search Domain Scan URL

URL: https://mediafire.zendesk.com/hc/en-us
Title: Support

Search URL Search Domain Scan URL

URL: https://translate.google.com/
Title: Translate

Search URL Search Domain Scan URL

URL: https://twitter.com/#!/mediafire

Search URL Search Domain Scan URL

URL: https://www.facebook.com/mediafire

Search URL Search Domain Scan URL

URL: https://twitter.com/mediafire
Title: Twitter Page

Search URL Search Domain Scan URL

URL: https://blog.mediafire.com/
Title: MediaFire Blog

Search URL Search Domain Scan URL

URL: https://adclick.g.doubleclick.net/aclk?sa=L&ai=CS8JR4pYFapKZOPeL8LAP8Oad6QnPlantgwHns7mozAzAjbcBEAEg9PnGJWD96KKB8APIAQngAgCoAwHIAwKqBOgCT9AkqdFGlZ83gcu9nQTdCxS8YXcXoht8kC_0H9WxhOQiVHeQ1q211WOLnFSjU-V-lee8EtzRyHfE5HMqRFKuSRNMHlu5rU-fdcqXYKzVc9hbxPRicOQPnOpIoy6BlHejyk8a02UWfdRdXd_JCDoOWWzPJh3HhU7G7MLY-XyOZSWinz1VeMOCLO5pvfuZa26mEQHiqbkiGWWSx7zzedUL8fayFUDMPGOJPkS23aJOqCAvPj9ZAlU285gV1Z2_m4TgOZOQiNvjlLPCMbxFLOZKHHHE1KXKKS9KA8qRBxf5vi9uJlCEa-wPArWc9d6-4OuJYj9EUAM1_rUnP7azcKEno8LrakbDL9GMHfX1n0z0EfmtTFUhuKmqmkIZq2vOSsD-5mcBsia6EtGjZWSx1o6s2caWYXbJpkRsxpDXi2l6mUfkk95wJ9iqg9sApsgFfKqOZpLLqWmenrZh9iwk9Eav8d5AOg9KbrEV4AQBgAazuuS9pdr733GgBiGoB5PYsQKoB5TYsQKoB5XYsQKoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7ECqAetvrECqAe_07EC2AcA0gguCIBhEAEyCIqCgICAgIAIOg-AQIDAgICAgKiAAqiDgBBIvf3BOljIx9vMvLiUA_oLAggBgAwBqg0CQ0HiDRMIlvvbzLy4lAMV9wUcAB1wcyed6g0TCLv83My8uJQDFfcFHAAdcHMnnYgO____________AdAVAYAXAbIXEBgMKgozMzQ1MzgzNzc0UAGqGBcJAQAAAAZqGEESCjMzNDUzODM3NzQYAQ&num=1&sig=AOD64_17ao8IIbxS2oWrOWbBft5CRZXXqw&client=ca-pub-6396844742497208&adurl=https://ban.jackery.com/click?requiredParamsv1=H4sIAAAAAAAA_31TbW_aMBD-K1GlSq2ozfk1NvtEadetL4wV1pd9QQaSNU0gaUgAIf_4XdJ-aLdpupz9-FHuzj4_PtCeafAawA_6Qw-t3eSrqoxcdjLok-8DT5hX0mophRVGGmWVtqYNAyrQQTNjwYQm9MIPPWtH5XWLZRM-bKFpmKKeES2sNlKGkksbcjCeq7fKjQ1bl17LUAtf5Ovp9tlN6zVWUp6JkFqQmI2B4BrzgxKMSpw8O4GP5q3nwDUBRZh8DQ9xl4ohi4W9DKdtESJIcxoG0EPHgUIPjf7hvuHfOXbsfHx-UT6ml-yeFZvTHw-nc57m39TU-Mm4s-gUi12n6iw2CAWC8QQBV5260yx-4gLLIjz92kAGxmjcllUWubOG-7vtGHs2Hl0_YofCUMgZKEWEcIxIZTmZhS4mPBI2jhzEds7xt5t8n2SZ6yoKwdEDY5-C62RV74Kd0Xj646BfFFl0H82ukqqrsLtCB0dXXyY31ydBlqRRcBHN0_w4GDyV-TLqMmkoNBaMXezK5C3Ej_e_JrW4vd29XA3S_fPdaDM6f9miEp6qqlgfiv4h_4zfdruly2iRuDgpIzrPl8jFSRbhxE1ZVi-7Nbh4UaQCmQu3nOUrt9o7ssF2U6ZJXGcZcUW6SdZJvqKI3hK0yqnKOmpuEVq5oXOcXkX1T9m9b_l_L7PVb5NX0FA1ivdMdkF1G3UFYHuM91B_Qz-9Gw3aRzFs1fbhpCh_ykCjeilHNWLKg99RaS0HfQMAAA;durl155=https%3A%2F%2Fban.jackery.com%2Fclick%3Fc15%3D229897%3A%3AuniId%3D177875120356130088219090588575129964405347%3A%3Aul15%3Dhttps%253A%252F%252Fwww.jackery.com%252Fproducts%252Fexplorer-1000-portable-power-station%253Futm_source%253Dpreciso%2526utm_medium%253Dcpc%2526utm_campaign%253DPrecisoC%2526n_c15%253D%257Bconversion_id%257D%2526n_i15%253D%257Bimpression_id%257D

Search URL Search Domain Scan URL

URL: https://ck.2trk.info/adchoice/Optout-in.aspx

Search URL Search Domain Scan URL

URL: https://adssettings.google.com/whythisad?source=display&reasons=AZwrskXq3GjFS1bGY2M5wJgQfiHkW3h7oVJX2Ux1WcyA_eEdqlcUfsFSdT433RqtvGy14PWtlM1wVrp6h3wIqAiMfwWi3odpqMVw5gzXxK0wB3gbCt_vb1mo_m8Zw09bWWjtqpOpLiC1iWZ0P9jWjT0i6Iji4nyLVUHwbTo8yxa3Az02VzLUMuQNKa5T4QPto_D-bCBgEjeE4nCYF3Mw3kfOXRp4j9iPQzCKYGOXvEPBLWjson7stBWxjGi8Z8MyEZwR5hiOcSpGRyGhaSXUDQP1E_tHXfHJZRPDA4ehzdVmkIPqRSU3ggnAG1nvcw75ikYL3EBz27Y5yLwR__GRLWePj4_-kle3l2TLWrfLlqjGGj5yOX7Wp0QbCXYi7PV2V3xScZ44ORUKcLdwx8p6m8SSVgLjon-9PzBceDvr9Bf9cz1nOzqmaJ3wle3m2OBf29CbzYGX4JXUpbD1NpcL6vVKhO5-QE4ShfmrXEQJCcEE_P9-fzhcwAqsDVndJ1BkZKmchkZcVCMQ6S6TmfOtSFh_J-hXLOODQKPx_HQ7YIyP1mUIpEhwSIlEhQi_VdnPtY2UhFZ_mL4HpwXvb-WmFpjsKrA0zzA5wRF9GzxpJwSF06kG4JQ1nkosyHXTB1jXP147d5Nj5KjhSIhd3QRzsvgaOf_HJrvx89NaGwYAOcEVPeJJpNuV9KQRUSeHcUC-OO-2Pb6Nmo1A1kjYwqfoysaGFc7613Np0uN8LC6Kr-F8qb5n0b9eyp1NYubQWBruX1xOmwVS_PaIqaR8lzva-Ax4MoieBvik43CoP7xNYCS97gjA0x-i8lk04OQnDsPwFsP_CzplnMJlTUUGwX74lQ9gxP8Xqj0bHEgD9FzjSVpF1THCLB370RxrofN2iAQfukvk1uCx12vsrP_2S_gNO_vMQ5opXsZqeUIOqQWc1P4tMZaziAb7Vnp8JBHQ-zMHGL0FUXo8PL5gDqCuMQo7bJiJJQol6q0d2XHVdZYYrx__OwTxmh3ljo0sComtb9h7R_IkIWVkSxdxqCat5ctedU9VO7j5wc1rhlumUdU0siGiJfXRMWRBJW2X_QKh1NRoX77oSyLKlmf722ynccaAEe0GDJxN4zMrWVMh8U6YoHXIeEAxlSr3Y67Mbaoy_ZUF8y79C5lHTfKYmD2T5iqfKiYHXh-mDuex32F9u85WyxoPG_0xKIAUAhY_8x5eiaDnwHCFPPCmOzp49WY-SDpca2MXmnqZDIGG7f6866eokw1xffyrzDs7HVy-v_DTl4xoHXRYKU8_ljFWtEbuXo8Lsk1TVUAVWxEzB6gR8MLqnwUn70XeOh9Zz3cS4-lfgDwFXT8QIZmShCP3xU2fFd9cb6Y2S99ytDOJvR2T-7CZHdgQM4kmykDJOAmXHtK-_J9n0TLb3kosD9-7Q-YPT8npG7zS97gqrCObk1xw3rQmHG5IT3o947AKvXOXFqo73ObehZuIBO9KGHgz30hbuqbTMq-138reAgxP-v5apycOnaYhpd7eUveaF0TZDKyzu7MloWVk_k23eqM9EaUKdErHVnh7301ru039YCnX86bAGa_-Uwc8IGFiqNgguk_u4KcJOOxkFxpor1QOeM2kQOYMSwbiFC6lUN0ymQ06T18sAw6jKwiSMlKygYESNmu_EYR3EgPrfx_zzWM4ahF3GByZgrfHByckH9XIrjoJ2aHVgdf8Y9kdlAXeu7tDlHqH-o9XIAms5QNMRwaQXfyyFLa377-APZ4TwFLgcILRtzwLw3wzUOq2rZugdvpPuN6e4t-mMd--vhAKNmQGrdiJxLCIr4z7Pt62RFqF8cD2ycAE1vcONpcVLGlOxDuoA2_Q8L5neV-MLO4tL9L0xjZUJ2VDvTatB9KkK4hv8dDdUv88lf-8xLDY5sSc6kmvJtTRS4K3sCDqHimypBTSmbe12hP4nmrfrLbvzrtThhzYoZCyaOYOTJELEyr1YmM2eBLcdPeqYv7wMoNGU-lNyZ2B92YdKZDxw2QaoqyDq8opp4QET2UbCNbFqe0MqzFgoSCs4EpGL9Jj_1vmxa9tY5G4Zcwi2HCl7f9WoXFtjWzMq5cxQEeAY-1BeX9SrIUcUr_9MtCymzGG4QWcqwQFwz5f8HA_6dwpoOxytk_5LU4flrUO9_A9Z_aKHzVrMtm4tJDis8eM30HtyD1oOjryLI4mPTibZ_S38FrPOINPJAHTiE5BvVc2R_BNTAErPU7IQIzFBk4LmxZ7sJw3Vd_Ev120Cmec1vVrnmDNmY5RzHnv2HXQ0pzWsIo_D3mJAkwsTgKDouX_do_18RNN43XwvIGDjihodGYBSeM1UYuIvVqeUhK9OMGo7YgX7Q9dEi8uaatrJSQt99grwkJ8DSLnS7MS4w5HKQQyadb78mCZULaLXdx-Ug2Av2ouYuS2oB-vOpD6Sx83BylwgXyF8-w0drqALa68uNselvmxs_n8uOEFODMJD2jqFxoyBZsxMyT6F_K9VZDeuO768Rq6vash-5odxYX1ZZ8m-dyqBGcd&opi=122715837

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 18

https://www.mediafire.com/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
https://www.mediafire.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/883a1f27d85f/main.js

Request Chain 149

https://oajs.openx.net/esp?url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F28rrtqxs0afdpk3%2FGambonanza-v1.0.16-full-apkvision.apk%2Ffile&rid=esp HTTP 302
https://oajs.openx.net/esp?url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F28rrtqxs0afdpk3%2FGambonanza-v1.0.16-full-apkvision.apk%2Ffile&rid=esp&cc=1

Request Chain 159

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEChrZC19b3btSVQbS_nrp80&google_cver=1

Request Chain 161

https://match.adsrvr.org/track/cmf/openx?oxid=efef7276-7110-7fd7-f441-b1bf080feb9d&gdpr=0 HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072971&val=54db8cce-f533-4d32-8b2f-cf501c4e6f79&ttd_puid=efef7276-7110-7fd7-f441-b1bf080feb9d&gdpr=0&gdpr_consent=

Request Chain 163

https://ad.turn.com/r/cs?pid=9&gdpr=0 HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537073061&val=4534177538656440189&gdpr=0&gdpr_consent=&us_privacy=

Request Chain 212

https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEJikFPI0tJ4BT2fhJ0UiZhA&google_cver=1&google_push=AXcoOmQCTKlZDZxyzDvaEcWtqoXIBcNqb2LWavNueml4NQjZDMmZtdFrNEvc9IDwy8N1FdW5_Qni836p1ID1Q2Rs-5iSt-731Y1Q HTTP 302
https://dclk-match.dotomi.com/match/bounce/current?DotomiTest=cb2d2b14821205&is_secure=true&networkId=14000&version=1&google_gid=CAESEJikFPI0tJ4BT2fhJ0UiZhA&google_cver=1&google_push=AXcoOmQCTKlZDZxyzDvaEcWtqoXIBcNqb2LWavNueml4NQjZDMmZtdFrNEvc9IDwy8N1FdW5_Qni836p1ID1Q2Rs-5iSt-731Y1Q HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AQAH4HZRddSUcQJ8ZgseAQEBAQEBAQCfJNRoxQEBAJ8k1GjF&expiration=1778837603&google_cver=1&is_secure=true&google_gid=CAESEJikFPI0tJ4BT2fhJ0UiZhA&google_push=AXcoOmQCTKlZDZxyzDvaEcWtqoXIBcNqb2LWavNueml4NQjZDMmZtdFrNEvc9IDwy8N1FdW5_Qni836p1ID1Q2Rs-5iSt-731Y1Q

Request Chain 213

https://a.c.appier.net/gcm?google_gid=CAESEONEhbZtuvtFMB1Rbk-dPMc&google_cver=1&google_push=AXcoOmQUunc5FlcXeB1t3h-GPbzkaQG8O_xss3tGqhu398sltseRRX7qoa2jfnfOMnUX66AuRMGY4hJlRKRTz-9OGxvU_51ywp8z HTTP 302
https://cm.g.doubleclick.net/pixel?google_hm=RnRZMWduZnhDdlc5ZzlxQTVaWUZhZw%3D%3D&google_nid=appier&google_push=AXcoOmQUunc5FlcXeB1t3h-GPbzkaQG8O_xss3tGqhu398sltseRRX7qoa2jfnfOMnUX66AuRMGY4hJlRKRTz-9OGxvU_51ywp8z

Request Chain 215

https://dis.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DAXcoOmQEqYgIiTmp3KqWpU5j-0Ha8IJTgbHP8BDOLog9P_D8OVfEx-MgEFj2stDH5IkSh6iqCoPGdtXfFUNehV8ty5DCw_3421I&google_gid=CAESEFEQouK7nR95KYDJsFt7P_I&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_hm=ay1sMnEtbWxsb0J3bnBoUC1jTVhfZHhCTDVaWG9iLWhtNWtERlpxQQ&google_push=AXcoOmQEqYgIiTmp3KqWpU5j-0Ha8IJTgbHP8BDOLog9P_D8OVfEx-MgEFj2stDH5IkSh6iqCoPGdtXfFUNehV8ty5DCw_3421I

Request Chain 216

https://b1sync.outbrain.com/usersync/googleadx/?google_gid=CAESEFEffKH-xuGSRpAG7neB7yQ&google_cver=1&google_push=AXcoOmSCVSz3rcJTOUtIPnuwwoGQY9h868UFKR_xsg3qvc_Y-d4UmhCg_6cj3pvh44Jxenm4rHSvNnL2My4oSRuvj5B-0KMNsmAw HTTP 302
https://b1sync.outbrain.com/usersync/googleadx/?google_cver=1&google_gid=CAESEFEffKH-xuGSRpAG7neB7yQ&google_push=AXcoOmSCVSz3rcJTOUtIPnuwwoGQY9h868UFKR_xsg3qvc_Y-d4UmhCg_6cj3pvh44Jxenm4rHSvNnL2My4oSRuvj5B-0KMNsmAw&s=3 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AXcoOmSCVSz3rcJTOUtIPnuwwoGQY9h868UFKR_xsg3qvc_Y-d4UmhCg_6cj3pvh44Jxenm4rHSvNnL2My4oSRuvj5B-0KMNsmAw&google_hm=MTkyZjBiN2UtZjI5Mi00N2M2LTlhMDAtODMzOTAzYjIxYzdk

Request Chain 217

https://sync.1rx.io/usersync2/rmpssp?sub=google&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3D%5BRX_SPD%5D%26google_hm%3D%5BRX_UUID_B64_BIN%5D&google_gid=CAESEAFy_69kDPWn1gtnisnrBHE&google_cver=1&google_push=AXcoOmSBndEsvLrCfVU_s_GITxUmlP3Y3QCS_3NVlXMNXayQ6_6NvTw7zKgdJio3nk-NVKi3y80vn3s6Zv9OBeUrl9RilYDFVpEV HTTP 302
https://sync.1rx.io/usersync2/rmpssp?sub=google&zcc=1&google_push=AXcoOmSBndEsvLrCfVU_s_GITxUmlP3Y3QCS_3NVlXMNXayQ6_6NvTw7zKgdJio3nk-NVKi3y80vn3s6Zv9OBeUrl9RilYDFVpEV&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3D%5BRX_SPD%5D%26google_hm%3D%5BRX_UUID_B64_BIN%5D&cb=1778751203848 HTTP 302
https://sync.targeting.unrulymedia.com/csync/RX-887cccaf-2990-4ba0-a4b3-657242c1e091-005?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3DAXcoOmSBndEsvLrCfVU_s_GITxUmlP3Y3QCS_3NVlXMNXayQ6_6NvTw7zKgdJio3nk-NVKi3y80vn3s6Zv9OBeUrl9RilYDFVpEV%26google_hm%3DBYh8zK8pkEugpLNlckLB4JE HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AXcoOmSBndEsvLrCfVU_s_GITxUmlP3Y3QCS_3NVlXMNXayQ6_6NvTw7zKgdJio3nk-NVKi3y80vn3s6Zv9OBeUrl9RilYDFVpEV&google_hm=BYh8zK8pkEugpLNlckLB4JE

Request Chain 218

https://eb2.3lift.com/ebda?sync=1&google_gid=CAESEJhWOR95tPRISSR_KmTdo_o&google_cver=1&google_push=AXcoOmQMMnHzU79MQ_63kEM-mhGWZzqbNLHgqp8naO227JC9jRbeLhca5AsrPCF7YOMrc-DFVv37vdD-QYZoj6NaLK5ydS5BusD7 HTTP 302
https://eb2.3lift.com/ebda?sync=1&google_gid=CAESEJhWOR95tPRISSR_KmTdo_o&google_cver=1&google_push=AXcoOmQMMnHzU79MQ_63kEM-mhGWZzqbNLHgqp8naO227JC9jRbeLhca5AsrPCF7YOMrc-DFVv37vdD-QYZoj6NaLK5ydS5BusD7&ld=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_push=AXcoOmQMMnHzU79MQ_63kEM-mhGWZzqbNLHgqp8naO227JC9jRbeLhca5AsrPCF7YOMrc-DFVv37vdD-QYZoj6NaLK5ydS5BusD7&google_hm=MjE2MzkyOTA5NzI4NDkyNjc2MDgyNg%3D%3D

Request Chain 260

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm&gdpr=0 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKSEMMQI3QAdNnf-aMhQJr4&google_cver=1&gdpr=0 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKSEMMQI3QAdNnf-aMhQJr4&google_cver=1&gdpr=0&C=1

Request Chain 261

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&gdpr=0&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&gdpr=0&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=agWW5kt3udUAECBkAF3h5AAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKSEMMQI3QAdNnf-aMhQJr4&google_cver=1

Request Chain 262

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm&gdpr=0 HTTP 302
https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEIlgXo23Yfql0MKtD17dWPk&google_cver=1

Request Chain 263

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}&gdpr=0 HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D%26gdpr%3D0 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjA3ODM3MjU2NDk3NjI3MzE0Mg%3D%3D&gdpr=0

Request Chain 275

https://match.360yield.com/match/ebda?google_gid=CAESEPNFggCbH6hKAqCMsrx38z8&google_cver=1&google_push=AXcoOmRPYAIkTIpB06KDGlHwaEoHjWxDjQhgMQLFkI8niFWJ3ZruoTgmjFm_ZqLD4mf1bFVXUkVb_6wZdwKhH2zPtz3AKHuW_mHPUK_WRQCTiBDcynNDle7FBnaNFjt4wWZUhRbZW2dl0paSlvg58qNO-Irm HTTP 302
https://match.360yield.com/ul_cb/match/ebda?google_gid=CAESEPNFggCbH6hKAqCMsrx38z8&google_cver=1&google_push=AXcoOmRPYAIkTIpB06KDGlHwaEoHjWxDjQhgMQLFkI8niFWJ3ZruoTgmjFm_ZqLD4mf1bFVXUkVb_6wZdwKhH2zPtz3AKHuW_mHPUK_WRQCTiBDcynNDle7FBnaNFjt4wWZUhRbZW2dl0paSlvg58qNO-Irm HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=HHEQ3oz5T3mz6AbpDhCOCg&google_push=AXcoOmRPYAIkTIpB06KDGlHwaEoHjWxDjQhgMQLFkI8niFWJ3ZruoTgmjFm_ZqLD4mf1bFVXUkVb_6wZdwKhH2zPtz3AKHuW_mHPUK_WRQCTiBDcynNDle7FBnaNFjt4wWZUhRbZW2dl0paSlvg58qNO-Irm

Request Chain 276

https://eb2.3lift.com/ebda?sync=1&google_gid=CAESEJhWOR95tPRISSR_KmTdo_o&google_cver=1&google_push=AXcoOmSsDj8FQAzokElMsh0PNko1o4PYZdUZbNeUkg7tV6QCfOGjDxmUABnIXNLZx7LIXyA6-St_oh5zE-eSZMYIneLxi1ArNRKi1mX0LTREgaHaIn13nL0uxtbux3_fItrXLoV5klO5Jtxv9RSjxF1npx6q HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_push=AXcoOmSsDj8FQAzokElMsh0PNko1o4PYZdUZbNeUkg7tV6QCfOGjDxmUABnIXNLZx7LIXyA6-St_oh5zE-eSZMYIneLxi1ArNRKi1mX0LTREgaHaIn13nL0uxtbux3_fItrXLoV5klO5Jtxv9RSjxF1npx6q&google_hm=MjE2MzkyOTA5NzI4NDkyNjc2MDgyNg%3D%3D

Request Chain 277

https://sync.teads.tv/um?ssb_provider_id=3&uid=&google_nid=teadstv_ab&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_ab%26google_hm%3D%5BVID_B64%5D&google_gid=CAESEHSMEtR85qmFlf17kjH8OP0&google_cver=1&google_push=AXcoOmTGdQ5aWV0Ln5EsrkzPrCnaSAKqJ5cp_4o7fznYDGOMOXzSasHJNoGZt_gZM01AFhOwCAubLfTrQsIIGHzt86e5wrxKPNrwrGiT6b-gPiSGLJhUx3hWtP0gwJgpehslVVj8ZUyvT0gRuFXoIx-fAXc_ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_ab&google_hm=NTNlZmVlOWMtNmExYS00ODVmLTgzYTUtYzYxZDA0YWYxYmVk&google_push=AXcoOmTGdQ5aWV0Ln5EsrkzPrCnaSAKqJ5cp_4o7fznYDGOMOXzSasHJNoGZt_gZM01AFhOwCAubLfTrQsIIGHzt86e5wrxKPNrwrGiT6b-gPiSGLJhUx3hWtP0gwJgpehslVVj8ZUyvT0gRuFXoIx-fAXc_ HTTP 302
https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab

Request Chain 278

https://www.temu.com/api/adx/cm/pixel-google?google_gid=CAESEFojXZmPP2fZKt7HgW57CT4&google_cver=1&google_push=AXcoOmTqVpFgSlIDx6mI-VPds0OQjv1a1DkkuApkLpAyKupZL0FNaCuGYbM1YzhFIaGbt9qUqVBI3JNxVllQA17AZeXSoMsgdeGDaQNNRwGUKyyb_Ng8DVUVO31MAt367QWraMLFJ-nSquPstIoHJTNIuMPqVg HTTP 302
https://cm.g.doubleclick.net/pixel?google_push=AXcoOmTqVpFgSlIDx6mI-VPds0OQjv1a1DkkuApkLpAyKupZL0FNaCuGYbM1YzhFIaGbt9qUqVBI3JNxVllQA17AZeXSoMsgdeGDaQNNRwGUKyyb_Ng8DVUVO31MAt367QWraMLFJ-nSquPstIoHJTNIuMPqVg&google_nid=temu_dsp2_

Request Chain 279

https://s.seedtag.com/cs/cookiesync/google?google_gid=CAESEHryUqJDAkVYkiD2uYTJsLs&google_cver=1&google_push=AXcoOmSTgquJb-wtAM0IbrAFk1MIGZqdT_ZuvTBCDn5m84Ic89NfYSbS6jRHVjbUyPaW0POSptoQZ4hmj2IcsDSpC8l6eEGZBDiinm0lkRT1iNW2jTw94VX5c8JOROOX8ctEjDwAxflbfpW2oMr20B94cKTr HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=seedtag_beachfront&google_hm=019e25d5-7870-7735-8a84-73f065971538&google_push=AXcoOmSTgquJb-wtAM0IbrAFk1MIGZqdT_ZuvTBCDn5m84Ic89NfYSbS6jRHVjbUyPaW0POSptoQZ4hmj2IcsDSpC8l6eEGZBDiinm0lkRT1iNW2jTw94VX5c8JOROOX8ctEjDwAxflbfpW2oMr20B94cKTr

Request Chain 317

https://pixel.quantserve.com/cs?a=p-31iz6hfFutd16&gdpr=0 HTTP 302
https://pixel.quantserve.com/cs?a=p-31iz6hfFutd16&gdpr=0&__qcmcs=1

Request Chain 319

https://idsync.rlcdn.com/380609.gif?gdpr=0&partner_uid=PFTZVTMDjFcnB9ACOlbEVD1Q2VQnDdpWPwO8aJS_ HTTP 307
https://idsync.rlcdn.com/1000.gif?memo=CMGdFxIzCi8IARCfOBooUEZUWlZUTURqRmNuQjlBQ09sYkVWRDFRMlZRbkRkcFdQd084YUpTXxAAGg0I6K2W0AYSBQjoBxAAQgBKAA HTTP 307
https://pippio.com/api/sync?pid=5324&it=1&iv=3eeb214efffd8cdbf7c9cc682a207f52955b9d20ac98ed5645699ddaa9a1b716791426b5417dce21&_=2

329 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3 200 Primary Request file Show response
www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/ 326 KB
86 KB 275ms
248ms Document
text/html 104.17.147.83
Cloudflare

General

Check archive.org

Download Go to

Full URL

https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.147.83 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

459ca76bb15524277447818595d3633447cf2f7b70e4d60dfcdf31f2f0b978e2

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

access-control-allow-methods: OPTIONS, POST, GET
access-control-allow-origin: https://www.mediafire.com
alt-svc: h3=":443"; ma=86400
cache-control: no-cache, no-store, must-revalidate, max-age=0, post-check=0, pre-check=0
cf-cache-status: DYNAMIC
cf-ray: 9fb8e68d5c86a2c8-YUL
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Thu, 14 May 2026 09:33:18 GMT
expires: 0
pragma: no-cache
priority: u=0,i
server: cloudflare
server-timing: cfCacheStatus;desc="DYNAMIC" cfEdge;dur=16,cfOrigin;dur=0,cfWorker;dur=211 cfExtPri
strict-transport-security: max-age=0
vary: Accept-Encoding
x-by
x-frame-options: SAMEORIGIN
x-mf-env: liveApi
x-mf-fe: mf1
x-robots-tag: noindex, nofollow

GET
H3 200 min.js Show response
cmp.gatekeeperconsent.com/ 1 KB
805 B 81ms
30ms Script
application/javascript 172.67.199.186
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cmp.gatekeeperconsent.com/min.js
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.199.186 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 345dbaad5cd394bb195e79a7d835ee2af91c02c76413d974f2e7fd3b9fcbfe39

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-encoding: zstd
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=uDZwxxbUQxz9IroieolngC%2B9AYN1Q1%2BSJW4Cpa8V%2BkX8sFCuMGvRc%2B3pfswQntmVoGFzVusvECQ90ub0WVhVwRU3MzW2vse6dqF5i9HViHkR2sIUcIh%2FcyplaPHHKki9PEtkJTRyxeOVE%2Fo8"}]}
cf-ray: 9fb8e6916c915163-YYZ
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 14 May 2026 09:33:18 GMT
content-type: application/javascript
server: cloudflare
priority: u=1,i=?0

GET
H3 200 cmp.min.js Show response
the.gatekeeperconsent.com/ 8 KB
3 KB 78ms
30ms Script
application/javascript 172.67.199.186
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://the.gatekeeperconsent.com/cmp.min.js
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.199.186 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 06c87cfc79d31896761b14ed789b3f747f1b885dac0ed193c16fb8d1d305083d

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-robots-tag: noindex, follow
content-encoding: gzip
cf-cache-status: HIT
age: 258
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=auzvdWXd0EOqO%2BdyIgdRl2mCKdv%2BS3ksONwKQI3NaYjfDqezumECR1K4KI2B9kbg0JrcpVvJdfpvZTDBp3Gzza4xEm%2F1x7VDDWTyzDtw5QQqGxY%2FTZCeiuf8MLDeb2H6XRE9vpauJ2%2F5Jmws"}]}
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 14 May 2026 09:33:18 GMT
x-middleton-display: sol-js
last-modified: Thu, 14 May 2026 09:29:01 GMT
content-type: application/javascript
vary: Accept-Encoding
priority: u=1,i=?0
cache-control: max-age=300, public
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray: 9fb8e6916c905163-YYZ
server: cloudflare

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 323 KB
117 KB 153ms
70ms Script
application/javascript 192.178.155.97
Google LLC

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-829541-1

Requested by

Host: www.mediafire.com
URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.178.155.97 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

yuiadrs-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

2ff49aca4944561b63e2611c79e9aab4f69d6b69353df913ccffe1b15e85943c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: zstd
expires: Thu, 14 May 2026 09:33:19 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 14 May 2026 09:33:19 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 14 May 2026 09:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 119038
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 tag Show response
btloader.com/ 94 KB
31 KB 95ms
40ms Script
application/javascript 104.20.20.189
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.20.189 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2bc354a9cd190461ea50cff92441010aef928bb4747bec778b612e0d55bb1b7f

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-robots-tag: noindex, nofollow
cache-control: public, max-age=300, stale-if-error=3600, stale-while-revalidate=300
content-encoding: br
cf-cache-status: HIT
etag: W/"f3cc939ec9405cccf7482f8a2b08da57"
via: 1.1 google
cf-ray: 9fb8e6920fada208-YYZ
access-control-allow-origin: *
date: Thu, 14 May 2026 09:33:19 GMT
content-type: application/javascript
last-modified: Thu, 14 May 2026 09:17:20 GMT
server: cloudflare
vary: Accept-Encoding, X-Acceptable-Ads, DNT

GET
H3 200 sa.min.js Show response
www.ezojs.com/ezoic/ 283 KB
84 KB 79ms
33ms Script
application/javascript 104.21.63.106
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://www.ezojs.com/ezoic/sa.min.js
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.63.106 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9011f03376c6bcb2ae49b26f2462c373826d54a6fcab34304e6284d23cdd85c8

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-robots-tag: noindex, follow
content-encoding: gzip
cf-cache-status: HIT
etag: W/"27597d79c8a18f1023b8ce42d34256fc"
age: 470
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=zj3aG7LDloV%2Fyb4cVKpv5cRAVxvWFG8fT50Cs9PK%2BIGDKcrXGKiKTY%2FbVHX6V7btGwhHYkKMv4rkzfPXQDNq8CAjeBCApD37C%2FjMnPjZ020wm7yisakC3wRQBIR4FS4j"}]}
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 14 May 2026 09:33:19 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding
priority: u=3,i=?0
cache-control: public, max-age=600, stale-while-revalidate=3600
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray: 9fb8e691fa03ab27-YYZ
server: cloudflare

GET
H2 200 element.js Show response
translate.google.com/translate_a/ 80 KB
28 KB 143ms
60ms Script
text/javascript 172.253.139.102
Google LLC

General

Check archive.org

Download Go to

Full URL

https://translate.google.com/translate_a/element.js?cb=googFooterTranslate

Requested by

Host: www.mediafire.com
URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.139.102 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

yuiadsk-in-f102.1e100.net

Software

ESF /

Resource Hash

915d3f4a44f3e2a32a31e413092bf7bfd3f1c85e2449adf9b48dd7b288ee6d19

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 14 May 2026 09:33:19 GMT
x-xss-protection: 0
content-type: text/javascript; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
server: ESF
x-frame-options: SAMEORIGIN

GET
H2 200 v8c78df7c7c0f484497ecbca7046644da1771523124516 Show response
static.cloudflareinsights.com/beacon.min.js/ 30 KB
11 KB 67ms
27ms Script
text/javascript 104.16.80.73
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/v8c78df7c7c0f484497ecbca7046644da1771523124516
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.80.73 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4b77eae349a8cbcea7133cf3640a64ebf1f69d54d8f6469d7be6fdc188ca4ca4

Request headers

Origin: https://www.mediafire.com
sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"2026.2.0"
cross-origin-resource-policy: cross-origin
cf-ray: 9fb8e691eaaaa266-YUL
access-control-allow-origin: *
date: Thu, 14 May 2026 09:33:19 GMT
content-type: text/javascript;charset=UTF-8
last-modified: Thu, 07 May 2026 16:44:36 GMT
server: cloudflare

GET
H3 200 consent_modules.json Show response
privacy.gatekeeperconsent.com/ 34 B
524 B 63ms
29ms XHR
application/json 172.67.199.186
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://privacy.gatekeeperconsent.com/consent_modules.json
Requested by: Host: the.gatekeeperconsent.com
URL: https://the.gatekeeperconsent.com/cmp.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.199.186 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 24434236112e2c40b190268b75b5a499d50fa6a4cd93664b9ec82f7852865ebf

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: max-age=15780000, public
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=idPlh1Crautqw9GzNXlv2JHeCZRqsJimqtiezXOEwc5oN%2B9AkxZxSHYGk%2Fa13okJUqhAyZHSO7dMcifWkdWOCBIiD%2BjUGWp7n0tU1%2Fuf5MH8506EusVUkNYS%2FtVyQrELKGfGp72OUj8GWwdTkqoxNg%3D%3D"}]}
cf-ray: 9fb8e691ebd7b0a3-YYZ
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
content-length: 34
server-timing: cfExtPri
date: Thu, 14 May 2026 09:33:19 GMT
content-type: application/json;charset=UTF-8
server: cloudflare
priority: u=1,i

GET
H2 200 amplitude-8.5.0-min.gz.js Show response
cdn.amplitude.com/libs/ 68 KB
22 KB 104ms
35ms Script
application/javascript 3.170.42.102
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://cdn.amplitude.com/libs/amplitude-8.5.0-min.gz.js
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.170.42.102 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-3-170-42-102.iad61.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2450e5580136f94bda7ccf95e3167b57e15b05b513a430967943a50036fa47a4

Request headers

Origin: https://www.mediafire.com
sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

access-control-max-age: 3000
content-encoding: gzip
etag: "660c3b546f2a131de50b69b91f26c636"
x-amz-version-id: NY8_7uBz3xoXYJBVsMSBAGHOz8ixMBS3
age: 267821
access-control-allow-methods: GET, HEAD
x-cache: Hit from cloudfront
x-amz-cf-id: NvD1z5JpmorbFFIz4pCjacf1AEJU2M4MQOFlAfmgC6ozOetBvJ74KA==
date: Mon, 11 May 2026 07:09:39 GMT
content-type: application/javascript
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method
last-modified: Fri, 13 Aug 2021 22:37:42 GMT
cache-control: max-age=31536000
via: 1.1 3578d122de1401ebc52a7afd35dd5d0c.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 22154
x-amz-cf-pop: IAD61-P10
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 430 KB
137 KB 154ms
78ms Script
application/javascript 192.178.155.97
Google LLC

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-53LP4T

Requested by

Host: www.mediafire.com
URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.178.155.97 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

yuiadrs-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

4938d2c9a69bc934406d692db0c2100e996225ef1fece07c60376861461ee901

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: zstd
expires: Thu, 14 May 2026 09:33:19 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 14 May 2026 09:33:19 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 14 May 2026 09:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 139970
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 mf_logo_full_color.svg
static.mediafire.com/images/backgrounds/header/ 3 KB
2 KB 38ms
32ms Image
image/svg+xml 104.17.147.83
Cloudflare

General

Check archive.org

Download Go to Show image

Full URL: https://static.mediafire.com/images/backgrounds/header/mf_logo_full_color.svg
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.147.83 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8539c91ae0a82f8cab27d481ea38ac4e66d1e5b36701fe295bcba4399b9255bd

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"5813cfb2-d1d"
age: 3545
access-control-allow-methods: OPTIONS, POST, GET
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Thu, 14 May 2026 09:33:19 GMT
content-type: image/svg+xml
last-modified: Fri, 28 Oct 2016 22:22:42 GMT
priority: u=3,i
x-mf-fe: mf1
cf-ray: 9fb8e691c937a2c8-YUL
access-control-allow-origin: *
server: cloudflare

GET
H3 200 file-zip-v3.png
static.mediafire.com/images/filetype/ 2 KB
2 KB 38ms
33ms Image
image/png 104.17.147.83
Cloudflare

General

Check archive.org

Download Go to Show image

Full URL: https://static.mediafire.com/images/filetype/file-zip-v3.png
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.147.83 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4448e430d3c53bad548a5d135e1c7e2f9593e806ba47892640d430ea752e979e

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cf-cache-status: HIT
etag: "62deda56-750"
age: 722
access-control-allow-methods: OPTIONS, POST, GET
expires: Sat, 13 Jun 2026 09:21:16 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Thu, 14 May 2026 09:33:19 GMT
content-type: image/png
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
priority: u=3,i
cache-control: max-age=2592000
x-mf-fe: mf1
cf-ray: 9fb8e691c93fa2c8-YUL
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1872
server: cloudflare

GET
H3 200 icons_sprite.svg
www.mediafire.com/images/icons/svg_light/ 36 KB
9 KB 48ms
47ms Image
image/svg+xml 104.17.147.83
Cloudflare

General

Check archive.org

Download Go to Show image

Full URL: https://www.mediafire.com/images/icons/svg_light/icons_sprite.svg
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.147.83 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7ba1bc2084def769e77a7dbf97cd91d68fe6c6d55b5d183a7d36630da8da2b02

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"62deda56-90ab"
age: 11335
access-control-allow-methods: OPTIONS, POST, GET
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Thu, 14 May 2026 09:33:19 GMT
content-type: image/svg+xml
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
vary: Accept-Encoding
priority: u=3,i
cf-ray: 9fb8e691c92ca2c8-YUL
x-mf-fe: mf2
access-control-allow-origin: *
server: cloudflare

GET
H3 200 arrow_dropdown.svg
www.mediafire.com/images/icons/svg_dark/ 315 B
502 B 46ms
44ms Image
image/svg+xml 104.17.147.83
Cloudflare

General

Check archive.org

Download Go to Show image

Full URL: https://www.mediafire.com/images/icons/svg_dark/arrow_dropdown.svg
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.147.83 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 82b94716473aa225e715e117802145c5d2d725aa1ba9d476d61a5d3da16a8c26

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"62deda56-13b"
age: 7616
access-control-allow-methods: OPTIONS, POST, GET
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Thu, 14 May 2026 09:33:19 GMT
content-type: image/svg+xml
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
vary: Accept-Encoding
priority: u=3,i
cf-ray: 9fb8e691c92fa2c8-YUL
x-mf-fe: mf1
access-control-allow-origin: *
x-by
server: cloudflare

GET
H3 200 check_circle_green.svg
static.mediafire.com/images/icons/svg_dark/ 444 B
535 B 35ms
31ms Image
image/svg+xml 104.17.147.83
Cloudflare

General

Check archive.org

Download Go to Show image

Full URL: https://static.mediafire.com/images/icons/svg_dark/check_circle_green.svg
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.147.83 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 03c8d2dc7d985c3004ff2cd6d8148dd03560f37ed15efdf6c2d7f4d771d0e599

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"62deda56-1bc"
age: 3385
access-control-allow-methods: OPTIONS, POST, GET
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Thu, 14 May 2026 09:33:19 GMT
content-type: image/svg+xml
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
priority: u=3,i
x-mf-fe: mf1
cf-ray: 9fb8e691c93aa2c8-YUL
access-control-allow-origin: *
server: cloudflare

GET
H3 200 fb_16x16.png
static.mediafire.com/images/backgrounds/download/social/ 181 B
440 B 33ms
32ms Image
image/png 104.17.147.83
Cloudflare

General

Check archive.org

Download Go to Show image

Full URL: https://static.mediafire.com/images/backgrounds/download/social/fb_16x16.png
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.147.83 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 720671166ac43aba99e3952b0b9341ab4e0fee1fd891db54e2a07f05db653142

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cf-cache-status: HIT
etag: "62deda56-b5"
age: 14039
access-control-allow-methods: OPTIONS, POST, GET
expires: Sat, 13 Jun 2026 05:39:19 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Thu, 14 May 2026 09:33:19 GMT
content-type: image/png
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
priority: u=1,i
cache-control: max-age=2592000
x-mf-fe: mf2
cf-ray: 9fb8e691e95ba2c8-YUL
accept-ranges: bytes
access-control-allow-origin: *
content-length: 181
server: cloudflare

GET
H3 200 infinity.js.aspx Show response
cdn.econventa.com/Scripts/ 160 KB
47 KB 71ms
35ms Script
text/javascript 172.67.69.81
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.econventa.com/Scripts/infinity.js.aspx?guid=5ff0fb62-0643-4ff1-aaee-c737f9ffc0e0
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.69.81 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0b7603ffd726854c0eff9970c3aad07a691042f49291df71f6d0b9c1708aa887

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

last-modified: Thu, 14 May 2026 09:30:43 GMT
cache-control: max-age=1200, no-transform
content-encoding: gzip
cf-cache-status: HIT
accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version
age: 227
cf-ray: 9fb8e6924a931185-YYZ
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 14 May 2026 09:33:19 GMT
content-type: text/javascript
vary: Accept-Encoding
server: cloudflare
priority: u=3,i=?0

GET
H3 200 footerIcons.png
static.mediafire.com/images/backgrounds/footer/social/ 583 B
842 B 31ms
30ms Image
image/png 104.17.147.83
Cloudflare

General

Check archive.org

Download Go to Show image

Full URL: https://static.mediafire.com/images/backgrounds/footer/social/footerIcons.png
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.147.83 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: f917a9105c311331b1d40f4d2bdbf11233c1c465616c1a9c46232f451463b061

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cf-cache-status: HIT
etag: "62deda56-247"
age: 2839
access-control-allow-methods: OPTIONS, POST, GET
expires: Sat, 13 Jun 2026 08:45:59 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Thu, 14 May 2026 09:33:19 GMT
content-type: image/png
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
priority: u=3,i
cache-control: max-age=2592000
x-mf-fe: mf2
cf-ray: 9fb8e692098fa2c8-YUL
accept-ranges: bytes
access-control-allow-origin: *
content-length: 583
server: cloudflare

GET
H3

200

main.js Show response
www.mediafire.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/883a1f27d85f/ Frame 9A55
Redirect Chain

https://www.mediafire.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
https://www.mediafire.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/883a1f27d85f/main.js?

22 KB
10 KB

21ms
21ms

Script
application/javascript

104.17.147.83
Cloudflare

General

Check archive.org

Download Go to

Full URL

https://www.mediafire.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/883a1f27d85f/main.js?

Requested by

Host: www.mediafire.com
URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file

Protocol

Server

104.17.147.83 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

3c28c089e67098ecef89ffebdaa206e3ac75f17e7123630f885b8bf2757d77e6

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
Referer

Response headers

cache-control: max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public
content-encoding: gzip
x-content-type-options: nosniff
cf-ray: 9fb8e6928a36a2c8-YUL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 14 May 2026 09:33:19 GMT
content-type: application/javascript; charset=UTF-8
server: cloudflare
priority: u=3,i=?0

Redirect headers

cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public
location: /cdn-cgi/challenge-platform/h/b/scripts/jsd/883a1f27d85f/main.js?
cf-ray: 9fb8e69259efa2c8-YUL
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
content-length: 0
server-timing: cfExtPri
date: Thu, 14 May 2026 09:33:19 GMT
server: cloudflare
priority: u=3,i=?0

GET
H3 200 like.php Show response
www.facebook.com/plugins/ Frame 6073 18 KB
7 KB 159ms
96ms Document
text/html 57.144.172.1
Facebook

General

Check archive.org

Download Go to

Full URL

https://www.facebook.com/plugins/like.php?href=http://www.facebook.com/MediaFire&width=193&layout=button_count&action=like&show_faces=false&share=true&height=30&appId=124578887583575

Requested by

Host: www.mediafire.com
URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file

Protocol

Security

QUIC, , AES_128_GCM

Server

57.144.172.1 Southfield, United States, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

edge-star-mini-shv-01-det1.facebook.com

Software

Resource Hash

31ee626bbcefde898154acc86c90b8d6335d43e582f0dad56dd666a6520c0699

Security Headers

Name	Value
Content-Security-Policy	default-src blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net .facebook.net .whatsapp.com .whatsapp.net;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1: 'nonce-64ONjNQB' blob: 'self' connect.facebook.net 'wasm-unsafe-eval' https://accounts.google.com https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://accounts.google.com https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com .instagram.com https://accounts.google.com https://.google-analytics.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com https://fonts.gstatic.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com .tenor.co .tenor.com .giphy.com https://trustly.one/ https://.trustly.one/ https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co .tenor.com https://.giphy.com;child-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net accounts.meta.com .accounts.meta.com https://trustly.one/ https://.trustly.one/ https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net .google.com .doubleclick.net;manifest-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;object-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.mediafire.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: private, no-cache, no-store, must-revalidate
content-encoding: zstd
content-security-policy: default-src blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net *.facebook.net *.whatsapp.com *.whatsapp.net;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'nonce-64ONjNQB' blob: 'self' connect.facebook.net 'wasm-unsafe-eval' https://accounts.google.com https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://accounts.google.com https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com *.instagram.com https://accounts.google.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;child-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net accounts.meta.com *.accounts.meta.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;manifest-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;object-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
content-type: text/html; charset="utf-8"
cross-origin-opener-policy: unsafe-none
cross-origin-resource-policy: cross-origin
date: Thu, 14 May 2026 09:33:19 GMT
document-policy: force-load-at-top include-js-call-stacks-in-crash-reports
expires: Sat, 01 Jan 2000 00:00:00 GMT
origin-agent-cluster: ?1
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self "https://www.fbsbx.com"), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
pragma: no-cache
priority: u=0,i
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7639678228771058192&cpp=C3&cv=1039495840&st=1778751199184"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7639678228771058192&cpp=C3&cv=1039495840&st=1778751199184", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
strict-transport-security: max-age=15552000; preload
vary: Accept-Encoding
x-content-type-options: nosniff
x-fb-connection-quality: GOOD; q=0.7, rtt=59, rtx=0, c=23, mss=1232, tbw=4926, tp=8, tpl=0, uplat=35, ullat=0
x-fb-debug: UxuW25g+C3mY7LUd5SXLv91D3wEsx4w5uARRhQsevBb0wTHvs2PlRQ5YIttVKzeYqr0MI05khtl1qHYtCeKVnQ==
x-xss-protection: 0

GET
H2 200 cchecker.html Show response
cdn.btloader.com/ Frame B4C4 366 B
778 B 86ms
29ms Document
text/html 104.20.20.189
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.btloader.com/cchecker.html?upapi=true
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.20.189 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: c700c58e763a5ae34f446713819957ed9755025d35b8497ec1150f428f5ff227

Request headers

Referer: https://www.mediafire.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

access-control-allow-origin: *
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
age: 3641
cache-control: public, max-age=86400, immutable
cf-cache-status: HIT
cf-ray: 9fb8e692d825f00c-YYZ
content-encoding: br
content-type: text/html
date: Thu, 14 May 2026 09:33:19 GMT
expires: Fri, 15 May 2026 07:36:18 GMT
last-modified: Thu, 16 Apr 2026 14:02:40 GMT
server: cloudflare
x-goog-generation: 1776348160499015
x-goog-hash: crc32c=/3eT+A== md5=WtMW8Jy4XJceDGzQqhOktA==
x-goog-metageneration: 1
x-goog-storage-class: MULTI_REGIONAL
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 366
x-guploader-uploadid: AAVLpEj0oqnZ13PrgDAKo_BLJVTyq4NSP0vcetV3AmjV1d5of31Rkgg_pZuKMDwRo5d9lHX_RvR7p6c

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
612 B 83ms
26ms Fetch
image/gif 172.66.148.140
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=2&e=0.3600368746282665
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.66.148.140 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 1
x-goog-stored-content-encoding: identity
expires: Tue, 12 May 2026 22:06:37 GMT
x-goog-stored-content-length: 43
date: Thu, 14 May 2026 09:33:19 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: AOCedOE4ceqfKqcxsn6FfQCul5MU3fPppaJoaSAD4zIpDi_AuCRSOF0vpherOnDkBFq5ISKOXI37mOc
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9fb8e692daa7b8f3-YYZ
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico Show response
ad.doubleclick.net/ 1 KB
129 B 81ms
38ms Fetch
image/x-icon 192.178.155.149
Google LLC

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.6499974702941395

Requested by

Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.155.149 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

yuiadrs-in-f149.1e100.net

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Fri, 15 May 2026 09:33:19 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 14 May 2026 09:33:19 GMT
content-type: image/x-icon
vary: Accept-Encoding
last-modified: Tue, 08 May 2012 13:08:06 GMT
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
109 B 83ms
27ms Fetch
image/gif 172.66.148.140
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.6210206557307958
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.66.148.140 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 1
x-goog-stored-content-encoding: identity
expires: Tue, 12 May 2026 22:06:37 GMT
x-goog-stored-content-length: 43
date: Thu, 14 May 2026 09:33:19 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: AOCedOE4ceqfKqcxsn6FfQCul5MU3fPppaJoaSAD4zIpDi_AuCRSOF0vpherOnDkBFq5ISKOXI37mOc
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9fb8e692daa8b8f3-YYZ
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H2 200 dns Show response
ab.dns-finder.com/meta/ 2 B
215 B 123ms
67ms Fetch
text/plain 34.36.200.111
Google LLC

General

Check archive.org

Download Go to

Full URL: https://ab.dns-finder.com/meta/dns
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.36.200.111 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS: 111.200.36.34.bc.googleusercontent.com
Software: /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: private, max-age=180, stale-if-error=180, stale-while-revalidate=180
access-control-expose-headers: X-Resolver
x-resolver: default
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000
content-length: 2
date: Thu, 14 May 2026 09:33:19 GMT
content-type: text/plain; charset=utf-8
vary: Origin

GET
H2 200 trustedIframe.html Show response
btloader.com/ Frame 14B1 6 KB
2 KB 86ms
34ms Document
text/html 172.66.171.133
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://btloader.com/trustedIframe.html?o=5678961798414336&upapi=true
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.66.171.133 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3f124cdc02a40817853db0a92e2dd20e0d4342c9b3532edb34429a78a2bbac54

Request headers

Referer: https://www.mediafire.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

cache-control: public, max-age=3600, stale-while-revalidate=3600
cf-ray: 9fb8e692d8cd086a-YYZ
content-encoding: br
content-type: text/html
date: Thu, 14 May 2026 09:33:19 GMT
server: cloudflare

GET
H3 200 world.svg
static.mediafire.com/images/backgrounds/download/additional_content/ 143 KB
53 KB 63ms
62ms Image
image/svg+xml 104.17.147.83
Cloudflare

General

Check archive.org

Download Go to Show image

Full URL: https://static.mediafire.com/images/backgrounds/download/additional_content/world.svg
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.147.83 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4342feac38021c4fe3069eba0edf1c2e1b4345e2b548b0afb7ab21b7369b3bc8

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"62deda56-23ce2"
age: 6160
access-control-allow-methods: OPTIONS, POST, GET
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Thu, 14 May 2026 09:33:19 GMT
content-type: image/svg+xml
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
priority: u=3,i
x-mf-fe: mf2
cf-ray: 9fb8e6928a2ba2c8-YUL
access-control-allow-origin: *
server: cloudflare

GET
H3 200 continent-na.svg
static.mediafire.com/images/backgrounds/download/additional_content/ 50 KB
19 KB 42ms
41ms Image
image/svg+xml 104.17.147.83
Cloudflare

General

Check archive.org

Download Go to Show image

Full URL: https://static.mediafire.com/images/backgrounds/download/additional_content/continent-na.svg
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.147.83 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 05cfe92d9794a54258a19bfec7ae0faa73f61b66416983136594b4f95bb114dd

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"62deda56-c817"
age: 9050
access-control-allow-methods: OPTIONS, POST, GET
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Thu, 14 May 2026 09:33:19 GMT
content-type: image/svg+xml
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
priority: u=3,i
x-mf-fe: mf2
cf-ray: 9fb8e6928a2ea2c8-YUL
access-control-allow-origin: *
x-by
server: cloudflare

GET
H3 200 mex.svg
static.mediafire.com/images/flags_svg/ 219 KB
86 KB 35ms
33ms Image
image/svg+xml 104.17.147.83
Cloudflare

General

Check archive.org

Download Go to Show image

Full URL: https://static.mediafire.com/images/flags_svg/mex.svg
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.147.83 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: b2d1b792e8f907b6a0be526d54a14957c07ea665826e9bbc3e0d97515b071797

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"62deda56-36bbc"
age: 12484
access-control-allow-methods: OPTIONS, POST, GET
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Thu, 14 May 2026 09:33:19 GMT
content-type: image/svg+xml
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
priority: u=3,i
x-mf-fe: mf1
cf-ray: 9fb8e6928a31a2c8-YUL
access-control-allow-origin: *
server: cloudflare

GET
H3 200 flag.svg
static.mediafire.com/images/backgrounds/download/additional_content/ 234 B
441 B 30ms
29ms Image
image/svg+xml 104.17.147.83
Cloudflare

General

Check archive.org

Download Go to Show image

Full URL: https://static.mediafire.com/images/backgrounds/download/additional_content/flag.svg
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.147.83 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: f52a0c7d9fa7ae8e45916c491ae7193f9a1e289f128f05264122c53d8da970db

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"62deda56-ea"
age: 7221
access-control-allow-methods: OPTIONS, POST, GET
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Thu, 14 May 2026 09:33:19 GMT
content-type: image/svg+xml
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
priority: u=3,i
x-mf-fe: mf2
cf-ray: 9fb8e6928a32a2c8-YUL
access-control-allow-origin: *
server: cloudflare

GET
H3 200 mf_round.svg
static.mediafire.com/images/backgrounds/download/additional_content/ 1 KB
1 KB 33ms
32ms Image
image/svg+xml 104.17.147.83
Cloudflare

General

Check archive.org

Download Go to Show image

Full URL: https://static.mediafire.com/images/backgrounds/download/additional_content/mf_round.svg
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.147.83 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: f1a67642fc97b508ce07cf6df329022bf5184a1c573044dc021e0d6e64688c64

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"62deda56-5b1"
age: 5047
access-control-allow-methods: OPTIONS, POST, GET
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Thu, 14 May 2026 09:33:19 GMT
content-type: image/svg+xml
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
priority: u=3,i
x-mf-fe: mf1
cf-ray: 9fb8e6928a33a2c8-YUL
access-control-allow-origin: *
server: cloudflare

GET
H3 200 browser_chrome.svg
static.mediafire.com/images/backgrounds/download/additional_content/ 8 KB
2 KB 33ms
33ms Image
image/svg+xml 104.17.147.83
Cloudflare

General

Check archive.org

Download Go to Show image

Full URL: https://static.mediafire.com/images/backgrounds/download/additional_content/browser_chrome.svg
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.147.83 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1c6ba1010c2cc88c59de9e9584728da124770fa399643ffc1beffcec54b84be7

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"62deda56-1e24"
age: 5881
access-control-allow-methods: OPTIONS, POST, GET
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Thu, 14 May 2026 09:33:19 GMT
content-type: image/svg+xml
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
priority: u=3,i
x-mf-fe: mf1
cf-ray: 9fb8e6928a34a2c8-YUL
access-control-allow-origin: *
server: cloudflare

GET
H2 200 device Show response
cdn.api.btloader.com/ 87 B
295 B 129ms
75ms Fetch
application/json 172.66.171.133
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://cdn.api.btloader.com/device?orgid=5678961798414336&fullVersionList=%5B%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22148.0.0.0%22%7D%2C%7B%22brand%22%3A%22Google+Chrome%22%2C%22version%22%3A%22148.0.0.0%22%7D%2C%7B%22brand%22%3A%22Not-A.Brand%22%2C%22version%22%3A%2224.0.0.0%22%7D%5D&upapi=true
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.66.171.133 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2ce6e5b04061617aeacd5c1b16004fbdc2fb510dcd7ccb92e1df8bcefbe2354d

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: public, max-age=3600
content-encoding: br
cf-cache-status: DYNAMIC
x-ratelimit-reset: 1778751200
via: 1.1 google
cf-ray: 9fb8e692ea7736a3-YYZ
x-ratelimit-remaining: 93
access-control-allow-origin: *
date: Thu, 14 May 2026 09:33:19 GMT
x-ratelimit-limit: 100
content-type: application/json
vary: Origin
server: cloudflare

POST
H2 200 / Show response
api.amplitude.com/ 7 B
138 B 309ms
102ms XHR
text/html 44.254.178.46
Amazon.com

General

Check archive.org

Download Go to

Full URL

https://api.amplitude.com/

Requested by

Host: cdn.amplitude.com
URL: https://cdn.amplitude.com/libs/amplitude-8.5.0-min.gz.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

44.254.178.46 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-44-254-178-46.us-west-2.compute.amazonaws.com

Software

Resource Hash

aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=15768000
access-control-allow-origin: *
content-length: 7
date: Thu, 14 May 2026 09:33:19 GMT
content-type: text/html;charset=utf-8

POST
H3 200 9fb8e68d5c86a2c8 Show response
www.mediafire.com/cdn-cgi/challenge-platform/h/b/jsd/oneshot/883a1f27d85f/0.8615074636356713:1778749528:OYExSCU6Iboy6HMdjiLLwIsSshgUfck-O2n-703TxKI/ Frame 9A55 0
876 B 28ms
23ms XHR
text/plain 104.17.147.83
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://www.mediafire.com/cdn-cgi/challenge-platform/h/b/jsd/oneshot/883a1f27d85f/0.8615074636356713:1778749528:OYExSCU6Iboy6HMdjiLLwIsSshgUfck-O2n-703TxKI/9fb8e68d5c86a2c8
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.147.83 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform: "Linux"
Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
Content-Type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0

Response headers

timing-allow-origin: https://www.mediafire.com
cf-ray: 9fb8e6935b19a2c8-YUL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
content-length: 0
cf-chl-out-s: ZcBhS4t5dXkksUTIDUiThg==$VX/kVbH9dzWhS1ArdJtA5g==
date: Thu, 14 May 2026 09:33:19 GMT
content-type: text/plain; charset=UTF-8
server: cloudflare
priority: u=1,i

GET
H3 200 TBAmH8s46M1.css
static.xx.fbcdn.net/rsrc.php/v5/yQ/l/0,cross/ Frame 6073 256 B
334 B 92ms
44ms Stylesheet
text/css 57.144.172.128
Facebook

General

Check archive.org

Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v5/yQ/l/0,cross/TBAmH8s46M1.css

Requested by

Host: www.facebook.com
URL: https://www.facebook.com/plugins/like.php?href=http://www.facebook.com/MediaFire&width=193&layout=button_count&action=like&show_faces=false&share=true&height=30&appId=124578887583575

Protocol

Security

QUIC, , AES_128_GCM

Server

57.144.172.128 Southfield, United States, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

xx-fbcdn-shv-01-det1.fbcdn.net

Software

Resource Hash

3f58fc6a1358253c2ae06e44b8bda5b4294a1f0ad3da306a1e5170531d279c2f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
sec-ch-ua-platform: "Linux"
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-md5: 4d6LvJxrRgUCwuO45GpmUw==
content-encoding: zstd
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Mon, 03 May 2027 16:48:50 GMT
alt-svc: h3=":443"; ma=86400
date: Thu, 14 May 2026 09:33:19 GMT
content-type: text/css; charset=utf-8
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
x-fb-debug: /C8txxSD1erZSYuOvF/IanvieL5YaE1a+Uk75Cy0SwLi0UuqbOSpIVW7oMN9DBuzyPI70MtncTAqhBkMfSqO+w==
priority: u=0
vary: Origin
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=41, rtx=0, c=23, mss=1232, tbw=4929, tp=8, tpl=0, uplat=0, ullat=-1
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
access-control-allow-origin: https://www.facebook.com
content-length: 189
origin-agent-cluster: ?1

GET
H3 200 yPnE3me-9-0.css
static.xx.fbcdn.net/rsrc.php/v5/yb/l/0,cross/ Frame 6073 659 B
483 B 93ms
44ms Stylesheet
text/css 57.144.172.128
Facebook

General

Check archive.org

Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v5/yb/l/0,cross/yPnE3me-9-0.css

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

57.144.172.128 Southfield, United States, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

xx-fbcdn-shv-01-det1.fbcdn.net

Software

Resource Hash

afc222aabf430f1be68418c8a2b29e3423d64530dbcd9032ab9b1c5d49f67b36

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
sec-ch-ua-platform: "Linux"
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-md5: WW6Ma/wB+QbCthQNgKAgSQ==
content-encoding: zstd
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Fri, 30 Apr 2027 21:17:03 GMT
alt-svc: h3=":443"; ma=86400
date: Thu, 14 May 2026 09:33:19 GMT
content-type: text/css; charset=utf-8
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
x-fb-debug: 4m5hj24dK5gnLEO1hFpGIecvziX6yJZ19xCDaO1emJVb+9rS7/obYa6KaBN3ANjzKmVlmk1UDTXbDgZKGks+5Q==
priority: u=0
vary: Origin
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=41, rtx=0, c=23, mss=1232, tbw=4929, tp=8, tpl=0, uplat=0, ullat=-1
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
access-control-allow-origin: https://www.facebook.com
content-length: 338
origin-agent-cluster: ?1

POST
H2 204 exd
api.btloader.com/ 0
0 126ms
68ms Fetch 130.211.23.194
Google LLC

General

Check archive.org

Download Go to

Full URL: https://api.btloader.com/exd?tid=dVd1AKxuWw-umSQH1hp-9e25d55779&sid=X3DxHRlt-C2M3GAQr-9e25d55779&cv=2.1.189-1-gf2b7278&upapi=true
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.23.194 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS: 194.23.211.130.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

via: 1.1 google
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 14 May 2026 09:33:19 GMT
vary: Origin

GET
H3 200 ezorca.min.js Show response
go.ezodn.com/ezoic/ 357 KB
83 KB 74ms
38ms Script
application/javascript 104.21.87.79
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://go.ezodn.com/ezoic/ezorca.min.js
Requested by: Host: www.ezojs.com
URL: https://www.ezojs.com/ezoic/sa.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.87.79 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 953ae0b28b4a6e7d9ec5f1b878b2b77a8d76fba506cf8e5df854ed56540b27bf

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-robots-tag: noindex, follow
content-encoding: br
cf-cache-status: HIT
etag: W/"be6d9a56fe7c79f8c7467aa39dd07d87"
age: 178
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=Sni%2BDmH2m1jZDhxW74vYCYkYTm3RFD%2BL5zE0IS6hHkuL%2FIHlAzn7HCkXtoI%2FECNI0SwRHnhXXXIs%2BnRBBRZLSMggTAJUiyayP%2BYB0IBBPbe2e2FcQ79HzN4B0z3hKVw%3D"}]}
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 14 May 2026 09:33:19 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding
priority: u=1,i=?0
cache-control: public, max-age=14400, stale-while-revalidate=3600
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray: 9fb8e694acb2ab5a-YYZ
server: cloudflare

GET
H3 200 columbus.js Show response
www.ezojs.com/detroitchicago/ 33 KB
15 KB 57ms
56ms Script
application/javascript 104.21.63.106
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://www.ezojs.com/detroitchicago/columbus.js
Requested by: Host: www.ezojs.com
URL: https://www.ezojs.com/ezoic/sa.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.63.106 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: d5f3b0b14d09909398ca69f59408911181d25700a0dd9203fd20417d968747cc

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-robots-tag: noindex, follow
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-encoding: gzip
cf-cache-status: BYPASS
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=SpPXBjUe0zu%2BwDp3tL5r6DKJBVeuRVkHfUM41hPwDy2sTXYbBhAwgLtdCEteZAEK%2FpOoAurKkwDF9HK%2FHRLssAizP6i6epx9P6WnCMNQE5V%2FOhFGOjqIB5DhLzLbV6ZE"}]}
cf-ray: 9fb8e6947a09ab27-YYZ
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 14 May 2026 09:33:19 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare
priority: u=3,i=?0

POST
H2 200 saa.go Show response
g.ezoic.net/ 68 KB
20 KB 108ms
36ms XHR
text/javascript 54.85.8.229
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/saa.go
Requested by: Host: www.ezojs.com
URL: https://www.ezojs.com/ezoic/sa.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.85.8.229 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-54-85-8-229.compute-1.amazonaws.com
Software: /
Resource Hash: 49564e322b2146898f9b8c4bc4daf5b84ffdff6e4caa07ea40ecb03452d16fc2

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
Content-Type: text/plain
sec-ch-ua-mobile: ?0

Response headers

x-robots-tag: noindex
access-control-max-age: 1728000
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
content-encoding: br
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, PUT, OPTIONS
expires: Wed, 13 May 2026 09:33:19 GMT
access-control-allow-origin: https://www.mediafire.com
date: Thu, 14 May 2026 09:33:19 GMT
content-type: text/javascript
vary: Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
access-control-allow-headers: Content-Type

OPTIONS
H2 200 ezconfig
g.ezoic.net/detroitchicago/ Frame 0
0 110ms
35ms Preflight 54.85.8.229
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/detroitchicago/ezconfig
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.85.8.229 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-54-85-8-229.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.mediafire.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET, POST, PUT, OPTIONS
access-control-allow-origin: https://www.mediafire.com
access-control-max-age: 1728000
content-length: 0
date: Thu, 14 May 2026 09:33:19 GMT
vary: Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers

GET
H3 200 boise.js Show response
go.ezodn.com/detroitchicago/ 860 B
929 B 32ms
32ms Script
application/javascript 104.21.87.79
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://go.ezodn.com/detroitchicago/boise.js?gcb=195-16&cb=5
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.87.79 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: c656d50263d423e681e4963066e86f087cb646cab3b440b3b082a0da28eb79ea

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-robots-tag: noindex, follow
content-encoding: br
cf-cache-status: HIT
age: 180543
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=3a7W0ODFEmQhqVNR6DIfBLq9Gn9EEVgUJm2WYbVBwlXGFP%2BeCeIQREA4014P79w4CJDYjMlRVu8KnvdiTP%2BRUchRsYBzV7iBkbUHjzG50LRVglrhnmVi874tyqO9%2Bx8%3D"}]}
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 14 May 2026 09:33:19 GMT
x-middleton-display: sol-js
last-modified: Thu, 14 May 2026 09:15:42 GMT
content-type: application/javascript
vary: Accept-Encoding
priority: u=3,i=?0
cache-control: public, max-age=31536000
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray: 9fb8e6956cb3ab5a-YYZ
accept-ranges: bytes
content-length: 429
server: cloudflare

GET
H3 200 mulvane.js Show response
go.ezodn.com/parsonsmaize/ 1 KB
1 KB 31ms
30ms Script
application/javascript 104.21.87.79
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://go.ezodn.com/parsonsmaize/mulvane.js?gcb=195-16&cb=e75e48eec0
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.87.79 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6a163c9c1e18a0fae78f3ce587d463c4aa6d39991639580d1106a9fa0774b8e8

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-robots-tag: noindex, follow
content-encoding: br
cf-cache-status: HIT
age: 2583798
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=CUr8xxVLcty0DeB3L%2Fn79qnMRWUOLssHp9bOe1rBMsq2dxL8siogMlcXc%2BBxoZA0FWraRQbwe%2FwpqlCYZbRSl5I9jncec3HVusP1npbuB94KrXR%2BT7k8l4vNDkk22W4%3D"}]}
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 14 May 2026 09:33:19 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding
last-modified: Tue, 14 Apr 2026 11:50:01 GMT
priority: u=3,i=?0
cache-control: public, max-age=31536000
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray: 9fb8e6956cb4ab5a-YYZ
accept-ranges: bytes
content-length: 526
server: cloudflare

GET
H3 200 birmingham.js Show response
go.ezodn.com/detroitchicago/ 752 B
879 B 31ms
30ms Script
application/javascript 104.21.87.79
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://go.ezodn.com/detroitchicago/birmingham.js?gcb=195-16&cb=539c47377c
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.87.79 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 30be558393bd8b0585c806a6eaed6d6f5b51d1ca63c0113061dfe35eaa128ce3

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-robots-tag: noindex, follow
content-encoding: br
cf-cache-status: HIT
age: 2254477
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=KDVWi%2F88l1dLzfEHHlTi9b5JqZcby1aozWU3gEI1WxaRO4fEWXhIkjEe7YjztPcfpquOUT5FdiRPsUAt5XXQWKCdiy8URXQP9%2BnSrIT1QZ7YULFJuNNWJRNvxrF5Ba0%3D"}]}
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 14 May 2026 09:33:19 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding
last-modified: Sat, 18 Apr 2026 07:18:41 GMT
priority: u=3,i=?0
cache-control: public, max-age=31536000
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray: 9fb8e6956cb5ab5a-YYZ
accept-ranges: bytes
content-length: 380
server: cloudflare

GET
H3 200 ezoicanalytics.js Show response
go.ezodn.com/ 2 KB
1 KB 36ms
35ms Script
application/javascript 104.21.87.79
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://go.ezodn.com/ezoicanalytics.js?cb=1&dcb=195-16&shcb=34
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.87.79 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: e814d50a228f54aecf40d8a58e41d48ce1dfc4376fd5fbedc28078fe0a8c5526

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-robots-tag: noindex, follow
content-encoding: br
cf-cache-status: HIT
age: 73211
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=ZC6gkJdHKe9aol1peWWxkoOan5PwqYZza08RyScIA%2B90%2F1rhC34P%2BCzBhcHlHX1ek1dE2JkBKP0XguRVdRlH%2FvRcqyJxSNXg7VUek0cLO8slGykYjEx6%2BShxOhRGc0Y%3D"}]}
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 14 May 2026 09:33:19 GMT
x-middleton-display: sol-js
last-modified: Wed, 13 May 2026 13:13:11 GMT
content-type: application/javascript
vary: Accept-Encoding
priority: u=3,i=?0
cache-control: public, max-age=86400
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray: 9fb8e6956cb6ab5a-YYZ
server: cloudflare

GET
H3 200 identity.js Show response
www.ezojs.com/ 362 KB
102 KB 33ms
33ms Script
application/javascript 104.21.63.106
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://www.ezojs.com/identity.js
Requested by: Host: www.ezojs.com
URL: https://www.ezojs.com/ezoic/sa.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.63.106 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 355474edae19c91b8508ab5483713a18ae97cad7cf90bafa0fecf2e73ed98266

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-robots-tag: noindex, follow
content-encoding: gzip
cf-cache-status: HIT
etag: W/"2afdae5bbf19d531f38c964b0c7ec6c6"
age: 833
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=9l9tk9rVERLqgvZPoEVANEF4W6JHNUJjqQ1tBqByAJGYNbAC9q6y1YJA8jKZ0suDBhvV1A1I%2FXB3gtIBy6LorxfK%2FGFAgAXym5%2FBqMMk9KNi82HS3BDvmfi%2BueZWmnm1"}]}
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 14 May 2026 09:33:19 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding
priority: u=3,i=?0
cache-control: public, max-age=900, stale-while-revalidate=3600
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray: 9fb8e6956a0aab27-YYZ
server: cloudflare

POST
H2 200 ezconfig Show response
g.ezoic.net/detroitchicago/ 92 B
124 B 34ms
32ms Fetch
application/json 54.85.8.229
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/detroitchicago/ezconfig
Requested by: Host: www.ezojs.com
URL: https://www.ezojs.com/ezoic/sa.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.85.8.229 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-54-85-8-229.compute-1.amazonaws.com
Software: /
Resource Hash: 1b7c4edd444f73d828aacb88e0f35efd212c8378d07e5ff848d699adf68ba550

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
Content-Type: application/json
sec-ch-ua-mobile: ?0

Response headers

access-control-max-age: 1728000
content-encoding: br
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, PUT, OPTIONS
access-control-allow-origin: https://www.mediafire.com
content-length: 66
date: Thu, 14 May 2026 09:33:19 GMT
content-type: application/json
vary: Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
access-control-allow-headers: Content-Type

GET
H2 200 ezintegration
g.ezoic.net/ 43 B
122 B 33ms
33ms Image
image/gif 54.85.8.229
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://g.ezoic.net/ezintegration?d=www.mediafire.com&ts=1778751199418
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.85.8.229 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-54-85-8-229.compute-1.amazonaws.com
Software: /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

expires: Wed, 13 May 2026 09:33:19 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
content-length: 43
date: Thu, 14 May 2026 09:33:19 GMT
x-middleton-display: integration_verify
content-type: image/gif
vary: Accept-Encoding

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
113 B 28ms
27ms Fetch
image/gif 172.66.148.140
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.8006098168522915
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.66.148.140 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 2
x-goog-stored-content-encoding: identity
expires: Tue, 12 May 2026 22:06:37 GMT
x-goog-stored-content-length: 43
date: Thu, 14 May 2026 09:33:19 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: AOCedOE4ceqfKqcxsn6FfQCul5MU3fPppaJoaSAD4zIpDi_AuCRSOF0vpherOnDkBFq5ISKOXI37mOc
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9fb8e6957ca5b8f3-YYZ
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 Tag.engine Show response
econventa.com/ 2 KB
3 KB 63ms
56ms Script
application/json 172.67.69.81
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://econventa.com/Tag.engine?time=420&id=5ff0fb62-0643-4ff1-aaee-c737f9ffc0e0&rand=58267&ver=async&referrerUrl=&fingerPrint=123&abr=false&stdTime=-480&fpe=1&bw=1600&bh=1200&res=1600x1200&curl=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F28rrtqxs0afdpk3%2FGambonanza-v1.0.16-full-apkvision.apk%2Ffile&kw=online%20storage%2Cfree%20storage%2Ccloud%20storage%2Ccollaboration%2Cbackup%20file%20sharing%2Cshare%20files%2Cphoto%20backup%2Cphoto%20sharing%2Cftp%20replacement%2Ccross%20platform%2Cremote%20access%2Cmobile%20access%2Csend%20large%20files%2Crecover%20files%2Cfile%20versioning%2Cundelete%2Cwindows%2Cpc%2Cmac%2Cos%20x%2Clinux%2Ciphone
Requested by: Host: cdn.econventa.com
URL: https://cdn.econventa.com/Scripts/infinity.js.aspx?guid=5ff0fb62-0643-4ff1-aaee-c737f9ffc0e0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.69.81 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 308887d614c91ca8e01bae9d9079d1957f9617e9ff715b65b3e916e2d23744f7

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version
cf-ray: 9fb8e695faa81185-YYZ
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 14 May 2026 09:33:19 GMT
content-type: application/json
vary: Accept-Encoding
server: cloudflare
priority: u=3,i=?0

GET
H2 200 m=el_main_css
www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.zZZZhVqDDCw.L.W.O/am=BBDg/d=0/rs=AN8SPfobRl8UQM01cRTktRUhaChx5xxdlg/ 22 KB
5 KB 174ms
57ms Stylesheet
text/css 172.253.63.94
Google LLC

General

Check archive.org

Download Go to

Full URL

https://www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.zZZZhVqDDCw.L.W.O/am=BBDg/d=0/rs=AN8SPfobRl8UQM01cRTktRUhaChx5xxdlg/m=el_main_css

Requested by

Host:
URL: /_/translate_http/_/js/k=translate_http.tr.en_US.TRsLV_wcQ3Q.O/am=BBDg/d=1/rs=AN8SPfoYetINdBHPXMrnCKMbwd6xtbP6XA/m=el_conf

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.94 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

bi-in-f94.1e100.net

Software

sffe /

Resource Hash

0ecbd1374ebd05d9733e3230e6ccaefadbfd8907cd151221d8af6fdf881b4e09

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
age: 7647
report-to: {"group":"rosetta","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/rosetta"}]}
x-content-type-options: nosniff
expires: Fri, 14 May 2027 07:25:52 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 14 May 2026 07:25:52 GMT
last-modified: Thu, 09 Apr 2026 01:12:55 GMT
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=31536000
cross-origin-opener-policy: same-origin; report-to="rosetta"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/rosetta
accept-ranges: bytes
access-control-allow-origin: *
content-length: 4160
x-xss-protection: 0
server: sffe

GET
H2 200 m=el_main Show response
translate.googleapis.com/_/translate_http/_/js/k=translate_http.tr.en_US.TRsLV_wcQ3Q.O/am=AAAACA/d=1/exm=el_conf/ed=1/rs=AN8SPfrSNkyifFfrD3d6ejKqemjb955kgg/ 410 KB
119 KB 175ms
57ms Script
text/javascript 142.251.16.95
Google LLC

General

Check archive.org

Download Go to

Full URL

https://translate.googleapis.com/_/translate_http/_/js/k=translate_http.tr.en_US.TRsLV_wcQ3Q.O/am=AAAACA/d=1/exm=el_conf/ed=1/rs=AN8SPfrSNkyifFfrD3d6ejKqemjb955kgg/m=el_main

Requested by

Host:
URL: /_/translate_http/_/js/k=translate_http.tr.en_US.TRsLV_wcQ3Q.O/am=BBDg/d=1/rs=AN8SPfoYetINdBHPXMrnCKMbwd6xtbP6XA/m=el_conf

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

142.251.16.95 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

bl-in-f95.1e100.net

Software

sffe /

Resource Hash

d278d0867e1dab846b070ef0ebfa6413dc008178bf7d12d72a228ab75ebc42e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
age: 58774
report-to: {"group":"rosetta","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/rosetta"}]}
x-content-type-options: nosniff
expires: Thu, 13 May 2027 17:13:45 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 13 May 2026 17:13:45 GMT
last-modified: Tue, 12 May 2026 01:10:52 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=31536000
cross-origin-opener-policy: same-origin; report-to="rosetta"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/rosetta
accept-ranges: bytes
access-control-allow-origin: *
content-length: 121263
x-xss-protection: 0
server: sffe

GET
H3 200 favicon.ico Show response
ad.doubleclick.net/ 1 KB
129 B 41ms
40ms Fetch
image/x-icon 192.178.155.149
Google LLC

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.4102961157410958

Requested by

Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.155.149 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

yuiadrs-in-f149.1e100.net

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Fri, 15 May 2026 09:33:19 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 14 May 2026 09:33:19 GMT
content-type: image/x-icon
vary: Accept-Encoding
last-modified: Tue, 08 May 2012 13:08:06 GMT
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
111 B 28ms
26ms Fetch
image/gif 172.66.148.140
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=2&e=0.047851401242741676
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.66.148.140 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 2
x-goog-stored-content-encoding: identity
expires: Tue, 12 May 2026 22:06:37 GMT
x-goog-stored-content-length: 43
date: Thu, 14 May 2026 09:33:19 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: AOCedOE4ceqfKqcxsn6FfQCul5MU3fPppaJoaSAD4zIpDi_AuCRSOF0vpherOnDkBFq5ISKOXI37mOc
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9fb8e6960d18b8f3-YYZ
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 51 KB
21 KB 118ms
38ms Script
text/javascript 142.251.163.101
Google LLC

General

Check archive.org

Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-829541-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.101 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

wv-in-f101.1e100.net

Software

Golfe2 /

Resource Hash

f1a61277e3f902f50ab42015d8b07218db9b7601bb0967e54a52bfdcb4fa7e81

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
age: 6489
report-to: {"group":"ascnsrsgac:225:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:225:0"}],}
x-content-type-options: nosniff
expires: Thu, 14 May 2026 09:45:10 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 14 May 2026 07:45:10 GMT
last-modified: Tue, 15 Jul 2025 00:44:26 GMT
content-type: text/javascript
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:225:0
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsgac:225:0
content-length: 20802
server: Golfe2

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 550 KB
178 KB 70ms
69ms Script
application/javascript 192.178.155.97
Google LLC

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-K68XP6D85D&cx=c&gtm=4e65c0

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-53LP4T

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.178.155.97 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

yuiadrs-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

5d66f8a47b3547cfa4f9e7f5d060d9e42373009ef01aee65aeffdb2e90540c35

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
content-encoding: zstd
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Thu, 14 May 2026 09:33:19 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 181992
date: Thu, 14 May 2026 09:33:19 GMT
x-xss-protection: 0
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Google Tag Manager
access-control-allow-headers: Cache-Control

POST
H2 200 analytics Show response
g.ezoic.net/ezais/ 15 KB
5 KB 69ms
62ms Fetch
text/plain 54.85.8.229
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/ezais/analytics?cb=1
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/ezoicanalytics.js?cb=1&dcb=195-16&shcb=34
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.85.8.229 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-54-85-8-229.compute-1.amazonaws.com
Software: /
Resource Hash: 83e54922aeb50ffb130041d1ee72bb1337f0c6518bf57130dbc01ac4ed4e0820

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
Content-Type: text/plain
sec-ch-ua-mobile: ?0

Response headers

x-robots-tag: noindex
access-control-max-age: 1728000
content-encoding: br
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, PUT, OPTIONS
access-control-allow-origin: https://www.mediafire.com
date: Thu, 14 May 2026 09:33:19 GMT
content-type: text/plain; charset=utf-8
vary: Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
access-control-allow-headers: Content-Type

GET
H2 200 id5-api.js Show response
cdn.id5-sync.com/api/1.0/ 117 KB
34 KB 90ms
31ms Script
text/javascript 104.20.23.13
Cloudflare

General

Check archive.org

Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/id5-api.js

Requested by

Host: www.ezojs.com
URL: https://www.ezojs.com/identity.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.23.13 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

18120a6bee05cd823d5f4ab0c52006863a059a5d6c535c790a31bdd2ee8c45e7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-amz-id-2: PTA7ygZ2brrCU2y2coR5ul4WDFG/ZotMC8wm3hZYMc5/NTsReajLb2VWpsFwJM9WgnZsJFgDdDI=
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: public, max-age=3600
content-encoding: br
cf-cache-status: HIT
etag: W/"78d670c3a2facd95b81a836b6857d830"
age: 2882
x-amz-request-id: WGPAXB0MJAGSQ8RN
cf-ray: 9fb8e697f9f9ae18-YYZ
date: Thu, 14 May 2026 09:33:20 GMT
content-type: text/javascript;charset=utf-8
last-modified: Wed, 18 Mar 2026 12:22:23 GMT
server: cloudflare
x-amz-server-side-encryption: AES256

POST
H2 200 ezconfig Show response
g.ezoic.net/detroitchicago/ 49 B
109 B 33ms
31ms Fetch
application/json 54.85.8.229
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/detroitchicago/ezconfig
Requested by: Host: www.ezojs.com
URL: https://www.ezojs.com/identity.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.85.8.229 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-54-85-8-229.compute-1.amazonaws.com
Software: /
Resource Hash: 50a63bf06dcdc62ce03de6a07d10770dc80cfa47ef2b63db1e9f6a5fbd786a7d

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
Content-Type: application/json
sec-ch-ua-mobile: ?0

Response headers

access-control-max-age: 1728000
content-encoding: gzip
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, PUT, OPTIONS
access-control-allow-origin: https://www.mediafire.com
content-length: 73
date: Thu, 14 May 2026 09:33:19 GMT
content-type: application/json
vary: Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
access-control-allow-headers: Content-Type

POST
H2 200 ezconfig Show response
g.ezoic.net/detroitchicago/ 29 B
60 B 32ms
32ms Fetch
application/json 54.85.8.229
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/detroitchicago/ezconfig
Requested by: Host: www.ezojs.com
URL: https://www.ezojs.com/identity.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.85.8.229 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-54-85-8-229.compute-1.amazonaws.com
Software: /
Resource Hash: 893719087a8bc6dcdfabc4e1d54fd6d724953d40da2ad369f8b4fb5f689394d7

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
Content-Type: application/json
sec-ch-ua-mobile: ?0

Response headers

access-control-max-age: 1728000
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, PUT, OPTIONS
access-control-allow-origin: https://www.mediafire.com
content-length: 29
date: Thu, 14 May 2026 09:33:19 GMT
content-type: application/json
vary: Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
access-control-allow-headers: Content-Type

GET
H2 200 olathe.js Show response
g.ezoic.net/parsonsmaize/ 2 KB
900 B 37ms
33ms Script
application/javascript 54.85.8.229
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/parsonsmaize/olathe.js?gcb=195-16&cb=30
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.85.8.229 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-54-85-8-229.compute-1.amazonaws.com
Software: /
Resource Hash: 8af2d4d39123c52a7c0ab7f7e4fbf96c5bfeb969ccce59ceb2bc7c96a7624f2b

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-robots-tag: noindex, follow
cache-control: max-age=31536000, public
content-encoding: br
date: Thu, 14 May 2026 09:33:19 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding

GET
H2 200 et.js Show response
g.ezoic.net/porpoiseant/ 2 KB
712 B 34ms
30ms Script
application/javascript 54.85.8.229
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/porpoiseant/et.js?gcb=195-16&cb=4
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.85.8.229 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-54-85-8-229.compute-1.amazonaws.com
Software: /
Resource Hash: 8fb0902cb2d17d83fa68fa9a81a2e2872675c67bac55f2aced4aa2c5540f6655

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-robots-tag: noindex, follow
cache-control: max-age=31536000, public
content-encoding: br
content-length: 624
date: Thu, 14 May 2026 09:33:19 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding

GET
H2 200 reno.js Show response
g.ezoic.net/detroitchicago/ 2 KB
807 B 38ms
34ms Script
application/javascript 54.85.8.229
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/detroitchicago/reno.js?gcb=195-16&cb=0bf9e049ca
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.85.8.229 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-54-85-8-229.compute-1.amazonaws.com
Software: /
Resource Hash: c03c74e3dfa5656dcd9841f61549cec816a1b2ec377dcc439761ca77a46ab1e2

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-robots-tag: noindex, follow
cache-control: max-age=31536000, public
content-encoding: br
date: Thu, 14 May 2026 09:33:19 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding

GET
H2 200 overlandpark.js Show response
g.ezoic.net/detroitchicago/ 1 KB
522 B 35ms
32ms Script
application/javascript 54.85.8.229
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/detroitchicago/overlandpark.js?gcb=195-16&cb=301bbdaf04
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.85.8.229 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-54-85-8-229.compute-1.amazonaws.com
Software: /
Resource Hash: ac5a4a0937632f257b63ebd53a656fd045529bc506cf4abb880bec8421e8eb60

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-robots-tag: noindex, follow
cache-control: max-age=31536000, public
content-encoding: br
content-length: 491
date: Thu, 14 May 2026 09:33:19 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding

GET
H2 200 denver.js Show response
g.ezoic.net/detroitchicago/ 5 KB
2 KB 36ms
33ms Script
application/javascript 54.85.8.229
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/detroitchicago/denver.js?gcb=195-16&cb=6172c8e946
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.85.8.229 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-54-85-8-229.compute-1.amazonaws.com
Software: /
Resource Hash: 8cf6a4c31fa2d18422547a79c358d008d2ffb1988bf14415627b32f60482c217

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-robots-tag: noindex, follow
cache-control: max-age=31536000, public
content-encoding: br
date: Thu, 14 May 2026 09:33:19 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding

GET
H2 200 wichita.js Show response
g.ezoic.net/detroitchicago/ 2 KB
982 B 37ms
34ms Script
application/javascript 54.85.8.229
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/detroitchicago/wichita.js?gcb=195-16&cb=e49d8d9bca
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.85.8.229 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-54-85-8-229.compute-1.amazonaws.com
Software: /
Resource Hash: b837449c7254dd5887b620b7903bb4dbafbf2424ae3eb25e7a9f3471ff105365

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-robots-tag: noindex, follow
cache-control: max-age=31536000, public
content-encoding: br
date: Thu, 14 May 2026 09:33:19 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding

GET
H2 200 vitals.js Show response
g.ezoic.net/tardisrocinante/ 11 KB
4 KB 35ms
32ms Script
application/javascript 54.85.8.229
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/tardisrocinante/vitals.js?gcb=16&cb=5
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.85.8.229 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-54-85-8-229.compute-1.amazonaws.com
Software: /
Resource Hash: 0a9da3cf7efd1a7499a1c888d44ab103ca6c92a9ab354e17e146384b39cead50

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-robots-tag: noindex, follow
cache-control: max-age=31536000, public
content-encoding: br
date: Thu, 14 May 2026 09:33:19 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding

GET
H2 200 chanute.js Show response
g.ezoic.net/parsonsmaize/ 21 KB
5 KB 62ms
59ms Script
application/javascript 54.85.8.229
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/parsonsmaize/chanute.js?a=a&cb=19&dcb=195-16&shcb=34
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.85.8.229 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-54-85-8-229.compute-1.amazonaws.com
Software: /
Resource Hash: e12bc1fca47f992f263407fdc0b3d6cb30d860ab0ed5e93a662387174e597d7b

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-robots-tag: noindex, follow
cache-control: max-age=31536000, public
content-encoding: br
date: Thu, 14 May 2026 09:33:19 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding

GET
H2 200 jellyfish.js Show response
g.ezoic.net/porpoiseant/ 28 KB
7 KB 64ms
62ms Script
application/javascript 54.85.8.229
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/porpoiseant/jellyfish.js?a=a&cb=21&dcb=195-16&shcb=34
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.85.8.229 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-54-85-8-229.compute-1.amazonaws.com
Software: /
Resource Hash: 1f0eaf56b1f181194ca996ec9d07da4e006dc9e1837dcc07f7bbc3a7a6d7b7c5

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-robots-tag: noindex, follow
cache-control: max-age=31536000, public
content-encoding: br
date: Thu, 14 May 2026 09:33:19 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding

GET
H2 404 0 Show response
www.mediafiredls.com/onclick/ 5 B
506 B 85ms
27ms XHR
text/plain 172.67.73.78
Cloudflare

General

Check archive.org

Download Go to

Full URL

https://www.mediafiredls.com/onclick/0

Requested by

Host: www.mediafire.com
URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.73.78 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

c6c094bc0054f9cbe34102ff49f86b3928b5ac09f3d2ac87e170d0500675921f

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=%2FpZ85PLSmCoX1maW3zZrbmsaHWANV%2BqBDKhnputDiuLbrQOZuXTcIuBZmhLdjqJqFHKHrY5yGofimji7gXCjttyaWEK79TQX5T6rDwbWa2RHdwOxPOxTx4D2SOMg5VskHDVZhGcg"}]}
referrer-policy: same-origin
cf-ray: 9fb8e6980d1936bf-YYZ
expires: Thu, 01 Jan 1970 00:00:01 GMT
access-control-allow-origin: *
content-length: 5
date: Thu, 14 May 2026 09:33:20 GMT
content-type: text/plain
server: cloudflare
x-frame-options: SAMEORIGIN

POST
H2 200 sa.go Show response
g.ezoic.net/ 212 KB
39 KB 153ms
149ms XHR
text/javascript 54.85.8.229
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/sa.go
Requested by: Host: www.ezojs.com
URL: https://www.ezojs.com/ezoic/sa.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.85.8.229 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-54-85-8-229.compute-1.amazonaws.com
Software: /
Resource Hash: 990b9290243b6a567be547695e6c7e19e01029c8568b5d122202c0aa0b52f8df

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
Content-Type: text/plain
sec-ch-ua-mobile: ?0

Response headers

x-ezidgraph-candidates: [{"id":"a4e12b26a69305139ad2595bbfc5bd1c","sim":0.9503845572471619},{"id":"f3201caaf68c91620f90b38283bc55b2","sim":0.9471734166145325},{"id":"a5d785826f448a17354a41de9d8aa04d","sim":0.9439606070518494},{"id":"194ecbf6f9a852070e278eca3d4142ff","sim":0.9430427551269531},{"id":"0f8850935834756460bbb76f1126d293","sim":0.9430427551269531},{"id":"514d8da3170dc511ac186a3635c5258e","sim":0.9430427551269531},{"id":"194c48f2cc77c4e16ff6e70ba48165e0","sim":0.9430427551269531},{"id":"1948ce2994603a5c8f30ec943e53ad53","sim":0.9430427551269531},{"id":"0f8555ec45d9f7455cdaa5ddfe666a68","sim":0.9430427551269531},{"id":"0f315cc0f366404f1b3cd818a7adbfca","sim":0.9430427551269531}]
access-control-max-age: 1728000
x-ezidgraph-status: ok
x-ezidgraph-latency: 11.592693ms
x-ezidgraph-producererrors: 0
content-encoding: br
x-robots-tag: noindex
x-ezidgraph-cluster: 142e99cc7726b3a439aa50ec804b6bbe
x-ezidgraph-producer: true
access-control-allow-methods: GET, POST, PUT, OPTIONS
expires: Wed, 13 May 2026 09:33:20 GMT
x-ezidgraph-signals: 18
date: Thu, 14 May 2026 09:33:20 GMT
content-type: text/javascript
vary: Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
access-control-allow-headers: Content-Type
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
access-control-allow-credentials: true
x-ezidgraph-producerstream: identity-graph-observations-us-east-1-prod
x-ezidgraph-confidence: 0.00
access-control-allow-origin: https://www.mediafire.com
x-ezidgraph-diag: dynamo miss: checked 0 signals; ann ok: 10 candidates
x-ezidgraph-match: new

POST
H2 200 imp.gif
g.ezoic.net/detroitchicago/ 43 B
205 B 61ms
58ms Ping
image/gif 54.85.8.229
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/detroitchicago/imp.gif
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.85.8.229 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-54-85-8-229.compute-1.amazonaws.com
Software: /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
Content-Type: text/plain
sec-ch-ua-mobile: ?0

Response headers

access-control-max-age: 1728000, 1728000
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, PUT, OPTIONS, HEAD, PUT, POST, GET, OPTIONS
expires: Wed, 13 May 2026 09:33:20 GMT
access-control-allow-origin: https://www.mediafire.com, https://www.mediafire.com
content-length: 43
date: Thu, 14 May 2026 09:33:20 GMT
x-middleton-display: imp_sol
content-type: image/gif
vary: Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
access-control-allow-headers: Content-Type, Content-Type

GET
H2 200 omaha.js Show response
g.ezoic.net/detroitchicago/ 2 KB
649 B 32ms
32ms Script
application/javascript 54.85.8.229
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://g.ezoic.net/detroitchicago/omaha.js?gcb=195-16&cb=8f3688675f
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.85.8.229 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-54-85-8-229.compute-1.amazonaws.com
Software: /
Resource Hash: 8952b91af1705fc7fddb2a9bcc53534d55f136755e48e957711d85b038287542

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-robots-tag: noindex, follow
cache-control: max-age=31536000, public
content-encoding: br
content-length: 595
date: Thu, 14 May 2026 09:33:20 GMT
x-middleton-display: sol-js
content-type: application/javascript
vary: Accept-Encoding

POST
H2 204 collect
analytics.google.com/g/ 0
0 145ms
65ms Fetch
text/plain 216.239.32.181
Google LLC

General

Check archive.org

Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-K68XP6D85D&gtm=45je65c0v887485693z86304663za20gzb6304663zd6304663&_p=1778751198976&_gaz=1&gcd=13l3l3l3l1l1&npa=0&dma=0&tcfd=10000&_eu=AAAAAGAC&are=1&cid=1798214675.1778751200&frm=0&pscdl=noapi&rcb=2&sr=1600x1200&uaa=x86&uab=64&uafvl=Chromium%3B148.0.0.0%7CGoogle%2520Chrome%3B148.0.0.0%7CNot-A.Brand%3B24.0.0.0&uam=&uamb=0&uap=Linux&uapv=&uaw=0&ul=en-ca&gaf=2&_s=1&tag_exp=0~115938466~115938468&sid=1778751200&sct=1&seg=0&dl=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F28rrtqxs0afdpk3%2FGambonanza-v1.0.16-full-apkvision.apk%2Ffile&dt=Gambonanza-v1.0.16-full-apkvision&en=page_view&_fv=1&_ss=1&up.page_url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F28rrtqxs0afdpk3%2FGambonanza-v1.0.16-full-apkvision.apk%2Ffile&tfd=2019
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-K68XP6D85D&cx=c&gtm=4e65c0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 216.239.32.181 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:196:0
report-to: {"group":"ascnsrsggc:196:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:196:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.mediafire.com
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:196:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 14 May 2026 09:33:20 GMT
content-type: text/plain
server: Golfe2

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
559 B 123ms
44ms Ping
text/plain 142.251.16.157
Google LLC

General

Check archive.org

Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-K68XP6D85D&cid=1798214675.1778751200&gtm=45je65c0v887485693z86304663za20gzb6304663zd6304663&rcb=2&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=0&tag_exp=0~115938466~115938468
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-K68XP6D85D&cx=c&gtm=4e65c0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.251.16.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: bl-in-f157.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:164:0
report-to: {"group":"ascnsrsggc:164:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:164:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.mediafire.com
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:164:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 14 May 2026 09:33:20 GMT
content-type: text/plain
server: Golfe2

GET
H3 200 ga-audiences
www.google.ca/ads/ 42 B
63 B 98ms
54ms Image
image/gif 64.233.180.94
Google LLC

General

Check archive.org

Download Go to Show image

Full URL

https://www.google.ca/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-K68XP6D85D&cid=1798214675.1778751200&gtm=45je65c0v887485693z86304663za20gzb6304663zd6304663&rcb=2&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=0&tag_exp=0~115938466~115938468&z=432990438

Requested by

Host: www.mediafire.com
URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file

Protocol

Security

QUIC, , AES_128_GCM

Server

64.233.180.94 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

on-in-f94.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Thu, 14 May 2026 09:33:20 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 24px.svg
fonts.gstatic.com/s/i/productlogos/translate/v14/ 6 KB
3 KB 118ms
56ms Image
image/svg+xml 142.251.163.94
Google LLC

General

Check archive.org

Download Go to Show image

Full URL

https://fonts.gstatic.com/s/i/productlogos/translate/v14/24px.svg

Requested by

Host: www.mediafire.com
URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.94 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

wv-in-f94.1e100.net

Software

sffe /

Resource Hash

ab5c23a05e39deed14d9d8262b0dce9f024f86105a27196cad37d14a3f516e09

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
age: 2295
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Fri, 14 May 2027 08:55:05 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 14 May 2026 08:55:05 GMT
last-modified: Wed, 20 Apr 2022 14:24:23 GMT
content-type: image/svg+xml
vary: Accept-Encoding
cache-control: public, max-age=31536000
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 3340
x-xss-protection: 0
server: sffe

GET
H2 200 googlelogo_color_42x16dp.png
www.gstatic.com/images/branding/googlelogo/1x/ 910 B
1 KB 58ms
57ms Image
image/png 172.253.63.94
Google LLC

General

Check archive.org

Download Go to Show image

Full URL

https://www.gstatic.com/images/branding/googlelogo/1x/googlelogo_color_42x16dp.png

Requested by

Host: www.mediafire.com
URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.94 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

bi-in-f94.1e100.net

Software

sffe /

Resource Hash

6318394f737c66f0e2ccfcd88e3935c6667633a1b95fa29fba2b75431d55eef2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

age: 16674
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
x-content-type-options: nosniff
expires: Fri, 14 May 2027 04:55:26 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 14 May 2026 04:55:26 GMT
last-modified: Thu, 02 Nov 2023 22:48:00 GMT
content-type: image/png
vary: Origin
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
content-length: 910
x-xss-protection: 0
server: sffe

GET
H3 200 anchorfix.js Show response
go.ezodn.com/detroitchicago/ 2 KB
1 KB 31ms
31ms Script
application/javascript 104.21.87.79
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://go.ezodn.com/detroitchicago/anchorfix.js?cb=29&gcb=195-16
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.87.79 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5b03993da08ad46dced1836ab4ae0c79e1425a3c6f807b5fdfa75798312af92c

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-robots-tag: noindex, follow
content-encoding: br
cf-cache-status: HIT
age: 751024
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=SaqOSHTZYTg3jKcA2FcXILflZnMVQEmIAyo%2BSnA0cAnLfiZ135FUEzW3ZL%2FPqA%2BOyPxU8e3yf3ToUgXJR3%2BDJR%2Bi1ckwxFgx%2Fut6DCyRP3MKXiJimE5eaYsfuZkVS9E%3D"}]}
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 14 May 2026 09:33:20 GMT
x-middleton-display: sol-js
last-modified: Tue, 05 May 2026 16:56:42 GMT
content-type: application/javascript
vary: Accept-Encoding
priority: u=3,i=?0
cache-control: public, max-age=31536000
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray: 9fb8e69abcbfab5a-YYZ
accept-ranges: bytes
content-length: 679
server: cloudflare

GET
H3 200 sidebarwall.js Show response
go.ezodn.com/detroitchicago/ 9 KB
3 KB 28ms
28ms Script
application/javascript 104.21.87.79
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://go.ezodn.com/detroitchicago/sidebarwall.js?gcb=16&cb=25
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.87.79 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cb6c1a2d4e9a1239a7887de158b87d86ecbd7047e9ed8214f367406762730003

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-robots-tag: noindex, follow
content-encoding: br
cf-cache-status: HIT
age: 597216
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=%2F44ywMtIfROtjXkKNxcDyhiTJPgHnkCpwtJYwfC7Rmw9j9qSz2N9%2FvWMzPgdhtHRVRebifH6YoKCl03HRAXlTRPYAtxyHERds0LSbKcbgr8z0kmfWj2sc885B2Ou6jY%3D"}]}
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 14 May 2026 09:33:20 GMT
x-middleton-display: sol-js
last-modified: Wed, 13 May 2026 06:29:02 GMT
content-type: application/javascript
vary: Accept-Encoding
priority: u=3,i=?0
cache-control: public, max-age=31536000
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray: 9fb8e69abcc0ab5a-YYZ
server: cloudflare

GET
H3 200 dall.js Show response
go.ezodn.com/hb/ 3 MB
501 KB 31ms
30ms Script
application/javascript 104.21.87.79
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://go.ezodn.com/hb/dall.js?cb=195-16-170
Requested by: Host:
URL: ez-standalone.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.87.79 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7c05738565e57009f34d8b82fbb45d2fb408e8360903530074b6e174c62c407f

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

last-modified: Mon, 11 May 2026 23:38:37 GMT
cache-control: public, max-age=31536000
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 208495
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=NuwNbCfWbF8FWl6QZgSaEkZXXl2Crp3b3W3eCbleyNXBdk%2F1kXWVnLqDu9XHNccKXp%2BwdwCe8%2BGEPO4Nskaolw21iE5XRvmoom%2Bjd%2Bdvg0S21yWPmzN3qLEkzqnalGg%3D"}]}
cf-ray: 9fb8e69abcc2ab5a-YYZ
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 14 May 2026 09:33:20 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare
priority: u=1,i=?0

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 112 KB
35 KB 137ms
56ms Script
text/javascript 192.178.155.155
Google LLC

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host:
URL: ez-standalone.js

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.155.155 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

yuiadrs-in-f155.1e100.net

Software

cafe /

Resource Hash

476cca556c4e2d3e83ac0a724905d02b9eb154b55483d4dfec2bd351b34bf3bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
etag: 992 / 20587 / 31098551 / config-hash: 18142154254346714374
x-content-type-options: nosniff
expires: Thu, 14 May 2026 09:33:20 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 14 May 2026 09:33:20 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 35412
x-xss-protection: 0
server: cafe

GET
H3 200 kenai.js Show response
go.ezodn.com/detroitchicago/ 19 KB
6 KB 55ms
55ms Script
application/javascript 104.21.87.79
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://go.ezodn.com/detroitchicago/kenai.js?gcb=16&cb=3d9e522590
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.87.79 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1a5f47be4022fbf22229416f64f12dbedcb685306e54a476cd524d8df18a24dd

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-robots-tag: noindex, follow
content-encoding: br
cf-cache-status: HIT
age: 818817
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=Dzw%2FJmW6YPeWHafOXXYt%2FpLabfL5tYyxuBGnyBFk60xrck2%2FjBwC1v3N49%2FZ2jBzld4R08ebKhMqs%2BdR%2FzsihHMCOY0VScImnG%2FKzMQBTcatmukkPVjwcSr8UIQHxk4%3D"}]}
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 14 May 2026 09:33:20 GMT
x-middleton-display: sol-js
last-modified: Wed, 13 May 2026 07:15:12 GMT
content-type: application/javascript
vary: Accept-Encoding
priority: u=3,i=?0
cache-control: public, max-age=31536000
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray: 9fb8e69abcc3ab5a-YYZ
server: cloudflare

GET
H3 200 portland.js Show response
go.ezodn.com/detroitchicago/ 350 KB
73 KB 55ms
55ms Script
application/javascript 104.21.87.79
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=dd428baff9
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.87.79 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 841bfbea28055cfe7f8c125ccaec87a9807866998072a09ae9a3702d8f0f2ad1

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-robots-tag: noindex, follow
content-encoding: br
cf-cache-status: HIT
age: 126846
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=5CQBN0jCIaIaAspO4om9Q91pRjvbVTvL393O75QOV4OnlRI05Gsfy8ZS7J%2Bis85rzF4nLVZwBU7XM41BvvE6PgEKaLX6nbfdaq2PdkGow%2F57MLyxTdb2SLYwruuSJv0%3D"}]}
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 14 May 2026 09:33:20 GMT
x-middleton-display: sol-js
last-modified: Tue, 12 May 2026 22:19:20 GMT
content-type: application/javascript
vary: Accept-Encoding
priority: u=3,i=?0
cache-control: public, max-age=31536000
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray: 9fb8e69abcc4ab5a-YYZ
server: cloudflare

GET
H3 200 ezadloadrewarded.js Show response
go.ezodn.com/porpoiseant/ 270 KB
66 KB 55ms
54ms Script
application/javascript 104.21.87.79
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://go.ezodn.com/porpoiseant/ezadloadrewarded.js?cb=1072&gcb=195-16
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.87.79 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 296a27fb10e9408a3da81d8199df73aa6f8a1416b37e165b09f7522c244dbce5

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-robots-tag: noindex, follow
content-encoding: br
cf-cache-status: HIT
age: 49907
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=f0sPV11aKW7QAaAEGw4hdUypKMxBa2VZQ6SmHFG4J1Qx6e%2BMxpA5GUh1ePxn998aT8%2FwJxpKeVXdA80RxXBUYX28Pk7HBWuDhCvQVce%2BE2lUFQBDDZka8hLwntxnPQ4%3D"}]}
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 14 May 2026 09:33:20 GMT
x-middleton-display: sol-js
last-modified: Thu, 14 May 2026 07:29:44 GMT
content-type: application/javascript
vary: Accept-Encoding
priority: u=3,i=?0
cache-control: public, max-age=31536000
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray: 9fb8e69accc5ab5a-YYZ
server: cloudflare

GET
H3 200 reportads.js Show response
go.ezodn.com/detroitchicago/ 6 KB
2 KB 56ms
54ms Script
application/javascript 104.21.87.79
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://go.ezodn.com/detroitchicago/reportads.js?gcb=195-16&cb=8
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.87.79 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3db1df8e9763f3440dc8595e7b4c99ae4b2dbab0dbf1624f2da5800a5e62026e

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-robots-tag: noindex, follow
content-encoding: br
cf-cache-status: HIT
age: 2589203
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=JUeBajuR42FFuZnbQqNXYs%2FX%2Fu8UAY2KKs0qbESCIk%2B%2B3igdJP2xP3Rs2zOb9YzVxqkhrdcn9Jz6yDK3nLB04lX3uEX%2F3YbSRYuT%2Bb7L40GffVNUyKcDPfqQy3zVtbs%3D"}]}
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 14 May 2026 09:33:20 GMT
x-middleton-display: sol-js
last-modified: Tue, 12 May 2026 12:40:15 GMT
content-type: application/javascript
vary: Accept-Encoding
priority: u=3,i=?0
cache-control: public, max-age=31536000
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray: 9fb8e69accc6ab5a-YYZ
server: cloudflare

GET
H2 200 did-006t.min.js Show response
d-code.liadm.com/ 137 KB
47 KB 119ms
34ms Script
application/javascript 108.138.64.116
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://d-code.liadm.com/did-006t.min.js
Requested by: Host:
URL: ez-standalone.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.64.116 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-108-138-64-116.iad12.r.cloudfront.net
Software: /
Resource Hash: 7152b1a8f92e12ba387acd309b9099e2832891fd848b514b284b1bb8eebabd63

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: public,max-age=86400
content-encoding: gzip
etag: W/"3a9a05c3"
age: 75109
via: 1.1 25d9b5959eaa82bb18ee3f35e6bf34b4.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: ia5284gH8lAqASNPCxzEE7ne6896Ua7qAPxRApKxEmpOQbbl1zypnA==
date: Wed, 13 May 2026 18:06:27 GMT
content-type: application/javascript
vary: Accept-Encoding
x-amz-cf-pop: IAD12-P1

GET
H2 200 21150.js Show response
link.rubiconproject.com/magnite/ 1 KB
855 B 177ms
63ms Script
text/javascript 23.222.201.103
Akamai Technologies

General

Check archive.org

Download Go to

Full URL: https://link.rubiconproject.com/magnite/21150.js
Requested by: Host:
URL: ez-standalone.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.222.201.103 Ashburn, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-222-201-103.deploy.static.akamaitechnologies.com
Software: Apache/2.4.65 (Debian) PHP/8.3.24 OpenSSL/3.5.1 / PHP/8.3.24
Resource Hash: 3a9f306824d6e118cf7248a9331b18520750b67af9096c6cb7b026651b419d3b

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: max-age=18050
content-encoding: gzip
expires: Thu, 14 May 2026 14:34:10 GMT
content-length: 636
date: Thu, 14 May 2026 09:33:20 GMT
last-modified: Wed, 19 Nov 2025 14:07:59 GMT
x-powered-by: PHP/8.3.24
server: Apache/2.4.65 (Debian) PHP/8.3.24 OpenSSL/3.5.1
content-type: text/javascript;charset=UTF-8
vary: Accept-Encoding

GET
H3 200 ezoic.png
go.ezodn.com/utilcave_com/ 1 KB
2 KB 55ms
55ms Image
image/png 104.21.87.79
Cloudflare

General

Check archive.org

Download Go to Show image

Full URL: https://go.ezodn.com/utilcave_com/ezoic.png
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.87.79 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 07a54e49f65745ec3e0c0bfec9c0005b787370f8f65476b8da936e14d9ceaaa1

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cf-cache-status: HIT
age: 3080
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=h5lMzgREQ4zkMxYJsvNXxvHyijUgJQvspjX123kpaQ1HoUOarmIrZE7FG5W8j5CvN4tMkGvRakY%2BojFGHn1fUYn3iuh9fzVy3zp06W%2FbZKcL6hwdY8hMlazncLEPQg8%3D"}]}
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 14 May 2026 09:33:20 GMT
last-modified: Thu, 14 May 2026 08:42:03 GMT
content-type: image/png
vary: Accept-Encoding
priority: u=3,i
cache-control: public, max-age=86400
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray: 9fb8e69accc7ab5a-YYZ
accept-ranges: bytes
content-length: 1426
server: cloudflare

GET
H2 200 translate_24dp.png
www.gstatic.com/images/branding/product/2x/ 2 KB
2 KB 58ms
58ms Image
image/png 172.253.63.94
Google LLC

General

Check archive.org

Download Go to Show image

Full URL

https://www.gstatic.com/images/branding/product/2x/translate_24dp.png

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.zZZZhVqDDCw.L.W.O/am=BBDg/d=0/rs=AN8SPfobRl8UQM01cRTktRUhaChx5xxdlg/m=el_main_css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.94 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

bi-in-f94.1e100.net

Software

sffe /

Resource Hash

4dac0026fbfa2615dce30c0af12830863fe885f84387a0147b9e338f548d5d82

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.zZZZhVqDDCw.L.W.O/am=BBDg/d=0/rs=AN8SPfobRl8UQM01cRTktRUhaChx5xxdlg/m=el_main_css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

age: 13229
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
x-content-type-options: nosniff
expires: Fri, 14 May 2027 05:52:51 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 14 May 2026 05:52:51 GMT
last-modified: Thu, 14 Oct 2021 09:08:00 GMT
content-type: image/png
vary: Origin
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
content-length: 1842
x-xss-protection: 0
server: sffe

GET
H3 200 ezoicbwa.png
go.ezodn.com/utilcave_com/ 1 KB
2 KB 53ms
52ms Image
image/png 104.21.87.79
Cloudflare

General

Check archive.org

Download Go to Show image

Full URL: https://go.ezodn.com/utilcave_com/ezoicbwa.png
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.87.79 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 44b848ce1bea5ca25251a1c22058f8df660f1c8161c21ebc13a9ba55ec479d10

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cf-cache-status: HIT
age: 20145
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=kffDyOhaX1qvwEWthgJ8ZPJx5SehaXW7pISSC9QBRoLibYphsK3cClXnHj%2BzJ1sfZAaelk8frLS5rjWYN1Id2%2FT2k6BnxrIepKIR7jI5UviPVuBTvCU2SZ%2Fm4KVyXfw%3D"}]}
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 14 May 2026 09:33:20 GMT
last-modified: Thu, 14 May 2026 03:57:35 GMT
content-type: image/png
vary: Accept-Encoding
priority: u=3,i
cache-control: public, max-age=86400
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray: 9fb8e69accc8ab5a-YYZ
accept-ranges: bytes
content-length: 1331
server: cloudflare

GET
H3 200 ezbidsystem.js Show response
go.ezodn.com/porpoiseant/ 79 KB
28 KB 34ms
33ms Script
application/javascript 104.21.87.79
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://go.ezodn.com/porpoiseant/ezbidsystem.js?cb=1072
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/ezoic/ezorca.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.87.79 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3ede315dfd2fa841e6c775010ef2c2429745efac7e5f7770db2268999f7ae442

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-robots-tag: noindex, follow
content-encoding: br
cf-cache-status: HIT
age: 49921
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=s29gTay%2BTlKesyADRur98EOGiT8%2BZQMBoXd4MzVVMiHYd%2B0DL6D3OerQdBvRW40xfcYBQVo7vLO8pkwcBPFZ6nHRjYQMM7odQvNV3dheUyK6O1F9cPyNhBbUZ%2FK9v%2FI%3D"}]}
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 14 May 2026 09:33:20 GMT
x-middleton-display: sol-js
last-modified: Thu, 14 May 2026 08:38:24 GMT
content-type: application/javascript
vary: Accept-Encoding
priority: u=3,i=?0
cache-control: public, max-age=31536000
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray: 9fb8e69b0ccaab5a-YYZ
server: cloudflare

GET
H2 200 supportedLanguages Show response
translate-pa.googleapis.com/v1/ Frame BE36 31 KB
3 KB 208ms
85ms Script
text/javascript 172.253.63.95
Google LLC

General

Check archive.org

Download Go to

Full URL

https://translate-pa.googleapis.com/v1/supportedLanguages?client=te&display_language=en-US&key=AIzaSyBWDj0QJvVIx8XOhRegXX5_SrRWxhT5Hs4&callback=callback

Requested by

Host:
URL: about:srcdoc

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

172.253.63.95 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

bi-in-f95.1e100.net

Software

ESF /

Resource Hash

8a056fd192a8ea16fcc3cc2cb33e093440ec225dc7e23584d7ee139efd15e0f1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: private
content-encoding: gzip
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Thu, 14 May 2026 09:33:20 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
content-length: 2678
date: Thu, 14 May 2026 09:33:20 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
vary: Origin, X-Origin, Referer
server: ESF
x-frame-options: SAMEORIGIN

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
136 B 28ms
26ms Fetch
image/gif 172.66.148.140
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=2&e=0.045267798418963445
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.66.148.140 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 3
x-goog-stored-content-encoding: identity
expires: Tue, 12 May 2026 22:06:37 GMT
x-goog-stored-content-length: 43
date: Thu, 14 May 2026 09:33:20 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: AOCedOE4ceqfKqcxsn6FfQCul5MU3fPppaJoaSAD4zIpDi_AuCRSOF0vpherOnDkBFq5ISKOXI37mOc
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9fb8e69ba93bb8f3-YYZ
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico Show response
ad.doubleclick.net/ 1 KB
129 B 41ms
39ms Fetch
image/x-icon 192.178.155.149
Google LLC

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.5273493255016013

Requested by

Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.155.149 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

yuiadrs-in-f149.1e100.net

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Fri, 15 May 2026 09:33:20 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 14 May 2026 09:33:20 GMT
content-type: image/x-icon
vary: Accept-Encoding
last-modified: Tue, 08 May 2012 13:08:06 GMT
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
111 B 28ms
25ms Fetch
image/gif 172.66.148.140
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.29108020798397805
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.66.148.140 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 3
x-goog-stored-content-encoding: identity
expires: Tue, 12 May 2026 22:06:37 GMT
x-goog-stored-content-length: 43
date: Thu, 14 May 2026 09:33:20 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: AOCedOE4ceqfKqcxsn6FfQCul5MU3fPppaJoaSAD4zIpDi_AuCRSOF0vpherOnDkBFq5ISKOXI37mOc
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9fb8e69ba93db8f3-YYZ
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H2 200 dns Show response
ab.dns-finder.com/meta/ 2 B
0 1ms
1ms Fetch
text/plain 34.36.200.111
Google LLC

General

Check archive.org

Download Go to

Full URL: https://ab.dns-finder.com/meta/dns
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.36.200.111 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS: 111.200.36.34.bc.googleusercontent.com
Software: /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: private, max-age=180, stale-if-error=180, stale-while-revalidate=180
access-control-expose-headers: X-Resolver
x-resolver: default
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000
content-length: 2
date: Thu, 14 May 2026 09:33:19 GMT
content-type: text/plain; charset=utf-8
vary: Origin

GET
H2 200 bsads.js Show response
ads.bidsystem.ai/ 122 KB
38 KB 394ms
32ms Script
text/javascript 104.21.3.76
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ads.bidsystem.ai/bsads.js
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/porpoiseant/ezbidsystem.js?cb=1072
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.21.3.76 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3a81ec63bc5f6514e53912cea2d2fad4d8173561b6743b0177d6aaadd08a9681

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: public, max-age=900, stale-while-revalidate=3600
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-encoding: zstd
cf-cache-status: HIT
age: 862
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=yrKrcm1YdXzi5C97nh1t08vGtkKX0AYX4VBePa7HAZaa1WBTPrSKnzYKN3hlRZrMD3hS1kJUcssHNJrTzJjOzMCrgUArSMrzhP9Fj4bcgspeWkHSuBXq5gVNgEadDyWrxOvt"}]}
cf-ray: 9fb8e69e1e4a8af6-YYZ
alt-svc: h3=":443"; ma=86400
date: Thu, 14 May 2026 09:33:20 GMT
content-type: text/javascript; charset=utf-8
last-modified: Fri, 08 May 2026 22:12:04 GMT
vary: Origin
server: cloudflare

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202605130101/ 594 KB
187 KB 38ms
38ms Script
text/javascript 192.178.155.155
Google LLC

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202605130101/pubads_impl.js?cb=31098551

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.155.155 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

yuiadrs-in-f155.1e100.net

Software

cafe /

Resource Hash

0ba5dbef7513c0f9ba69b894042e2609a3aba34d2cd92c3b8d130be699aaa378

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
etag: 16020616869842361057
age: 84234
x-content-type-options: nosniff
expires: Thu, 13 May 2027 10:09:26 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Wed, 13 May 2026 10:09:26 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 191234
x-xss-protection: 0
server: cafe

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
134 B 27ms
27ms Fetch
image/gif 172.66.148.140
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.07098413463687725
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.66.148.140 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 3
x-goog-stored-content-encoding: identity
expires: Tue, 12 May 2026 22:06:37 GMT
x-goog-stored-content-length: 43
date: Thu, 14 May 2026 09:33:21 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: AOCedOE4ceqfKqcxsn6FfQCul5MU3fPppaJoaSAD4zIpDi_AuCRSOF0vpherOnDkBFq5ISKOXI37mOc
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9fb8e69edb75b8f3-YYZ
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
111 B 27ms
26ms Fetch
image/gif 172.66.148.140
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=2&e=0.9518405021402037
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.66.148.140 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 3
x-goog-stored-content-encoding: identity
expires: Tue, 12 May 2026 22:06:37 GMT
x-goog-stored-content-length: 43
date: Thu, 14 May 2026 09:33:21 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: AOCedOE4ceqfKqcxsn6FfQCul5MU3fPppaJoaSAD4zIpDi_AuCRSOF0vpherOnDkBFq5ISKOXI37mOc
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9fb8e69edb77b8f3-YYZ
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico Show response
ad.doubleclick.net/ 1 KB
129 B 42ms
42ms Fetch
image/x-icon 192.178.155.149
Google LLC

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.7991248577957506

Requested by

Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.155.149 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

yuiadrs-in-f149.1e100.net

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Fri, 15 May 2026 09:33:21 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 14 May 2026 09:33:21 GMT
content-type: image/x-icon
vary: Accept-Encoding
last-modified: Tue, 08 May 2012 13:08:06 GMT
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET bounce
id5-sync.com/ 0
0

GET
H2 200 v1 Show response
lbs.eu-1-id5-sync.com/lbs/ 54 B
162 B 378ms
123ms Fetch
application/json 135.125.170.95
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://lbs.eu-1-id5-sync.com/lbs/v1
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 135.125.170.95 , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ns31890042.ip-135-125-170.eu
Software: /
Resource Hash: f87faa1a8a9d8dbc9295850876b8eaea1535a2445869942f3aef330c93750d49

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

access-control-allow-origin: https://www.mediafire.com
content-length: 54
date: Thu, 14 May 2026 09:33:21 GMT
content-type: application/json
vary: Origin

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
336 B 368ms
119ms Fetch
application/json 135.125.170.98
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

135.125.170.98 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ns31890040.ip-135-125-170.eu

Software

Resource Hash

88e6a0820d28a7f35f2040b6148ba8a546f4fc3317665216d01633e6370d90a4

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://www.mediafire.com
content-encoding: gzip
date: Thu, 14 May 2026 09:33:20 GMT
content-type: application/json;charset=UTF-8
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 102ms
30ms Preflight
application/json 74.119.117.62
Criteo Corp.

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.mediafire.com%2F&domain=www.mediafire.com&cw=1&lsw=1&gdpr=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.62 , United States, ASN19750 (AS-CRITEO - Criteo Corp., US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://www.mediafire.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://www.mediafire.com
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Thu, 14 May 2026 09:33:21 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 200596
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 indy.js Show response
go.ezodn.com/detroitchicago/ 362 KB
96 KB 29ms
28ms Script
application/javascript 104.21.87.79
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://go.ezodn.com/detroitchicago/indy.js?cb=118&gcb=0
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.87.79 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: d92fdbca4cf04d6ca524a8443eefa70b755a0ec237ebdd19ad1816b1afa4a9df

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-robots-tag: noindex, follow
content-encoding: br
cf-cache-status: HIT
age: 1965722
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=jwr1l%2Ftn8lT7w72pTLetL0IlnLXGclACP2Yxqynw2Z2ErQLAG%2FB8Yo4Ue7QsI9UyrI20L%2FWwdlUgSoPqS%2BKwZFKBO074OP1yIUwZh4Jv2nhAScaoS4WGHJ4JWvZNC%2Bc%3D"}]}
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 14 May 2026 09:33:21 GMT
x-middleton-display: sol-js
last-modified: Fri, 01 May 2026 00:32:13 GMT
content-type: application/javascript
vary: Accept-Encoding
priority: u=3,i=?0
cache-control: public, max-age=31536000
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray: 9fb8e69f2cceab5a-YYZ
server: cloudflare

GET
H2 200 latest.json Show response
cdn.jsdelivr.net/gh/prebid/currency-file@1/ 2 KB
1 KB 82ms
21ms Fetch
application/json 151.101.1.229
Fastly

General

Check archive.org

Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/currency-file@1/latest.json

Requested by

Host:
URL: webpack:///./src/ajax.js?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.1.229 , United States, ASN54113 (FASTLY - Fastly, Inc., US),

Reverse DNS

Software

Resource Hash

cfd403f898eab46a5540f9c7b0d50ff086c81b8a15facd3824bfaa8af50079e4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
content-type: text/plain
sec-ch-ua-mobile: ?0

Response headers

access-control-expose-headers: *
content-encoding: br
etag: W/"611-eiKQrvGnhaY6VypDT/JzCKQkqWw"
age: 23557
x-content-type-options: nosniff
x-jsd-version-type: version
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-cache: HIT, HIT
date: Thu, 14 May 2026 09:33:21 GMT
content-type: application/json; charset=utf-8
x-served-by: cache-fra-etou8220102-FRA, cache-yul1970051-YUL
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
content-length: 806
x-jsd-version: 1.0.2791

GET
H2 200 envelope Show response
lexicon.33across.com/v1/ 1 KB
2 KB 107ms
32ms Fetch
application/json 37.19.206.161
CDN77 Datacamp Li...

General

Check archive.org

Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0010b00002MpnPqAAJ&gdpr=0&src=pbjs&ver=10.23.0&coppa=0
Requested by: Host:
URL: webpack:///./src/ajax.js?
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 37.19.206.161 Ashburn, United States, ASN60068 (CDN77 Datacamp Limited, GB),
Reverse DNS: unn-37-19-206-161.datapacket.com
Software: /
Resource Hash: 730513f1782bade420d056d7cc92c1d2bce293a644430e54ad14ac65c8c6360b

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
content-type: text/plain
sec-ch-ua-mobile: ?0

Response headers

access-control-allow-origin: https://www.mediafire.com
content-length: 1528
content-type: application/json
vary: origin
access-control-allow-credentials: true

GET
H2 200 / Show response
id.a-mx.com/sync/ 66 B
466 B 212ms
85ms Fetch
application/json 156.146.43.72
CDN77 Datacamp Li...

General

Check archive.org

Download Go to

Full URL: https://id.a-mx.com/sync/?tagId=&ref=null&u=https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file&tl=https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file&nf=0&rt=true&v=10.23.0&av=2.0&vg=epbjs&us_privacy=null&am=null&gdpr=0&gdpr_consent=
Requested by: Host:
URL: webpack:///./src/ajax.js?
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 156.146.43.72 Miami, United States, ASN60068 (CDN77 Datacamp Limited, GB),
Reverse DNS: 156-146-43-72.bunnyinfra.net
Software: BunnyCDN-MI1-1212 /
Resource Hash: bca47f32db64890bfe823be924f8523713184dc64aa54c21f09eaeb4ffb97b71

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
content-type: text/plain
sec-ch-ua-mobile: ?0

Response headers

cdn-status: 200
date: Thu, 14 May 2026 09:33:21 GMT
cdn-cache: BYPASS
content-type: application/json
cdn-cachedat: 05/14/2026 09:33:21
cdn-requestpullcode: 200
cache-control: public, max-age=0
cdn-requestpullsuccess: True
cdn-requesttime: 0
cdn-requestid: 403b1dee3e12ecfe6771832dccd2d3a3
access-control-allow-credentials: true
cdn-pullzone: 5497800
cdn-proxyver: 1.53
access-control-allow-origin: https://www.mediafire.com
content-length: 66
cdn-edgestorageid: 1356
server: BunnyCDN-MI1-1212
cdn-requestcountrycode: CA

GET
H2 200 fed Show response
ups.analytics.yahoo.com/ups/58713/ 2 B
254 B 317ms
107ms Fetch
application/json 69.147.92.12
Yahoo Holdings Inc.

General

Check archive.org

Download Go to

Full URL

https://ups.analytics.yahoo.com/ups/58713/fed?v=1&1p=0&gdpr=0&gdpr_consent=&us_privacy=&url=https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file&pixelId=58713

Requested by

Host:
URL: webpack:///./src/ajax.js?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

69.147.92.12 Ashburn, United States, ASN14777 (YAHOO - Yahoo Holdings Inc., US),

Reverse DNS

e2.ycpi.vip.dca.yahoo.com

Software

ATS /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
content-type: text/plain
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000
age: 0
access-control-allow-credentials: true
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
access-control-allow-origin: https://www.mediafire.com
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Thu, 14 May 2026 09:33:21 GMT
content-type: application/json
vary: Origin
server: ATS

GET
H2 200 json Show response
gum.criteo.com/sid/ 359 B
1 KB 146ms
49ms Fetch
application/json 74.119.117.62
Criteo Corp.

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.mediafire.com%2F&domain=www.mediafire.com&cw=1&lsw=1&gdpr=0

Requested by

Host:
URL: webpack:///./src/ajax.js?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.62 , United States, ASN19750 (AS-CRITEO - Criteo Corp., US),

Reverse DNS

Software

Kestrel /

Resource Hash

4f9c9b58f7afd13f9db7613ddad39a9ab40038fb9c00e7a6876b56ad86073228

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
content-type: application/json
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 419281
expires: 0
access-control-allow-origin: https://www.mediafire.com
date: Thu, 14 May 2026 09:33:20 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

GET
H2 200 d9core Show response
d9.flashtalking.com/ 11 KB
11 KB 127ms
30ms Script
application/javascript 50.16.131.99
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://d9.flashtalking.com/d9core
Requested by: Host:
URL: webpack:///./src/utils.js?
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.16.131.99 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-50-16-131-99.compute-1.amazonaws.com
Software: Apache/2.4.66 (Amazon Linux) OpenSSL/3.2.2 /
Resource Hash: fedf6cae088b1d6a484aa46adf6498e281e2d32f79c8f681f32f8ac9c169fd77

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: private, must-revalidate, proxy-revalidate, max-age=172800
etag: 5bc31bf7d4a298e1bef9d35fce222bfc
access-control-allow-credentials: true
access-control-allow-methods: GET,POST,SERVER
access-control-allow-origin: d9.flashtalking.com
p3p: policyref="localhost/w3c/D9_p3p_.xml", CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"
date: Thu, 14 May 2026 09:33:21 GMT
content-type: application/javascript;charset=utf-8
server: Apache/2.4.66 (Amazon Linux) OpenSSL/3.2.2

GET
H2 200 pbhid Show response
id.hadron.ad.gt/api/v1/ 2 B
271 B 115ms
44ms Fetch
application/json 172.66.148.159
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://id.hadron.ad.gt/api/v1/pbhid?partner_id=524&_it=prebid&t=1&src=id&domain=www.mediafire.com&gdpr=0
Requested by: Host:
URL: webpack:///./src/ajax.js?
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.66.148.159 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
content-type: text/plain
sec-ch-ua-mobile: ?0

Response headers

cache-control: max-age=604800
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
access-control-allow-methods: HEAD,GET,POST,PUT,DELETE,OPTIONS
cf-ray: 9fb8e69fefcede04-YYZ
access-control-allow-origin: *
content-length: 2
date: Thu, 14 May 2026 09:33:21 GMT
content-type: application/json; charset=utf8
server: cloudflare
access-control-allow-headers: authorization,content-type

POST
H2 200 prebid Show response
id5-sync.com/api/config/ 194 B
645 B 293ms
124ms Fetch
application/json 135.125.170.98
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host:
URL: webpack:///./src/ajax.js?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

135.125.170.98 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ns31890040.ip-135-125-170.eu

Software

Resource Hash

446a24acf9272b37cf14bf847684201154b6648113a148f1381b7489db6294f3

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
Content-Type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
content-encoding: gzip
access-control-allow-credentials: true
access-control-allow-origin: https://www.mediafire.com
p3p: CP="CAO PSA OUR"
date: Thu, 14 May 2026 09:33:20 GMT
content-type: application/json;charset=UTF-8
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding

GET
H2 200 id5PrebidModule.js Show response
cdn.id5-sync.com/api/1.0/ 100 KB
29 KB 31ms
31ms Script
text/javascript 104.20.23.13
Cloudflare

General

Check archive.org

Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/id5PrebidModule.js

Requested by

Host:
URL: webpack:///./src/utils.js?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.23.13 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

5adfa8fdf36805dec0395a90e3347559da75fe8fc8830c48e22c94b18f8d9753

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-amz-id-2: +GcJMpiuSq0mITfJdFLRJ2b7zKFKn1wEkLxVi7H73/2D2zP+IGYLj9h8BgXChIht59OBuxDca/U=
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: public, max-age=3600
content-encoding: br
cf-cache-status: HIT
etag: W/"dc5fa4f92eff1fb575f1de07a68916ea"
age: 3086
x-amz-request-id: PCC2XXSSKEC5MG1T
cf-ray: 9fb8e69f7c2dae18-YYZ
date: Thu, 14 May 2026 09:33:21 GMT
content-type: text/javascript;charset=utf-8
last-modified: Wed, 18 Mar 2026 12:22:23 GMT
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 204 envelope Show response
api.rlcdn.com/api/identity/ 0
261 B 136ms
68ms Fetch 34.107.165.188
Google LLC

General

Check archive.org

Download Go to

Full URL: https://api.rlcdn.com/api/identity/envelope?pid=14067
Requested by: Host:
URL: webpack:///./src/ajax.js?
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.165.188 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS: 188.165.107.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
content-type: text/plain
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-cache, no-store
timing-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET, OPTIONS
via: 1.1 google
access-control-allow-origin: https://www.mediafire.com
alt-svc: h3=":443"; ma=2592000
date: Thu, 14 May 2026 09:33:21 GMT
access-control-allow-headers: Accept, Authorization, Content-Type, Cookie, Origin, X-Requested-With

GET
H2 200 id Show response
id.crwdcntrl.net/ 75 B
828 B 142ms
39ms Fetch
application/json 52.2.73.27
Amazon.com

General

Check archive.org

Download Go to

Full URL

https://id.crwdcntrl.net/id?gdpr_applies=false

Requested by

Host:
URL: webpack:///./src/ajax.js?

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.2.73.27 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-52-2-73-27.compute-1.amazonaws.com

Software

Resource Hash

d91b0d2e4d5cad7ebdc5dd2224d4359285c001ba188951e60a61d7b934406c32

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
content-type: text/plain
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains
cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://www.mediafire.com
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 75
date: Thu, 14 May 2026 09:33:21 GMT
content-type: application/json;charset=utf-8

GET
H2 204 UCookieSetPug Show response
image6.pubmatic.com/AdServer/ 0
265 B 101ms
30ms Fetch
text/html 8.28.7.81
PubMatic

General

Check archive.org

Download Go to

Full URL

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=5&p=156983&publisherId=156983&gdpr=0&gdpr_consent=&src=pbjs_uid&ver=1&coppa=0&us_privacy=&gpp=&gpp_sid=

Requested by

Host:
URL: webpack:///./src/ajax.js?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

8.28.7.81 , United States, ASN62713 (AS-PUBMATIC - PubMatic, Inc., US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400; includeSubDomains

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
content-type: text/plain
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=16070400; includeSubDomains
cache-control: no-cache, no-store, must-revalidate
access-control-allow-origin: https://www.mediafire.com
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 14 May 2026 09:33:21 GMT
content-type: text/html; charset=UTF-8
access-control-allow-credentials: true

GET
H2 200 fpc Show response
at.teads.tv/ 56 B
489 B 104ms
42ms Fetch
text/plain 151.101.194.132
Fastly

General

Check archive.org

Download Go to

Full URL

https://at.teads.tv/fpc?analytics_tag_id=PUB_13877&tfpvi=&gdpr_consent=&gdpr_status=0&gdpr_reason=0&ccpa_consent=&sv=prebid-v1

Requested by

Host:
URL: webpack:///./src/ajax.js?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.194.132 , United States, ASN54113 (FASTLY - Fastly, Inc., US),

Reverse DNS

Software

Resource Hash

d1466a7684ac9b1af90477f554e4c50ec51a87a78275468ed2b9e3aba915b5de

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
content-type: text/plain
sec-ch-ua-mobile: ?0

Response headers

x-check-cacheable: NO
x-cache: MISS
date: Thu, 14 May 2026 09:33:21 GMT
content-type: text/plain; charset=UTF-8
x-served-by: cache-yul1970054-YUL
x-cache-hits: 0
x-u: /fpc?analytics_tag_id=PUB_13877&tfpvi=&gdpr_consent=&gdpr_status=0&gdpr_reason=0&ccpa_consent=&sv=prebid-v1
x-b: ylOjgn7Xd9Ovs8YIkDlH51--F_at_use1_teads_tv
strict-transport-security: max-age=300
vary: Accept-Encoding
cache-control: max-age=0, no-cache, no-store
x-timer: S1778751201.262695,VS0,VE18
access-control-allow-credentials: true
via: 1.1 varnish
x-ff: 86.106.90.214
accept-ranges: bytes
access-control-allow-origin: https://www.mediafire.com
content-length: 56
traffic-path: NVADC2

GET
H2 200 rid Show response
match.adsrvr.org/track/ 109 B
574 B 126ms
39ms Fetch
application/json 15.197.193.217
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://match.adsrvr.org/track/rid?ttd_pid=muno13d&fmt=json
Requested by: Host:
URL: webpack:///./src/ajax.js?
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 4fdef4d0781bf1700ef5095ea7f80a10fcc49a613e5be4b86e0fe9e123b8306e

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
content-type: text/plain
sec-ch-ua-mobile: ?0

Response headers

cache-control: private
content-encoding: gzip
access-control-allow-credentials: true
expires: Sat, 13 Jun 2026 09:33:21 GMT
access-control-allow-origin: https://www.mediafire.com
date: Thu, 14 May 2026 09:33:21 GMT
content-type: application/json
vary: Origin,Accept-Encoding
server: Kestrel
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept, x-integration-type

GET
H2 200 script Show response
carbon-cdn.ccgateway.net/ 33 KB
8 KB 103ms
30ms Script
text/javascript 3.237.175.195
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://carbon-cdn.ccgateway.net/script?id=www.mediafire.com&parentId=0dae949f4b
Requested by: Host: link.rubiconproject.com
URL: https://link.rubiconproject.com/magnite/21150.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.237.175.195 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-3-237-175-195.compute-1.amazonaws.com
Software: /
Resource Hash: 57cc1c9137aafed5c0e134a1b985bad322811fdced91b2139c486184ebb8cf93

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: private,max-age=900
content-encoding: gzip
date: Thu, 14 May 2026 09:33:21 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 partnerpixels Show response
cm.g.doubleclick.net/ Frame B57E 41 B
232 B 444ms
48ms Document
text/html 142.251.111.155
Google LLC

General

Check archive.org

Download Go to

Full URL

https://cm.g.doubleclick.net/partnerpixels?gdpr=0&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F28rrtqxs0afdpk3%2FGambonanza-v1.0.16-full-apkvision.apk%2Ffile

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202605130101/pubads_impl.js?cb=31098551

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.111.155 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

bk-in-f155.1e100.net

Software

HTTP server (unknown) /

Resource Hash

a09179dd962df38a01440ce2e4748c37bd832fe1ac2f65ad974490a89d63d129

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.mediafire.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 48
content-type: text/html; charset=UTF-8
date: Thu, 14 May 2026 09:33:21 GMT
referrer-policy: origin
server: HTTP server (unknown)
x-xss-protection: 0

GET
H2 200 esp.js Show response
oa.openxcdn.net/ 24 KB
8 KB 400ms
26ms Script
application/javascript 34.102.146.192
Google LLC

General

Check archive.org

Download Go to

Full URL: https://oa.openxcdn.net/esp.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202605130101/pubads_impl.js?cb=31098551
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.146.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS: 192.146.102.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-goog-metageneration: 1
content-encoding: gzip
x-goog-hash: crc32c=f21hYg==, md5=31VCuIvA42jGmZdUpbniug==
etag: "df5542b88bc0e368c6999754a5b9e2ba"
age: 389274
x-goog-stored-content-encoding: gzip
expires: Sun, 09 May 2027 21:25:27 GMT
alt-svc: h3=":443"; ma=2592000
x-goog-stored-content-length: 7927
date: Sat, 09 May 2026 21:25:27 GMT
last-modified: Thu, 27 May 2021 18:30:51 GMT
content-type: application/javascript
x-guploader-uploadid: AAVLpEi3w9ljWH9zGbirzCeWt09zwFJXiiCkk9Elb92oDv_g7hufuawvHlrIKpgPI6E19Xbj
cache-control: no-transform
x-goog-storage-class: MULTI_REGIONAL
accept-ranges: bytes
x-goog-generation: 1622140251693895
content-length: 7927
server: UploadServer

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16589/ 45 KB
14 KB 393ms
20ms Script
text/javascript 18.239.6.97
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202605130101/pubads_impl.js?cb=31098551
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.239.6.97 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-18-239-6-97.yul62.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 59f4e0057c651cb962d4637e70ff0d239f2b9c2cf4b31345d0145e03320b5b5a

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

vary: Accept-Encoding
cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"16a2c198855d5eacecb864b94a4e05ff"
age: 6710
via: 1.1 af88a9fe36a270a032e7b509430eba58.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: Dp9NZcVo6dTqZ1sZhP5kV_FSYsYXYjVLzP9YaxJr0eP7Jbgv0FxBxQ==
date: Thu, 14 May 2026 07:41:32 GMT
content-type: text/javascript
last-modified: Tue, 21 Apr 2026 21:53:16 GMT
server: AmazonS3
x-amz-cf-pop: YUL62-P3
x-amz-server-side-encryption: AES256

GET
H3 200 pubcid.min.js Show response
cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/ 382 B
614 B 52ms
23ms Script
application/javascript 151.101.1.229
Fastly

General

Check archive.org

Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/pubcid.min.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202605130101/pubads_impl.js?cb=31098551

Protocol

Security

QUIC, , AES_256_GCM

Server

151.101.1.229 , United States, ASN54113 (FASTLY - Fastly, Inc., US),

Reverse DNS

Software

Resource Hash

6b9ae1fa0d1fc51ee0ad3feb565083bee200289c71bb346020f9b3d80cf73636

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

access-control-expose-headers: *
content-encoding: br
etag: W/"17e-goBKDsAq4SrgyL37A4bNh/aMb7I"
age: 12609
x-content-type-options: nosniff
x-jsd-version-type: branch
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-cache: HIT, HIT
date: Thu, 14 May 2026 09:33:21 GMT
content-type: application/javascript; charset=utf-8
x-served-by: cache-fra-etou8220184-FRA, cache-yul1970048-YUL
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
content-length: 237
x-jsd-version: master

GET
H2 200 publishertag.ids.js Show response
static.criteo.net/js/ld/ 42 KB
15 KB 413ms
32ms Script
text/javascript 74.119.117.47
Criteo Corp.

General

Check archive.org

Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.ids.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202605130101/pubads_impl.js?cb=31098551

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.47 , United States, ASN19750 (AS-CRITEO - Criteo Corp., US),

Reverse DNS

Software

Kestrel /

Resource Hash

8c34599808e4da9e86775b694fdadd5bf0856637602c896c21aef15e9783308e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: public, max-age=86400
timing-allow-origin: *
content-encoding: br
x-criteo-endpoint-version: none
cross-origin-resource-policy: cross-origin
expires: Fri, 15 May 2026 09:33:21 GMT
x-criteo-endpoint-controller: DynamicPublisherTag
access-control-allow-origin: *
x-criteo-endpoint-action: GetPublisherTag
date: Thu, 14 May 2026 09:33:21 GMT
content-type: text/javascript
vary: x-geo-country, Accept-Encoding
server: Kestrel

GET
H2 200 encrypted-tag-g.js Show response
invstatic101.creativecdn.com/encrypted-signals/ 3 KB
3 KB 515ms
144ms Script
text/javascript 34.96.70.87
Google LLC

General

Check archive.org

Download Go to

Full URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202605130101/pubads_impl.js?cb=31098551
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.70.87 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS: 87.70.96.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 2e5f5cb912c0619933ea6c3ad8ac1466a005f792e3338d96a8432d144c63520f

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

etag: 861bdaf24bda5c0db45c6ebe1c94a9eb
via: 1.1 google
alt-svc: h3=":443"; ma=2592000
content-length: 2729
date: Thu, 14 May 2026 09:33:21 GMT
content-type: text/javascript; charset=utf-8
last-modified: Wed, 05 Feb 2025 14:45:21 GMT
server: Google Frontend
x-cloud-trace-context: d763fa8c7887a9b79dd87bb16460d5a0

GET
H2 200 connectId-gpt.js Show response
connectid.analytics.yahoo.com/ 9 KB
9 KB 418ms
30ms Script
application/javascript 3.167.37.97
Amazon.com

General

Check archive.org

Download Go to

Full URL

https://connectid.analytics.yahoo.com/connectId-gpt.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202605130101/pubads_impl.js?cb=31098551

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.167.37.97 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

server-3-167-37-97.iad61.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

56351c084d8d56437d41f1e58b7eb184b563871e88bab60f6b15486c39f13996

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

etag: "faa388a163b1b6d0377ee77a861591e5"
age: 2586
x-cache: Hit from cloudfront
x-amz-cf-id: Q61OREp-ONS8SbgZqPK5kHZPTnxUZR0wJS__QQv9VP4hE_USyeMPhQ==
date: Thu, 14 May 2026 08:50:16 GMT
content-type: application/javascript
last-modified: Mon, 22 Apr 2024 18:18:45 GMT
x-amz-expiration: expiry-date="Mon, 23 Apr 2029 00:00:00 GMT", rule-id="webapp-standard-lifecycle"
content-security-policy: default-src 'self'
cache-control: max-age=3600
via: 1.1 3801c1756029d7785c1b1ccb7897ebfc.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 8729
x-amz-cf-pop: IAD61-P4
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 1021 B
563 B 547ms
547ms Fetch
text/plain 192.178.155.155
Google LLC

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=6265647328545851&correlator=3519847303630392&eid=31098551&output=ldjh&gdfp_req=1&vrg=202605130101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=1&didk=46178465&dids=div-gpt-ad-mediafire_com-medre&adfs=1959198455&sfv=1-0-45&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1778751201420&lmt=1778751201&adxs=27&adys=1109&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE0OC4wLjc3NzguMTY3IixudWxsLDAsbnVsbCwiNjQiLFtbIkNocm9taXVtIiwiMTQ4LjAuMC4wIl0sWyJHb29nbGUgQ2hyb21lIiwiMTQ4LjAuMC4wIl0sWyJOb3QtQS5CcmFuZCIsIjI0LjAuMC4wIl1dLDBd&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F28rrtqxs0afdpk3%2FGambonanza-v1.0.16-full-apkvision.apk%2Ffile&vis=1&aee=0&a3p=EjQKCnB1YmNpZC5vcmcSJDNiNzE3NTllLTQ5NWQtNGRhZi05ODg5LWZjYjhkNTY3ZWNhM1gBEhwKDWNyd2RjbnRybC5uZXQYgsHVruIzSABSAghkEh0KDmVzcC5jcml0ZW8uY29tGILB1a7iM0gAUgIIZBIYCgl5YWhvby5jb20YgsHVruIzSABSAghkEhQKBW9wZW54GIHB1a7iM0gAUgIIZBIXCghydGJob3VzZRiCwdWu4jNIAFICCGQ.&dlt=1778751198874&idt=2419&ppid=142e99cc7726b3a439aa50ec804b6bbe&uule=a%20cm9sZToxIHByb2R1Y2VyOjEyIGxvYzoiSDNCLENBIg%3D%3D&prev_scp=a%3D1%26iid1%3D6924024930410049%26eid%3D6924024930410049%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D1%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252F28rrtqxs0afdpk3%252FGambonanza-v1.0.16-full-apkvision.apk%252Ffile%26path%3D%252Ffile%252F28rrtqxs0afdpk3%252FGambonanza-v1.0.16-full-apkvision.apk%252Ffile%26ap%3D1100%26sap%3D1100%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D7%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-medrectangle-2%26tap%3Dmediafire_com-medrectangle-2-6924024930410049%26eb_br%3D527e52c10635ac8136a4c84094ee49a8%26eba%3D0%26bv%3D12%26bvm%3D0%26bvr%3D2%26avc%3D49%26evc%3D35%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D70%26br2%3D34%26ezoic%3D1%26nmau%3D2%26mau%3D0%26stl%3D83%2C152%2C154%2C27%2C51%2C193%2C88%2C20%2C26%2C171%2C205%2C0%2C158%2C173%2C901%2C902%2C903%26osb%3DLinux%252FChrome%26dbg%3Drc%253A5%26reqt%3D1778751201384&cust_params=li-module-enabled%3Dt0&adks=1630800042&frm=20&eoidce=1&pbbce=1

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=dd428baff9

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.155.155 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

yuiadrs-in-f155.1e100.net

Software

cafe /

Resource Hash

b6b001190f17df21f71a97f8022106776e3aa76e48eb8d3dcc794efba5c9aa93

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
google-lineitem-id: -2
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 14 May 2026 09:33:21 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.mediafire.com
content-length: 532
x-xss-protection: 0
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 855 B
412 B 302ms
301ms Fetch
text/plain 192.178.155.155
Google LLC

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=6265647328545851&correlator=3519847303630392&eid=31098551&output=ldjh&gdfp_req=1&vrg=202605130101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=2&didk=219167732&dids=div-gpt-ad-mediafire_com-medre&adfs=2995551083&sfv=1-0-45&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1778751201428&lmt=1778751201&adxs=795&adys=1109&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE0OC4wLjc3NzguMTY3IixudWxsLDAsbnVsbCwiNjQiLFtbIkNocm9taXVtIiwiMTQ4LjAuMC4wIl0sWyJHb29nbGUgQ2hyb21lIiwiMTQ4LjAuMC4wIl0sWyJOb3QtQS5CcmFuZCIsIjI0LjAuMC4wIl1dLDBd&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F28rrtqxs0afdpk3%2FGambonanza-v1.0.16-full-apkvision.apk%2Ffile&vis=1&aee=0&a3p=EjQKCnB1YmNpZC5vcmcSJDNiNzE3NTllLTQ5NWQtNGRhZi05ODg5LWZjYjhkNTY3ZWNhM1gBEhwKDWNyd2RjbnRybC5uZXQYgsHVruIzSABSAghkEh0KDmVzcC5jcml0ZW8uY29tGILB1a7iM0gAUgIIZBIYCgl5YWhvby5jb20YgsHVruIzSABSAghkEhQKBW9wZW54GIHB1a7iM0gAUgIIZBIXCghydGJob3VzZRiCwdWu4jNIAFICCGQ.&dlt=1778751198874&idt=2419&ppid=142e99cc7726b3a439aa50ec804b6bbe&uule=a%20cm9sZToxIHByb2R1Y2VyOjEyIGxvYzoiSDNCLENBIg%3D%3D&prev_scp=a%3D1%26iid1%3D6924024930410049%26eid%3D6924024930410049%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D1%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252F28rrtqxs0afdpk3%252FGambonanza-v1.0.16-full-apkvision.apk%252Ffile%26path%3D%252Ffile%252F28rrtqxs0afdpk3%252FGambonanza-v1.0.16-full-apkvision.apk%252Ffile%26ap%3D1100%26sap%3D1100%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D8%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-medrectangle-2%26tap%3Dmediafire_com-medrectangle-2-6924024930410049%26eb_br%3D527e52c10635ac8136a4c84094ee49a8%26eba%3D0%26bv%3D12%26bvm%3D0%26bvr%3D2%26avc%3D49%26evc%3D35%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D70%26br2%3D34%26ezoic%3D1%26nmau%3D2%26mau%3D1%26stl%3D157%2C14%2C0%2C0%2C0%2C168%2C184%2C20%2C0%2C0%2C192%2C31%2C902%2C903%2C901%2C902%2C903%26osb%3DLinux%252FChrome%26dbg%3Dadap%253A1%2Crc%253A6%26reqt%3D1778751201386&cust_params=li-module-enabled%3Dt0&adks=1277576459&frm=20&eoidce=1&pbbce=1

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=dd428baff9

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.155.155 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

yuiadrs-in-f155.1e100.net

Software

cafe /

Resource Hash

5e136dbee7f7bac9df1fc7147f391f8e4bfa79df02f595a017baeaffd27144b6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
google-lineitem-id: -2
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 14 May 2026 09:33:21 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.mediafire.com
content-length: 381
x-xss-protection: 0
server: cafe

GET
H2 200 container.html Show response
409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/safeframe/1-0-45/html/ Frame D967 7 KB
3 KB 399ms
38ms Document
text/html 142.251.163.132
Google LLC

General

Check archive.org

Download Go to

Full URL

https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202605130101/pubads_impl.js?cb=31098551

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.132 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

wv-in-f132.1e100.net

Software

sffe /

Resource Hash

f1a68bf826c55985468304f4284a09cb8a68e82503d764166e611a7c58a85a4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.mediafire.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 3121
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 14 May 2026 09:33:21 GMT
expires: Thu, 14 May 2026 09:33:21 GMT
last-modified: Thu, 08 May 2025 23:15:48 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 849 B
403 B 369ms
369ms Fetch
text/plain 192.178.155.155
Google LLC

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=6265647328545851&correlator=3690155947706431&eid=31098551&output=ldjh&gdfp_req=1&vrg=202605130101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-banner-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=3&didk=417644066&dids=div-gpt-ad-mediafire_com-banne&adfs=4128408292&sfv=1-0-45&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1778751201503&lmt=1778751201&adxs=436&adys=1500&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=1&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE0OC4wLjc3NzguMTY3IixudWxsLDAsbnVsbCwiNjQiLFtbIkNocm9taXVtIiwiMTQ4LjAuMC4wIl0sWyJHb29nbGUgQ2hyb21lIiwiMTQ4LjAuMC4wIl0sWyJOb3QtQS5CcmFuZCIsIjI0LjAuMC4wIl1dLDBd&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F28rrtqxs0afdpk3%2FGambonanza-v1.0.16-full-apkvision.apk%2Ffile&vis=1&aee=0&a3p=EjQKCnB1YmNpZC5vcmcSJDNiNzE3NTllLTQ5NWQtNGRhZi05ODg5LWZjYjhkNTY3ZWNhM1gBEhwKDWNyd2RjbnRybC5uZXQYgsHVruIzSABSAghkEh0KDmVzcC5jcml0ZW8uY29tGILB1a7iM0gAUgIIZBIYCgl5YWhvby5jb20YgsHVruIzSABSAghkEhQKBW9wZW54GIHB1a7iM0gAUgIIZBIXCghydGJob3VzZRiCwdWu4jNIAFICCGQ.&dlt=1778751198874&idt=2419&ppid=142e99cc7726b3a439aa50ec804b6bbe&uule=a%20cm9sZToxIHByb2R1Y2VyOjEyIGxvYzoiSDNCLENBIg%3D%3D&prev_scp=a%3D1%26iid1%3D7145616782351968%26eid%3D7145616782351968%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D1%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252F28rrtqxs0afdpk3%252FGambonanza-v1.0.16-full-apkvision.apk%252Ffile%26path%3D%252Ffile%252F28rrtqxs0afdpk3%252FGambonanza-v1.0.16-full-apkvision.apk%252Ffile%26ap%3D1107%26sap%3D1107%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D9%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D30%26al%3D1030%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-banner-1%26tap%3Dmediafire_com-banner-1-7145616782351968%26eb_br%3D3ba982fc4238dd4197b1d51b345478dc%26eba%3D0%26bv%3D11%26bvm%3D0%26bvr%3D1%26avc%3D36%26evc%3D27%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D50%26br2%3D26%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D78%2C193%2C0%2C0%2C0%2C131%2C132%2C0%2C0%2C0%2C187%2C0%2C901%2C182%2C901%2C902%2C903%26osb%3DLinux%252FChrome%26dbg%3Drc%253A1%26reqt%3D1778751201498&cust_params=li-module-enabled%3Dt0&adks=3665333008&frm=20&eoidce=1&pbbce=1

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=dd428baff9

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.155.155 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

yuiadrs-in-f155.1e100.net

Software

cafe /

Resource Hash

a01e6e8ed2eae582de0d9f2cdb353f97721aa0400aeb1cb6787d882ccafb6072

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
google-lineitem-id: -2
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 14 May 2026 09:33:21 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.mediafire.com
content-length: 372
x-xss-protection: 0
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 846 B
401 B 294ms
294ms Fetch
text/plain 192.178.155.155
Google LLC

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=6265647328545851&correlator=3997020808681812&eid=31098551&output=ldjh&gdfp_req=1&vrg=202605130101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=4&didk=1697938527&dids=div-gpt-ad-mediafire_com-box-2&adfs=2211965457&sfv=1-0-45&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1778751201517&lmt=1778751201&adxs=552&adys=10&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE0OC4wLjc3NzguMTY3IixudWxsLDAsbnVsbCwiNjQiLFtbIkNocm9taXVtIiwiMTQ4LjAuMC4wIl0sWyJHb29nbGUgQ2hyb21lIiwiMTQ4LjAuMC4wIl0sWyJOb3QtQS5CcmFuZCIsIjI0LjAuMC4wIl1dLDBd&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F28rrtqxs0afdpk3%2FGambonanza-v1.0.16-full-apkvision.apk%2Ffile&vis=1&aee=0&a3p=EjQKCnB1YmNpZC5vcmcSJDNiNzE3NTllLTQ5NWQtNGRhZi05ODg5LWZjYjhkNTY3ZWNhM1gBEhwKDWNyd2RjbnRybC5uZXQYgsHVruIzSABSAghkEh0KDmVzcC5jcml0ZW8uY29tGILB1a7iM0gAUgIIZBIYCgl5YWhvby5jb20YgsHVruIzSABSAghkEhQKBW9wZW54GIHB1a7iM0gAUgIIZBIXCghydGJob3VzZRiCwdWu4jNIAFICCGQ.&dlt=1778751198874&idt=2419&ppid=142e99cc7726b3a439aa50ec804b6bbe&uule=a%20cm9sZToxIHByb2R1Y2VyOjEyIGxvYzoiSDNCLENBIg%3D%3D&prev_scp=a%3D1%26iid1%3D8206134848363251%26eid%3D8206134848363251%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D1%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252F28rrtqxs0afdpk3%252FGambonanza-v1.0.16-full-apkvision.apk%252Ffile%26path%3D%252Ffile%252F28rrtqxs0afdpk3%252FGambonanza-v1.0.16-full-apkvision.apk%252Ffile%26ap%3D1103%26sap%3D1103%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-box-2%26tap%3Dmediafire_com-box-2-8206134848363251%26eb_br%3Db355e9227b551c119a30a68852723b62%26eba%3D0%26bv%3D51%26bvm%3D0%26bvr%3D12%26avc%3D93%26evc%3D46%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D90%26br2%3D46%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D157%2C168%2C0%2C0%2C0%2C168%2C184%2C20%2C0%2C0%2C192%2C31%2C902%2C903%2C901%2C902%2C903%26osb%3DLinux%252FChrome%26dbg%3Drc%253A2%26reqt%3D1778751201509&cust_params=li-module-enabled%3Dt0&adks=3106951849&frm=20&eoidce=1&pbbce=1

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=dd428baff9

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.155.155 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

yuiadrs-in-f155.1e100.net

Software

cafe /

Resource Hash

8a0afff8cfdd6cabc97565177aa3f7c83efcad80f7920a83b2670a4bcebe74f8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
google-lineitem-id: -2
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 14 May 2026 09:33:21 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.mediafire.com
content-length: 370
x-xss-protection: 0
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 848 B
407 B 322ms
321ms Fetch
text/plain 192.178.155.155
Google LLC

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=6265647328545851&correlator=1089385021989710&eid=31098551&output=ldjh&gdfp_req=1&vrg=202605130101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-edge-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=160x600&ifi=5&didk=2994425013&dids=div-gpt-ad-mediafire_com-edge-&adfs=982453029&sfv=1-0-45&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1778751201528&lmt=1778751201&adxs=1440&adys=300&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=5&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE0OC4wLjc3NzguMTY3IixudWxsLDAsbnVsbCwiNjQiLFtbIkNocm9taXVtIiwiMTQ4LjAuMC4wIl0sWyJHb29nbGUgQ2hyb21lIiwiMTQ4LjAuMC4wIl0sWyJOb3QtQS5CcmFuZCIsIjI0LjAuMC4wIl1dLDBd&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F28rrtqxs0afdpk3%2FGambonanza-v1.0.16-full-apkvision.apk%2Ffile&vis=1&aee=0&a3p=EjQKCnB1YmNpZC5vcmcSJDNiNzE3NTllLTQ5NWQtNGRhZi05ODg5LWZjYjhkNTY3ZWNhM1gBEhwKDWNyd2RjbnRybC5uZXQYgsHVruIzSABSAghkEh0KDmVzcC5jcml0ZW8uY29tGILB1a7iM0gAUgIIZBIYCgl5YWhvby5jb20YgsHVruIzSABSAghkEhQKBW9wZW54GIHB1a7iM0gAUgIIZBIXCghydGJob3VzZRiCwdWu4jNIAFICCGQ.&dlt=1778751198874&idt=2419&ppid=142e99cc7726b3a439aa50ec804b6bbe&uule=a%20cm9sZToxIHByb2R1Y2VyOjEyIGxvYzoiSDNCLENBIg%3D%3D&prev_scp=a%3D1%26iid1%3D8044379006359734%26eid%3D8044379006359734%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D1%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252F28rrtqxs0afdpk3%252FGambonanza-v1.0.16-full-apkvision.apk%252Ffile%26path%3D%252Ffile%252F28rrtqxs0afdpk3%252FGambonanza-v1.0.16-full-apkvision.apk%252Ffile%26ap%3D1102%26sap%3D1102%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D3%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D39%26al%3D1039%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-edge-2%26tap%3Dmediafire_com-edge-2-8044379006359734%26eb_br%3Da495ce7dbb4cefcd3e0a722048894f41%26eba%3D0%26bv%3D11%26bvm%3D0%26bvr%3D1%26avc%3D56%26evc%3D41%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D100%26br2%3D50%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D78%2C168%2C0%2C0%2C0%2C131%2C132%2C0%2C0%2C0%2C187%2C0%2C901%2C182%2C901%2C902%2C903%26osb%3DLinux%252FChrome%26dbg%3Drc%253A4%26reqt%3D1778751201522&cust_params=li-module-enabled%3Dt0&adks=697308627&frm=20&eoidce=1&pbbce=1

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=dd428baff9

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.155.155 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

yuiadrs-in-f155.1e100.net

Software

cafe /

Resource Hash

8335d293f354a547ba3d73f16fd6291fc47dc083af674de0cd021b3ab9d9abad

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
google-lineitem-id: -2
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 14 May 2026 09:33:21 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.mediafire.com
content-length: 376
x-xss-protection: 0
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 856 B
413 B 322ms
321ms Fetch
text/plain 192.178.155.155
Google LLC

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=6265647328545851&correlator=2192307506679103&eid=31098551&output=ldjh&gdfp_req=1&vrg=202605130101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-medrectangle-3&enc_prev_ius=%2F0%2F1&prev_iu_szs=336x280&ifi=6&didk=46179496&dids=div-gpt-ad-mediafire_com-medre&adfs=1911771697&sfv=1-0-45&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1778751201543&lmt=1778751201&adxs=320&adys=120&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=6&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE0OC4wLjc3NzguMTY3IixudWxsLDAsbnVsbCwiNjQiLFtbIkNocm9taXVtIiwiMTQ4LjAuMC4wIl0sWyJHb29nbGUgQ2hyb21lIiwiMTQ4LjAuMC4wIl0sWyJOb3QtQS5CcmFuZCIsIjI0LjAuMC4wIl1dLDBd&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F28rrtqxs0afdpk3%2FGambonanza-v1.0.16-full-apkvision.apk%2Ffile&vis=1&aee=0&a3p=EjQKCnB1YmNpZC5vcmcSJDNiNzE3NTllLTQ5NWQtNGRhZi05ODg5LWZjYjhkNTY3ZWNhM1gBEhwKDWNyd2RjbnRybC5uZXQYgsHVruIzSABSAghkEh0KDmVzcC5jcml0ZW8uY29tGILB1a7iM0gAUgIIZBIYCgl5YWhvby5jb20YgsHVruIzSABSAghkEhQKBW9wZW54GIHB1a7iM0gAUgIIZBIXCghydGJob3VzZRiCwdWu4jNIAFICCGQ.&dlt=1778751198874&idt=2419&ppid=142e99cc7726b3a439aa50ec804b6bbe&uule=a%20cm9sZToxIHByb2R1Y2VyOjEyIGxvYzoiSDNCLENBIg%3D%3D&prev_scp=a%3D1%26iid1%3D3199650704416009%26eid%3D3199650704416009%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D1%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252F28rrtqxs0afdpk3%252FGambonanza-v1.0.16-full-apkvision.apk%252Ffile%26path%3D%252Ffile%252F28rrtqxs0afdpk3%252FGambonanza-v1.0.16-full-apkvision.apk%252Ffile%26ap%3D1104%26sap%3D1104%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D5%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D21%26al%3D1021%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-medrectangle-3%26tap%3Dmediafire_com-medrectangle-3-3199650704416009%26eb_br%3D58ef7bddb438af5e257c4377f32c243a%26eba%3D0%26bv%3D11%26bvm%3D0%26bvr%3D1%26avc%3D108%26evc%3D57%26shp%3D3%26ftsn%3D12%26ftsng%3D12%26br1%3D120%26br2%3D60%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D157%2C131%2C0%2C0%2C0%2C168%2C184%2C20%2C0%2C0%2C192%2C31%2C902%2C903%2C901%2C902%2C903%26osb%3DLinux%252FChrome%26dbg%3Drc%253A7%26reqt%3D1778751201536&cust_params=li-module-enabled%3Dt0&adks=4079446691&frm=20&eoidce=1&pbbce=1

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=dd428baff9

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.155.155 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

yuiadrs-in-f155.1e100.net

Software

cafe /

Resource Hash

fcee3d7b1484077513a22cd07a88f2baf4389e83459b59d6e20a8a4e3242d369

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
google-lineitem-id: -2
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 14 May 2026 09:33:21 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.mediafire.com
content-length: 382
x-xss-protection: 0
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 856 B
413 B 296ms
295ms Fetch
text/plain 192.178.155.155
Google LLC

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=6265647328545851&correlator=1141618609815668&eid=31098551&output=ldjh&gdfp_req=1&vrg=202605130101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-medrectangle-4&enc_prev_ius=%2F0%2F1&prev_iu_szs=336x280%7C300x250&ifi=7&didk=46192883&dids=div-gpt-ad-mediafire_com-medre&adfs=1749122204&sfv=1-0-45&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1778751201557&lmt=1778751201&adxs=320&adys=420&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=7&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE0OC4wLjc3NzguMTY3IixudWxsLDAsbnVsbCwiNjQiLFtbIkNocm9taXVtIiwiMTQ4LjAuMC4wIl0sWyJHb29nbGUgQ2hyb21lIiwiMTQ4LjAuMC4wIl0sWyJOb3QtQS5CcmFuZCIsIjI0LjAuMC4wIl1dLDBd&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F28rrtqxs0afdpk3%2FGambonanza-v1.0.16-full-apkvision.apk%2Ffile&vis=1&aee=0&a3p=EjQKCnB1YmNpZC5vcmcSJDNiNzE3NTllLTQ5NWQtNGRhZi05ODg5LWZjYjhkNTY3ZWNhM1gBEhwKDWNyd2RjbnRybC5uZXQYgsHVruIzSABSAghkEh0KDmVzcC5jcml0ZW8uY29tGILB1a7iM0gAUgIIZBIYCgl5YWhvby5jb20YgsHVruIzSABSAghkEhQKBW9wZW54GIHB1a7iM0gAUgIIZBIXCghydGJob3VzZRiCwdWu4jNIAFICCGQ.&dlt=1778751198874&idt=2419&ppid=142e99cc7726b3a439aa50ec804b6bbe&uule=a%20cm9sZToxIHByb2R1Y2VyOjEyIGxvYzoiSDNCLENBIg%3D%3D&prev_scp=a%3D1%26iid1%3D1431131254394124%26eid%3D1431131254394124%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D1%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252F28rrtqxs0afdpk3%252FGambonanza-v1.0.16-full-apkvision.apk%252Ffile%26path%3D%252Ffile%252F28rrtqxs0afdpk3%252FGambonanza-v1.0.16-full-apkvision.apk%252Ffile%26ap%3D1105%26sap%3D1105%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D6%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D22%26al%3D1022%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-medrectangle-4%26tap%3Dmediafire_com-medrectangle-4-1431131254394124%26eb_br%3D527e52c10635ac8136a4c84094ee49a8%26eba%3D0%26bv%3D11%26bvm%3D0%26bvr%3D1%26avc%3D67%26evc%3D34%26shp%3D3%26ftsn%3D12%26ftsng%3D12%26br1%3D70%26br2%3D34%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D81%2C189%2C207%2C4%2C5%2C193%2C24%2C20%2C71%2C201%2C205%2C0%2C124%2C166%2C901%2C902%2C903%26osb%3DLinux%252FChrome%26dbg%3Drc%253A8%26reqt%3D1778751201551&cust_params=li-module-enabled%3Dt0&adks=1277606936&frm=20&eoidce=1&pbbce=1

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=dd428baff9

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.155.155 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

yuiadrs-in-f155.1e100.net

Software

cafe /

Resource Hash

41636f65a7fada6396727ca7cf78fe609cfd07d2422fa1a3303e1622a601b828

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
google-lineitem-id: -2
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 14 May 2026 09:33:21 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.mediafire.com
content-length: 382
x-xss-protection: 0
server: cafe

POST v3
id5-sync.com/gm/ 0
0

POST
H2 204 serve Show response
ads.bidsystem.ai/v1/ 0
413 B 64ms
61ms XHR
text/plain 104.21.3.76
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ads.bidsystem.ai/v1/serve
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=dd428baff9
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.21.3.76 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
Accept: application/json, text/plain, */*
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
Content-Type: text/plain
sec-ch-ua-mobile: ?0

Response headers

nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=NHp%2Bmm8VshdJ8WbDNqawSmGE%2BiaoQTbrpXibVMY57ExFhFU7qzVW%2FfTuw4mZoIEtihDKXSXlVBmVWPuIDp8uxkR2JzC2mhpvpESF9HF7%2B%2BHZZ62KlIMB1tqgCH%2BlEPkw6PDd"}]}
cf-ray: 9fb8e6a22a858af6-YYZ
access-control-allow-origin: https://www.mediafire.com
alt-svc: h3=":443"; ma=86400
date: Thu, 14 May 2026 09:33:21 GMT
vary: Origin, Accept-Encoding
server: cloudflare

POST
H2 204 serve Show response
ads.bidsystem.ai/v1/ 0
315 B 65ms
64ms XHR
text/plain 104.21.3.76
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ads.bidsystem.ai/v1/serve
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=dd428baff9
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.21.3.76 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
Accept: application/json, text/plain, */*
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
Content-Type: text/plain
sec-ch-ua-mobile: ?0

Response headers

nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=EZBJ4f2N3mB9qhcHboQYCCBfvoHNpOhNsGYybuFNPE6hLlb7MA9KQ9t3Tv%2F5UOXCta0ySSUDNZBgMe0Vaawy%2BdF5kD%2FVna0sk7SK7RKYjU4%2B7aIq68ehgrqIvRu%2F9UGuRiu6"}]}
cf-ray: 9fb8e6a22a878af6-YYZ
access-control-allow-origin: https://www.mediafire.com
alt-svc: h3=":443"; ma=86400
date: Thu, 14 May 2026 09:33:21 GMT
vary: Origin, Accept-Encoding
server: cloudflare

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
112 B 28ms
28ms Fetch
image/gif 172.66.148.140
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=2&e=0.4717171029770485
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=dd428baff9
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.66.148.140 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 4
x-goog-stored-content-encoding: identity
expires: Tue, 12 May 2026 22:06:37 GMT
x-goog-stored-content-length: 43
date: Thu, 14 May 2026 09:33:21 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: AOCedOE4ceqfKqcxsn6FfQCul5MU3fPppaJoaSAD4zIpDi_AuCRSOF0vpherOnDkBFq5ISKOXI37mOc
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9fb8e6a22e8cb8f3-YYZ
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico Show response
ad.doubleclick.net/ 1 KB
129 B 40ms
39ms Fetch
image/x-icon 192.178.155.149
Google LLC

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.1892777595471844

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=dd428baff9

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.155.149 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

yuiadrs-in-f149.1e100.net

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Fri, 15 May 2026 09:33:21 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 14 May 2026 09:33:21 GMT
content-type: image/x-icon
vary: Accept-Encoding
last-modified: Tue, 08 May 2012 13:08:06 GMT
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

POST
H2 200 lgc Show response
d9.flashtalking.com/ 103 B
539 B 55ms
53ms XHR
application/json 50.16.131.99
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://d9.flashtalking.com/lgc
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=dd428baff9
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.16.131.99 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-50-16-131-99.compute-1.amazonaws.com
Software: Apache/2.4.66 (Amazon Linux) OpenSSL/3.2.2 /
Resource Hash: bfd4b869068a5c8f4c21a435e2c8f9daa937326894b23268523c81f7de8f2698

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
Content-Type: application/x-www-form-urlencoded
sec-ch-ua-mobile: ?0

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET,POST,SERVER
access-control-allow-origin: https://www.mediafire.com
content-length: 103
p3p: policyref="localhost/w3c/D9_p3p_.xml", CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"
date: Thu, 14 May 2026 09:33:21 GMT
content-type: application/json;charset=UTF-8
server: Apache/2.4.66 (Amazon Linux) OpenSSL/3.2.2

GET
H2 200 location Show response
privacy-location-edge.ccgateway.net/privacy/ 2 B
188 B 124ms
31ms XHR
text/plain 52.91.215.149
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://privacy-location-edge.ccgateway.net/privacy/location
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=dd428baff9
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.91.215.149 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-91-215-149.compute-1.amazonaws.com
Software: /
Resource Hash: 9170a8b2fb3234baa721bf8b3de5935d8d160f6f987215b83b07a49a403e5e74

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

access-control-allow-origin: *
content-encoding: gzip
date: Thu, 14 May 2026 09:33:21 GMT
content-type: text/plain; charset=utf-8
vary: Accept-Encoding
access-control-allow-credentials: true

GET
H3 200 gpt
securepubads.g.doubleclick.net/pagead/managed/dict/m202605120101/ 63 KB
23 KB 137ms
38ms Other
text/plain 192.178.155.155
Google LLC

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/dict/m202605120101/gpt

Requested by

Host: www.mediafire.com
URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.155.155 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

yuiadrs-in-f155.1e100.net

Software

cafe /

Resource Hash

4b5759dbc8de321134bbf7d25def0ee87454559310dcb8a192b9344b7603d0f0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
etag: 7855493455319312213
age: 62
x-content-type-options: nosniff
expires: Thu, 21 May 2026 09:32:19 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 14 May 2026 09:32:19 GMT
content-type: text/plain; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=604800, stale-while-revalidate=7200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 23782
x-xss-protection: 0
server: cafe
use-as-dictionary: match="/gampad/ads", id="m202605120101"

POST v3
id5-sync.com/gm/ 0
0

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
335 B 119ms
119ms Fetch
application/json 135.125.170.98
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host:
URL: webpack:///./src/ajax.js?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

135.125.170.98 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ns31890040.ip-135-125-170.eu

Software

Resource Hash

a3cb2c4b19504b47f0c990ac34f9764e0cea778760cf1066eb70b012695a1778

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://www.mediafire.com
content-encoding: gzip
date: Thu, 14 May 2026 09:33:21 GMT
content-type: application/json;charset=UTF-8
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 498 B
217 B 337ms
337ms Fetch
text/plain 192.178.155.155
Google LLC

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=6265647328545851&correlator=2540922039485801&eid=31098551&output=ldjh&gdfp_req=1&vrg=202605130101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-edge-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=160x600&ifi=8&didk=2994273263&dids=div-gpt-ad-mediafire_com-edge-&adfs=580935078&sfv=1-0-45&eri=1&sc=1&cookie=ID%3D5d636861f810e2ce%3AT%3D1778751201%3ART%3D1778751201%3AS%3DALNI_MawPvNrbeZIHg2kRjt5DTWyUDKmEg&gpic=UID%3D0000138956c0dd89%3AT%3D1778751201%3ART%3D1778751201%3AS%3DALNI_MaB-M5hkABT8kCpd3Cd1aTlMY6KDA&abxe=1&dt=1778751201805&lmt=1778751201&adxs=0&adys=300&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=8&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE0OC4wLjc3NzguMTY3IixudWxsLDAsbnVsbCwiNjQiLFtbIkNocm9taXVtIiwiMTQ4LjAuMC4wIl0sWyJHb29nbGUgQ2hyb21lIiwiMTQ4LjAuMC4wIl0sWyJOb3QtQS5CcmFuZCIsIjI0LjAuMC4wIl1dLDBd&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F28rrtqxs0afdpk3%2FGambonanza-v1.0.16-full-apkvision.apk%2Ffile&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a&a3p=EpgBCgpjcml0ZW8uY29tEocBUHZ0SDJsOVpVM2hOYmxSdE5UaDFORVl5ZFhWUWNGSlhjV3g2VGsxWVdIVjZTMDVPVVRsUVRUQmpObmhXTVc5SFlubExlalZuYUZOSGQxazRNMDlaZUZORlRIRndSRU5ZTmxVMmVqRTJKVEpDYkVsaUpUSkNWVkkxVHpsbFJGRWxNMFFsTTBRWAESNgoMYWRzZXJ2ZXIub3JnEiQ1NGRiOGNjZS1mNTMzLTRkMzItOGIyZi1jZjUwMWM0ZTZmNzlYARI0CgpwdWJjaWQub3JnEiQzYjcxNzU5ZS00OTVkLTRkYWYtOTg4OS1mY2I4ZDU2N2VjYTNYARIcCg1jcndkY250cmwubmV0GILB1a7iM0gAUgIIZBIdCg5lc3AuY3JpdGVvLmNvbRiCwdWu4jNIAFICCGQSGAoJeWFob28uY29tGILB1a7iM0gAUgIIZBIUCgVvcGVueBiBwdWu4jNIAFICCGQSFwoIcnRiaG91c2UYgsHVruIzSABSAghk&dlt=1778751198874&idt=2419&ppid=142e99cc7726b3a439aa50ec804b6bbe&uule=a%20cm9sZToxIHByb2R1Y2VyOjEyIGxvYzoiSDNCLENBIg%3D%3D&prev_scp=a%3D1%26iid1%3D644503750349328%26eid%3D644503750349328%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D1%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252F28rrtqxs0afdpk3%252FGambonanza-v1.0.16-full-apkvision.apk%252Ffile%26path%3D%252Ffile%252F28rrtqxs0afdpk3%252FGambonanza-v1.0.16-full-apkvision.apk%252Ffile%26ap%3D1101%26sap%3D1101%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D4%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D38%26al%3D1038%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-edge-1%26tap%3Dmediafire_com-edge-1-644503750349328%26eb_br%3Dfe5b0c99ab7ba15f050582be1301303f%26eba%3D0%26bv%3D4%26bvm%3D0%26bvr%3D4%26avc%3D59%26evc%3D49%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D46%26br2%3D22%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D78%2C168%2C0%2C0%2C0%2C131%2C132%2C0%2C0%2C0%2C187%2C0%2C901%2C182%2C901%2C902%2C903%26osb%3DLinux%252FChrome%26dbg%3Drc%253A3%26reqt%3D1778751201799&cust_params=li-module-enabled%3Dt0&adks=966014519&frm=20&eo_id_str=ID%3D4f39727d52387fc6%3AT%3D1778751201%3ART%3D1778751201%3AS%3DAA-Afjb6pMdFxpu4luuhLUATFMTa&pbbce=1

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=dd428baff9

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.155.155 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

yuiadrs-in-f155.1e100.net

Software

cafe /

Resource Hash

9f9c4427d27d49d2b1340250c6b606135eda8b4bb3699308d0093a0c99854a29

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
google-lineitem-id: -2
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 14 May 2026 09:33:22 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.mediafire.com
content-length: 185
x-xss-protection: 0
server: cafe

GET
H2

200

esp Show response
oajs.openx.net/
Redirect Chain

https://oajs.openx.net/esp?url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F28rrtqxs0afdpk3%2FGambonanza-v1.0.16-full-apkvision.apk%2Ffile&rid=esp
https://oajs.openx.net/esp?url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F28rrtqxs0afdpk3%2FGambonanza-v1.0.16-full-apkvision.apk%2Ffile&rid=esp&cc=1

85 B
193 B

51ms
50ms

Fetch
application/json

34.120.107.143
Google LLC

General

Check archive.org

Download Go to

Full URL: https://oajs.openx.net/esp?url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F28rrtqxs0afdpk3%2FGambonanza-v1.0.16-full-apkvision.apk%2Ffile&rid=esp&cc=1
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file
Protocol: H2
Server: 34.120.107.143 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS: 143.107.120.34.bc.googleusercontent.com
Software: / Express
Resource Hash: f104f0bc9687bcc861ac96cf17531f6ce25dd2cab1b74fda3e12986e939459e7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

etag: W/"55-4oEh9RdwEuIBqxshceGM0VxDaNM"
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://www.mediafire.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 85
date: Thu, 14 May 2026 09:33:21 GMT
content-type: application/json; charset=utf-8
x-powered-by: Express
vary: Origin

Redirect headers

location: /esp?url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F28rrtqxs0afdpk3%2FGambonanza-v1.0.16-full-apkvision.apk%2Ffile&rid=esp&cc=1
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://www.mediafire.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Thu, 14 May 2026 09:33:21 GMT
x-powered-by: Express
vary: Origin

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame CF9C 12 KB
5 KB 93ms
33ms Document
text/html 74.119.117.62
Criteo Corp.

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=www.mediafire.com&gdpr=0&gdpr_consent=

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.ids.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.62 , United States, ASN19750 (AS-CRITEO - Criteo Corp., US),

Reverse DNS

Software

Kestrel /

Resource Hash

36ce068a4107077cee7072231c246281cd2a208444ed215337b5c3f4ec1b9a3e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://www.mediafire.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 14 May 2026 09:33:21 GMT
server: Kestrel
server-processing-duration-in-ticks: 1748182
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding
x-robots-tag: noindex

GET
H2 200 fed Show response
ups.analytics.yahoo.com/ups/58813/ 2 B
32 B 109ms
108ms XHR
application/json 69.147.92.12
Yahoo Holdings Inc.

General

Check archive.org

Download Go to

Full URL

https://ups.analytics.yahoo.com/ups/58813/fed?gpp_sid=-1&gdpr=false&gdpr_consent=&v=1&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F28rrtqxs0afdpk3%2FGambonanza-v1.0.16-full-apkvision.apk%2Ffile

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=dd428baff9

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

69.147.92.12 Ashburn, United States, ASN14777 (YAHOO - Yahoo Holdings Inc., US),

Reverse DNS

e2.ycpi.vip.dca.yahoo.com

Software

ATS /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000
age: 0
access-control-allow-credentials: true
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
access-control-allow-origin: https://www.mediafire.com
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Thu, 14 May 2026 09:33:21 GMT
content-type: application/json
vary: Origin
server: ATS

POST 457.json
id5-sync.com/g/v2/ 0
0

POST
H2 200 encrypt Show response
esp.rtbhouse.com/ 305 B
551 B 203ms
146ms Fetch
application/json 35.190.39.111
Google LLC

General

Check archive.org

Download Go to

Full URL: https://esp.rtbhouse.com/encrypt
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=dd428baff9
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.39.111 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS: 111.39.190.35.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 7ff5779bf5434a0ffc31ce0d01df8ffbf9482ac3b55fc018cce03634b4c1054b

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
Content-Type: text/plain
sec-ch-ua-mobile: ?0

Response headers

access-control-allow-credentials: true
access-control-allow-methods: POST
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000
content-length: 305
date: Thu, 14 May 2026 09:33:22 GMT
content-type: application/json
x-cloud-trace-context: adb08595e3687d7000c7f9b15ecc40fe
server: Google Frontend
access-control-allow-headers: X-Requested-With

GET
H2 200 json Show response
gum.criteo.com/sid/ Frame CF9C 441 B
916 B 32ms
32ms Fetch
application/json 74.119.117.62
Criteo Corp.

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=publishertagids&domain=www.mediafire.com&sn=ChromeSyncframe&so=0&topUrl=www.mediafire.com

Requested by

Host: gum.criteo.com
URL: https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=www.mediafire.com&gdpr=0&gdpr_consent=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.62 , United States, ASN19750 (AS-CRITEO - Criteo Corp., US),

Reverse DNS

Software

Kestrel /

Resource Hash

30865570b5f459633282b0b92999d36084a7ed90dfc5b043d8335269dcf25591

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=www.mediafire.com&gdpr=0&gdpr_consent=
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
server-processing-duration-in-ticks: 627554
expires: 0
date: Thu, 14 May 2026 09:33:21 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

GET
H3 200 sodar Show response
ep1.adtrafficquality.google/getconfig/ 18 KB
13 KB 137ms
75ms XHR
application/json 192.178.155.157
Google LLC

General

Check archive.org

Download Go to

Full URL

https://ep1.adtrafficquality.google/getconfig/sodar?sv=200&tid=gpt&tv=m202605130101&st=env&sjk=6265647328545851

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=dd428baff9

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.155.157 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

yuiadrs-in-f157.1e100.net

Software

cafe /

Resource Hash

4065c400cc21c48d18812442dd54621ae668379e1889dce5845bd60471010539

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

timing-allow-origin: *
content-encoding: br
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 13799
date: Thu, 14 May 2026 09:33:22 GMT
x-xss-protection: 0
content-type: application/json; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

POST
H3 204 rum Show response
www.mediafire.com/cdn-cgi/ 0
197 B 24ms
21ms XHR
text/plain 104.17.147.83
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://www.mediafire.com/cdn-cgi/rum?
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=dd428baff9
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.147.83 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
content-type: application/json
sec-ch-ua-mobile: ?0

Response headers

access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-methods: POST,OPTIONS
cf-ray: 9fb8e6a44ee9a2c8-YUL
access-control-allow-origin: https://www.mediafire.com
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 14 May 2026 09:33:21 GMT
content-type: text/plain
vary: Origin, accept-encoding
server: cloudflare
priority: u=1,i

GET
H3 200 favicon.ico
www.mediafire.com/ 11 KB
2 KB 48ms
47ms Other
image/x-icon 104.17.147.83
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://www.mediafire.com/favicon.ico
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.147.83 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cdc78cc8b2994712a041a2a4cb02f488afbab00981771bdd3a8036c2dddf540f

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"62deda56-2a46"
age: 423275
access-control-allow-methods: OPTIONS, POST, GET
expires: Mon, 08 Jun 2026 11:58:46 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
x-mf-env: liveApi
date: Thu, 14 May 2026 09:33:22 GMT
content-type: image/x-icon
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
vary: Accept-Encoding
priority: u=1,i
cache-control: max-age=2592000
cf-ray: 9fb8e6a45ef1a2c8-YUL
x-mf-fe: mf2
access-control-allow-origin: *
server: cloudflare

GET
H2 200 pd Show response
google-bidout-d.openx.net/w/1.0/ Frame 0950 480 B
736 B 87ms
35ms Document
text/html 34.98.64.218
Google LLC

General

Check archive.org

Download Go to

Full URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Requested by: Host: oa.openxcdn.net
URL: https://oa.openxcdn.net/esp.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: bbe519344742e92f95ad65a1eb23b2a23bd55059fcc3fc02f4339c9df6fb5c11

Request headers

Referer: https://www.mediafire.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

alt-svc: h3=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-encoding: br
content-length: 365
content-type: text/html
date: Thu, 14 May 2026 09:33:21 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 86.106.90.214

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 0950
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEChrZC19b3btSVQbS_nrp80&google_cver=1

43 B
136 B

40ms
35ms

Image
image/gif

34.98.64.218
Google LLC

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEChrZC19b3btSVQbS_nrp80&google_cver=1
Requested by: Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Protocol: H2
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
Referer: https://google-bidout-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 86.106.90.214
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 14 May 2026 09:33:21 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: no-cache, must-revalidate
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEChrZC19b3btSVQbS_nrp80&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 295
date: Thu, 14 May 2026 09:33:22 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame 0950 170 B
243 B 53ms
50ms Image
image/png 142.251.111.155
Google LLC

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=YzM4MGExYmMtYjg2Ny0yMTczLWUxYTEtZWIwNmMyZWQyNWZk

Requested by

Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.111.155 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

bk-in-f155.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://google-bidout-d.openx.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 14 May 2026 09:33:22 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 0950
Redirect Chain

https://match.adsrvr.org/track/cmf/openx?oxid=efef7276-7110-7fd7-f441-b1bf080feb9d&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072971&val=54db8cce-f533-4d32-8b2f-cf501c4e6f79&ttd_puid=efef7276-7110-7fd7-f441-b1bf080feb9d&gdpr=0&gdpr_consent=

43 B
97 B

37ms
36ms

Image
image/gif

34.98.64.218
Google LLC

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072971&val=54db8cce-f533-4d32-8b2f-cf501c4e6f79&ttd_puid=efef7276-7110-7fd7-f441-b1bf080feb9d&gdpr=0&gdpr_consent=
Requested by: Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Protocol: H2
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
Referer: https://google-bidout-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 86.106.90.214
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 14 May 2026 09:33:21 GMT
content-type: image/gif
vary: Accept

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?id=537072971&val=54db8cce-f533-4d32-8b2f-cf501c4e6f79&ttd_puid=efef7276-7110-7fd7-f441-b1bf080feb9d&gdpr=0&gdpr_consent=
content-length: 335
date: Thu, 14 May 2026 09:33:22 GMT
server: Kestrel

GET cms
ups.analytics.yahoo.com/ups/58934/ Frame 0950 0
0

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 0950
Redirect Chain

https://ad.turn.com/r/cs?pid=9&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537073061&val=4534177538656440189&gdpr=0&gdpr_consent=&us_privacy=

43 B
61 B

35ms
34ms

Image
image/gif

34.98.64.218
Google LLC

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073061&val=4534177538656440189&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
Referer: https://google-bidout-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 86.106.90.214
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 14 May 2026 09:33:22 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://us-u.openx.net/w/1.0/sd?id=537073061&val=4534177538656440189&gdpr=0&gdpr_consent=&us_privacy=
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Thu, 14 May 2026 09:33:11 GMT

GET
H2 200 sodar2.js Show response
ep2.adtrafficquality.google/sodar/ 21 KB
8 KB 374ms
44ms Script
text/javascript 64.233.180.132
Google LLC

General

Check archive.org

Download Go to

Full URL

https://ep2.adtrafficquality.google/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202605130101/pubads_impl.js?cb=31098551

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

64.233.180.132 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

pe-in-f132.1e100.net

Software

sffe /

Resource Hash

cb8d603426932f2666666f4bd32b3dde726161c7f7413e385d2e124e6e03039c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
etag: "1775059593017171"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
x-content-type-options: nosniff
expires: Thu, 14 May 2026 09:33:22 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 14 May 2026 09:33:22 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: private, max-age=3000
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 7628
x-xss-protection: 0
server: sffe

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
133 B 28ms
27ms Fetch
image/gif 172.66.148.140
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=2&e=0.7371313021693634
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=dd428baff9
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.66.148.140 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 4
x-goog-stored-content-encoding: identity
expires: Tue, 12 May 2026 22:06:37 GMT
x-goog-stored-content-length: 43
date: Thu, 14 May 2026 09:33:22 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: AOCedOE4ceqfKqcxsn6FfQCul5MU3fPppaJoaSAD4zIpDi_AuCRSOF0vpherOnDkBFq5ISKOXI37mOc
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9fb8e6a5e9adb8f3-YYZ
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico Show response
ad.doubleclick.net/ 1 KB
129 B 40ms
40ms Fetch
image/x-icon 192.178.155.149
Google LLC

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.1959238561297343

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=dd428baff9

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.155.149 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

yuiadrs-in-f149.1e100.net

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Fri, 15 May 2026 09:33:22 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 14 May 2026 09:33:22 GMT
content-type: image/x-icon
vary: Accept-Encoding
last-modified: Tue, 08 May 2012 13:08:06 GMT
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 505 B
170 B 315ms
315ms Fetch
text/plain 192.178.155.155
Google LLC

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=6265647328545851&correlator=3907398462773607&eid=31098551&output=ldjh&gdfp_req=1&vrg=202605130101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=9&didk=46178465&dids=div-gpt-ad-mediafire_com-medre&adfs=1959198455&sfv=1-0-45&rcs=1&eri=1&sc=1&cookie=ID%3D4c907cf15727623e%3AT%3D1778751201%3ART%3D1778751201%3AS%3DALNI_MaDaZ5ZTDiSo5EJt4ZtmZyvBoaSXQ&gpic=UID%3D000013894fcd7a92%3AT%3D1778751201%3ART%3D1778751201%3AS%3DALNI_MYl5oJsAwAqe897fEVIZyg0ne9Asw&abxe=1&dt=1778751202394&lmt=1778751202&adxs=27&adys=1109&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE0OC4wLjc3NzguMTY3IixudWxsLDAsbnVsbCwiNjQiLFtbIkNocm9taXVtIiwiMTQ4LjAuMC4wIl0sWyJHb29nbGUgQ2hyb21lIiwiMTQ4LjAuMC4wIl0sWyJOb3QtQS5CcmFuZCIsIjI0LjAuMC4wIl1dLDBd&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F28rrtqxs0afdpk3%2FGambonanza-v1.0.16-full-apkvision.apk%2Ffile&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&a3p=EpgBCgpjcml0ZW8uY29tEocBUHZ0SDJsOVpVM2hOYmxSdE5UaDFORVl5ZFhWUWNGSlhjV3g2VGsxWVdIVjZTMDVPVVRsUVRUQmpObmhXTVc5SFlubExlalZuYUZOSGQxazRNMDlaZUZORlRIRndSRU5ZTmxVMmVqRTJKVEpDYkVsaUpUSkNWVkkxVHpsbFJGRWxNMFFsTTBRWAESNgoMYWRzZXJ2ZXIub3JnEiQ1NGRiOGNjZS1mNTMzLTRkMzItOGIyZi1jZjUwMWM0ZTZmNzlYARI0CgpwdWJjaWQub3JnEiQzYjcxNzU5ZS00OTVkLTRkYWYtOTg4OS1mY2I4ZDU2N2VjYTNYARIcCg1jcndkY250cmwubmV0GILB1a7iM0gAUgIIZBIdCg5lc3AuY3JpdGVvLmNvbRiCwdWu4jNIAFICCGQSGAoJeWFob28uY29tGOTE1a7iM0gAUgIIbxI-CgVvcGVueBIsZXlKcElqb2lVRVZPVGt3NWFWaFJRME4xYkROc1dHSkRhbGxaUVQwOUluMD0YzMXVruIzSAASlgIKCHJ0YmhvdXNlEoACU2ZpVmpBaWV3WXpxaHhlM2dBWEY2VnFEYUx2dVVFb1ViQ2V2K284cncxRGFJOFFVWjl4RVNzNCs3QVFoR3ZPSkEzQ3cvUk8reFVCUS9aaGxHWUxWd0R0S25EY0NUUVVxOGs5ZGRRWmNFNlJ3b3U4OTBMNlBlWU93MFR0K1R5cjNIUDg0ZjY1TGtKazYvclJ6L0JDZ0J6cnROeUFzb2VFR1dhTTNhTGhqWmhEdzVFc0xiS20xNXkrLy9VS0gvdXJmV1VzSVlmUkNOMUxtSkVadnZRWmtYSHJGdlJidzU0Rzl6TjdVMnd0elNqclgrakxiY1lXRm8vWk1DRUtxQ2gwdRjgxtWu4jNIAA..&dlt=1778751198874&idt=2419&ppid=142e99cc7726b3a439aa50ec804b6bbe&uule=a%20cm9sZToxIHByb2R1Y2VyOjEyIGxvYzoiSDNCLENBIg%3D%3D&prev_scp=a%3D1%26iid1%3D6924024930410049%26eid%3D6924024930410049%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D1%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252F28rrtqxs0afdpk3%252FGambonanza-v1.0.16-full-apkvision.apk%252Ffile%26path%3D%252Ffile%252F28rrtqxs0afdpk3%252FGambonanza-v1.0.16-full-apkvision.apk%252Ffile%26ap%3D1100%26sap%3D1100%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D7%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-medrectangle-2%26tap%3Dmediafire_com-medrectangle-2-6924024930410049%26eb_br%3D8c5ffefb122f59a66a8b7672d4452af2%26eba%3D0%26bv%3D12%26bvm%3D0%26bvr%3D2%26avc%3D49%26evc%3D35%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D36%26br2%3D34%26ezoic%3D1%26nmau%3D2%26mau%3D0%26stl%3D83%2C152%2C154%2C27%2C51%2C193%2C88%2C20%2C26%2C171%2C205%2C0%2C158%2C173%2C901%2C902%2C903%26deal1%3D2693%2C3053%2C4276%2C7331%2C8290%2C8296%2C8299%2C8335%26osb%3DLinux%252FChrome%26dbg%3Drc%253A5%26reqt%3D1778751202037&cust_params=li-module-enabled%3Dt0&adks=1630800042&frm=20&eo_id_str=ID%3D777f7e13823df6a9%3AT%3D1778751201%3ART%3D1778751201%3AS%3DAA-AfjYoKIs1prfKFD6uebUMaLzZ&pbbce=1

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=dd428baff9

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.155.155 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

yuiadrs-in-f155.1e100.net

Software

cafe /

Resource Hash

8568a18d2ec89dbad8ca3fade3195e0e98a99ad6a2d12f2421f79689f6e399b6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: dcb
google-lineitem-id: -2
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 14 May 2026 09:33:22 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.mediafire.com
content-length: 140
x-xss-protection: 0
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 505 B
168 B 356ms
356ms Fetch
text/plain 192.178.155.155
Google LLC

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=6265647328545851&correlator=69646841059213&eid=31098551&output=ldjh&gdfp_req=1&vrg=202605130101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=10&didk=219167732&dids=div-gpt-ad-mediafire_com-medre&adfs=2995551083&sfv=1-0-45&rcs=1&eri=1&sc=1&cookie=ID%3D4c907cf15727623e%3AT%3D1778751201%3ART%3D1778751201%3AS%3DALNI_MaDaZ5ZTDiSo5EJt4ZtmZyvBoaSXQ&gpic=UID%3D000013894fcd7a92%3AT%3D1778751201%3ART%3D1778751201%3AS%3DALNI_MYl5oJsAwAqe897fEVIZyg0ne9Asw&abxe=1&dt=1778751202400&lmt=1778751202&adxs=795&adys=1109&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=2&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE0OC4wLjc3NzguMTY3IixudWxsLDAsbnVsbCwiNjQiLFtbIkNocm9taXVtIiwiMTQ4LjAuMC4wIl0sWyJHb29nbGUgQ2hyb21lIiwiMTQ4LjAuMC4wIl0sWyJOb3QtQS5CcmFuZCIsIjI0LjAuMC4wIl1dLDBd&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F28rrtqxs0afdpk3%2FGambonanza-v1.0.16-full-apkvision.apk%2Ffile&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&a3p=EpgBCgpjcml0ZW8uY29tEocBUHZ0SDJsOVpVM2hOYmxSdE5UaDFORVl5ZFhWUWNGSlhjV3g2VGsxWVdIVjZTMDVPVVRsUVRUQmpObmhXTVc5SFlubExlalZuYUZOSGQxazRNMDlaZUZORlRIRndSRU5ZTmxVMmVqRTJKVEpDYkVsaUpUSkNWVkkxVHpsbFJGRWxNMFFsTTBRWAESNgoMYWRzZXJ2ZXIub3JnEiQ1NGRiOGNjZS1mNTMzLTRkMzItOGIyZi1jZjUwMWM0ZTZmNzlYARI0CgpwdWJjaWQub3JnEiQzYjcxNzU5ZS00OTVkLTRkYWYtOTg4OS1mY2I4ZDU2N2VjYTNYARIcCg1jcndkY250cmwubmV0GILB1a7iM0gAUgIIZBIdCg5lc3AuY3JpdGVvLmNvbRiCwdWu4jNIAFICCGQSGAoJeWFob28uY29tGOTE1a7iM0gAUgIIbxI-CgVvcGVueBIsZXlKcElqb2lVRVZPVGt3NWFWaFJRME4xYkROc1dHSkRhbGxaUVQwOUluMD0YzMXVruIzSAASlgIKCHJ0YmhvdXNlEoACU2ZpVmpBaWV3WXpxaHhlM2dBWEY2VnFEYUx2dVVFb1ViQ2V2K284cncxRGFJOFFVWjl4RVNzNCs3QVFoR3ZPSkEzQ3cvUk8reFVCUS9aaGxHWUxWd0R0S25EY0NUUVVxOGs5ZGRRWmNFNlJ3b3U4OTBMNlBlWU93MFR0K1R5cjNIUDg0ZjY1TGtKazYvclJ6L0JDZ0J6cnROeUFzb2VFR1dhTTNhTGhqWmhEdzVFc0xiS20xNXkrLy9VS0gvdXJmV1VzSVlmUkNOMUxtSkVadnZRWmtYSHJGdlJidzU0Rzl6TjdVMnd0elNqclgrakxiY1lXRm8vWk1DRUtxQ2gwdRjgxtWu4jNIAA..&dlt=1778751198874&idt=2419&ppid=142e99cc7726b3a439aa50ec804b6bbe&uule=a%20cm9sZToxIHByb2R1Y2VyOjEyIGxvYzoiSDNCLENBIg%3D%3D&prev_scp=a%3D1%26iid1%3D6924024930410049%26eid%3D6924024930410049%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D1%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252F28rrtqxs0afdpk3%252FGambonanza-v1.0.16-full-apkvision.apk%252Ffile%26path%3D%252Ffile%252F28rrtqxs0afdpk3%252FGambonanza-v1.0.16-full-apkvision.apk%252Ffile%26ap%3D1100%26sap%3D1100%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D8%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-medrectangle-2%26tap%3Dmediafire_com-medrectangle-2-6924024930410049%26eb_br%3D8c5ffefb122f59a66a8b7672d4452af2%26eba%3D0%26bv%3D12%26bvm%3D0%26bvr%3D2%26avc%3D49%26evc%3D35%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D36%26br2%3D34%26ezoic%3D1%26nmau%3D2%26mau%3D1%26stl%3D157%2C14%2C0%2C0%2C0%2C168%2C184%2C20%2C0%2C0%2C192%2C31%2C902%2C903%2C901%2C902%2C903%26deal1%3D2693%2C3053%2C4276%2C7331%2C8290%2C8296%2C8299%2C8335%26osb%3DLinux%252FChrome%26dbg%3Dadap%253A1%2Crc%253A6%26reqt%3D1778751201811&cust_params=li-module-enabled%3Dt0&adks=1277576459&frm=20&eo_id_str=ID%3D777f7e13823df6a9%3AT%3D1778751201%3ART%3D1778751201%3AS%3DAA-AfjYoKIs1prfKFD6uebUMaLzZ&pbbce=1

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=dd428baff9

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.155.155 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

yuiadrs-in-f155.1e100.net

Software

cafe /

Resource Hash

bcf0ad7f14a8164cd2cced6dca68f0199c44606f9a167bd03b2152940713f1b8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: dcb
google-lineitem-id: -2
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 14 May 2026 09:33:22 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.mediafire.com
content-length: 138
x-xss-protection: 0
server: cafe

POST
H3 204 ping
pagead2.googlesyndication.com/pagead/ 0
0 126ms
47ms Fetch
image/gif 142.251.167.155
Google LLC

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/ping?e=1

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=dd428baff9

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.155 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

ww-in-f155.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
Content-Type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 14 May 2026 09:33:22 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 runner.html Show response
ep2.adtrafficquality.google/sodar/sodar2/254/ Frame D63B 14 KB
6 KB 384ms
36ms Document
text/html 64.233.180.132
Google LLC

General

Check archive.org

Download Go to

Full URL

https://ep2.adtrafficquality.google/sodar/sodar2/254/runner.html

Requested by

Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

64.233.180.132 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

pe-in-f132.1e100.net

Software

sffe /

Resource Hash

fe2eddeaa8adad53d570fdeeb04412a07ec65ad99b25fe5beb092dfe4fb78cc9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.mediafire.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

accept-ranges: bytes
age: 92
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000
content-encoding: gzip
content-length: 5457
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 14 May 2026 09:31:50 GMT
expires: Thu, 14 May 2026 10:21:50 GMT
last-modified: Wed, 01 Apr 2026 16:06:33 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 7AEB 829 B
568 B 122ms
70ms Document
text/html 142.251.153.119
Google LLC

General

Check archive.org

Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.153.119 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

3ffe92946fd71e550b2c6da4d0605bcfa9863bae24bdccdf74585b18ad2ae7e8

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-GnVjXeqi5sRmTfXUbVH-gw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.mediafire.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-GnVjXeqi5sRmTfXUbVH-gw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy-report-only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
cross-origin-resource-policy: cross-origin
date: Thu, 14 May 2026 09:33:22 GMT
expires: Thu, 14 May 2026 09:33:22 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
server: ESF
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 499 B
157 B 302ms
301ms Fetch
text/plain 192.178.155.155
Google LLC

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=6265647328545851&correlator=4364617245348991&eid=31098551&output=ldjh&gdfp_req=1&vrg=202605130101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-banner-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=11&didk=417644066&dids=div-gpt-ad-mediafire_com-banne&adfs=4128408292&sfv=1-0-45&rcs=1&eri=1&sc=1&cookie=ID%3D4c907cf15727623e%3AT%3D1778751201%3ART%3D1778751201%3AS%3DALNI_MaDaZ5ZTDiSo5EJt4ZtmZyvBoaSXQ&gpic=UID%3D000013894fcd7a92%3AT%3D1778751201%3ART%3D1778751201%3AS%3DALNI_MYl5oJsAwAqe897fEVIZyg0ne9Asw&abxe=1&dt=1778751202503&lmt=1778751202&adxs=436&adys=1410&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=2&ucis=3&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE0OC4wLjc3NzguMTY3IixudWxsLDAsbnVsbCwiNjQiLFtbIkNocm9taXVtIiwiMTQ4LjAuMC4wIl0sWyJHb29nbGUgQ2hyb21lIiwiMTQ4LjAuMC4wIl0sWyJOb3QtQS5CcmFuZCIsIjI0LjAuMC4wIl1dLDBd&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F28rrtqxs0afdpk3%2FGambonanza-v1.0.16-full-apkvision.apk%2Ffile&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&a3p=EpgBCgpjcml0ZW8uY29tEocBUHZ0SDJsOVpVM2hOYmxSdE5UaDFORVl5ZFhWUWNGSlhjV3g2VGsxWVdIVjZTMDVPVVRsUVRUQmpObmhXTVc5SFlubExlalZuYUZOSGQxazRNMDlaZUZORlRIRndSRU5ZTmxVMmVqRTJKVEpDYkVsaUpUSkNWVkkxVHpsbFJGRWxNMFFsTTBRWAESNgoMYWRzZXJ2ZXIub3JnEiQ1NGRiOGNjZS1mNTMzLTRkMzItOGIyZi1jZjUwMWM0ZTZmNzlYARI0CgpwdWJjaWQub3JnEiQzYjcxNzU5ZS00OTVkLTRkYWYtOTg4OS1mY2I4ZDU2N2VjYTNYARIcCg1jcndkY250cmwubmV0GILB1a7iM0gAUgIIZBIdCg5lc3AuY3JpdGVvLmNvbRiCwdWu4jNIAFICCGQSGAoJeWFob28uY29tGOTE1a7iM0gAUgIIbxI-CgVvcGVueBIsZXlKcElqb2lVRVZPVGt3NWFWaFJRME4xYkROc1dHSkRhbGxaUVQwOUluMD0YzMXVruIzSAASlgIKCHJ0YmhvdXNlEoACU2ZpVmpBaWV3WXpxaHhlM2dBWEY2VnFEYUx2dVVFb1ViQ2V2K284cncxRGFJOFFVWjl4RVNzNCs3QVFoR3ZPSkEzQ3cvUk8reFVCUS9aaGxHWUxWd0R0S25EY0NUUVVxOGs5ZGRRWmNFNlJ3b3U4OTBMNlBlWU93MFR0K1R5cjNIUDg0ZjY1TGtKazYvclJ6L0JDZ0J6cnROeUFzb2VFR1dhTTNhTGhqWmhEdzVFc0xiS20xNXkrLy9VS0gvdXJmV1VzSVlmUkNOMUxtSkVadnZRWmtYSHJGdlJidzU0Rzl6TjdVMnd0elNqclgrakxiY1lXRm8vWk1DRUtxQ2gwdRjgxtWu4jNIAA..&dlt=1778751198874&idt=2419&ppid=142e99cc7726b3a439aa50ec804b6bbe&uule=a%20cm9sZToxIHByb2R1Y2VyOjEyIGxvYzoiSDNCLENBIg%3D%3D&prev_scp=a%3D1%26iid1%3D7145616782351968%26eid%3D7145616782351968%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D1%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252F28rrtqxs0afdpk3%252FGambonanza-v1.0.16-full-apkvision.apk%252Ffile%26path%3D%252Ffile%252F28rrtqxs0afdpk3%252FGambonanza-v1.0.16-full-apkvision.apk%252Ffile%26ap%3D1107%26sap%3D1107%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D9%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D30%26al%3D1030%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-banner-1%26tap%3Dmediafire_com-banner-1-7145616782351968%26eb_br%3Dbf9a045b836005b6c23b7b0749249612%26eba%3D0%26bv%3D11%26bvm%3D0%26bvr%3D1%26avc%3D36%26evc%3D27%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D26%26br2%3D26%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D78%2C193%2C0%2C0%2C0%2C131%2C132%2C0%2C0%2C0%2C187%2C0%2C901%2C182%2C901%2C902%2C903%26deal1%3D18%2C1428%2C2693%2C3052%2C3053%2C3856%2C7331%2C8229%2C8333%2C8334%2C8335%26osb%3DLinux%252FChrome%26dbg%3Drc%253A1%26reqt%3D1778751201937&cust_params=li-module-enabled%3Dt0&adks=3665333008&frm=20&eo_id_str=ID%3D777f7e13823df6a9%3AT%3D1778751201%3ART%3D1778751201%3AS%3DAA-AfjYoKIs1prfKFD6uebUMaLzZ&pbbce=1

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=dd428baff9

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.155.155 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

yuiadrs-in-f155.1e100.net

Software

cafe /

Resource Hash

82df847d47ee8d3da6c2a70ed3eddca63183eeae76c2604100357546521099ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: dcb
google-lineitem-id: -2
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 14 May 2026 09:33:22 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.mediafire.com
content-length: 127
x-xss-protection: 0
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 496 B
160 B 256ms
255ms Fetch
text/plain 192.178.155.155
Google LLC

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=6265647328545851&correlator=1691308490050652&eid=31098551&output=ldjh&gdfp_req=1&vrg=202605130101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=12&didk=1697938527&dids=div-gpt-ad-mediafire_com-box-2&adfs=2211965457&sfv=1-0-45&rcs=1&eri=1&sc=1&cookie=ID%3D4c907cf15727623e%3AT%3D1778751201%3ART%3D1778751201%3AS%3DALNI_MaDaZ5ZTDiSo5EJt4ZtmZyvBoaSXQ&gpic=UID%3D000013894fcd7a92%3AT%3D1778751201%3ART%3D1778751201%3AS%3DALNI_MYl5oJsAwAqe897fEVIZyg0ne9Asw&abxe=1&dt=1778751202514&lmt=1778751202&adxs=552&adys=10&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=4&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE0OC4wLjc3NzguMTY3IixudWxsLDAsbnVsbCwiNjQiLFtbIkNocm9taXVtIiwiMTQ4LjAuMC4wIl0sWyJHb29nbGUgQ2hyb21lIiwiMTQ4LjAuMC4wIl0sWyJOb3QtQS5CcmFuZCIsIjI0LjAuMC4wIl1dLDBd&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F28rrtqxs0afdpk3%2FGambonanza-v1.0.16-full-apkvision.apk%2Ffile&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&a3p=EpgBCgpjcml0ZW8uY29tEocBUHZ0SDJsOVpVM2hOYmxSdE5UaDFORVl5ZFhWUWNGSlhjV3g2VGsxWVdIVjZTMDVPVVRsUVRUQmpObmhXTVc5SFlubExlalZuYUZOSGQxazRNMDlaZUZORlRIRndSRU5ZTmxVMmVqRTJKVEpDYkVsaUpUSkNWVkkxVHpsbFJGRWxNMFFsTTBRWAESNgoMYWRzZXJ2ZXIub3JnEiQ1NGRiOGNjZS1mNTMzLTRkMzItOGIyZi1jZjUwMWM0ZTZmNzlYARI0CgpwdWJjaWQub3JnEiQzYjcxNzU5ZS00OTVkLTRkYWYtOTg4OS1mY2I4ZDU2N2VjYTNYARIcCg1jcndkY250cmwubmV0GILB1a7iM0gAUgIIZBIdCg5lc3AuY3JpdGVvLmNvbRiCwdWu4jNIAFICCGQSGAoJeWFob28uY29tGOTE1a7iM0gAUgIIbxI-CgVvcGVueBIsZXlKcElqb2lVRVZPVGt3NWFWaFJRME4xYkROc1dHSkRhbGxaUVQwOUluMD0YzMXVruIzSAASlgIKCHJ0YmhvdXNlEoACU2ZpVmpBaWV3WXpxaHhlM2dBWEY2VnFEYUx2dVVFb1ViQ2V2K284cncxRGFJOFFVWjl4RVNzNCs3QVFoR3ZPSkEzQ3cvUk8reFVCUS9aaGxHWUxWd0R0S25EY0NUUVVxOGs5ZGRRWmNFNlJ3b3U4OTBMNlBlWU93MFR0K1R5cjNIUDg0ZjY1TGtKazYvclJ6L0JDZ0J6cnROeUFzb2VFR1dhTTNhTGhqWmhEdzVFc0xiS20xNXkrLy9VS0gvdXJmV1VzSVlmUkNOMUxtSkVadnZRWmtYSHJGdlJidzU0Rzl6TjdVMnd0elNqclgrakxiY1lXRm8vWk1DRUtxQ2gwdRjgxtWu4jNIAA..&dlt=1778751198874&idt=2419&ppid=142e99cc7726b3a439aa50ec804b6bbe&uule=a%20cm9sZToxIHByb2R1Y2VyOjEyIGxvYzoiSDNCLENBIg%3D%3D&prev_scp=a%3D1%26iid1%3D8206134848363251%26eid%3D8206134848363251%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D1%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252F28rrtqxs0afdpk3%252FGambonanza-v1.0.16-full-apkvision.apk%252Ffile%26path%3D%252Ffile%252F28rrtqxs0afdpk3%252FGambonanza-v1.0.16-full-apkvision.apk%252Ffile%26ap%3D1103%26sap%3D1103%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-box-2%26tap%3Dmediafire_com-box-2-8206134848363251%26eb_br%3Dfe5b0c99ab7ba15f050582be1301303f%26eba%3D0%26bv%3D51%26bvm%3D0%26bvr%3D12%26avc%3D93%26evc%3D46%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D46%26br2%3D46%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D157%2C168%2C0%2C0%2C0%2C168%2C184%2C20%2C0%2C0%2C192%2C31%2C902%2C903%2C901%2C902%2C903%26deal1%3D2693%2C3045%2C4276%2C7330%2C8290%2C8296%2C8299%2C8300%2C8303%2C8312%26osb%3DLinux%252FChrome%26dbg%3Drc%253A2%26reqt%3D1778751201876&cust_params=li-module-enabled%3Dt0&adks=3106951849&frm=20&eo_id_str=ID%3D777f7e13823df6a9%3AT%3D1778751201%3ART%3D1778751201%3AS%3DAA-AfjYoKIs1prfKFD6uebUMaLzZ&pbbce=1

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=dd428baff9

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.155.155 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

yuiadrs-in-f155.1e100.net

Software

cafe /

Resource Hash

0f29e071004f949cd1062714ccc9b0bc950b34c07f0af10ad5a3ce2504ba152d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: dcb
google-lineitem-id: -2
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 14 May 2026 09:33:22 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.mediafire.com
content-length: 130
x-xss-protection: 0
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 498 B
155 B 327ms
326ms Fetch
text/plain 192.178.155.155
Google LLC

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=6265647328545851&correlator=2552098463878804&eid=31098551&output=ldjh&gdfp_req=1&vrg=202605130101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-edge-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=160x600&ifi=13&didk=2994425013&dids=div-gpt-ad-mediafire_com-edge-&adfs=982453029&sfv=1-0-45&rcs=1&eri=1&sc=1&cookie=ID%3D4c907cf15727623e%3AT%3D1778751201%3ART%3D1778751201%3AS%3DALNI_MaDaZ5ZTDiSo5EJt4ZtmZyvBoaSXQ&gpic=UID%3D000013894fcd7a92%3AT%3D1778751201%3ART%3D1778751201%3AS%3DALNI_MYl5oJsAwAqe897fEVIZyg0ne9Asw&abxe=1&dt=1778751202525&lmt=1778751202&adxs=1440&adys=300&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=5&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE0OC4wLjc3NzguMTY3IixudWxsLDAsbnVsbCwiNjQiLFtbIkNocm9taXVtIiwiMTQ4LjAuMC4wIl0sWyJHb29nbGUgQ2hyb21lIiwiMTQ4LjAuMC4wIl0sWyJOb3QtQS5CcmFuZCIsIjI0LjAuMC4wIl1dLDBd&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F28rrtqxs0afdpk3%2FGambonanza-v1.0.16-full-apkvision.apk%2Ffile&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&a3p=EpgBCgpjcml0ZW8uY29tEocBUHZ0SDJsOVpVM2hOYmxSdE5UaDFORVl5ZFhWUWNGSlhjV3g2VGsxWVdIVjZTMDVPVVRsUVRUQmpObmhXTVc5SFlubExlalZuYUZOSGQxazRNMDlaZUZORlRIRndSRU5ZTmxVMmVqRTJKVEpDYkVsaUpUSkNWVkkxVHpsbFJGRWxNMFFsTTBRWAESNgoMYWRzZXJ2ZXIub3JnEiQ1NGRiOGNjZS1mNTMzLTRkMzItOGIyZi1jZjUwMWM0ZTZmNzlYARI0CgpwdWJjaWQub3JnEiQzYjcxNzU5ZS00OTVkLTRkYWYtOTg4OS1mY2I4ZDU2N2VjYTNYARIcCg1jcndkY250cmwubmV0GILB1a7iM0gAUgIIZBIdCg5lc3AuY3JpdGVvLmNvbRiCwdWu4jNIAFICCGQSGAoJeWFob28uY29tGOTE1a7iM0gAUgIIbxI-CgVvcGVueBIsZXlKcElqb2lVRVZPVGt3NWFWaFJRME4xYkROc1dHSkRhbGxaUVQwOUluMD0YzMXVruIzSAASlgIKCHJ0YmhvdXNlEoACU2ZpVmpBaWV3WXpxaHhlM2dBWEY2VnFEYUx2dVVFb1ViQ2V2K284cncxRGFJOFFVWjl4RVNzNCs3QVFoR3ZPSkEzQ3cvUk8reFVCUS9aaGxHWUxWd0R0S25EY0NUUVVxOGs5ZGRRWmNFNlJ3b3U4OTBMNlBlWU93MFR0K1R5cjNIUDg0ZjY1TGtKazYvclJ6L0JDZ0J6cnROeUFzb2VFR1dhTTNhTGhqWmhEdzVFc0xiS20xNXkrLy9VS0gvdXJmV1VzSVlmUkNOMUxtSkVadnZRWmtYSHJGdlJidzU0Rzl6TjdVMnd0elNqclgrakxiY1lXRm8vWk1DRUtxQ2gwdRjgxtWu4jNIAA..&dlt=1778751198874&idt=2419&ppid=142e99cc7726b3a439aa50ec804b6bbe&uule=a%20cm9sZToxIHByb2R1Y2VyOjEyIGxvYzoiSDNCLENBIg%3D%3D&prev_scp=a%3D1%26iid1%3D8044379006359734%26eid%3D8044379006359734%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D1%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252F28rrtqxs0afdpk3%252FGambonanza-v1.0.16-full-apkvision.apk%252Ffile%26path%3D%252Ffile%252F28rrtqxs0afdpk3%252FGambonanza-v1.0.16-full-apkvision.apk%252Ffile%26ap%3D1102%26sap%3D1102%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D3%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D39%26al%3D1039%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-edge-2%26tap%3Dmediafire_com-edge-2-8044379006359734%26eb_br%3D3ba982fc4238dd4197b1d51b345478dc%26eba%3D0%26bv%3D11%26bvm%3D0%26bvr%3D1%26avc%3D56%26evc%3D41%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D50%26br2%3D50%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D78%2C168%2C0%2C0%2C0%2C131%2C132%2C0%2C0%2C0%2C187%2C0%2C901%2C182%2C901%2C902%2C903%26deal1%3D18%2C19%2C1428%2C2688%2C2693%2C3045%2C3052%2C3053%2C3856%2C4276%2C7330%2C7331%2C8229%2C8290%2C8296%2C8299%2C8300%2C8303%2C8312%2C8333%2C8334%2C8335%2C8344%26osb%3DLinux%252FChrome%26dbg%3Drc%253A4%26reqt%3D1778751201927&cust_params=li-module-enabled%3Dt0&adks=697308627&frm=20&eo_id_str=ID%3D777f7e13823df6a9%3AT%3D1778751201%3ART%3D1778751201%3AS%3DAA-AfjYoKIs1prfKFD6uebUMaLzZ&pbbce=1

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=dd428baff9

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.155.155 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

yuiadrs-in-f155.1e100.net

Software

cafe /

Resource Hash

7e1fc3bd3f6fdac2f28dbb7f190ec0b997499a59b8b1080204614981c2e82796

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: dcb
google-lineitem-id: -2
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 14 May 2026 09:33:22 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.mediafire.com
content-length: 125
x-xss-protection: 0
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 506 B
161 B 314ms
313ms Fetch
text/plain 192.178.155.155
Google LLC

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=6265647328545851&correlator=1666996354432244&eid=31098551&output=ldjh&gdfp_req=1&vrg=202605130101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-medrectangle-3&enc_prev_ius=%2F0%2F1&prev_iu_szs=336x280&ifi=14&didk=46179496&dids=div-gpt-ad-mediafire_com-medre&adfs=1911771697&sfv=1-0-45&rcs=1&eri=1&sc=1&cookie=ID%3D4c907cf15727623e%3AT%3D1778751201%3ART%3D1778751201%3AS%3DALNI_MaDaZ5ZTDiSo5EJt4ZtmZyvBoaSXQ&gpic=UID%3D000013894fcd7a92%3AT%3D1778751201%3ART%3D1778751201%3AS%3DALNI_MYl5oJsAwAqe897fEVIZyg0ne9Asw&abxe=1&dt=1778751202541&lmt=1778751202&adxs=320&adys=120&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=6&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE0OC4wLjc3NzguMTY3IixudWxsLDAsbnVsbCwiNjQiLFtbIkNocm9taXVtIiwiMTQ4LjAuMC4wIl0sWyJHb29nbGUgQ2hyb21lIiwiMTQ4LjAuMC4wIl0sWyJOb3QtQS5CcmFuZCIsIjI0LjAuMC4wIl1dLDBd&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F28rrtqxs0afdpk3%2FGambonanza-v1.0.16-full-apkvision.apk%2Ffile&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&a3p=EpgBCgpjcml0ZW8uY29tEocBUHZ0SDJsOVpVM2hOYmxSdE5UaDFORVl5ZFhWUWNGSlhjV3g2VGsxWVdIVjZTMDVPVVRsUVRUQmpObmhXTVc5SFlubExlalZuYUZOSGQxazRNMDlaZUZORlRIRndSRU5ZTmxVMmVqRTJKVEpDYkVsaUpUSkNWVkkxVHpsbFJGRWxNMFFsTTBRWAESNgoMYWRzZXJ2ZXIub3JnEiQ1NGRiOGNjZS1mNTMzLTRkMzItOGIyZi1jZjUwMWM0ZTZmNzlYARI0CgpwdWJjaWQub3JnEiQzYjcxNzU5ZS00OTVkLTRkYWYtOTg4OS1mY2I4ZDU2N2VjYTNYARIcCg1jcndkY250cmwubmV0GILB1a7iM0gAUgIIZBIdCg5lc3AuY3JpdGVvLmNvbRiCwdWu4jNIAFICCGQSGAoJeWFob28uY29tGOTE1a7iM0gAUgIIbxI-CgVvcGVueBIsZXlKcElqb2lVRVZPVGt3NWFWaFJRME4xYkROc1dHSkRhbGxaUVQwOUluMD0YzMXVruIzSAASlgIKCHJ0YmhvdXNlEoACU2ZpVmpBaWV3WXpxaHhlM2dBWEY2VnFEYUx2dVVFb1ViQ2V2K284cncxRGFJOFFVWjl4RVNzNCs3QVFoR3ZPSkEzQ3cvUk8reFVCUS9aaGxHWUxWd0R0S25EY0NUUVVxOGs5ZGRRWmNFNlJ3b3U4OTBMNlBlWU93MFR0K1R5cjNIUDg0ZjY1TGtKazYvclJ6L0JDZ0J6cnROeUFzb2VFR1dhTTNhTGhqWmhEdzVFc0xiS20xNXkrLy9VS0gvdXJmV1VzSVlmUkNOMUxtSkVadnZRWmtYSHJGdlJidzU0Rzl6TjdVMnd0elNqclgrakxiY1lXRm8vWk1DRUtxQ2gwdRjgxtWu4jNIAA..&dlt=1778751198874&idt=2419&ppid=142e99cc7726b3a439aa50ec804b6bbe&uule=a%20cm9sZToxIHByb2R1Y2VyOjEyIGxvYzoiSDNCLENBIg%3D%3D&prev_scp=a%3D1%26iid1%3D3199650704416009%26eid%3D3199650704416009%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D1%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252F28rrtqxs0afdpk3%252FGambonanza-v1.0.16-full-apkvision.apk%252Ffile%26path%3D%252Ffile%252F28rrtqxs0afdpk3%252FGambonanza-v1.0.16-full-apkvision.apk%252Ffile%26ap%3D1104%26sap%3D1104%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D5%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D21%26al%3D1021%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-medrectangle-3%26tap%3Dmediafire_com-medrectangle-3-3199650704416009%26eb_br%3Dc352ba581bd3ffd8cea608cf2d55f519%26eba%3D0%26bv%3D11%26bvm%3D0%26bvr%3D1%26avc%3D108%26evc%3D57%26shp%3D3%26ftsn%3D12%26ftsng%3D12%26br1%3D60%26br2%3D60%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D157%2C131%2C0%2C0%2C0%2C168%2C184%2C20%2C0%2C0%2C192%2C31%2C902%2C903%2C901%2C902%2C903%26deal1%3D18%2C19%2C1428%2C2688%2C2693%2C3045%2C3052%2C3053%2C3856%2C4276%2C7330%2C7331%2C8229%2C8290%2C8295%2C8296%2C8299%2C8300%2C8303%2C8312%2C8327%2C8333%2C8334%2C8335%2C8336%2C8344%26osb%3DLinux%252FChrome%26dbg%3Drc%253A7%26reqt%3D1778751201933&cust_params=li-module-enabled%3Dt0&adks=4079446691&frm=20&eo_id_str=ID%3D777f7e13823df6a9%3AT%3D1778751201%3ART%3D1778751201%3AS%3DAA-AfjYoKIs1prfKFD6uebUMaLzZ&pbbce=1

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=dd428baff9

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.155.155 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

yuiadrs-in-f155.1e100.net

Software

cafe /

Resource Hash

1a68b4ed311f1f0008b1d021e4186774365b849f7a3aec3dd4bc967998fd4e72

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: dcb
google-lineitem-id: -2
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 14 May 2026 09:33:22 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.mediafire.com
content-length: 131
x-xss-protection: 0
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 506 B
159 B 327ms
326ms Fetch
text/plain 192.178.155.155
Google LLC

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=6265647328545851&correlator=2437753991625224&eid=31098551&output=ldjh&gdfp_req=1&vrg=202605130101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-medrectangle-4&enc_prev_ius=%2F0%2F1&prev_iu_szs=336x280%7C300x250&ifi=15&didk=46192883&dids=div-gpt-ad-mediafire_com-medre&adfs=1749122204&sfv=1-0-45&rcs=1&eri=1&sc=1&cookie=ID%3D4c907cf15727623e%3AT%3D1778751201%3ART%3D1778751201%3AS%3DALNI_MaDaZ5ZTDiSo5EJt4ZtmZyvBoaSXQ&gpic=UID%3D000013894fcd7a92%3AT%3D1778751201%3ART%3D1778751201%3AS%3DALNI_MYl5oJsAwAqe897fEVIZyg0ne9Asw&abxe=1&dt=1778751202557&lmt=1778751202&adxs=320&adys=420&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=7&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE0OC4wLjc3NzguMTY3IixudWxsLDAsbnVsbCwiNjQiLFtbIkNocm9taXVtIiwiMTQ4LjAuMC4wIl0sWyJHb29nbGUgQ2hyb21lIiwiMTQ4LjAuMC4wIl0sWyJOb3QtQS5CcmFuZCIsIjI0LjAuMC4wIl1dLDBd&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F28rrtqxs0afdpk3%2FGambonanza-v1.0.16-full-apkvision.apk%2Ffile&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&a3p=EpgBCgpjcml0ZW8uY29tEocBUHZ0SDJsOVpVM2hOYmxSdE5UaDFORVl5ZFhWUWNGSlhjV3g2VGsxWVdIVjZTMDVPVVRsUVRUQmpObmhXTVc5SFlubExlalZuYUZOSGQxazRNMDlaZUZORlRIRndSRU5ZTmxVMmVqRTJKVEpDYkVsaUpUSkNWVkkxVHpsbFJGRWxNMFFsTTBRWAESNgoMYWRzZXJ2ZXIub3JnEiQ1NGRiOGNjZS1mNTMzLTRkMzItOGIyZi1jZjUwMWM0ZTZmNzlYARI0CgpwdWJjaWQub3JnEiQzYjcxNzU5ZS00OTVkLTRkYWYtOTg4OS1mY2I4ZDU2N2VjYTNYARIcCg1jcndkY250cmwubmV0GILB1a7iM0gAUgIIZBIdCg5lc3AuY3JpdGVvLmNvbRiCwdWu4jNIAFICCGQSGAoJeWFob28uY29tGOTE1a7iM0gAUgIIbxI-CgVvcGVueBIsZXlKcElqb2lVRVZPVGt3NWFWaFJRME4xYkROc1dHSkRhbGxaUVQwOUluMD0YzMXVruIzSAASlgIKCHJ0YmhvdXNlEoACU2ZpVmpBaWV3WXpxaHhlM2dBWEY2VnFEYUx2dVVFb1ViQ2V2K284cncxRGFJOFFVWjl4RVNzNCs3QVFoR3ZPSkEzQ3cvUk8reFVCUS9aaGxHWUxWd0R0S25EY0NUUVVxOGs5ZGRRWmNFNlJ3b3U4OTBMNlBlWU93MFR0K1R5cjNIUDg0ZjY1TGtKazYvclJ6L0JDZ0J6cnROeUFzb2VFR1dhTTNhTGhqWmhEdzVFc0xiS20xNXkrLy9VS0gvdXJmV1VzSVlmUkNOMUxtSkVadnZRWmtYSHJGdlJidzU0Rzl6TjdVMnd0elNqclgrakxiY1lXRm8vWk1DRUtxQ2gwdRjgxtWu4jNIAA..&dlt=1778751198874&idt=2419&ppid=142e99cc7726b3a439aa50ec804b6bbe&uule=a%20cm9sZToxIHByb2R1Y2VyOjEyIGxvYzoiSDNCLENBIg%3D%3D&prev_scp=a%3D1%26iid1%3D1431131254394124%26eid%3D1431131254394124%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D1%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252F28rrtqxs0afdpk3%252FGambonanza-v1.0.16-full-apkvision.apk%252Ffile%26path%3D%252Ffile%252F28rrtqxs0afdpk3%252FGambonanza-v1.0.16-full-apkvision.apk%252Ffile%26ap%3D1105%26sap%3D1105%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D6%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D22%26al%3D1022%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-medrectangle-4%26tap%3Dmediafire_com-medrectangle-4-1431131254394124%26eb_br%3D8c5ffefb122f59a66a8b7672d4452af2%26eba%3D0%26bv%3D11%26bvm%3D0%26bvr%3D1%26avc%3D67%26evc%3D34%26shp%3D3%26ftsn%3D12%26ftsng%3D12%26br1%3D36%26br2%3D34%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D81%2C189%2C207%2C4%2C5%2C193%2C24%2C20%2C71%2C201%2C205%2C0%2C124%2C166%2C901%2C902%2C903%26deal1%3D18%2C1428%2C2693%2C3052%2C3053%2C3856%2C4276%2C7331%2C8229%2C8290%2C8296%2C8299%2C8333%2C8334%2C8335%26osb%3DLinux%252FChrome%26dbg%3Drc%253A8%26reqt%3D1778751201931&cust_params=li-module-enabled%3Dt0&adks=1277606936&frm=20&eo_id_str=ID%3D777f7e13823df6a9%3AT%3D1778751201%3ART%3D1778751201%3AS%3DAA-AfjYoKIs1prfKFD6uebUMaLzZ&pbbce=1

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=dd428baff9

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.155.155 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

yuiadrs-in-f155.1e100.net

Software

cafe /

Resource Hash

bfe136e0e6d681e63caaa9fceb9901bb354882676852df6a08bd61e0e92bc503

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: dcb
google-lineitem-id: -2
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 14 May 2026 09:33:22 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.mediafire.com
content-length: 129
x-xss-protection: 0
server: cafe

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 7AEB 0
17 B 123ms
47ms Image
image/ 142.251.167.157
Google LLC

General

Check archive.org

Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=254&li=gpt_m202605130101&jk=6265647328545851&rc=

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.157 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

ww-in-f157.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

timing-allow-origin: *
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 14 May 2026 09:33:22 GMT
x-xss-protection: 0
content-type: image/
server: cafe

GET
H2 200 px.gif Show response
ad-delivery.net/ 43 B
112 B 28ms
27ms Fetch
image/gif 172.66.148.140
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://ad-delivery.net/px.gif?ch=2&e=0.16162510686611553
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=dd428baff9
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.66.148.140 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 5
x-goog-stored-content-encoding: identity
expires: Tue, 12 May 2026 22:06:37 GMT
x-goog-stored-content-length: 43
date: Thu, 14 May 2026 09:33:22 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid: AOCedOE4ceqfKqcxsn6FfQCul5MU3fPppaJoaSAD4zIpDi_AuCRSOF0vpherOnDkBFq5ISKOXI37mOc
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 9fb8e6a89c30b8f3-YYZ
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico Show response
ad.doubleclick.net/ 1 KB
129 B 40ms
39ms Fetch
image/x-icon 192.178.155.149
Google LLC

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.9280035863575812

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=dd428baff9

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.155.149 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

yuiadrs-in-f149.1e100.net

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Fri, 15 May 2026 09:33:22 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 14 May 2026 09:33:22 GMT
content-type: image/x-icon
vary: Accept-Encoding
last-modified: Tue, 08 May 2012 13:08:06 GMT
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 28 KB
5 KB 556ms
555ms Fetch
text/plain 192.178.155.155
Google LLC

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=6265647328545851&correlator=366908496735950&eid=31098551&output=ldjh&gdfp_req=1&vrg=202605130101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-edge-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=160x600&ifi=16&didk=2994273263&dids=div-gpt-ad-mediafire_com-edge-&adfs=580935078&sfv=1-0-45&rcs=1&eri=1&sc=1&cookie=ID%3D4c907cf15727623e%3AT%3D1778751201%3ART%3D1778751201%3AS%3DALNI_MaDaZ5ZTDiSo5EJt4ZtmZyvBoaSXQ&gpic=UID%3D000013894fcd7a92%3AT%3D1778751201%3ART%3D1778751201%3AS%3DALNI_MYl5oJsAwAqe897fEVIZyg0ne9Asw&abxe=1&dt=1778751202804&lmt=1778751202&adxs=0&adys=300&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=8&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE0OC4wLjc3NzguMTY3IixudWxsLDAsbnVsbCwiNjQiLFtbIkNocm9taXVtIiwiMTQ4LjAuMC4wIl0sWyJHb29nbGUgQ2hyb21lIiwiMTQ4LjAuMC4wIl0sWyJOb3QtQS5CcmFuZCIsIjI0LjAuMC4wIl1dLDBd&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F28rrtqxs0afdpk3%2FGambonanza-v1.0.16-full-apkvision.apk%2Ffile&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&a3p=EpgBCgpjcml0ZW8uY29tEocBUHZ0SDJsOVpVM2hOYmxSdE5UaDFORVl5ZFhWUWNGSlhjV3g2VGsxWVdIVjZTMDVPVVRsUVRUQmpObmhXTVc5SFlubExlalZuYUZOSGQxazRNMDlaZUZORlRIRndSRU5ZTmxVMmVqRTJKVEpDYkVsaUpUSkNWVkkxVHpsbFJGRWxNMFFsTTBRWAESNgoMYWRzZXJ2ZXIub3JnEiQ1NGRiOGNjZS1mNTMzLTRkMzItOGIyZi1jZjUwMWM0ZTZmNzlYARI0CgpwdWJjaWQub3JnEiQzYjcxNzU5ZS00OTVkLTRkYWYtOTg4OS1mY2I4ZDU2N2VjYTNYARIcCg1jcndkY250cmwubmV0GILB1a7iM0gAUgIIZBIdCg5lc3AuY3JpdGVvLmNvbRiCwdWu4jNIAFICCGQSGAoJeWFob28uY29tGOTE1a7iM0gAUgIIbxI-CgVvcGVueBIsZXlKcElqb2lVRVZPVGt3NWFWaFJRME4xYkROc1dHSkRhbGxaUVQwOUluMD0YzMXVruIzSAASlgIKCHJ0YmhvdXNlEoACU2ZpVmpBaWV3WXpxaHhlM2dBWEY2VnFEYUx2dVVFb1ViQ2V2K284cncxRGFJOFFVWjl4RVNzNCs3QVFoR3ZPSkEzQ3cvUk8reFVCUS9aaGxHWUxWd0R0S25EY0NUUVVxOGs5ZGRRWmNFNlJ3b3U4OTBMNlBlWU93MFR0K1R5cjNIUDg0ZjY1TGtKazYvclJ6L0JDZ0J6cnROeUFzb2VFR1dhTTNhTGhqWmhEdzVFc0xiS20xNXkrLy9VS0gvdXJmV1VzSVlmUkNOMUxtSkVadnZRWmtYSHJGdlJidzU0Rzl6TjdVMnd0elNqclgrakxiY1lXRm8vWk1DRUtxQ2gwdRjgxtWu4jNIAA..&dlt=1778751198874&idt=2419&ppid=142e99cc7726b3a439aa50ec804b6bbe&uule=a%20cm9sZToxIHByb2R1Y2VyOjEyIGxvYzoiSDNCLENBIg%3D%3D&prev_scp=a%3D1%26iid1%3D644503750349328%26eid%3D644503750349328%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D1%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252F28rrtqxs0afdpk3%252FGambonanza-v1.0.16-full-apkvision.apk%252Ffile%26path%3D%252Ffile%252F28rrtqxs0afdpk3%252FGambonanza-v1.0.16-full-apkvision.apk%252Ffile%26ap%3D1101%26sap%3D1101%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D4%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D38%26al%3D1038%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-edge-1%26tap%3Dmediafire_com-edge-1-644503750349328%26eb_br%3De66c30deca31b19eda212eeca1258584%26eba%3D0%26bv%3D4%26bvm%3D0%26bvr%3D4%26avc%3D59%26evc%3D49%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D24%26br2%3D22%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D78%2C168%2C0%2C0%2C0%2C131%2C132%2C0%2C0%2C0%2C187%2C0%2C901%2C182%2C901%2C902%2C903%26deal1%3D18%2C1428%2C3053%2C7331%2C8333%2C8334%2C8335%26osb%3DLinux%252FChrome%26dbg%3Drc%253A3%26reqt%3D1778751202202&cust_params=li-module-enabled%3Dt0&adks=966014519&frm=20&eo_id_str=ID%3D777f7e13823df6a9%3AT%3D1778751201%3ART%3D1778751201%3AS%3DAA-AfjYoKIs1prfKFD6uebUMaLzZ&pbbce=1

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=dd428baff9

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.155.155 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

yuiadrs-in-f155.1e100.net

Software

cafe /

Resource Hash

0984f7c40a7b6064c7c023f91167e33e19d63e01fff5557a664b6e30a84e7057

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: dcb
google-lineitem-id: -1
observe-browsing-topics: ?1
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 14 May 2026 09:33:23 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -1
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.mediafire.com
content-length: 4899
x-xss-protection: 0
server: cafe

GET
H3 200 MK_n3_4yBb5PQspzm0gYhnuZeqyYa0O-dZQ5WGlSCLw.js Show response
pagead2.googlesyndication.com/bg/ Frame D63B 57 KB
22 KB 39ms
39ms Script
text/javascript 142.251.167.157
Google LLC

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/MK_n3_4yBb5PQspzm0gYhnuZeqyYa0O-dZQ5WGlSCLw.js

Requested by

Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/sodar2/254/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.157 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

ww-in-f157.1e100.net

Software

sffe /

Resource Hash

30afe7dffe3205be4f42ca739b4818867b997aac986b43be75943958695208bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://ep2.adtrafficquality.google/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
age: 5192
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
x-content-type-options: nosniff
expires: Fri, 14 May 2027 08:06:50 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 14 May 2026 08:06:50 GMT
last-modified: Mon, 04 May 2026 12:38:00 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=31536000
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
accept-ranges: bytes
content-length: 22258
x-xss-protection: 0
server: sffe

GET
H2 204 generate_204
ep2.adtrafficquality.google/ Frame D63B 0
41 B 37ms
36ms Image
text/plain 64.233.180.132
Google LLC

General

Check archive.org

Download Go to Show image

Full URL: https://ep2.adtrafficquality.google/generate_204?HEU4Dg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 64.233.180.132 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: pe-in-f132.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://ep2.adtrafficquality.google/sodar/sodar2/254/runner.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Thu, 14 May 2026 09:33:23 GMT
cross-origin-resource-policy: cross-origin

GET
H2 200 country Show response
api.btloader.com/ 37 B
154 B 67ms
66ms Fetch
application/json 130.211.23.194
Google LLC

General

Check archive.org

Download Go to

Full URL: https://api.btloader.com/country?o=5678961798414336
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=dd428baff9
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.23.194 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS: 194.23.211.130.bc.googleusercontent.com
Software: /
Resource Hash: b8f0ca68362cf245f891fc09ddfa50806d195e78e196cf96ac5d9cf72be2577a

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: private, max-age=300, stale-while-revalidate=600, stale-if-error=600
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37
date: Thu, 14 May 2026 09:33:23 GMT
content-type: application/json
vary: Origin

POST
H2 204 pv
api.btloader.com/ 0
0 68ms
67ms Fetch 130.211.23.194
Google LLC

General

Check archive.org

Download Go to

Full URL: https://api.btloader.com/pv?nlf=false&tid=dVd1AKxuWw-umSQH1hp-9e25d55779&sid=X3DxHRlt-C2M3GAQr-9e25d55779&cv=2.1.189-1-gf2b7278&upapi=true
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=dd428baff9
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.23.194 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS: 194.23.211.130.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

via: 1.1 google
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 14 May 2026 09:33:23 GMT
vary: Origin

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 34ms
29ms Preflight
application/json 74.119.117.62
Criteo Corp.

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.mediafire.com%2F&domain=www.mediafire.com&bundle=35g9DV9qWEM4RGhoS1hpdjJ0VzZnQ2RNbVZPVlJpZ1A1dVNES0RxM0pqcU1kdWJMJTJCMndpanVuOUNnbHc3U1UlMkZZU1JiZnV3ZE9PaWJsbk0zUHRRclVNcHZNeEp3UkV5R1VzTWVhd0NlRGtQc1luV0Y0R0ZnaUxnaGY0ejUlMkY4cG90JTJGREhI&cw=1&pbt=1&lsw=1&gdpr=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.62 , United States, ASN19750 (AS-CRITEO - Criteo Corp., US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://www.mediafire.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://www.mediafire.com
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Thu, 14 May 2026 09:33:23 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 256451
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 envelope Show response
lexicon.33across.com/v1/ 1 KB
2 KB 31ms
30ms Fetch
application/json 37.19.206.161
CDN77 Datacamp Li...

General

Check archive.org

Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0010b00002MpnPqAAJ&gdpr=0&src=pbjs&ver=10.23.0&coppa=0&tp=%2BhYBVl5ec%2BQiIwefkND98YwvuhlgL5i7B81KE%2BKKda4%3D
Requested by: Host:
URL: webpack:///./src/ajax.js?
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 37.19.206.161 Ashburn, United States, ASN60068 (CDN77 Datacamp Limited, GB),
Reverse DNS: unn-37-19-206-161.datapacket.com
Software: /
Resource Hash: fb77c7aea0ddff558d0d8914f8cae4da96ba0b87292eac8bb8997c4562b6b123

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
content-type: text/plain
sec-ch-ua-mobile: ?0

Response headers

access-control-allow-origin: https://www.mediafire.com
content-length: 1528
content-type: application/json
vary: origin
access-control-allow-credentials: true

GET
H2 200 / Show response
id.a-mx.com/sync/ 66 B
467 B 88ms
87ms Fetch
application/json 156.146.43.72
CDN77 Datacamp Li...

General

Check archive.org

Download Go to

Full URL: https://id.a-mx.com/sync/?tagId=&ref=null&u=https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file&tl=https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file&nf=0&rt=true&v=10.23.0&av=2.0&vg=epbjs&us_privacy=null&am=null&gdpr=0&gdpr_consent=
Requested by: Host:
URL: webpack:///./src/ajax.js?
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 156.146.43.72 Miami, United States, ASN60068 (CDN77 Datacamp Limited, GB),
Reverse DNS: 156-146-43-72.bunnyinfra.net
Software: BunnyCDN-MI1-1212 /
Resource Hash: 96cec99c62e04eb51ee65dc72ebaff2e27985160abaf825f5592af2ce0031fd0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
content-type: text/plain
sec-ch-ua-mobile: ?0

Response headers

cdn-status: 200
date: Thu, 14 May 2026 09:33:23 GMT
cdn-cache: BYPASS
content-type: application/json
cdn-cachedat: 05/14/2026 09:33:23
cdn-requestpullcode: 200
cache-control: public, max-age=0
cdn-requestpullsuccess: True
cdn-requesttime: 0
cdn-requestid: 05e116dfd82384da58933c69d2e614ac
access-control-allow-credentials: true
cdn-pullzone: 5497800
cdn-proxyver: 1.53
access-control-allow-origin: https://www.mediafire.com
content-length: 66
cdn-edgestorageid: 1356
server: BunnyCDN-MI1-1212
cdn-requestcountrycode: CA

GET
H2 200 json Show response
gum.criteo.com/sid/ 416 B
1 KB 51ms
48ms Fetch
application/json 74.119.117.62
Criteo Corp.

General

Check archive.org

Download Go to

Full URL

Requested by

Host:
URL: webpack:///./src/ajax.js?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.62 , United States, ASN19750 (AS-CRITEO - Criteo Corp., US),

Reverse DNS

Software

Kestrel /

Resource Hash

247e4518237746ef63caccfdeb6cf7e939b40eb4137859bc372bea52ebe2a0d7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
content-type: application/json
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 773285
expires: 0
access-control-allow-origin: https://www.mediafire.com
date: Thu, 14 May 2026 09:33:22 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

GET
H2 200 pbhid Show response
id.hadron.ad.gt/api/v1/ 2 B
0 4ms
4ms Fetch
application/json 172.66.148.159
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://id.hadron.ad.gt/api/v1/pbhid?partner_id=524&_it=prebid&t=1&src=id&domain=www.mediafire.com&gdpr=0
Requested by: Host:
URL: webpack:///./src/ajax.js?
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.66.148.159 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
content-type: text/plain
sec-ch-ua-mobile: ?0

Response headers

cache-control: max-age=604800
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
access-control-allow-methods: HEAD,GET,POST,PUT,DELETE,OPTIONS
cf-ray: 9fb8e69fefcede04-YYZ
access-control-allow-origin: *
content-length: 2
date: Thu, 14 May 2026 09:33:21 GMT
content-type: application/json; charset=utf8
server: cloudflare
access-control-allow-headers: authorization,content-type

POST
H2 200 prebid Show response
id5-sync.com/api/config/ 195 B
457 B 131ms
125ms Fetch
application/json 135.125.170.98
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host:
URL: webpack:///./src/ajax.js?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

135.125.170.98 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ns31890040.ip-135-125-170.eu

Software

Resource Hash

aa8a5c4a92b78ce2c775274d190dafb720a44b4facce02c94e63f63c90c60a57

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
Content-Type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://www.mediafire.com
content-encoding: gzip
date: Thu, 14 May 2026 09:33:22 GMT
content-type: application/json;charset=UTF-8
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding
access-control-allow-credentials: true

GET
H2 204 UCookieSetPug Show response
image6.pubmatic.com/AdServer/ 0
62 B 34ms
30ms Fetch
text/html 8.28.7.81
PubMatic

General

Check archive.org

Download Go to

Full URL

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=5&p=156983&publisherId=156983&gdpr=0&gdpr_consent=&src=pbjs_uid&ver=1&coppa=0&us_privacy=&gpp=&gpp_sid=

Requested by

Host:
URL: webpack:///./src/ajax.js?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

8.28.7.81 , United States, ASN62713 (AS-PUBMATIC - PubMatic, Inc., US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400; includeSubDomains

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
content-type: text/plain
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=16070400; includeSubDomains
cache-control: no-cache, no-store, must-revalidate
access-control-allow-origin: https://www.mediafire.com
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 14 May 2026 09:33:23 GMT
content-type: text/html; charset=UTF-8
access-control-allow-credentials: true

GET
H2 200 fpc Show response
at.teads.tv/ 56 B
275 B 40ms
39ms Fetch
text/plain 151.101.194.132
Fastly

General

Check archive.org

Download Go to

Full URL

https://at.teads.tv/fpc?analytics_tag_id=PUB_13877&tfpvi=MGEzODM1OWItNDU2ZS00OTY1LWI2MDMtMzM5NGI2OTIwMjczIzctNw%3D%3D&gdpr_consent=&gdpr_status=0&gdpr_reason=0&ccpa_consent=&sv=prebid-v1

Requested by

Host:
URL: webpack:///./src/ajax.js?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.194.132 , United States, ASN54113 (FASTLY - Fastly, Inc., US),

Reverse DNS

Software

Resource Hash

cec3f4c833f0b4805febeaef70c44d4a48e700f8cbaec417f237d8a900a78a3d

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
content-type: text/plain
sec-ch-ua-mobile: ?0

Response headers

x-check-cacheable: NO
x-cache: MISS
date: Thu, 14 May 2026 09:33:23 GMT
content-type: text/plain; charset=UTF-8
x-served-by: cache-yul1970054-YUL
x-cache-hits: 0
x-u: /fpc?analytics_tag_id=PUB_13877&tfpvi=MGEzODM1OWItNDU2ZS00OTY1LWI2MDMtMzM5NGI2OTIwMjczIzctNw%3D%3D&gdpr_consent=&gdpr_status=0&gdpr_reason=0&ccpa_consent=&sv=prebid-v1
x-b: ylOjgn7Xd9Ovs8YIkDlH51--F_at_use1_teads_tv
strict-transport-security: max-age=300
vary: Accept-Encoding
cache-control: max-age=0, no-cache, no-store
x-timer: S1778751203.259674,VS0,VE16
access-control-allow-credentials: true
via: 1.1 varnish
x-ff: 86.106.90.214
accept-ranges: bytes
access-control-allow-origin: https://www.mediafire.com
content-length: 56
traffic-path: NVADC2

GET
H2 200 rid Show response
match.adsrvr.org/track/ 109 B
0 0ms
0ms Fetch
application/json 15.197.193.217
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://match.adsrvr.org/track/rid?ttd_pid=muno13d&fmt=json
Requested by: Host:
URL: webpack:///./src/ajax.js?
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 4fdef4d0781bf1700ef5095ea7f80a10fcc49a613e5be4b86e0fe9e123b8306e

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
content-type: text/plain
sec-ch-ua-mobile: ?0

Response headers

cache-control: private
content-encoding: gzip
access-control-allow-credentials: true
expires: Sat, 13 Jun 2026 09:33:21 GMT
access-control-allow-origin: https://www.mediafire.com
date: Thu, 14 May 2026 09:33:21 GMT
content-type: application/json
vary: Origin,Accept-Encoding
server: Kestrel
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept, x-integration-type

GET
H2 200 container.html Show response
409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/safeframe/1-0-45/html/ Frame D33C 7 KB
0 0ms
0ms Document
text/html 142.251.163.132
Google LLC

General

Check archive.org

Download Go to

Full URL

https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202605130101/pubads_impl.js?cb=31098551

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.132 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

wv-in-f132.1e100.net

Software

sffe /

Resource Hash

f1a68bf826c55985468304f4284a09cb8a68e82503d764166e611a7c58a85a4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.mediafire.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 3121
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 14 May 2026 09:33:21 GMT
expires: Thu, 14 May 2026 09:33:21 GMT
last-modified: Thu, 08 May 2025 23:15:48 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

OPTIONS
H3 200 lcpm
go.ezodn.com/ Frame 0
0 76ms
50ms Preflight 104.21.87.79
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://go.ezodn.com/lcpm
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.87.79 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.mediafire.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET, POST, PUT, OPTIONS
access-control-allow-origin: https://www.mediafire.com
access-control-max-age: 1728000
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 9fb8e6ad7885a2d9-YYZ
content-length: 0
date: Thu, 14 May 2026 09:33:23 GMT
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
priority: u=1,i
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=d9MndA8a5FTFij5FIwJMefC42yQENNUknSPpoCdTHXWCxP8ww6RudeuTqzYNHnmk0HZv%2FrmnTPaNkNv0GXe%2BiAKhgDQW%2FIVyurOTJ5vGgELzGPmA1xN1VH1Hh5efFN0%3D"}]}
server: cloudflare
server-timing: cfExtPri
vary: Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers

POST
H3 200 lcpm Show response
go.ezodn.com/ 45 B
469 B 57ms
54ms Fetch
application/json 104.21.87.79
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://go.ezodn.com/lcpm
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=dd428baff9
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.87.79 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: b40dceeaa34bd1ba5a6f9b2e1c883f2fd80e1ab661d1322c46bcd0fc802b8437

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
Content-Type: application/json
sec-ch-ua-mobile: ?0

Response headers

nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-cache-status: DYNAMIC
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=84ynSSAADVqMMnjt7eRji2DwSwq88wUo41jpW%2Ff%2BIEIAaVmvLwYm%2BGrBM%2BPXlO47T1GHMXOdftQlOGoNBJm%2FocgPxCvhfMzh%2BgOtbzLJMNLXW92hz4T8cXz8P%2Bb0mAk%3D"}]}
cf-ray: 9fb8e6adc888a2d9-YYZ
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
content-length: 45
server-timing: cfExtPri
date: Thu, 14 May 2026 09:33:23 GMT
content-type: application/json
vary: Accept-Encoding
server: cloudflare
priority: u=1,i

POST
H2 204 collect
analytics.google.com/g/ 0
0 71ms
68ms Fetch
text/plain 216.239.32.181
Google LLC

General

Check archive.org

Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-K68XP6D85D&gtm=45je65c0v887485693za20gzb6304663zd6304663&_p=1778751198976&_gaz=1&gcs=G111&gcd=13n3n3l3l5l1&npa=0&dma=0&tcfd=10000&_eu=AEIAAGQC&are=1&cid=1798214675.1778751200&frm=0&pscdl=noapi&rcb=2&sr=1600x1200&uaa=x86&uab=64&uafvl=Chromium%3B148.0.0.0%7CGoogle%2520Chrome%3B148.0.0.0%7CNot-A.Brand%3B24.0.0.0&uam=&uamb=0&uap=Linux&uapv=&uaw=0&ul=en-ca&gaf=2&_s=2&tag_exp=0~115938466~115938468&sid=1778751200&sct=1&seg=0&dl=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F28rrtqxs0afdpk3%2FGambonanza-v1.0.16-full-apkvision.apk%2Ffile&dt=Gambonanza-v1.0.16-full-apkvision&en=ad_impression&ep.query_id=CJKS4My8uJQDFfcFHAAdcHMnnQ&_et=3126&tfd=5148
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=dd428baff9
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 216.239.32.181 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:196:0
report-to: {"group":"ascnsrsggc:196:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:196:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.mediafire.com
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:196:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 14 May 2026 09:33:23 GMT
content-type: text/plain
server: Golfe2

GET
H3 200 ga-audiences
www.google.ca/ads/ 42 B
63 B 54ms
53ms Image
image/gif 64.233.180.94
Google LLC

General

Check archive.org

Download Go to Show image

Full URL

https://www.google.ca/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-K68XP6D85D&cid=1798214675.1778751200&gtm=45je65c0v887485693za20gzb6304663zd6304663&rcb=2&aip=1&dma=0&gcs=G111&gcd=13n3n3l3l5l1&npa=0&frm=0&tag_exp=0~115938466~115938468&z=1442451552

Protocol

Security

QUIC, , AES_128_GCM

Server

64.233.180.94 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

on-in-f94.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Thu, 14 May 2026 09:33:23 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 505 B
169 B 331ms
330ms Fetch
text/plain 192.178.155.155
Google LLC

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=6265647328545851&correlator=4051269572816901&eid=31098551&output=ldjh&gdfp_req=1&vrg=202605130101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=17&didk=46178465&dids=div-gpt-ad-mediafire_com-medre&adfs=1959198455&sfv=1-0-45&rcs=2&eri=1&sc=1&cookie=ID%3D4c907cf15727623e%3AT%3D1778751201%3ART%3D1778751201%3AS%3DALNI_MaDaZ5ZTDiSo5EJt4ZtmZyvBoaSXQ&gpic=UID%3D000013894fcd7a92%3AT%3D1778751201%3ART%3D1778751201%3AS%3DALNI_MYl5oJsAwAqe897fEVIZyg0ne9Asw&abxe=1&dt=1778751203424&lmt=1778751203&adxs=27&adys=1109&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE0OC4wLjc3NzguMTY3IixudWxsLDAsbnVsbCwiNjQiLFtbIkNocm9taXVtIiwiMTQ4LjAuMC4wIl0sWyJHb29nbGUgQ2hyb21lIiwiMTQ4LjAuMC4wIl0sWyJOb3QtQS5CcmFuZCIsIjI0LjAuMC4wIl1dLDBd&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F28rrtqxs0afdpk3%2FGambonanza-v1.0.16-full-apkvision.apk%2Ffile&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&a3p=EqsBCgpjcml0ZW8uY29tEpoBcWlrbk5WOVpVM2hOYmxSdE5UaDFORVl5ZFhWUWNGSlhjV3g2VGsxWVdIVjZTMDVPVVRsUVRUQmpObmhXTVc5SFlubExlalZuYUZOSGQxazRNMDlaZUZORlRIRndNR1J4Um1KWmMzVlRUVVpqY1hKRGJHbzFaVGhVVkdkT2FqQk5UR2hsVERCVFQyOHhaVGx4U1RCMVVTVXpSQVgBEjYKDGFkc2VydmVyLm9yZxIkNTRkYjhjY2UtZjUzMy00ZDMyLThiMmYtY2Y1MDFjNGU2Zjc5WAESNAoKcHViY2lkLm9yZxIkM2I3MTc1OWUtNDk1ZC00ZGFmLTk4ODktZmNiOGQ1NjdlY2EzWAESHAoNY3J3ZGNudHJsLm5ldBiCwdWu4jNIAFICCGQSHQoOZXNwLmNyaXRlby5jb20YgsHVruIzSABSAghkEhgKCXlhaG9vLmNvbRjkxNWu4jNIAFICCG8SPgoFb3BlbngSLGV5SnBJam9pVUVWT1RrdzVhVmhSUTBOMWJETnNXR0pEYWxsWlFUMDlJbjA9GMzF1a7iM0gAEpYCCghydGJob3VzZRKAAlNmaVZqQWlld1l6cWh4ZTNnQVhGNlZxRGFMdnVVRW9VYkNlditvOHJ3MURhSThRVVo5eEVTczQrN0FRaEd2T0pBM0N3L1JPK3hVQlEvWmhsR1lMVndEdEtuRGNDVFFVcThrOWRkUVpjRTZSd291ODkwTDZQZVlPdzBUdCtUeXIzSFA4NGY2NUxrSms2L3JSei9CQ2dCenJ0TnlBc29lRUdXYU0zYUxoalpoRHc1RXNMYkttMTV5Ky8vVUtIL3VyZldVc0lZZlJDTjFMbUpFWnZ2UVprWEhyRnZSYnc1NEc5ek43VTJ3dHpTanJYK2pMYmNZV0ZvL1pNQ0VLcUNoMHUY4MbVruIzSAA.&dlt=1778751198874&idt=2419&ppid=142e99cc7726b3a439aa50ec804b6bbe&uule=a%20cm9sZToxIHByb2R1Y2VyOjEyIGxvYzoiSDNCLENBIg%3D%3D&prev_scp=a%3D1%26iid1%3D6924024930410049%26eid%3D6924024930410049%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D1%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252F28rrtqxs0afdpk3%252FGambonanza-v1.0.16-full-apkvision.apk%252Ffile%26path%3D%252Ffile%252F28rrtqxs0afdpk3%252FGambonanza-v1.0.16-full-apkvision.apk%252Ffile%26ap%3D1100%26sap%3D1100%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D7%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-medrectangle-2%26tap%3Dmediafire_com-medrectangle-2-6924024930410049%26eb_br%3D9c3e4ee8eae7f1433cb2fe69b1326605%26eba%3D0%26bv%3D12%26bvm%3D0%26bvr%3D2%26avc%3D49%26evc%3D35%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D4%26br2%3D34%26ezoic%3D1%26nmau%3D2%26mau%3D0%26stl%3D83%2C152%2C154%2C27%2C51%2C193%2C88%2C20%2C26%2C171%2C205%2C0%2C158%2C173%2C901%2C902%2C903%26deal1%3D18%2C1428%2C2693%2C3052%2C3053%2C3856%2C4276%2C7331%2C8229%2C8290%2C8296%2C8299%2C8333%2C8334%2C8335%26osb%3DLinux%252FChrome%26dbg%3Drc%253A5%26reqt%3D1778751202769&cust_params=li-module-enabled%3Dt0&adks=1630800042&frm=20&eo_id_str=ID%3D777f7e13823df6a9%3AT%3D1778751201%3ART%3D1778751201%3AS%3DAA-AfjYoKIs1prfKFD6uebUMaLzZ&pbbce=1

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=dd428baff9

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.155.155 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

yuiadrs-in-f155.1e100.net

Software

cafe /

Resource Hash

6ca54890dd41b6c684142bea43cd60c5a77c908e4d71b0c344af74b06a3c8155

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: dcb
google-lineitem-id: -2
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 14 May 2026 09:33:23 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.mediafire.com
content-length: 139
x-xss-protection: 0
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 505 B
169 B 354ms
353ms Fetch
text/plain 192.178.155.155
Google LLC

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=6265647328545851&correlator=288137309715654&eid=31098551&output=ldjh&gdfp_req=1&vrg=202605130101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=18&didk=219167732&dids=div-gpt-ad-mediafire_com-medre&adfs=2995551083&sfv=1-0-45&rcs=2&eri=1&sc=1&cookie=ID%3D4c907cf15727623e%3AT%3D1778751201%3ART%3D1778751201%3AS%3DALNI_MaDaZ5ZTDiSo5EJt4ZtmZyvBoaSXQ&gpic=UID%3D000013894fcd7a92%3AT%3D1778751201%3ART%3D1778751201%3AS%3DALNI_MYl5oJsAwAqe897fEVIZyg0ne9Asw&abxe=1&dt=1778751203434&lmt=1778751203&adxs=795&adys=1109&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=2&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE0OC4wLjc3NzguMTY3IixudWxsLDAsbnVsbCwiNjQiLFtbIkNocm9taXVtIiwiMTQ4LjAuMC4wIl0sWyJHb29nbGUgQ2hyb21lIiwiMTQ4LjAuMC4wIl0sWyJOb3QtQS5CcmFuZCIsIjI0LjAuMC4wIl1dLDBd&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F28rrtqxs0afdpk3%2FGambonanza-v1.0.16-full-apkvision.apk%2Ffile&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&a3p=EqsBCgpjcml0ZW8uY29tEpoBcWlrbk5WOVpVM2hOYmxSdE5UaDFORVl5ZFhWUWNGSlhjV3g2VGsxWVdIVjZTMDVPVVRsUVRUQmpObmhXTVc5SFlubExlalZuYUZOSGQxazRNMDlaZUZORlRIRndNR1J4Um1KWmMzVlRUVVpqY1hKRGJHbzFaVGhVVkdkT2FqQk5UR2hsVERCVFQyOHhaVGx4U1RCMVVTVXpSQVgBEjYKDGFkc2VydmVyLm9yZxIkNTRkYjhjY2UtZjUzMy00ZDMyLThiMmYtY2Y1MDFjNGU2Zjc5WAESNAoKcHViY2lkLm9yZxIkM2I3MTc1OWUtNDk1ZC00ZGFmLTk4ODktZmNiOGQ1NjdlY2EzWAESHAoNY3J3ZGNudHJsLm5ldBiCwdWu4jNIAFICCGQSHQoOZXNwLmNyaXRlby5jb20YgsHVruIzSABSAghkEhgKCXlhaG9vLmNvbRjkxNWu4jNIAFICCG8SPgoFb3BlbngSLGV5SnBJam9pVUVWT1RrdzVhVmhSUTBOMWJETnNXR0pEYWxsWlFUMDlJbjA9GMzF1a7iM0gAEpYCCghydGJob3VzZRKAAlNmaVZqQWlld1l6cWh4ZTNnQVhGNlZxRGFMdnVVRW9VYkNlditvOHJ3MURhSThRVVo5eEVTczQrN0FRaEd2T0pBM0N3L1JPK3hVQlEvWmhsR1lMVndEdEtuRGNDVFFVcThrOWRkUVpjRTZSd291ODkwTDZQZVlPdzBUdCtUeXIzSFA4NGY2NUxrSms2L3JSei9CQ2dCenJ0TnlBc29lRUdXYU0zYUxoalpoRHc1RXNMYkttMTV5Ky8vVUtIL3VyZldVc0lZZlJDTjFMbUpFWnZ2UVprWEhyRnZSYnc1NEc5ek43VTJ3dHpTanJYK2pMYmNZV0ZvL1pNQ0VLcUNoMHUY4MbVruIzSAA.&dlt=1778751198874&idt=2419&ppid=142e99cc7726b3a439aa50ec804b6bbe&uule=a%20cm9sZToxIHByb2R1Y2VyOjEyIGxvYzoiSDNCLENBIg%3D%3D&prev_scp=a%3D1%26iid1%3D6924024930410049%26eid%3D6924024930410049%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D1%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252F28rrtqxs0afdpk3%252FGambonanza-v1.0.16-full-apkvision.apk%252Ffile%26path%3D%252Ffile%252F28rrtqxs0afdpk3%252FGambonanza-v1.0.16-full-apkvision.apk%252Ffile%26ap%3D1100%26sap%3D1100%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D8%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-medrectangle-2%26tap%3Dmediafire_com-medrectangle-2-6924024930410049%26eb_br%3D9c3e4ee8eae7f1433cb2fe69b1326605%26eba%3D0%26bv%3D12%26bvm%3D0%26bvr%3D2%26avc%3D49%26evc%3D35%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D4%26br2%3D34%26ezoic%3D1%26nmau%3D2%26mau%3D1%26stl%3D157%2C14%2C0%2C0%2C0%2C168%2C184%2C20%2C0%2C0%2C192%2C31%2C902%2C903%2C901%2C902%2C903%26deal1%3D18%2C1428%2C2693%2C3052%2C3053%2C3856%2C4276%2C7331%2C8229%2C8290%2C8296%2C8299%2C8333%2C8334%2C8335%26osb%3DLinux%252FChrome%26dbg%3Dadap%253A1%2Crc%253A6%26reqt%3D1778751202818&cust_params=li-module-enabled%3Dt0&adks=1277576459&frm=20&eo_id_str=ID%3D777f7e13823df6a9%3AT%3D1778751201%3ART%3D1778751201%3AS%3DAA-AfjYoKIs1prfKFD6uebUMaLzZ&pbbce=1

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=dd428baff9

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.155.155 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

yuiadrs-in-f155.1e100.net

Software

cafe /

Resource Hash

150d066300aa46b8f74af291442cf5b58c25691e4ecd92cb4d4eafb8d0039da6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: dcb
google-lineitem-id: -2
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 14 May 2026 09:33:23 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.mediafire.com
content-length: 139
x-xss-protection: 0
server: cafe

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame D33C 0
0 193ms
80ms Fetch
text/html 192.178.155.154
Google LLC

General

Check archive.org

Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CnQLn4pYFapKZOPeL8LAP8Oad6QnPlantgwHns7mozAzAjbcBEAEg9PnGJWD96KKB8APIAQngAgCoAwHIAwKqBOUCT9AkqdFGlZ83gcu9nQTdCxS8YXcXoht8kC_0H9WxhOQiVHeQ1q211WOLnFSjU-V-lee8EtzRyHfE5HMqRFKuSRNMHlu5rU-fdcqXYKzVc9hbxPRicOQPnOpIoy6BlHejyk8a02UWfdRdXd_JCDoOWWzPJh3HhU7G7MLY-XyOZSWinz1VeMOCLO5pvfuZa26mEQHiqbkiGWWSx7zzedUL8fayFUDMPGOJPkS23aJOqCAvPj9ZAlU285gV1Z2_m4TgOZOQiNvjlLPCMbxFLOZKHHHE1KXKKS9KA8qRBxf5vi9uJlCEa-wPArWc9d6-4OuJYj9EUAM1_rUnP7azcKEno8LrakbDL9GMHfX1n0z0EfmtTFUhuKmqmkIZq2vOSsD-5mcBsia6EtGjZWSx1o6s2caWYXbJpkRsxpDXi2l6mQXmskyslW3ZCm4vGXBd7zqdUJgCo0eGHBXBrr--LnqD6QDXl3zD4AQBgAazuuS9pdr733GgBiGoB5PYsQKoB5TYsQKoB5XYsQKoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7ECqAetvrEC2AcA0gguCIBhEAEyCIqCgICAgIAIOg-AQIDAgICAgKiAAqiDgBBIvf3BOljIx9vMvLiUA4AKA_oLAggBgAwBqg0CQ0HiDRMIlvvbzLy4lAMV9wUcAB1wcyed6g0TCLv83My8uJQDFfcFHAAdcHMnnYgO____________AdAVAYAXAbIXLAoaEhRwdWItNjM5Njg0NDc0MjQ5NzIwOBi-yQcYDCoKMzM0NTM4Mzc3NFABqhgXCQEAAAAGahhBEgozMzQ1MzgzNzc0GAE&sigh=-Fn02YvdjSQ&uach_m=%5BUACH%5D&sreq=1&cid=CAQS4gEABaugfUTQsMDn0Y_RCOm-SpPdTh5GMI5ai8gk1Z1yuTW4k3SyOnLLs8xkFCGQATvuQ2JzNvp6fKmMAN4xSV2hGTuZAXL5hszrkmFYV7R1yPrCtm4CrX5xFiAX0-diK_76GyWjJbVeNywraXHMyW7MaRqPbfhNSBoA-oYCNqkl0Xv8WoLVfhZAJK3g2byyjg0SlDbyiTHssZyK0imktHq9A7JqLHox9Dg9g_2j9X4LYfpMnDCnh8k47MfD_cWldw44_c5RgeBWs3AKsOHbctIQN3_eNrHdZC3uI6O6DE-okdngGAE
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 192.178.155.154 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: yuiadrs-in-f154.1e100.net
Software: /
Resource Hash

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

GET
H2 200 impression Show response
bid.2trk.info/ Frame D33C 43 B
472 B 185ms
124ms Fetch
image/gif 172.67.68.154
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://bid.2trk.info/impression?v3ImpParams=H4sIAAAAAAAA_31TbW_aMBD-K1GlSq2ozfk1NvtEadetL4wV1pd9QQaSNU0gaUgAIf_4XdJ-aLdpupz9-FHuzj4_PtCeafAawA_6Qw-t3eSrqoxcdjLok-8DT5hX0mophRVGGmWVtqYNAyrQQTNjwYQm9MIPPWtH5XWLZRM-bKFpmKKeES2sNlKGkksbcjCeq7fKjQ1bl17LUAtf5Ovp9tlN6zVWUp6JkFqQmI2B4BrzgxKMSpw8O4GP5q3nwDUBRZh8DQ9xl4ohi4W9DKdtESJIcxoG0EPHgUIPjf7hvuHfOXbsfHx-UT6ml-yeFZvTHw-nc57m39TU-Mm4s-gUi12n6iw2CAWC8QQBV5260yx-4gLLIjz92kAGxmjcllUWubOG-7vtGHs2Hl0_YofCUMgZKEWEcIxIZTmZhS4mPBI2jhzEds7xt5t8n2SZ6yoKwdEDY5-C62RV74Kd0Xj646BfFFl0H82ukqqrsLtCB0dXXyY31ydBlqRRcBHN0_w4GDyV-TLqMmkoNBaMXezK5C3Ej_e_JrW4vd29XA3S_fPdaDM6f9miEp6qqlgfiv4h_4zfdruly2iRuDgpIzrPl8jFSRbhxE1ZVi-7Nbh4UaQCmQu3nOUrt9o7ssF2U6ZJXGcZcUW6SdZJvqKI3hK0yqnKOmpuEVq5oXOcXkX1T9m9b_l_L7PVb5NX0FA1ivdMdkF1G3UFYHuM91B_Qz-9Gw3aRzFs1fbhpCh_ykCjeilHNWLKg99RaS0HfQMAAA&price=agWW4gAODJIAHAX3ACdzcHTob1_pi71zlTC6iQ&bs=7734b055-33a1-4592-b7af-2e39fea0f9c2
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.68.154 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=DG03CzC%2BuexE1Cp%2Bo%2FahNN9SsZmx%2BPnfZCo3VCQHaalFENJOyhU6BpOYrFZzPaH%2Fqb%2BTveRXYQBsLMmmLNcp03xBxdjNHUS0uWkMZYvk5g%2B2X%2FkLEp1HPu9tnK%2Fesr0%3D"}]}
via: 1.1 google
cf-ray: 9fb8e6ae0aa736d7-YYZ
content-length: 43
date: Thu, 14 May 2026 09:33:23 GMT
content-type: image/gif
server: cloudflare

GET
H2 200 rtgban Show response
ban.jackery.com/ Frame 4CAA 3 KB
5 KB 142ms
61ms Document
text/html 35.190.34.69
Google LLC

General

Check archive.org

Download Go to

Full URL

https://ban.jackery.com/rtgban?bannerparamv1=size=160::cmpId=64763::bmpclickURL=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCS8JR4pYFapKZOPeL8LAP8Oad6QnPlantgwHns7mozAzAjbcBEAEg9PnGJWD96KKB8APIAQngAgCoAwHIAwKqBOgCT9AkqdFGlZ83gcu9nQTdCxS8YXcXoht8kC_0H9WxhOQiVHeQ1q211WOLnFSjU-V-lee8EtzRyHfE5HMqRFKuSRNMHlu5rU-fdcqXYKzVc9hbxPRicOQPnOpIoy6BlHejyk8a02UWfdRdXd_JCDoOWWzPJh3HhU7G7MLY-XyOZSWinz1VeMOCLO5pvfuZa26mEQHiqbkiGWWSx7zzedUL8fayFUDMPGOJPkS23aJOqCAvPj9ZAlU285gV1Z2_m4TgOZOQiNvjlLPCMbxFLOZKHHHE1KXKKS9KA8qRBxf5vi9uJlCEa-wPArWc9d6-4OuJYj9EUAM1_rUnP7azcKEno8LrakbDL9GMHfX1n0z0EfmtTFUhuKmqmkIZq2vOSsD-5mcBsia6EtGjZWSx1o6s2caWYXbJpkRsxpDXi2l6mUfkk95wJ9iqg9sApsgFfKqOZpLLqWmenrZh9iwk9Eav8d5AOg9KbrEV4AQBgAazuuS9pdr733GgBiGoB5PYsQKoB5TYsQKoB5XYsQKoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7ECqAetvrECqAe_07EC2AcA0gguCIBhEAEyCIqCgICAgIAIOg-AQIDAgICAgKiAAqiDgBBIvf3BOljIx9vMvLiUA_oLAggBgAwBqg0CQ0HiDRMIlvvbzLy4lAMV9wUcAB1wcyed6g0TCLv83My8uJQDFfcFHAAdcHMnnYgO____________AdAVAYAXAbIXEBgMKgozMzQ1MzgzNzc0UAGqGBcJAQAAAAZqGEESCjMzNDUzODM3NzQYAQ%26num%3D1%26sig%3DAOD64_17ao8IIbxS2oWrOWbBft5CRZXXqw%26client%3Dca-pub-6396844742497208%26adurl%3Dhttps%3A%2F%2Fban.jackery.com%2Fclick%3FrequiredParamsv1%3DH4sIAAAAAAAA_31TbW_aMBD-K1GlSq2ozfk1NvtEadetL4wV1pd9QQaSNU0gaUgAIf_4XdJ-aLdpupz9-FHuzj4_PtCeafAawA_6Qw-t3eSrqoxcdjLok-8DT5hX0mophRVGGmWVtqYNAyrQQTNjwYQm9MIPPWtH5XWLZRM-bKFpmKKeES2sNlKGkksbcjCeq7fKjQ1bl17LUAtf5Ovp9tlN6zVWUp6JkFqQmI2B4BrzgxKMSpw8O4GP5q3nwDUBRZh8DQ9xl4ohi4W9DKdtESJIcxoG0EPHgUIPjf7hvuHfOXbsfHx-UT6ml-yeFZvTHw-nc57m39TU-Mm4s-gUi12n6iw2CAWC8QQBV5260yx-4gLLIjz92kAGxmjcllUWubOG-7vtGHs2Hl0_YofCUMgZKEWEcIxIZTmZhS4mPBI2jhzEds7xt5t8n2SZ6yoKwdEDY5-C62RV74Kd0Xj646BfFFl0H82ukqqrsLtCB0dXXyY31ydBlqRRcBHN0_w4GDyV-TLqMmkoNBaMXezK5C3Ej_e_JrW4vd29XA3S_fPdaDM6f9miEp6qqlgfiv4h_4zfdruly2iRuDgpIzrPl8jFSRbhxE1ZVi-7Nbh4UaQCmQu3nOUrt9o7ssF2U6ZJXGcZcUW6SdZJvqKI3hK0yqnKOmpuEVq5oXOcXkX1T9m9b_l_L7PVb5NX0FA1ivdMdkF1G3UFYHuM91B_Qz-9Gw3aRzFs1fbhpCh_ykCjeilHNWLKg99RaS0HfQMAAA%253Bdurl155%3D::bamt=agWW4gAODJIAHAX3ACdzcHTob1_pi71zlTC6iQ::mode=4::label=::ul15=

Requested by

Host: 409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com
URL: https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.190.34.69 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),

Reverse DNS

69.34.190.35.bc.googleusercontent.com

Software

Resource Hash

ee42952553dceadfd93352659c897004635efb6e3a051affa8f723902e61d9f7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

alt-svc: h3=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 3414
content-type: text/html;charset=UTF-8
date: Thu, 14 May 2026 09:33:23 GMT
expires: 0
pragma: no-cache
referrer-policy: unsafe-url
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
via: 1.1 google
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20260513/r20110914/client/ Frame D33C 3 KB
1 KB 126ms
41ms Script
text/javascript 142.251.167.132
Google LLC

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20260513/r20110914/client/window_focus_fy2021.js

Requested by

Host: 409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com
URL: https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.167.132 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

ww-in-f132.1e100.net

Software

cafe /

Resource Hash

8b925b4e5891d39f0ce66a499c87d39286e308916e3ad36dcd22b7548079d30f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
etag: 7208902950285533371
age: 2609
x-content-type-options: nosniff
expires: Thu, 28 May 2026 08:49:54 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 14 May 2026 08:49:54 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 1227
x-xss-protection: 0
server: cafe

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame B65D 1 KB
837 B 41ms
40ms Document
text/html 142.251.167.157
Google LLC

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com
URL: https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.157 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

ww-in-f157.1e100.net

Software

cafe /

Resource Hash

bea1c5ab168f662fc9eb5bda3474e5b1bbd0d3ecc1d9c68e2a753f613c2ae0c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

age: 23616
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 812
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 14 May 2026 02:59:47 GMT
etag: 9725182468138058862
expires: Fri, 15 May 2026 02:59:47 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20260513/r20110914/client/ Frame D33C 20 KB
9 KB 120ms
37ms Script
text/javascript 142.251.167.132
Google LLC

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20260513/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com
URL: https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.167.132 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

ww-in-f132.1e100.net

Software

cafe /

Resource Hash

72869ba28dbe7dfde1cac4d1bd0ea84e491738e0fd578232aaaf90c693095b6c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
etag: 11196190604902853639
age: 2979
x-content-type-options: nosniff
expires: Thu, 28 May 2026 08:43:44 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 14 May 2026 08:43:44 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 8623
x-xss-protection: 0
server: cafe

GET l
www.google.com/ads/measurement/ Frame D33C 0
0

GET
H2 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-45/js/ Frame D33C 23 KB
6 KB 126ms
44ms Script
text/javascript 142.251.167.132
Google LLC

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-45/js/ext.js

Requested by

Host: 409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com
URL: https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.167.132 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

ww-in-f132.1e100.net

Software

sffe /

Resource Hash

4c95e84767aed248594e7d485707c7ed904fd2fe4ec3ea98687fc2de59ddf231

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
x-content-type-options: nosniff
expires: Thu, 14 May 2026 09:33:23 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 14 May 2026 09:33:23 GMT
content-type: text/javascript
vary: Accept-Encoding
last-modified: Thu, 08 May 2025 23:15:48 GMT
cache-control: private, max-age=300
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
content-length: 6269
x-xss-protection: 0
server: sffe

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame D33C 238 KB
73 KB 42ms
38ms Script
text/javascript 142.251.167.157
Google LLC

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: 409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com
URL: https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.157 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

ww-in-f157.1e100.net

Software

cafe /

Resource Hash

05c031fcdb94d1b3a011bbd713d70122286841a6ecd3e4a6c480077c139792de

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
etag: 17047940826023111822
age: 824
x-content-type-options: nosniff
expires: Thu, 14 May 2026 10:19:39 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 14 May 2026 09:19:39 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 74908
x-xss-protection: 0
server: cafe

POST v3
id5-sync.com/gm/ 0
0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 499 B
156 B 233ms
232ms Fetch
text/plain 192.178.155.155
Google LLC

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=6265647328545851&correlator=685015901328087&eid=31098551&output=ldjh&gdfp_req=1&vrg=202605130101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-banner-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=19&didk=417644066&dids=div-gpt-ad-mediafire_com-banne&adfs=4128408292&sfv=1-0-45&rcs=2&eri=1&sc=1&cookie=ID%3D4c907cf15727623e%3AT%3D1778751201%3ART%3D1778751201%3AS%3DALNI_MaDaZ5ZTDiSo5EJt4ZtmZyvBoaSXQ&gpic=UID%3D000013894fcd7a92%3AT%3D1778751201%3ART%3D1778751201%3AS%3DALNI_MYl5oJsAwAqe897fEVIZyg0ne9Asw&abxe=1&dt=1778751203511&lmt=1778751203&adxs=436&adys=1410&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=3&ucis=3&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE0OC4wLjc3NzguMTY3IixudWxsLDAsbnVsbCwiNjQiLFtbIkNocm9taXVtIiwiMTQ4LjAuMC4wIl0sWyJHb29nbGUgQ2hyb21lIiwiMTQ4LjAuMC4wIl0sWyJOb3QtQS5CcmFuZCIsIjI0LjAuMC4wIl1dLDBd&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F28rrtqxs0afdpk3%2FGambonanza-v1.0.16-full-apkvision.apk%2Ffile&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&a3p=EqsBCgpjcml0ZW8uY29tEpoBcWlrbk5WOVpVM2hOYmxSdE5UaDFORVl5ZFhWUWNGSlhjV3g2VGsxWVdIVjZTMDVPVVRsUVRUQmpObmhXTVc5SFlubExlalZuYUZOSGQxazRNMDlaZUZORlRIRndNR1J4Um1KWmMzVlRUVVpqY1hKRGJHbzFaVGhVVkdkT2FqQk5UR2hsVERCVFQyOHhaVGx4U1RCMVVTVXpSQVgBEjYKDGFkc2VydmVyLm9yZxIkNTRkYjhjY2UtZjUzMy00ZDMyLThiMmYtY2Y1MDFjNGU2Zjc5WAESNAoKcHViY2lkLm9yZxIkM2I3MTc1OWUtNDk1ZC00ZGFmLTk4ODktZmNiOGQ1NjdlY2EzWAESHAoNY3J3ZGNudHJsLm5ldBiCwdWu4jNIAFICCGQSHQoOZXNwLmNyaXRlby5jb20YgsHVruIzSABSAghkEhgKCXlhaG9vLmNvbRjkxNWu4jNIAFICCG8SPgoFb3BlbngSLGV5SnBJam9pVUVWT1RrdzVhVmhSUTBOMWJETnNXR0pEYWxsWlFUMDlJbjA9GMzF1a7iM0gAEpYCCghydGJob3VzZRKAAlNmaVZqQWlld1l6cWh4ZTNnQVhGNlZxRGFMdnVVRW9VYkNlditvOHJ3MURhSThRVVo5eEVTczQrN0FRaEd2T0pBM0N3L1JPK3hVQlEvWmhsR1lMVndEdEtuRGNDVFFVcThrOWRkUVpjRTZSd291ODkwTDZQZVlPdzBUdCtUeXIzSFA4NGY2NUxrSms2L3JSei9CQ2dCenJ0TnlBc29lRUdXYU0zYUxoalpoRHc1RXNMYkttMTV5Ky8vVUtIL3VyZldVc0lZZlJDTjFMbUpFWnZ2UVprWEhyRnZSYnc1NEc5ek43VTJ3dHpTanJYK2pMYmNZV0ZvL1pNQ0VLcUNoMHUY4MbVruIzSAA.&dlt=1778751198874&idt=2419&ppid=142e99cc7726b3a439aa50ec804b6bbe&uule=a%20cm9sZToxIHByb2R1Y2VyOjEyIGxvYzoiSDNCLENBIg%3D%3D&prev_scp=a%3D1%26iid1%3D7145616782351968%26eid%3D7145616782351968%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D1%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252F28rrtqxs0afdpk3%252FGambonanza-v1.0.16-full-apkvision.apk%252Ffile%26path%3D%252Ffile%252F28rrtqxs0afdpk3%252FGambonanza-v1.0.16-full-apkvision.apk%252Ffile%26ap%3D1107%26sap%3D1107%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D9%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D30%26al%3D1030%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-banner-1%26tap%3Dmediafire_com-banner-1-7145616782351968%26eb_br%3Dzero%26eba%3D0%26bv%3D11%26bvm%3D0%26bvr%3D1%26avc%3D36%26evc%3D27%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D0%26br2%3D26%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D78%2C193%2C0%2C0%2C0%2C131%2C132%2C0%2C0%2C0%2C187%2C0%2C901%2C182%2C901%2C902%2C903%26deal1%3D18%2C1428%2C2693%2C3052%2C3053%2C3856%2C7331%2C8229%2C8333%2C8334%2C8335%26osb%3DLinux%252FChrome%26dbg%3Drc%253A1%26reqt%3D1778751202866&cust_params=li-module-enabled%3Dt0&adks=3665333008&frm=20&eo_id_str=ID%3D777f7e13823df6a9%3AT%3D1778751201%3ART%3D1778751201%3AS%3DAA-AfjYoKIs1prfKFD6uebUMaLzZ&pbbce=1

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=dd428baff9

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.155.155 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

yuiadrs-in-f155.1e100.net

Software

cafe /

Resource Hash

6e7698ae74315d2d24f5d21d8b11fb84ad157e0e760dec622cdb3369ea819b2b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: dcb
google-lineitem-id: -2
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 14 May 2026 09:33:23 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.mediafire.com
content-length: 126
x-xss-protection: 0
server: cafe

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B65D
Redirect Chain

https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEJikFPI0tJ4BT2fhJ0UiZhA&google_cver=1&google_push=AXcoOmQCTKlZDZxyzDvaEcWtqoXIBcNqb2LWavNueml4NQjZDMmZtdF...
https://dclk-match.dotomi.com/match/bounce/current?DotomiTest=cb2d2b14821205&is_secure=true&networkId=14000&version=1&google_gid=CAESEJikFPI0tJ4BT2fhJ0UiZhA&google_cver=1&google_push=AXcoOmQCTKlZDZ...
https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AQAH4HZRddSUcQJ8ZgseAQEBAQEBAQCfJNRoxQEBAJ8k1GjF&expiration=1778837603&google_cver=1&is_secure=true&google_gid=CAES...

170 B
188 B

49ms
48ms

Image
image/png

142.251.111.155
Google LLC

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AQAH4HZRddSUcQJ8ZgseAQEBAQEBAQCfJNRoxQEBAJ8k1GjF&expiration=1778837603&google_cver=1&is_secure=true&google_gid=CAESEJikFPI0tJ4BT2fhJ0UiZhA&google_push=AXcoOmQCTKlZDZxyzDvaEcWtqoXIBcNqb2LWavNueml4NQjZDMmZtdFrNEvc9IDwy8N1FdW5_Qni836p1ID1Q2Rs-5iSt-731Y1Q

Requested by

Host: 409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com
URL: https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Server

142.251.111.155 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

bk-in-f155.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 14 May 2026 09:33:23 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

expires: 0
cache-control: no-cache, private, max-age=0, no-store
location: https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AQAH4HZRddSUcQJ8ZgseAQEBAQEBAQCfJNRoxQEBAJ8k1GjF&expiration=1778837603&google_cver=1&is_secure=true&google_gid=CAESEJikFPI0tJ4BT2fhJ0UiZhA&google_push=AXcoOmQCTKlZDZxyzDvaEcWtqoXIBcNqb2LWavNueml4NQjZDMmZtdFrNEvc9IDwy8N1FdW5_Qni836p1ID1Q2Rs-5iSt-731Y1Q
content-length: 0
date: Thu, 14 May 2026 09:33:23 GMT
pragma: no-cache
server: nginx

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B65D
Redirect Chain

https://a.c.appier.net/gcm?google_gid=CAESEONEhbZtuvtFMB1Rbk-dPMc&google_cver=1&google_push=AXcoOmQUunc5FlcXeB1t3h-GPbzkaQG8O_xss3tGqhu398sltseRRX7qoa2jfnfOMnUX66AuRMGY4hJlRKRTz-9OGxvU_51ywp8z
https://cm.g.doubleclick.net/pixel?google_hm=RnRZMWduZnhDdlc5ZzlxQTVaWUZhZw%3D%3D&google_nid=appier&google_push=AXcoOmQUunc5FlcXeB1t3h-GPbzkaQG8O_xss3tGqhu398sltseRRX7qoa2jfnfOMnUX66AuRMGY4hJlRKRTz...

170 B
188 B

57ms
57ms

Image
image/png

142.251.111.155
Google LLC

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_hm=RnRZMWduZnhDdlc5ZzlxQTVaWUZhZw%3D%3D&google_nid=appier&google_push=AXcoOmQUunc5FlcXeB1t3h-GPbzkaQG8O_xss3tGqhu398sltseRRX7qoa2jfnfOMnUX66AuRMGY4hJlRKRTz-9OGxvU_51ywp8z

Protocol

Server

142.251.111.155 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

bk-in-f155.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 14 May 2026 09:33:25 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

Cache-Control: no-store
Location: https://cm.g.doubleclick.net/pixel?google_hm=RnRZMWduZnhDdlc5ZzlxQTVaWUZhZw%3D%3D&google_nid=appier&google_push=AXcoOmQUunc5FlcXeB1t3h-GPbzkaQG8O_xss3tGqhu398sltseRRX7qoa2jfnfOMnUX66AuRMGY4hJlRKRTz-9OGxvU_51ywp8z
Accept-Ch: Sec-CH-UA-Model,Sec-CH-UA-Platform-Version
Connection: keep-alive
Content-Length: 0
P3p: CP="CUR ADM DEV TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Date: Thu, 14 May 2026 09:33:25 GMT
Server: nginx

GET cms
ups.analytics.yahoo.com/ups/58933/ Frame B65D 0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B65D
Redirect Chain

https://dis.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DAXcoOmQEqY...
https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_hm=ay1sMnEtbWxsb0J3bnBoUC1jTVhfZHhCTDVaWG9iLWhtNWtERlpxQQ&google_push=AXcoOmQEqYgIiTmp3KqWpU5j-0Ha8IJTgbHP8BDOLog9P_D8OVfEx-MgEFj2stDH5IkSh6...

170 B
188 B

51ms
51ms

Image
image/png

142.251.111.155
Google LLC

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_hm=ay1sMnEtbWxsb0J3bnBoUC1jTVhfZHhCTDVaWG9iLWhtNWtERlpxQQ&google_push=AXcoOmQEqYgIiTmp3KqWpU5j-0Ha8IJTgbHP8BDOLog9P_D8OVfEx-MgEFj2stDH5IkSh6iqCoPGdtXfFUNehV8ty5DCw_3421I

Requested by

Host: 409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com
URL: https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Server

142.251.111.155 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

bk-in-f155.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 14 May 2026 09:33:23 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache
location: https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_hm=ay1sMnEtbWxsb0J3bnBoUC1jTVhfZHhCTDVaWG9iLWhtNWtERlpxQQ&google_push=AXcoOmQEqYgIiTmp3KqWpU5j-0Ha8IJTgbHP8BDOLog9P_D8OVfEx-MgEFj2stDH5IkSh6iqCoPGdtXfFUNehV8ty5DCw_3421I
x-criteo-endpoint-version: none
pragma: no-cache
api-supported-versions: 1.0
cross-origin-resource-policy: cross-origin
expires: Thu, 14 May 2026 00:00:00 GMT
x-criteo-endpoint-controller: UserSync
x-errorlevel: 0
x-criteo-endpoint-action: UserSync
content-length: 0
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
date: Thu, 14 May 2026 09:33:23 GMT
server: Kestrel

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B65D
Redirect Chain

https://b1sync.outbrain.com/usersync/googleadx/?google_gid=CAESEFEffKH-xuGSRpAG7neB7yQ&google_cver=1&google_push=AXcoOmSCVSz3rcJTOUtIPnuwwoGQY9h868UFKR_xsg3qvc_Y-d4UmhCg_6cj3pvh44Jxenm4rHSvNnL2My4o...
https://b1sync.outbrain.com/usersync/googleadx/?google_cver=1&google_gid=CAESEFEffKH-xuGSRpAG7neB7yQ&google_push=AXcoOmSCVSz3rcJTOUtIPnuwwoGQY9h868UFKR_xsg3qvc_Y-d4UmhCg_6cj3pvh44Jxenm4rHSvNnL2My4o...
https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AXcoOmSCVSz3rcJTOUtIPnuwwoGQY9h868UFKR_xsg3qvc_Y-d4UmhCg_6cj3pvh44Jxenm4rHSvNnL2My4oSRuvj5B-0KMNsmAw&google_hm=MTkyZjBiN2UtZjI5Mi00...

170 B
188 B

50ms
50ms

Image
image/png

142.251.111.155
Google LLC

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AXcoOmSCVSz3rcJTOUtIPnuwwoGQY9h868UFKR_xsg3qvc_Y-d4UmhCg_6cj3pvh44Jxenm4rHSvNnL2My4oSRuvj5B-0KMNsmAw&google_hm=MTkyZjBiN2UtZjI5Mi00N2M2LTlhMDAtODMzOTAzYjIxYzdk

Protocol

Server

142.251.111.155 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

bk-in-f155.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 14 May 2026 09:33:24 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, no-store, must-revalidate
location: https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AXcoOmSCVSz3rcJTOUtIPnuwwoGQY9h868UFKR_xsg3qvc_Y-d4UmhCg_6cj3pvh44Jxenm4rHSvNnL2My4oSRuvj5B-0KMNsmAw&google_hm=MTkyZjBiN2UtZjI5Mi00N2M2LTlhMDAtODMzOTAzYjIxYzdk
pragma: no-cache
expires: Thu, 01 Dec 1994 16:00:00 GMT
p3p: CP="We do not support P3P header."
content-length: 256
date: Thu, 14 May 2026 09:33:24 GMT
content-type: text/html; charset=utf-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B65D
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=google&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3D%5BRX_SPD%5D%26google_hm%3D%5BRX_UUID_B64_BIN%5D&google_gid=CAESEA...
https://sync.1rx.io/usersync2/rmpssp?sub=google&zcc=1&google_push=AXcoOmSBndEsvLrCfVU_s_GITxUmlP3Y3QCS_3NVlXMNXayQ6_6NvTw7zKgdJio3nk-NVKi3y80vn3s6Zv9OBeUrl9RilYDFVpEV&redir=https%3A%2F%2Fcm.g.doubl...
https://sync.targeting.unrulymedia.com/csync/RX-887cccaf-2990-4ba0-a4b3-657242c1e091-005?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3DAXcoOmSBndEsvLrCfVU_s_GIT...
https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AXcoOmSBndEsvLrCfVU_s_GITxUmlP3Y3QCS_3NVlXMNXayQ6_6NvTw7zKgdJio3nk-NVKi3y80vn3s6Zv9OBeUrl9RilYDFVpEV&google_hm=BYh8zK8pkEugpLNlckLB4JE

170 B
188 B

51ms
50ms

Image
image/png

142.251.111.155
Google LLC

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AXcoOmSBndEsvLrCfVU_s_GITxUmlP3Y3QCS_3NVlXMNXayQ6_6NvTw7zKgdJio3nk-NVKi3y80vn3s6Zv9OBeUrl9RilYDFVpEV&google_hm=BYh8zK8pkEugpLNlckLB4JE

Protocol

Server

142.251.111.155 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

bk-in-f155.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 14 May 2026 09:33:24 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AXcoOmSBndEsvLrCfVU_s_GITxUmlP3Y3QCS_3NVlXMNXayQ6_6NvTw7zKgdJio3nk-NVKi3y80vn3s6Zv9OBeUrl9RilYDFVpEV&google_hm=BYh8zK8pkEugpLNlckLB4JE
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
date: Thu, 14 May 2026 09:33:23 GMT
etag: RX887cccaf29904ba0a4b3657242c1e091005
content-type: text/html

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B65D
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&google_gid=CAESEJhWOR95tPRISSR_KmTdo_o&google_cver=1&google_push=AXcoOmQMMnHzU79MQ_63kEM-mhGWZzqbNLHgqp8naO227JC9jRbeLhca5AsrPCF7YOMrc-DFVv37vdD-QYZoj6NaLK5ydS5BusD7
https://eb2.3lift.com/ebda?sync=1&google_gid=CAESEJhWOR95tPRISSR_KmTdo_o&google_cver=1&google_push=AXcoOmQMMnHzU79MQ_63kEM-mhGWZzqbNLHgqp8naO227JC9jRbeLhca5AsrPCF7YOMrc-DFVv37vdD-QYZoj6NaLK5ydS5Bus...
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_push=AXcoOmQMMnHzU79MQ_63kEM-mhGWZzqbNLHgqp8naO227JC9jRbeLhca5AsrPCF7YOMrc-DFVv37vdD-QYZoj6NaLK5ydS5BusD7&go...

170 B
188 B

50ms
50ms

Image
image/png

142.251.111.155
Google LLC

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_push=AXcoOmQMMnHzU79MQ_63kEM-mhGWZzqbNLHgqp8naO227JC9jRbeLhca5AsrPCF7YOMrc-DFVv37vdD-QYZoj6NaLK5ydS5BusD7&google_hm=MjE2MzkyOTA5NzI4NDkyNjc2MDgyNg%3D%3D

Requested by

Host: 409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com
URL: https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Server

142.251.111.155 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

bk-in-f155.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 14 May 2026 09:33:23 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

date: Thu, 14 May 2026 09:33:23 GMT
location: https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_push=AXcoOmQMMnHzU79MQ_63kEM-mhGWZzqbNLHgqp8naO227JC9jRbeLhca5AsrPCF7YOMrc-DFVv37vdD-QYZoj6NaLK5ydS5BusD7&google_hm=MjE2MzkyOTA5NzI4NDkyNjc2MDgyNg%3D%3D
content-length: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame B65D 0
12 B 49ms
48ms Image
text/html 142.251.111.155
Google LLC

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13L_Jo5OR2nuK4nHtgkiMtRza6uHk3EPFOBQKFO57EvHuOW7uoz5hFOV5Jnax6vbuyWWhvR5

Requested by

Host: 409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com
URL: https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.155 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

bk-in-f155.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Thu, 14 May 2026 09:33:23 GMT
x-xss-protection: 0
content-type: text/html
server: HTTP server (unknown)

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 496 B
161 B 266ms
265ms Fetch
text/plain 192.178.155.155
Google LLC

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=6265647328545851&correlator=2904411965008754&eid=31098551&output=ldjh&gdfp_req=1&vrg=202605130101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=20&didk=1697938527&dids=div-gpt-ad-mediafire_com-box-2&adfs=2211965457&sfv=1-0-45&rcs=2&eri=1&sc=1&cookie=ID%3D4c907cf15727623e%3AT%3D1778751201%3ART%3D1778751201%3AS%3DALNI_MaDaZ5ZTDiSo5EJt4ZtmZyvBoaSXQ&gpic=UID%3D000013894fcd7a92%3AT%3D1778751201%3ART%3D1778751201%3AS%3DALNI_MYl5oJsAwAqe897fEVIZyg0ne9Asw&abxe=1&dt=1778751203520&lmt=1778751203&adxs=552&adys=10&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=4&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE0OC4wLjc3NzguMTY3IixudWxsLDAsbnVsbCwiNjQiLFtbIkNocm9taXVtIiwiMTQ4LjAuMC4wIl0sWyJHb29nbGUgQ2hyb21lIiwiMTQ4LjAuMC4wIl0sWyJOb3QtQS5CcmFuZCIsIjI0LjAuMC4wIl1dLDBd&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F28rrtqxs0afdpk3%2FGambonanza-v1.0.16-full-apkvision.apk%2Ffile&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&a3p=EqsBCgpjcml0ZW8uY29tEpoBcWlrbk5WOVpVM2hOYmxSdE5UaDFORVl5ZFhWUWNGSlhjV3g2VGsxWVdIVjZTMDVPVVRsUVRUQmpObmhXTVc5SFlubExlalZuYUZOSGQxazRNMDlaZUZORlRIRndNR1J4Um1KWmMzVlRUVVpqY1hKRGJHbzFaVGhVVkdkT2FqQk5UR2hsVERCVFQyOHhaVGx4U1RCMVVTVXpSQVgBEjYKDGFkc2VydmVyLm9yZxIkNTRkYjhjY2UtZjUzMy00ZDMyLThiMmYtY2Y1MDFjNGU2Zjc5WAESNAoKcHViY2lkLm9yZxIkM2I3MTc1OWUtNDk1ZC00ZGFmLTk4ODktZmNiOGQ1NjdlY2EzWAESHAoNY3J3ZGNudHJsLm5ldBiCwdWu4jNIAFICCGQSHQoOZXNwLmNyaXRlby5jb20YgsHVruIzSABSAghkEhgKCXlhaG9vLmNvbRjkxNWu4jNIAFICCG8SPgoFb3BlbngSLGV5SnBJam9pVUVWT1RrdzVhVmhSUTBOMWJETnNXR0pEYWxsWlFUMDlJbjA9GMzF1a7iM0gAEpYCCghydGJob3VzZRKAAlNmaVZqQWlld1l6cWh4ZTNnQVhGNlZxRGFMdnVVRW9VYkNlditvOHJ3MURhSThRVVo5eEVTczQrN0FRaEd2T0pBM0N3L1JPK3hVQlEvWmhsR1lMVndEdEtuRGNDVFFVcThrOWRkUVpjRTZSd291ODkwTDZQZVlPdzBUdCtUeXIzSFA4NGY2NUxrSms2L3JSei9CQ2dCenJ0TnlBc29lRUdXYU0zYUxoalpoRHc1RXNMYkttMTV5Ky8vVUtIL3VyZldVc0lZZlJDTjFMbUpFWnZ2UVprWEhyRnZSYnc1NEc5ek43VTJ3dHpTanJYK2pMYmNZV0ZvL1pNQ0VLcUNoMHUY4MbVruIzSAA.&dlt=1778751198874&idt=2419&ppid=142e99cc7726b3a439aa50ec804b6bbe&uule=a%20cm9sZToxIHByb2R1Y2VyOjEyIGxvYzoiSDNCLENBIg%3D%3D&prev_scp=a%3D1%26iid1%3D8206134848363251%26eid%3D8206134848363251%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D1%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252F28rrtqxs0afdpk3%252FGambonanza-v1.0.16-full-apkvision.apk%252Ffile%26path%3D%252Ffile%252F28rrtqxs0afdpk3%252FGambonanza-v1.0.16-full-apkvision.apk%252Ffile%26ap%3D1103%26sap%3D1103%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-box-2%26tap%3Dmediafire_com-box-2-8206134848363251%26eb_br%3D8c5ffefb122f59a66a8b7672d4452af2%26eba%3D0%26bv%3D51%26bvm%3D0%26bvr%3D12%26avc%3D93%26evc%3D46%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D36%26br2%3D46%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D157%2C168%2C0%2C0%2C0%2C168%2C184%2C20%2C0%2C0%2C192%2C31%2C902%2C903%2C901%2C902%2C903%26deal1%3D2693%2C3045%2C3053%2C4276%2C7330%2C7331%2C8290%2C8296%2C8299%2C8300%2C8303%2C8312%2C8335%26osb%3DLinux%252FChrome%26dbg%3Drc%253A2%26reqt%3D1778751202829&cust_params=li-module-enabled%3Dt0&adks=3106951849&frm=20&eo_id_str=ID%3D777f7e13823df6a9%3AT%3D1778751201%3ART%3D1778751201%3AS%3DAA-AfjYoKIs1prfKFD6uebUMaLzZ&pbbce=1

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=dd428baff9

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.155.155 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

yuiadrs-in-f155.1e100.net

Software

cafe /

Resource Hash

f011a3b90cc534fb02b140f039bef2579f5874997079349598890c6f7055cf0f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: dcb
google-lineitem-id: -2
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 14 May 2026 09:33:23 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.mediafire.com
content-length: 131
x-xss-protection: 0
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 498 B
155 B 289ms
288ms Fetch
text/plain 192.178.155.155
Google LLC

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=6265647328545851&correlator=1956948670102034&eid=31098551&output=ldjh&gdfp_req=1&vrg=202605130101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-edge-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=160x600&ifi=21&didk=2994425013&dids=div-gpt-ad-mediafire_com-edge-&adfs=982453029&sfv=1-0-45&rcs=2&eri=1&sc=1&cookie=ID%3D4c907cf15727623e%3AT%3D1778751201%3ART%3D1778751201%3AS%3DALNI_MaDaZ5ZTDiSo5EJt4ZtmZyvBoaSXQ&gpic=UID%3D000013894fcd7a92%3AT%3D1778751201%3ART%3D1778751201%3AS%3DALNI_MYl5oJsAwAqe897fEVIZyg0ne9Asw&abxe=1&dt=1778751203528&lmt=1778751203&adxs=1440&adys=300&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=5&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE0OC4wLjc3NzguMTY3IixudWxsLDAsbnVsbCwiNjQiLFtbIkNocm9taXVtIiwiMTQ4LjAuMC4wIl0sWyJHb29nbGUgQ2hyb21lIiwiMTQ4LjAuMC4wIl0sWyJOb3QtQS5CcmFuZCIsIjI0LjAuMC4wIl1dLDBd&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F28rrtqxs0afdpk3%2FGambonanza-v1.0.16-full-apkvision.apk%2Ffile&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&a3p=EqsBCgpjcml0ZW8uY29tEpoBcWlrbk5WOVpVM2hOYmxSdE5UaDFORVl5ZFhWUWNGSlhjV3g2VGsxWVdIVjZTMDVPVVRsUVRUQmpObmhXTVc5SFlubExlalZuYUZOSGQxazRNMDlaZUZORlRIRndNR1J4Um1KWmMzVlRUVVpqY1hKRGJHbzFaVGhVVkdkT2FqQk5UR2hsVERCVFQyOHhaVGx4U1RCMVVTVXpSQVgBEjYKDGFkc2VydmVyLm9yZxIkNTRkYjhjY2UtZjUzMy00ZDMyLThiMmYtY2Y1MDFjNGU2Zjc5WAESNAoKcHViY2lkLm9yZxIkM2I3MTc1OWUtNDk1ZC00ZGFmLTk4ODktZmNiOGQ1NjdlY2EzWAESHAoNY3J3ZGNudHJsLm5ldBiCwdWu4jNIAFICCGQSHQoOZXNwLmNyaXRlby5jb20YgsHVruIzSABSAghkEhgKCXlhaG9vLmNvbRjkxNWu4jNIAFICCG8SPgoFb3BlbngSLGV5SnBJam9pVUVWT1RrdzVhVmhSUTBOMWJETnNXR0pEYWxsWlFUMDlJbjA9GMzF1a7iM0gAEpYCCghydGJob3VzZRKAAlNmaVZqQWlld1l6cWh4ZTNnQVhGNlZxRGFMdnVVRW9VYkNlditvOHJ3MURhSThRVVo5eEVTczQrN0FRaEd2T0pBM0N3L1JPK3hVQlEvWmhsR1lMVndEdEtuRGNDVFFVcThrOWRkUVpjRTZSd291ODkwTDZQZVlPdzBUdCtUeXIzSFA4NGY2NUxrSms2L3JSei9CQ2dCenJ0TnlBc29lRUdXYU0zYUxoalpoRHc1RXNMYkttMTV5Ky8vVUtIL3VyZldVc0lZZlJDTjFMbUpFWnZ2UVprWEhyRnZSYnc1NEc5ek43VTJ3dHpTanJYK2pMYmNZV0ZvL1pNQ0VLcUNoMHUY4MbVruIzSAA.&dlt=1778751198874&idt=2419&ppid=142e99cc7726b3a439aa50ec804b6bbe&uule=a%20cm9sZToxIHByb2R1Y2VyOjEyIGxvYzoiSDNCLENBIg%3D%3D&prev_scp=a%3D1%26iid1%3D8044379006359734%26eid%3D8044379006359734%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D1%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252F28rrtqxs0afdpk3%252FGambonanza-v1.0.16-full-apkvision.apk%252Ffile%26path%3D%252Ffile%252F28rrtqxs0afdpk3%252FGambonanza-v1.0.16-full-apkvision.apk%252Ffile%26ap%3D1102%26sap%3D1102%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D3%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D39%26al%3D1039%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-edge-2%26tap%3Dmediafire_com-edge-2-8044379006359734%26eb_br%3Dzero%26eba%3D0%26bv%3D11%26bvm%3D0%26bvr%3D1%26avc%3D56%26evc%3D41%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D0%26br2%3D50%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D78%2C168%2C0%2C0%2C0%2C131%2C132%2C0%2C0%2C0%2C187%2C0%2C901%2C182%2C901%2C902%2C903%26deal1%3D18%2C19%2C1428%2C2688%2C2693%2C3045%2C3052%2C3053%2C3856%2C4276%2C7330%2C7331%2C8229%2C8290%2C8296%2C8299%2C8300%2C8303%2C8312%2C8333%2C8334%2C8335%2C8344%26osb%3DLinux%252FChrome%26dbg%3Drc%253A4%26reqt%3D1778751202912&cust_params=li-module-enabled%3Dt0&adks=697308627&frm=20&eo_id_str=ID%3D777f7e13823df6a9%3AT%3D1778751201%3ART%3D1778751201%3AS%3DAA-AfjYoKIs1prfKFD6uebUMaLzZ&pbbce=1

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=dd428baff9

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.155.155 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

yuiadrs-in-f155.1e100.net

Software

cafe /

Resource Hash

d6e4b62659dfeb8565e75a7f8ed955e44fcb30eb78beaa2717b1e684e08b8c93

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: dcb
google-lineitem-id: -2
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 14 May 2026 09:33:23 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.mediafire.com
content-length: 125
x-xss-protection: 0
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 506 B
160 B 256ms
255ms Fetch
text/plain 192.178.155.155
Google LLC

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=6265647328545851&correlator=3292513638357549&eid=31098551&output=ldjh&gdfp_req=1&vrg=202605130101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-medrectangle-3&enc_prev_ius=%2F0%2F1&prev_iu_szs=336x280&ifi=22&didk=46179496&dids=div-gpt-ad-mediafire_com-medre&adfs=1911771697&sfv=1-0-45&rcs=2&eri=1&sc=1&cookie=ID%3D4c907cf15727623e%3AT%3D1778751201%3ART%3D1778751201%3AS%3DALNI_MaDaZ5ZTDiSo5EJt4ZtmZyvBoaSXQ&gpic=UID%3D000013894fcd7a92%3AT%3D1778751201%3ART%3D1778751201%3AS%3DALNI_MYl5oJsAwAqe897fEVIZyg0ne9Asw&abxe=1&dt=1778751203541&lmt=1778751203&adxs=320&adys=120&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=6&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE0OC4wLjc3NzguMTY3IixudWxsLDAsbnVsbCwiNjQiLFtbIkNocm9taXVtIiwiMTQ4LjAuMC4wIl0sWyJHb29nbGUgQ2hyb21lIiwiMTQ4LjAuMC4wIl0sWyJOb3QtQS5CcmFuZCIsIjI0LjAuMC4wIl1dLDBd&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F28rrtqxs0afdpk3%2FGambonanza-v1.0.16-full-apkvision.apk%2Ffile&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&a3p=EqsBCgpjcml0ZW8uY29tEpoBcWlrbk5WOVpVM2hOYmxSdE5UaDFORVl5ZFhWUWNGSlhjV3g2VGsxWVdIVjZTMDVPVVRsUVRUQmpObmhXTVc5SFlubExlalZuYUZOSGQxazRNMDlaZUZORlRIRndNR1J4Um1KWmMzVlRUVVpqY1hKRGJHbzFaVGhVVkdkT2FqQk5UR2hsVERCVFQyOHhaVGx4U1RCMVVTVXpSQVgBEjYKDGFkc2VydmVyLm9yZxIkNTRkYjhjY2UtZjUzMy00ZDMyLThiMmYtY2Y1MDFjNGU2Zjc5WAESNAoKcHViY2lkLm9yZxIkM2I3MTc1OWUtNDk1ZC00ZGFmLTk4ODktZmNiOGQ1NjdlY2EzWAESHAoNY3J3ZGNudHJsLm5ldBiCwdWu4jNIAFICCGQSHQoOZXNwLmNyaXRlby5jb20YgsHVruIzSABSAghkEhgKCXlhaG9vLmNvbRjkxNWu4jNIAFICCG8SPgoFb3BlbngSLGV5SnBJam9pVUVWT1RrdzVhVmhSUTBOMWJETnNXR0pEYWxsWlFUMDlJbjA9GMzF1a7iM0gAEpYCCghydGJob3VzZRKAAlNmaVZqQWlld1l6cWh4ZTNnQVhGNlZxRGFMdnVVRW9VYkNlditvOHJ3MURhSThRVVo5eEVTczQrN0FRaEd2T0pBM0N3L1JPK3hVQlEvWmhsR1lMVndEdEtuRGNDVFFVcThrOWRkUVpjRTZSd291ODkwTDZQZVlPdzBUdCtUeXIzSFA4NGY2NUxrSms2L3JSei9CQ2dCenJ0TnlBc29lRUdXYU0zYUxoalpoRHc1RXNMYkttMTV5Ky8vVUtIL3VyZldVc0lZZlJDTjFMbUpFWnZ2UVprWEhyRnZSYnc1NEc5ek43VTJ3dHpTanJYK2pMYmNZV0ZvL1pNQ0VLcUNoMHUY4MbVruIzSAA.&dlt=1778751198874&idt=2419&ppid=142e99cc7726b3a439aa50ec804b6bbe&uule=a%20cm9sZToxIHByb2R1Y2VyOjEyIGxvYzoiSDNCLENBIg%3D%3D&prev_scp=a%3D1%26iid1%3D3199650704416009%26eid%3D3199650704416009%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D1%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252F28rrtqxs0afdpk3%252FGambonanza-v1.0.16-full-apkvision.apk%252Ffile%26path%3D%252Ffile%252F28rrtqxs0afdpk3%252FGambonanza-v1.0.16-full-apkvision.apk%252Ffile%26ap%3D1104%26sap%3D1104%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D5%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D21%26al%3D1021%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-medrectangle-3%26tap%3Dmediafire_com-medrectangle-3-3199650704416009%26eb_br%3Dzero%26eba%3D0%26bv%3D11%26bvm%3D0%26bvr%3D1%26avc%3D108%26evc%3D57%26shp%3D3%26ftsn%3D12%26ftsng%3D12%26br1%3D0%26br2%3D60%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D157%2C131%2C0%2C0%2C0%2C168%2C184%2C20%2C0%2C0%2C192%2C31%2C902%2C903%2C901%2C902%2C903%26deal1%3D18%2C19%2C1428%2C2688%2C2693%2C3045%2C3052%2C3053%2C3856%2C4276%2C7330%2C7331%2C8229%2C8290%2C8295%2C8296%2C8299%2C8300%2C8303%2C8312%2C8327%2C8333%2C8334%2C8335%2C8336%2C8344%26osb%3DLinux%252FChrome%26dbg%3Drc%253A7%26reqt%3D1778751202916&cust_params=li-module-enabled%3Dt0&adks=4079446691&frm=20&eo_id_str=ID%3D777f7e13823df6a9%3AT%3D1778751201%3ART%3D1778751201%3AS%3DAA-AfjYoKIs1prfKFD6uebUMaLzZ&pbbce=1

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=dd428baff9

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.155.155 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

yuiadrs-in-f155.1e100.net

Software

cafe /

Resource Hash

7d8011f93d7f0642471d84aeaa0685e449311f5f45d3cbfc97c733a3f2c2364c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: dcb
google-lineitem-id: -2
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 14 May 2026 09:33:23 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.mediafire.com
content-length: 130
x-xss-protection: 0
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 506 B
161 B 253ms
253ms Fetch
text/plain 192.178.155.155
Google LLC

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=6265647328545851&correlator=2651378461468059&eid=31098551&output=ldjh&gdfp_req=1&vrg=202605130101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-medrectangle-4&enc_prev_ius=%2F0%2F1&prev_iu_szs=336x280%7C300x250&ifi=23&didk=46192883&dids=div-gpt-ad-mediafire_com-medre&adfs=1749122204&sfv=1-0-45&rcs=2&eri=1&sc=1&cookie=ID%3D4c907cf15727623e%3AT%3D1778751201%3ART%3D1778751201%3AS%3DALNI_MaDaZ5ZTDiSo5EJt4ZtmZyvBoaSXQ&gpic=UID%3D000013894fcd7a92%3AT%3D1778751201%3ART%3D1778751201%3AS%3DALNI_MYl5oJsAwAqe897fEVIZyg0ne9Asw&abxe=1&dt=1778751203556&lmt=1778751203&adxs=320&adys=420&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=7&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE0OC4wLjc3NzguMTY3IixudWxsLDAsbnVsbCwiNjQiLFtbIkNocm9taXVtIiwiMTQ4LjAuMC4wIl0sWyJHb29nbGUgQ2hyb21lIiwiMTQ4LjAuMC4wIl0sWyJOb3QtQS5CcmFuZCIsIjI0LjAuMC4wIl1dLDBd&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F28rrtqxs0afdpk3%2FGambonanza-v1.0.16-full-apkvision.apk%2Ffile&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&a3p=EqsBCgpjcml0ZW8uY29tEpoBcWlrbk5WOVpVM2hOYmxSdE5UaDFORVl5ZFhWUWNGSlhjV3g2VGsxWVdIVjZTMDVPVVRsUVRUQmpObmhXTVc5SFlubExlalZuYUZOSGQxazRNMDlaZUZORlRIRndNR1J4Um1KWmMzVlRUVVpqY1hKRGJHbzFaVGhVVkdkT2FqQk5UR2hsVERCVFQyOHhaVGx4U1RCMVVTVXpSQVgBEjYKDGFkc2VydmVyLm9yZxIkNTRkYjhjY2UtZjUzMy00ZDMyLThiMmYtY2Y1MDFjNGU2Zjc5WAESNAoKcHViY2lkLm9yZxIkM2I3MTc1OWUtNDk1ZC00ZGFmLTk4ODktZmNiOGQ1NjdlY2EzWAESHAoNY3J3ZGNudHJsLm5ldBiCwdWu4jNIAFICCGQSHQoOZXNwLmNyaXRlby5jb20YgsHVruIzSABSAghkEhgKCXlhaG9vLmNvbRjkxNWu4jNIAFICCG8SPgoFb3BlbngSLGV5SnBJam9pVUVWT1RrdzVhVmhSUTBOMWJETnNXR0pEYWxsWlFUMDlJbjA9GMzF1a7iM0gAEpYCCghydGJob3VzZRKAAlNmaVZqQWlld1l6cWh4ZTNnQVhGNlZxRGFMdnVVRW9VYkNlditvOHJ3MURhSThRVVo5eEVTczQrN0FRaEd2T0pBM0N3L1JPK3hVQlEvWmhsR1lMVndEdEtuRGNDVFFVcThrOWRkUVpjRTZSd291ODkwTDZQZVlPdzBUdCtUeXIzSFA4NGY2NUxrSms2L3JSei9CQ2dCenJ0TnlBc29lRUdXYU0zYUxoalpoRHc1RXNMYkttMTV5Ky8vVUtIL3VyZldVc0lZZlJDTjFMbUpFWnZ2UVprWEhyRnZSYnc1NEc5ek43VTJ3dHpTanJYK2pMYmNZV0ZvL1pNQ0VLcUNoMHUY4MbVruIzSAA.&dlt=1778751198874&idt=2419&ppid=142e99cc7726b3a439aa50ec804b6bbe&uule=a%20cm9sZToxIHByb2R1Y2VyOjEyIGxvYzoiSDNCLENBIg%3D%3D&prev_scp=a%3D1%26iid1%3D1431131254394124%26eid%3D1431131254394124%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D1%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252F28rrtqxs0afdpk3%252FGambonanza-v1.0.16-full-apkvision.apk%252Ffile%26path%3D%252Ffile%252F28rrtqxs0afdpk3%252FGambonanza-v1.0.16-full-apkvision.apk%252Ffile%26ap%3D1105%26sap%3D1105%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D6%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D22%26al%3D1022%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-medrectangle-4%26tap%3Dmediafire_com-medrectangle-4-1431131254394124%26eb_br%3Dzero%26eba%3D0%26bv%3D11%26bvm%3D0%26bvr%3D1%26avc%3D67%26evc%3D34%26shp%3D3%26ftsn%3D12%26ftsng%3D12%26br1%3D0%26br2%3D34%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D81%2C189%2C207%2C4%2C5%2C193%2C24%2C20%2C71%2C201%2C205%2C0%2C124%2C166%2C901%2C902%2C903%26deal1%3D18%2C1428%2C2693%2C3052%2C3053%2C3856%2C4276%2C7331%2C8229%2C8290%2C8296%2C8299%2C8333%2C8334%2C8335%26osb%3DLinux%252FChrome%26dbg%3Drc%253A8%26reqt%3D1778751202947&cust_params=li-module-enabled%3Dt0&adks=1277606936&frm=20&eo_id_str=ID%3D777f7e13823df6a9%3AT%3D1778751201%3ART%3D1778751201%3AS%3DAA-AfjYoKIs1prfKFD6uebUMaLzZ&pbbce=1

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=dd428baff9

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.155.155 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

yuiadrs-in-f155.1e100.net

Software

cafe /

Resource Hash

151c3f58e6c03a20daccec9f9a05806c6222e002a9f700822ea313e3e17b02d2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: dcb
google-lineitem-id: -2
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 14 May 2026 09:33:23 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.mediafire.com
content-length: 131
x-xss-protection: 0
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D33C 0
0 162ms
160ms Fetch
image/gif 142.251.167.157
Google LLC

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=fle-fetch-start2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.157 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

ww-in-f157.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 14 May 2026 09:33:23 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D33C 0
0 151ms
151ms Fetch
image/gif 142.251.167.157
Google LLC

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.157 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

ww-in-f157.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 14 May 2026 09:33:23 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
DATA 200
OK truncated
/ Frame D33C 216 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 802ff97397b3c47f5379227a443f4548622a1e41e6b5fd186d0b04c09933e6ea

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H2 200 2024-05-14-095317006160.png
cdn.2trk.info/rtgbannerimage/ Frame 4CAA 36 KB
37 KB 36ms
31ms Image
image/png 172.67.68.154
Cloudflare

General

Check archive.org

Download Go to Show image

Full URL: https://cdn.2trk.info/rtgbannerimage/2024-05-14-095317006160.png
Requested by: Host: ban.jackery.com
URL: https://ban.jackery.com/rtgban?bannerparamv1=size=160::cmpId=64763::bmpclickURL=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCS8JR4pYFapKZOPeL8LAP8Oad6QnPlantgwHns7mozAzAjbcBEAEg9PnGJWD96KKB8APIAQngAgCoAwHIAwKqBOgCT9AkqdFGlZ83gcu9nQTdCxS8YXcXoht8kC_0H9WxhOQiVHeQ1q211WOLnFSjU-V-lee8EtzRyHfE5HMqRFKuSRNMHlu5rU-fdcqXYKzVc9hbxPRicOQPnOpIoy6BlHejyk8a02UWfdRdXd_JCDoOWWzPJh3HhU7G7MLY-XyOZSWinz1VeMOCLO5pvfuZa26mEQHiqbkiGWWSx7zzedUL8fayFUDMPGOJPkS23aJOqCAvPj9ZAlU285gV1Z2_m4TgOZOQiNvjlLPCMbxFLOZKHHHE1KXKKS9KA8qRBxf5vi9uJlCEa-wPArWc9d6-4OuJYj9EUAM1_rUnP7azcKEno8LrakbDL9GMHfX1n0z0EfmtTFUhuKmqmkIZq2vOSsD-5mcBsia6EtGjZWSx1o6s2caWYXbJpkRsxpDXi2l6mUfkk95wJ9iqg9sApsgFfKqOZpLLqWmenrZh9iwk9Eav8d5AOg9KbrEV4AQBgAazuuS9pdr733GgBiGoB5PYsQKoB5TYsQKoB5XYsQKoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7ECqAetvrECqAe_07EC2AcA0gguCIBhEAEyCIqCgICAgIAIOg-AQIDAgICAgKiAAqiDgBBIvf3BOljIx9vMvLiUA_oLAggBgAwBqg0CQ0HiDRMIlvvbzLy4lAMV9wUcAB1wcyed6g0TCLv83My8uJQDFfcFHAAdcHMnnYgO____________AdAVAYAXAbIXEBgMKgozMzQ1MzgzNzc0UAGqGBcJAQAAAAZqGEESCjMzNDUzODM3NzQYAQ%26num%3D1%26sig%3DAOD64_17ao8IIbxS2oWrOWbBft5CRZXXqw%26client%3Dca-pub-6396844742497208%26adurl%3Dhttps%3A%2F%2Fban.jackery.com%2Fclick%3FrequiredParamsv1%3DH4sIAAAAAAAA_31TbW_aMBD-K1GlSq2ozfk1NvtEadetL4wV1pd9QQaSNU0gaUgAIf_4XdJ-aLdpupz9-FHuzj4_PtCeafAawA_6Qw-t3eSrqoxcdjLok-8DT5hX0mophRVGGmWVtqYNAyrQQTNjwYQm9MIPPWtH5XWLZRM-bKFpmKKeES2sNlKGkksbcjCeq7fKjQ1bl17LUAtf5Ovp9tlN6zVWUp6JkFqQmI2B4BrzgxKMSpw8O4GP5q3nwDUBRZh8DQ9xl4ohi4W9DKdtESJIcxoG0EPHgUIPjf7hvuHfOXbsfHx-UT6ml-yeFZvTHw-nc57m39TU-Mm4s-gUi12n6iw2CAWC8QQBV5260yx-4gLLIjz92kAGxmjcllUWubOG-7vtGHs2Hl0_YofCUMgZKEWEcIxIZTmZhS4mPBI2jhzEds7xt5t8n2SZ6yoKwdEDY5-C62RV74Kd0Xj646BfFFl0H82ukqqrsLtCB0dXXyY31ydBlqRRcBHN0_w4GDyV-TLqMmkoNBaMXezK5C3Ej_e_JrW4vd29XA3S_fPdaDM6f9miEp6qqlgfiv4h_4zfdruly2iRuDgpIzrPl8jFSRbhxE1ZVi-7Nbh4UaQCmQu3nOUrt9o7ssF2U6ZJXGcZcUW6SdZJvqKI3hK0yqnKOmpuEVq5oXOcXkX1T9m9b_l_L7PVb5NX0FA1ivdMdkF1G3UFYHuM91B_Qz-9Gw3aRzFs1fbhpCh_ykCjeilHNWLKg99RaS0HfQMAAA%253Bdurl155%3D::bamt=agWW4gAODJIAHAX3ACdzcHTob1_pi71zlTC6iQ::mode=4::label=::ul15=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.68.154 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: d13456a4570f3bba2950266c5092620990422a988bc0c4cf20ad0f2af6ef2921

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://ban.jackery.com/rtgban?bannerparamv1=size=160::cmpId=64763::bmpclickURL=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCS8JR4pYFapKZOPeL8LAP8Oad6QnPlantgwHns7mozAzAjbcBEAEg9PnGJWD96KKB8APIAQngAgCoAwHIAwKqBOgCT9AkqdFGlZ83gcu9nQTdCxS8YXcXoht8kC_0H9WxhOQiVHeQ1q211WOLnFSjU-V-lee8EtzRyHfE5HMqRFKuSRNMHlu5rU-fdcqXYKzVc9hbxPRicOQPnOpIoy6BlHejyk8a02UWfdRdXd_JCDoOWWzPJh3HhU7G7MLY-XyOZSWinz1VeMOCLO5pvfuZa26mEQHiqbkiGWWSx7zzedUL8fayFUDMPGOJPkS23aJOqCAvPj9ZAlU285gV1Z2_m4TgOZOQiNvjlLPCMbxFLOZKHHHE1KXKKS9KA8qRBxf5vi9uJlCEa-wPArWc9d6-4OuJYj9EUAM1_rUnP7azcKEno8LrakbDL9GMHfX1n0z0EfmtTFUhuKmqmkIZq2vOSsD-5mcBsia6EtGjZWSx1o6s2caWYXbJpkRsxpDXi2l6mUfkk95wJ9iqg9sApsgFfKqOZpLLqWmenrZh9iwk9Eav8d5AOg9KbrEV4AQBgAazuuS9pdr733GgBiGoB5PYsQKoB5TYsQKoB5XYsQKoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7ECqAetvrECqAe_07EC2AcA0gguCIBhEAEyCIqCgICAgIAIOg-AQIDAgICAgKiAAqiDgBBIvf3BOljIx9vMvLiUA_oLAggBgAwBqg0CQ0HiDRMIlvvbzLy4lAMV9wUcAB1wcyed6g0TCLv83My8uJQDFfcFHAAdcHMnnYgO____________AdAVAYAXAbIXEBgMKgozMzQ1MzgzNzc0UAGqGBcJAQAAAAZqGEESCjMzNDUzODM3NzQYAQ%26num%3D1%26sig%3DAOD64_17ao8IIbxS2oWrOWbBft5CRZXXqw%26client%3Dca-pub-6396844742497208%26adurl%3Dhttps%3A%2F%2Fban.jackery.com%2Fclick%3FrequiredParamsv1%3DH4sIAAAAAAAA_31TbW_aMBD-K1GlSq2ozfk1NvtEadetL4wV1pd9QQaSNU0gaUgAIf_4XdJ-aLdpupz9-FHuzj4_PtCeafAawA_6Qw-t3eSrqoxcdjLok-8DT5hX0mophRVGGmWVtqYNAyrQQTNjwYQm9MIPPWtH5XWLZRM-bKFpmKKeES2sNlKGkksbcjCeq7fKjQ1bl17LUAtf5Ovp9tlN6zVWUp6JkFqQmI2B4BrzgxKMSpw8O4GP5q3nwDUBRZh8DQ9xl4ohi4W9DKdtESJIcxoG0EPHgUIPjf7hvuHfOXbsfHx-UT6ml-yeFZvTHw-nc57m39TU-Mm4s-gUi12n6iw2CAWC8QQBV5260yx-4gLLIjz92kAGxmjcllUWubOG-7vtGHs2Hl0_YofCUMgZKEWEcIxIZTmZhS4mPBI2jhzEds7xt5t8n2SZ6yoKwdEDY5-C62RV74Kd0Xj646BfFFl0H82ukqqrsLtCB0dXXyY31ydBlqRRcBHN0_w4GDyV-TLqMmkoNBaMXezK5C3Ej_e_JrW4vd29XA3S_fPdaDM6f9miEp6qqlgfiv4h_4zfdruly2iRuDgpIzrPl8jFSRbhxE1ZVi-7Nbh4UaQCmQu3nOUrt9o7ssF2U6ZJXGcZcUW6SdZJvqKI3hK0yqnKOmpuEVq5oXOcXkX1T9m9b_l_L7PVb5NX0FA1ivdMdkF1G3UFYHuM91B_Qz-9Gw3aRzFs1fbhpCh_ykCjeilHNWLKg99RaS0HfQMAAA%253Bdurl155%3D::bamt=agWW4gAODJIAHAX3ACdzcHTob1_pi71zlTC6iQ::mode=4::label=::ul15=
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-goog-metageneration: 1
access-control-expose-headers: Content-Length,Content-Range,Accept-Ranges
x-goog-hash: crc32c=9XPVxA==, md5=QDz32gHp/VO5WRxPbfc8TQ==
cf-cache-status: HIT
etag: "403cf7da01e9fd53b9591c4f6df73c4d"
age: 21764
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=p%2Fo7uFdFQ0VC1jqYfcVd5HPBcf2jSChijGSEZZenA40QvnhRwAFO7DR5azvs226LOoNzn35HMHUmaJlrSFaO19bRnZx1wItyLNnxuYDR19b9TwiBbwfBTy4a2cfSrmg%3D"}]}
access-control-allow-methods: GET,HEAD,OPTIONS
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 36924
date: Thu, 14 May 2026 09:33:23 GMT
content-type: image/png
last-modified: Mon, 05 Jan 2026 06:27:32 GMT
x-guploader-uploadid: AAVLpEjvH6-G3YenDz7EqwwRxsJvSUNsPhIf-KKJTnj-CM7EeTXryaIjdYqSQI2f36xl0Q8bImhZJFQ
access-control-allow-headers: Origin,Range,Accept,Content-Type,Authorization,X-Requested-With
cache-control: public, max-age=28800
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
x-goog-storage-class: STANDARD
via: 1.1 google
cf-ray: 9fb8e6af2ae236d7-YYZ
x-amz-checksum-crc32c: 9XPVxA==
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1767594452984832
content-length: 36924
server: cloudflare

GET
H2 200 nai_smallpreciso.png
cdn.2trk.info/rtgstat/adchoice-links/ Frame 4CAA 183 B
984 B 35ms
30ms Image
image/png 172.67.68.154
Cloudflare

General

Check archive.org

Download Go to Show image

Full URL: https://cdn.2trk.info/rtgstat/adchoice-links/nai_smallpreciso.png
Requested by: Host: ban.jackery.com
URL: https://ban.jackery.com/rtgban?bannerparamv1=size=160::cmpId=64763::bmpclickURL=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCS8JR4pYFapKZOPeL8LAP8Oad6QnPlantgwHns7mozAzAjbcBEAEg9PnGJWD96KKB8APIAQngAgCoAwHIAwKqBOgCT9AkqdFGlZ83gcu9nQTdCxS8YXcXoht8kC_0H9WxhOQiVHeQ1q211WOLnFSjU-V-lee8EtzRyHfE5HMqRFKuSRNMHlu5rU-fdcqXYKzVc9hbxPRicOQPnOpIoy6BlHejyk8a02UWfdRdXd_JCDoOWWzPJh3HhU7G7MLY-XyOZSWinz1VeMOCLO5pvfuZa26mEQHiqbkiGWWSx7zzedUL8fayFUDMPGOJPkS23aJOqCAvPj9ZAlU285gV1Z2_m4TgOZOQiNvjlLPCMbxFLOZKHHHE1KXKKS9KA8qRBxf5vi9uJlCEa-wPArWc9d6-4OuJYj9EUAM1_rUnP7azcKEno8LrakbDL9GMHfX1n0z0EfmtTFUhuKmqmkIZq2vOSsD-5mcBsia6EtGjZWSx1o6s2caWYXbJpkRsxpDXi2l6mUfkk95wJ9iqg9sApsgFfKqOZpLLqWmenrZh9iwk9Eav8d5AOg9KbrEV4AQBgAazuuS9pdr733GgBiGoB5PYsQKoB5TYsQKoB5XYsQKoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7ECqAetvrECqAe_07EC2AcA0gguCIBhEAEyCIqCgICAgIAIOg-AQIDAgICAgKiAAqiDgBBIvf3BOljIx9vMvLiUA_oLAggBgAwBqg0CQ0HiDRMIlvvbzLy4lAMV9wUcAB1wcyed6g0TCLv83My8uJQDFfcFHAAdcHMnnYgO____________AdAVAYAXAbIXEBgMKgozMzQ1MzgzNzc0UAGqGBcJAQAAAAZqGEESCjMzNDUzODM3NzQYAQ%26num%3D1%26sig%3DAOD64_17ao8IIbxS2oWrOWbBft5CRZXXqw%26client%3Dca-pub-6396844742497208%26adurl%3Dhttps%3A%2F%2Fban.jackery.com%2Fclick%3FrequiredParamsv1%3DH4sIAAAAAAAA_31TbW_aMBD-K1GlSq2ozfk1NvtEadetL4wV1pd9QQaSNU0gaUgAIf_4XdJ-aLdpupz9-FHuzj4_PtCeafAawA_6Qw-t3eSrqoxcdjLok-8DT5hX0mophRVGGmWVtqYNAyrQQTNjwYQm9MIPPWtH5XWLZRM-bKFpmKKeES2sNlKGkksbcjCeq7fKjQ1bl17LUAtf5Ovp9tlN6zVWUp6JkFqQmI2B4BrzgxKMSpw8O4GP5q3nwDUBRZh8DQ9xl4ohi4W9DKdtESJIcxoG0EPHgUIPjf7hvuHfOXbsfHx-UT6ml-yeFZvTHw-nc57m39TU-Mm4s-gUi12n6iw2CAWC8QQBV5260yx-4gLLIjz92kAGxmjcllUWubOG-7vtGHs2Hl0_YofCUMgZKEWEcIxIZTmZhS4mPBI2jhzEds7xt5t8n2SZ6yoKwdEDY5-C62RV74Kd0Xj646BfFFl0H82ukqqrsLtCB0dXXyY31ydBlqRRcBHN0_w4GDyV-TLqMmkoNBaMXezK5C3Ej_e_JrW4vd29XA3S_fPdaDM6f9miEp6qqlgfiv4h_4zfdruly2iRuDgpIzrPl8jFSRbhxE1ZVi-7Nbh4UaQCmQu3nOUrt9o7ssF2U6ZJXGcZcUW6SdZJvqKI3hK0yqnKOmpuEVq5oXOcXkX1T9m9b_l_L7PVb5NX0FA1ivdMdkF1G3UFYHuM91B_Qz-9Gw3aRzFs1fbhpCh_ykCjeilHNWLKg99RaS0HfQMAAA%253Bdurl155%3D::bamt=agWW4gAODJIAHAX3ACdzcHTob1_pi71zlTC6iQ::mode=4::label=::ul15=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.68.154 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 20d9446b589f06289e3a2f62cd749f76b571c6acc63ec6e1e93710854017c6bf

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://ban.jackery.com/rtgban?bannerparamv1=size=160::cmpId=64763::bmpclickURL=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCS8JR4pYFapKZOPeL8LAP8Oad6QnPlantgwHns7mozAzAjbcBEAEg9PnGJWD96KKB8APIAQngAgCoAwHIAwKqBOgCT9AkqdFGlZ83gcu9nQTdCxS8YXcXoht8kC_0H9WxhOQiVHeQ1q211WOLnFSjU-V-lee8EtzRyHfE5HMqRFKuSRNMHlu5rU-fdcqXYKzVc9hbxPRicOQPnOpIoy6BlHejyk8a02UWfdRdXd_JCDoOWWzPJh3HhU7G7MLY-XyOZSWinz1VeMOCLO5pvfuZa26mEQHiqbkiGWWSx7zzedUL8fayFUDMPGOJPkS23aJOqCAvPj9ZAlU285gV1Z2_m4TgOZOQiNvjlLPCMbxFLOZKHHHE1KXKKS9KA8qRBxf5vi9uJlCEa-wPArWc9d6-4OuJYj9EUAM1_rUnP7azcKEno8LrakbDL9GMHfX1n0z0EfmtTFUhuKmqmkIZq2vOSsD-5mcBsia6EtGjZWSx1o6s2caWYXbJpkRsxpDXi2l6mUfkk95wJ9iqg9sApsgFfKqOZpLLqWmenrZh9iwk9Eav8d5AOg9KbrEV4AQBgAazuuS9pdr733GgBiGoB5PYsQKoB5TYsQKoB5XYsQKoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7ECqAetvrECqAe_07EC2AcA0gguCIBhEAEyCIqCgICAgIAIOg-AQIDAgICAgKiAAqiDgBBIvf3BOljIx9vMvLiUA_oLAggBgAwBqg0CQ0HiDRMIlvvbzLy4lAMV9wUcAB1wcyed6g0TCLv83My8uJQDFfcFHAAdcHMnnYgO____________AdAVAYAXAbIXEBgMKgozMzQ1MzgzNzc0UAGqGBcJAQAAAAZqGEESCjMzNDUzODM3NzQYAQ%26num%3D1%26sig%3DAOD64_17ao8IIbxS2oWrOWbBft5CRZXXqw%26client%3Dca-pub-6396844742497208%26adurl%3Dhttps%3A%2F%2Fban.jackery.com%2Fclick%3FrequiredParamsv1%3DH4sIAAAAAAAA_31TbW_aMBD-K1GlSq2ozfk1NvtEadetL4wV1pd9QQaSNU0gaUgAIf_4XdJ-aLdpupz9-FHuzj4_PtCeafAawA_6Qw-t3eSrqoxcdjLok-8DT5hX0mophRVGGmWVtqYNAyrQQTNjwYQm9MIPPWtH5XWLZRM-bKFpmKKeES2sNlKGkksbcjCeq7fKjQ1bl17LUAtf5Ovp9tlN6zVWUp6JkFqQmI2B4BrzgxKMSpw8O4GP5q3nwDUBRZh8DQ9xl4ohi4W9DKdtESJIcxoG0EPHgUIPjf7hvuHfOXbsfHx-UT6ml-yeFZvTHw-nc57m39TU-Mm4s-gUi12n6iw2CAWC8QQBV5260yx-4gLLIjz92kAGxmjcllUWubOG-7vtGHs2Hl0_YofCUMgZKEWEcIxIZTmZhS4mPBI2jhzEds7xt5t8n2SZ6yoKwdEDY5-C62RV74Kd0Xj646BfFFl0H82ukqqrsLtCB0dXXyY31ydBlqRRcBHN0_w4GDyV-TLqMmkoNBaMXezK5C3Ej_e_JrW4vd29XA3S_fPdaDM6f9miEp6qqlgfiv4h_4zfdruly2iRuDgpIzrPl8jFSRbhxE1ZVi-7Nbh4UaQCmQu3nOUrt9o7ssF2U6ZJXGcZcUW6SdZJvqKI3hK0yqnKOmpuEVq5oXOcXkX1T9m9b_l_L7PVb5NX0FA1ivdMdkF1G3UFYHuM91B_Qz-9Gw3aRzFs1fbhpCh_ykCjeilHNWLKg99RaS0HfQMAAA%253Bdurl155%3D::bamt=agWW4gAODJIAHAX3ACdzcHTob1_pi71zlTC6iQ::mode=4::label=::ul15=
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-goog-metageneration: 1
access-control-expose-headers: Content-Length,Content-Range,Accept-Ranges
x-goog-hash: crc32c=8Q7Kmw==, md5=/kvfDzFLaHV/LuXGPt1MLQ==
cf-cache-status: HIT
etag: "fe4bdf0f314b68757f2ee5c63edd4c2d"
age: 21906
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=vPiI1%2FD%2BfFUDmh8y7K2ErgmFKqFS%2FtDnZbeny5rI0EPb%2FWlrRqHM%2FNt7031WVjFaBbr3MJs06xxx8mFihRiqL29VX5aJ2Q6GEMMMQvId46R3K4U30b%2FEhpDX039CZng%3D"}]}
access-control-allow-methods: GET,HEAD,OPTIONS
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 183
date: Thu, 14 May 2026 09:33:23 GMT
content-type: image/png
last-modified: Mon, 05 Jan 2026 05:29:15 GMT
x-guploader-uploadid: AAVLpEja6cs29ZelwwWaLRQKqTP4nrQECTEdcwY0f7qA6tGIN1eShU7zm0k4gZPEkysGQkeGNGOLwIM
access-control-allow-headers: Origin,Range,Accept,Content-Type,Authorization,X-Requested-With
cache-control: public, max-age=28800
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
x-goog-storage-class: STANDARD
via: 1.1 google
cf-ray: 9fb8e6af2ae336d7-YYZ
x-amz-checksum-crc32c: 8Q7Kmw==
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1767590955207215
content-length: 183
server: cloudflare

GET
H2 200 nai_bigpreciso.png
cdn.2trk.info/rtgstat/adchoice-links/ Frame 4CAA 2 KB
2 KB 30ms
29ms Image
image/png 172.67.68.154
Cloudflare

General

Check archive.org

Download Go to Show image

Full URL: https://cdn.2trk.info/rtgstat/adchoice-links/nai_bigpreciso.png
Requested by: Host: ban.jackery.com
URL: https://ban.jackery.com/rtgban?bannerparamv1=size=160::cmpId=64763::bmpclickURL=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCS8JR4pYFapKZOPeL8LAP8Oad6QnPlantgwHns7mozAzAjbcBEAEg9PnGJWD96KKB8APIAQngAgCoAwHIAwKqBOgCT9AkqdFGlZ83gcu9nQTdCxS8YXcXoht8kC_0H9WxhOQiVHeQ1q211WOLnFSjU-V-lee8EtzRyHfE5HMqRFKuSRNMHlu5rU-fdcqXYKzVc9hbxPRicOQPnOpIoy6BlHejyk8a02UWfdRdXd_JCDoOWWzPJh3HhU7G7MLY-XyOZSWinz1VeMOCLO5pvfuZa26mEQHiqbkiGWWSx7zzedUL8fayFUDMPGOJPkS23aJOqCAvPj9ZAlU285gV1Z2_m4TgOZOQiNvjlLPCMbxFLOZKHHHE1KXKKS9KA8qRBxf5vi9uJlCEa-wPArWc9d6-4OuJYj9EUAM1_rUnP7azcKEno8LrakbDL9GMHfX1n0z0EfmtTFUhuKmqmkIZq2vOSsD-5mcBsia6EtGjZWSx1o6s2caWYXbJpkRsxpDXi2l6mUfkk95wJ9iqg9sApsgFfKqOZpLLqWmenrZh9iwk9Eav8d5AOg9KbrEV4AQBgAazuuS9pdr733GgBiGoB5PYsQKoB5TYsQKoB5XYsQKoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7ECqAetvrECqAe_07EC2AcA0gguCIBhEAEyCIqCgICAgIAIOg-AQIDAgICAgKiAAqiDgBBIvf3BOljIx9vMvLiUA_oLAggBgAwBqg0CQ0HiDRMIlvvbzLy4lAMV9wUcAB1wcyed6g0TCLv83My8uJQDFfcFHAAdcHMnnYgO____________AdAVAYAXAbIXEBgMKgozMzQ1MzgzNzc0UAGqGBcJAQAAAAZqGEESCjMzNDUzODM3NzQYAQ%26num%3D1%26sig%3DAOD64_17ao8IIbxS2oWrOWbBft5CRZXXqw%26client%3Dca-pub-6396844742497208%26adurl%3Dhttps%3A%2F%2Fban.jackery.com%2Fclick%3FrequiredParamsv1%3DH4sIAAAAAAAA_31TbW_aMBD-K1GlSq2ozfk1NvtEadetL4wV1pd9QQaSNU0gaUgAIf_4XdJ-aLdpupz9-FHuzj4_PtCeafAawA_6Qw-t3eSrqoxcdjLok-8DT5hX0mophRVGGmWVtqYNAyrQQTNjwYQm9MIPPWtH5XWLZRM-bKFpmKKeES2sNlKGkksbcjCeq7fKjQ1bl17LUAtf5Ovp9tlN6zVWUp6JkFqQmI2B4BrzgxKMSpw8O4GP5q3nwDUBRZh8DQ9xl4ohi4W9DKdtESJIcxoG0EPHgUIPjf7hvuHfOXbsfHx-UT6ml-yeFZvTHw-nc57m39TU-Mm4s-gUi12n6iw2CAWC8QQBV5260yx-4gLLIjz92kAGxmjcllUWubOG-7vtGHs2Hl0_YofCUMgZKEWEcIxIZTmZhS4mPBI2jhzEds7xt5t8n2SZ6yoKwdEDY5-C62RV74Kd0Xj646BfFFl0H82ukqqrsLtCB0dXXyY31ydBlqRRcBHN0_w4GDyV-TLqMmkoNBaMXezK5C3Ej_e_JrW4vd29XA3S_fPdaDM6f9miEp6qqlgfiv4h_4zfdruly2iRuDgpIzrPl8jFSRbhxE1ZVi-7Nbh4UaQCmQu3nOUrt9o7ssF2U6ZJXGcZcUW6SdZJvqKI3hK0yqnKOmpuEVq5oXOcXkX1T9m9b_l_L7PVb5NX0FA1ivdMdkF1G3UFYHuM91B_Qz-9Gw3aRzFs1fbhpCh_ykCjeilHNWLKg99RaS0HfQMAAA%253Bdurl155%3D::bamt=agWW4gAODJIAHAX3ACdzcHTob1_pi71zlTC6iQ::mode=4::label=::ul15=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.68.154 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: c7b4e0ead046aaf8bf5ccbfc2cacb1034484502f3edef69134a060f49edda834

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://ban.jackery.com/rtgban?bannerparamv1=size=160::cmpId=64763::bmpclickURL=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCS8JR4pYFapKZOPeL8LAP8Oad6QnPlantgwHns7mozAzAjbcBEAEg9PnGJWD96KKB8APIAQngAgCoAwHIAwKqBOgCT9AkqdFGlZ83gcu9nQTdCxS8YXcXoht8kC_0H9WxhOQiVHeQ1q211WOLnFSjU-V-lee8EtzRyHfE5HMqRFKuSRNMHlu5rU-fdcqXYKzVc9hbxPRicOQPnOpIoy6BlHejyk8a02UWfdRdXd_JCDoOWWzPJh3HhU7G7MLY-XyOZSWinz1VeMOCLO5pvfuZa26mEQHiqbkiGWWSx7zzedUL8fayFUDMPGOJPkS23aJOqCAvPj9ZAlU285gV1Z2_m4TgOZOQiNvjlLPCMbxFLOZKHHHE1KXKKS9KA8qRBxf5vi9uJlCEa-wPArWc9d6-4OuJYj9EUAM1_rUnP7azcKEno8LrakbDL9GMHfX1n0z0EfmtTFUhuKmqmkIZq2vOSsD-5mcBsia6EtGjZWSx1o6s2caWYXbJpkRsxpDXi2l6mUfkk95wJ9iqg9sApsgFfKqOZpLLqWmenrZh9iwk9Eav8d5AOg9KbrEV4AQBgAazuuS9pdr733GgBiGoB5PYsQKoB5TYsQKoB5XYsQKoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7ECqAetvrECqAe_07EC2AcA0gguCIBhEAEyCIqCgICAgIAIOg-AQIDAgICAgKiAAqiDgBBIvf3BOljIx9vMvLiUA_oLAggBgAwBqg0CQ0HiDRMIlvvbzLy4lAMV9wUcAB1wcyed6g0TCLv83My8uJQDFfcFHAAdcHMnnYgO____________AdAVAYAXAbIXEBgMKgozMzQ1MzgzNzc0UAGqGBcJAQAAAAZqGEESCjMzNDUzODM3NzQYAQ%26num%3D1%26sig%3DAOD64_17ao8IIbxS2oWrOWbBft5CRZXXqw%26client%3Dca-pub-6396844742497208%26adurl%3Dhttps%3A%2F%2Fban.jackery.com%2Fclick%3FrequiredParamsv1%3DH4sIAAAAAAAA_31TbW_aMBD-K1GlSq2ozfk1NvtEadetL4wV1pd9QQaSNU0gaUgAIf_4XdJ-aLdpupz9-FHuzj4_PtCeafAawA_6Qw-t3eSrqoxcdjLok-8DT5hX0mophRVGGmWVtqYNAyrQQTNjwYQm9MIPPWtH5XWLZRM-bKFpmKKeES2sNlKGkksbcjCeq7fKjQ1bl17LUAtf5Ovp9tlN6zVWUp6JkFqQmI2B4BrzgxKMSpw8O4GP5q3nwDUBRZh8DQ9xl4ohi4W9DKdtESJIcxoG0EPHgUIPjf7hvuHfOXbsfHx-UT6ml-yeFZvTHw-nc57m39TU-Mm4s-gUi12n6iw2CAWC8QQBV5260yx-4gLLIjz92kAGxmjcllUWubOG-7vtGHs2Hl0_YofCUMgZKEWEcIxIZTmZhS4mPBI2jhzEds7xt5t8n2SZ6yoKwdEDY5-C62RV74Kd0Xj646BfFFl0H82ukqqrsLtCB0dXXyY31ydBlqRRcBHN0_w4GDyV-TLqMmkoNBaMXezK5C3Ej_e_JrW4vd29XA3S_fPdaDM6f9miEp6qqlgfiv4h_4zfdruly2iRuDgpIzrPl8jFSRbhxE1ZVi-7Nbh4UaQCmQu3nOUrt9o7ssF2U6ZJXGcZcUW6SdZJvqKI3hK0yqnKOmpuEVq5oXOcXkX1T9m9b_l_L7PVb5NX0FA1ivdMdkF1G3UFYHuM91B_Qz-9Gw3aRzFs1fbhpCh_ykCjeilHNWLKg99RaS0HfQMAAA%253Bdurl155%3D::bamt=agWW4gAODJIAHAX3ACdzcHTob1_pi71zlTC6iQ::mode=4::label=::ul15=
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-goog-metageneration: 1
access-control-expose-headers: Content-Length,Content-Range,Accept-Ranges
x-goog-hash: crc32c=xZG4mQ==, md5=pPLcP1uCo83PfVdUKUSRdw==
cf-cache-status: HIT
etag: "a4f2dc3f5b82a3cdcf7d575429449177"
age: 21906
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=Tf0rUAV0V6qmVXXMFaeZnA6OrIrTOjtF2oNwIi1gw%2FWvQfSkXymAhI0mMDnadWWN5%2Fm1dXknFTgyozuSzysR7Pch6R%2FITEQZeBRKlfZV2PeIPXf8btZvRC8JTD8HB5A%3D"}]}
access-control-allow-methods: GET,HEAD,OPTIONS
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 1710
date: Thu, 14 May 2026 09:33:23 GMT
content-type: image/png
last-modified: Mon, 05 Jan 2026 05:29:15 GMT
x-guploader-uploadid: AAVLpEi9iPaTUL6j81Yw3JStmYoIT67E11iTML6id0Kseu9TsXMSybEDF_ArFKWUSwdU4R5aCPnUgrM
access-control-allow-headers: Origin,Range,Accept,Content-Type,Authorization,X-Requested-With
cache-control: public, max-age=28800
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
x-goog-storage-class: STANDARD
via: 1.1 google
cf-ray: 9fb8e6af3ae736d7-YYZ
x-amz-checksum-crc32c: xZG4mQ==
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1767590955072165
content-length: 1710
server: cloudflare

GET
H3 200 reach_worklet.html Show response
www.googleadservices.com/pagead/managed/js/activeview/current/ Frame 6A21 93 B
93 B 126ms
66ms Document
text/html 64.233.180.154
Google LLC

General

Check archive.org

Download Go to

Full URL

https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

64.233.180.154 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

on-in-f154.1e100.net

Software

cafe /

Resource Hash

136b3dfa7c254f92a9a3513c191c87c05f7c7ff7f82c6d648a33496c3c380593

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=3600, stale-while-revalidate=3600
content-encoding: br
content-length: 69
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 14 May 2026 09:33:23 GMT
etag: 9658810392779322030
expires: Thu, 14 May 2026 09:33:23 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 sodar
ep1.adtrafficquality.google/pagead/ 0
17 B 115ms
113ms Image
image/ 192.178.155.157
Google LLC

General

Check archive.org

Download Go to Show image

Full URL

https://ep1.adtrafficquality.google/pagead/sodar?id=sodar2&v=254&t=2&li=gpt_m202605130101&jk=6265647328545851&bg=!Q0ClQCLNAAYiAzjxAgM7AEcBe5WfOGfnQroaiCOudtrSRNt1ht_fasa_ie3KAFLu2o4nudzfQUtzIOEdbib10xa1fig-3dOgwXYocbNCQHrY9VOSSW2pEAIAAABsUgAAAAVoAQd-ADdwB4TIZMjEGn2Bk75ZuY8I2WoHGjVeZoDSPCajBXBDHCZxOw2VN1Tn1EqRbYshnMkniDAWPq47mQJaB967DmaA9jJtkaDV48oo588cBqeqaBbL2PHpbux2TJBV-DtEqRWi2Dz2qNS9HeR0Ytq6ygfnP4wlfq-h6ZHICDIZjYy9zQCi10GLmtzZtedWVadqjqlfWlblK0cOgOwt08v8GPXcZlc0fqhNTUKUDQvu8AjyoEbwrNaX_fpj6u5RF9QvI--lBL7SsLzqj0aJfn_qwVa_ofAOSKrwIua4fpbZrhS0FvUO8GM_kKEa7KB0ZyRr8FetJ29Jxkg6PJzTcJ246_CXEhTwdypnbdXI897j7zsZ-2zT7Zz97-yS1ib_xredqCXrqTMKv1vxn78V-wDDclQzWHNB5SZ3EWCHW-rEmb_RRTbZ8yxbXg_6TSKMJaVc0waxWUdzhwTncZ6qd4X9qQXG5LIZ7u8jmEQtc44xrlc4o5U5v6XAv5G_oQwtkjQEasxNETazeQvJoDP0G6VY5grQba37FZWy9fnmOicQoRY-QKjq2PFtnXvVpFvVA3RblecA7EWFDFhO6gnLHAYL4aNZzuiVxgDwG979YnWl8JdsGGLQOl2UzR0uq2CqsMCly1K-FNLLQvvuU8EXB_tx_Thmc5xCRmo3q3nQusDfEG_5B1AuGf7zl1T6Zlqikmh0p8FHpGo8EhV6-GuaBR4SUTx1fg0dCx1bVcU6pow5TjFylqcnxbrX8r6rkjUG-g8hMzI4Y7wqagw_sIzRRVKDIvqXko8aQRn2FWVQvxQndS4vTJB4yleMeaqN0hcRD3ic2VL3QQ0IGvTxpIMZ3tiNWkYHj2GnG0n0r4gcgusjXwGSVeMqQp4

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.155.157 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

yuiadrs-in-f157.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

timing-allow-origin: *
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 14 May 2026 09:33:23 GMT
x-xss-protection: 0
content-type: image/
server: cafe

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
335 B 118ms
117ms Fetch
application/json 135.125.170.98
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host:
URL: webpack:///./src/ajax.js?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

135.125.170.98 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ns31890040.ip-135-125-170.eu

Software

Resource Hash

8d29511efaf9437ab09d682f6710db1be0b4f5082d6bc782c994f777322a1c2a

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://www.mediafire.com
content-encoding: gzip
date: Thu, 14 May 2026 09:33:23 GMT
content-type: application/json;charset=UTF-8
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding

POST 457.json
id5-sync.com/g/v2/ 0
0

GET
H3 200 reach_worklet.js Show response
www.googleadservices.com/pagead/managed/js/activeview/current/ Frame 6A21 195 KB
62 KB 82ms
81ms Script
text/javascript 64.233.180.154
Google LLC

General

Check archive.org

Download Go to

Full URL

https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.html

Protocol

Security

QUIC, , AES_128_GCM

Server

64.233.180.154 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

on-in-f154.1e100.net

Software

cafe /

Resource Hash

bed4d32b2c3440f32df8e267317ed6fed766b0f4c39eaf4a58bee428a1ebf6b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
etag: 5116508366472751509
x-content-type-options: nosniff
expires: Thu, 14 May 2026 09:33:23 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 14 May 2026 09:33:23 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 63024
x-xss-protection: 0
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D33C 0
0 46ms
46ms Fetch
image/gif 142.251.167.157
Google LLC

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.157 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

ww-in-f157.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 14 May 2026 09:33:24 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D33C 0
0 46ms
46ms Fetch
image/gif 142.251.167.157
Google LLC

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACYANgBGgD

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.157 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

ww-in-f157.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 14 May 2026 09:33:24 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 model_person_country_code_CA_person_region_code_5175656265635f4d6f6e747265616c.json Show response
www.googletagservices.com/agrp/prod/ Frame 6A21 632 KB
86 KB 123ms
41ms Fetch
application/json 172.253.139.157
Google LLC

General

Check archive.org

Download Go to

Full URL

https://www.googletagservices.com/agrp/prod/model_person_country_code_CA_person_region_code_5175656265635f4d6f6e747265616c.json

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.139.157 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

yuiadsk-in-f157.1e100.net

Software

sffe /

Resource Hash

7dfb320f62f8e93b26f7760ed53ade019c720b1a267826a9672177c801223e5b

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-people-metrics-releaser
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.googleadservices.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
age: 1686
report-to: {"group":"ads-people-metrics-releaser","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-people-metrics-releaser"}]}
x-content-type-options: nosniff
expires: Fri, 15 May 2026 09:05:18 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 14 May 2026 09:05:18 GMT
last-modified: Tue, 30 Jul 2024 19:25:57 GMT
content-type: application/json
vary: Accept-Encoding
content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-people-metrics-releaser
cache-control: public, max-age=86400
cross-origin-opener-policy: same-origin; report-to="ads-people-metrics-releaser"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
content-length: 87370
x-xss-protection: 0
server: sffe

POST
H3 200 report-shared-storage
www.googleadservices.com/.well-known/private-aggregation/ Frame 6A21 0
0 71ms
69ms Fetch
text/html 64.233.180.154
Google LLC

General

Check archive.org

Download Go to

Full URL

https://www.googleadservices.com/.well-known/private-aggregation/report-shared-storage

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js

Protocol

Security

QUIC, , AES_128_GCM

Server

64.233.180.154 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

on-in-f154.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
Content-Type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0

Response headers

timing-allow-origin: *
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 14 May 2026 09:33:24 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: cafe

POST
H3 200 report-shared-storage
www.googleadservices.com/.well-known/private-aggregation/ Frame 6A21 0
0 83ms
82ms Fetch
text/html 64.233.180.154
Google LLC

General

Check archive.org

Download Go to

Full URL

https://www.googleadservices.com/.well-known/private-aggregation/report-shared-storage

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js

Protocol

Security

QUIC, , AES_128_GCM

Server

64.233.180.154 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

on-in-f154.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
Content-Type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0

Response headers

timing-allow-origin: *
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 14 May 2026 09:33:24 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: cafe

POST
H3 200 report-shared-storage
www.googleadservices.com/.well-known/private-aggregation/ Frame 6A21 0
0 80ms
79ms Fetch
text/html 64.233.180.154
Google LLC

General

Check archive.org

Download Go to

Full URL

https://www.googleadservices.com/.well-known/private-aggregation/report-shared-storage

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js

Protocol

Security

QUIC, , AES_128_GCM

Server

64.233.180.154 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

on-in-f154.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
Content-Type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0

Response headers

timing-allow-origin: *
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 14 May 2026 09:33:24 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6A21 0
0 46ms
45ms Fetch
image/gif 142.251.167.157
Google LLC

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAESDk9wZXJhdGlvbkVycm9yGpgBc2hhcmVkU3RvcmFnZS53b3JrbGV0LmFkZE1vZHVsZSBpcyBkaXNhYmxlZCBiZWNhdXNlIGVpdGhlciBzaGFyZWRTdG9yYWdlIGlzIGRpc2FibGVkIG9yIGJvdGggc2hhcmVkU3RvcmFnZS5zZWxlY3RVUkwgYW5kIHByaXZhdGVBZ2dyZWdhdGlvbiBhcmUgZGlzYWJsZWQ%3D

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.157 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

ww-in-f157.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.googleadservices.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 14 May 2026 09:33:24 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6A21 0
0 45ms
45ms Fetch
image/gif 142.251.167.157
Google LLC

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAIgATpTbW9kZWxfcGVyc29uX2NvdW50cnlfY29kZV9DQV9wZXJzb25fcmVnaW9uX2NvZGVfNTE3NTY1NjI2NTYzNWY0ZDZmNmU3NDcyNjU2MTZjLmpzb25IyAFSGkNKS1M0TXk4dUpRREZmY0ZIQUFkY0hNbm5RWiQIzBAQm50BGOyYPSCmhakEKEAwAjgBXQAAgD%2FqAQYIZBhkIGQ%3D

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.157 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

ww-in-f157.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.googleadservices.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 14 May 2026 09:33:24 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 505 B
169 B 256ms
255ms Fetch
text/plain 192.178.155.155
Google LLC

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=6265647328545851&correlator=3473114114908370&eid=31098551&output=ldjh&gdfp_req=1&vrg=202605130101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=24&didk=46178465&dids=div-gpt-ad-mediafire_com-medre&adfs=1959198455&sfv=1-0-45&rcs=3&eri=1&sc=1&cookie=ID%3D4c907cf15727623e%3AT%3D1778751201%3ART%3D1778751201%3AS%3DALNI_MaDaZ5ZTDiSo5EJt4ZtmZyvBoaSXQ&gpic=UID%3D000013894fcd7a92%3AT%3D1778751201%3ART%3D1778751201%3AS%3DALNI_MYl5oJsAwAqe897fEVIZyg0ne9Asw&abxe=1&dt=1778751204424&lmt=1778751204&adxs=27&adys=1109&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE0OC4wLjc3NzguMTY3IixudWxsLDAsbnVsbCwiNjQiLFtbIkNocm9taXVtIiwiMTQ4LjAuMC4wIl0sWyJHb29nbGUgQ2hyb21lIiwiMTQ4LjAuMC4wIl0sWyJOb3QtQS5CcmFuZCIsIjI0LjAuMC4wIl1dLDBd&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F28rrtqxs0afdpk3%2FGambonanza-v1.0.16-full-apkvision.apk%2Ffile&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&a3p=EqsBCgpjcml0ZW8uY29tEpoBcWlrbk5WOVpVM2hOYmxSdE5UaDFORVl5ZFhWUWNGSlhjV3g2VGsxWVdIVjZTMDVPVVRsUVRUQmpObmhXTVc5SFlubExlalZuYUZOSGQxazRNMDlaZUZORlRIRndNR1J4Um1KWmMzVlRUVVpqY1hKRGJHbzFaVGhVVkdkT2FqQk5UR2hsVERCVFQyOHhaVGx4U1RCMVVTVXpSQVgBEjYKDGFkc2VydmVyLm9yZxIkNTRkYjhjY2UtZjUzMy00ZDMyLThiMmYtY2Y1MDFjNGU2Zjc5WAESNAoKcHViY2lkLm9yZxIkM2I3MTc1OWUtNDk1ZC00ZGFmLTk4ODktZmNiOGQ1NjdlY2EzWAESHAoNY3J3ZGNudHJsLm5ldBiCwdWu4jNIAFICCGQSHQoOZXNwLmNyaXRlby5jb20YgsHVruIzSABSAghkEhgKCXlhaG9vLmNvbRjkxNWu4jNIAFICCG8SPgoFb3BlbngSLGV5SnBJam9pVUVWT1RrdzVhVmhSUTBOMWJETnNXR0pEYWxsWlFUMDlJbjA9GMzF1a7iM0gAEpYCCghydGJob3VzZRKAAlNmaVZqQWlld1l6cWh4ZTNnQVhGNlZxRGFMdnVVRW9VYkNlditvOHJ3MURhSThRVVo5eEVTczQrN0FRaEd2T0pBM0N3L1JPK3hVQlEvWmhsR1lMVndEdEtuRGNDVFFVcThrOWRkUVpjRTZSd291ODkwTDZQZVlPdzBUdCtUeXIzSFA4NGY2NUxrSms2L3JSei9CQ2dCenJ0TnlBc29lRUdXYU0zYUxoalpoRHc1RXNMYkttMTV5Ky8vVUtIL3VyZldVc0lZZlJDTjFMbUpFWnZ2UVprWEhyRnZSYnc1NEc5ek43VTJ3dHpTanJYK2pMYmNZV0ZvL1pNQ0VLcUNoMHUY4MbVruIzSAA.&dlt=1778751198874&idt=2419&ppid=142e99cc7726b3a439aa50ec804b6bbe&uule=a%20cm9sZToxIHByb2R1Y2VyOjEyIGxvYzoiSDNCLENBIg%3D%3D&prev_scp=a%3D1%26iid1%3D6924024930410049%26eid%3D6924024930410049%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D1%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252F28rrtqxs0afdpk3%252FGambonanza-v1.0.16-full-apkvision.apk%252Ffile%26path%3D%252Ffile%252F28rrtqxs0afdpk3%252FGambonanza-v1.0.16-full-apkvision.apk%252Ffile%26ap%3D1100%26sap%3D1100%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D4%26at%3Dmbf%26adr%3D399%26ezosn%3D7%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-medrectangle-2%26tap%3Dmediafire_com-medrectangle-2-6924024930410049%26eb_br%3Dzero%26eba%3D0%26bv%3D12%26bvm%3D0%26bvr%3D2%26avc%3D49%26evc%3D35%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D0%26br2%3D34%26ezoic%3D1%26nmau%3D2%26mau%3D0%26stl%3D83%2C152%2C154%2C27%2C51%2C193%2C88%2C20%2C26%2C171%2C205%2C0%2C158%2C173%2C901%2C902%2C903%26deal1%3D18%2C1428%2C2693%2C3052%2C3053%2C3856%2C4276%2C7331%2C8229%2C8290%2C8296%2C8299%2C8333%2C8334%2C8335%26osb%3DLinux%252FChrome%26dbg%3Drc%253A5%26reqt%3D1778751203816&cust_params=li-module-enabled%3Dt0&adks=1630800042&frm=20&eo_id_str=ID%3D777f7e13823df6a9%3AT%3D1778751201%3ART%3D1778751201%3AS%3DAA-AfjYoKIs1prfKFD6uebUMaLzZ&pbbce=1

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=dd428baff9

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.155.155 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

yuiadrs-in-f155.1e100.net

Software

cafe /

Resource Hash

9c8d07e7330bce5cf95ebcc0e3dc86a81ffd411665bf468a0ba667ff5b8ad660

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: dcb
google-lineitem-id: -2
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 14 May 2026 09:33:24 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.mediafire.com
content-length: 139
x-xss-protection: 0
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 505 B
168 B 326ms
326ms Fetch
text/plain 192.178.155.155
Google LLC

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=6265647328545851&correlator=2467769425297419&eid=31098551&output=ldjh&gdfp_req=1&vrg=202605130101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=25&didk=219167732&dids=div-gpt-ad-mediafire_com-medre&adfs=2995551083&sfv=1-0-45&rcs=3&eri=1&sc=1&cookie=ID%3D4c907cf15727623e%3AT%3D1778751201%3ART%3D1778751201%3AS%3DALNI_MaDaZ5ZTDiSo5EJt4ZtmZyvBoaSXQ&gpic=UID%3D000013894fcd7a92%3AT%3D1778751201%3ART%3D1778751201%3AS%3DALNI_MYl5oJsAwAqe897fEVIZyg0ne9Asw&abxe=1&dt=1778751204435&lmt=1778751204&adxs=795&adys=1109&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=2&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE0OC4wLjc3NzguMTY3IixudWxsLDAsbnVsbCwiNjQiLFtbIkNocm9taXVtIiwiMTQ4LjAuMC4wIl0sWyJHb29nbGUgQ2hyb21lIiwiMTQ4LjAuMC4wIl0sWyJOb3QtQS5CcmFuZCIsIjI0LjAuMC4wIl1dLDBd&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F28rrtqxs0afdpk3%2FGambonanza-v1.0.16-full-apkvision.apk%2Ffile&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&a3p=EqsBCgpjcml0ZW8uY29tEpoBcWlrbk5WOVpVM2hOYmxSdE5UaDFORVl5ZFhWUWNGSlhjV3g2VGsxWVdIVjZTMDVPVVRsUVRUQmpObmhXTVc5SFlubExlalZuYUZOSGQxazRNMDlaZUZORlRIRndNR1J4Um1KWmMzVlRUVVpqY1hKRGJHbzFaVGhVVkdkT2FqQk5UR2hsVERCVFQyOHhaVGx4U1RCMVVTVXpSQVgBEjYKDGFkc2VydmVyLm9yZxIkNTRkYjhjY2UtZjUzMy00ZDMyLThiMmYtY2Y1MDFjNGU2Zjc5WAESNAoKcHViY2lkLm9yZxIkM2I3MTc1OWUtNDk1ZC00ZGFmLTk4ODktZmNiOGQ1NjdlY2EzWAESHAoNY3J3ZGNudHJsLm5ldBiCwdWu4jNIAFICCGQSHQoOZXNwLmNyaXRlby5jb20YgsHVruIzSABSAghkEhgKCXlhaG9vLmNvbRjkxNWu4jNIAFICCG8SPgoFb3BlbngSLGV5SnBJam9pVUVWT1RrdzVhVmhSUTBOMWJETnNXR0pEYWxsWlFUMDlJbjA9GMzF1a7iM0gAEpYCCghydGJob3VzZRKAAlNmaVZqQWlld1l6cWh4ZTNnQVhGNlZxRGFMdnVVRW9VYkNlditvOHJ3MURhSThRVVo5eEVTczQrN0FRaEd2T0pBM0N3L1JPK3hVQlEvWmhsR1lMVndEdEtuRGNDVFFVcThrOWRkUVpjRTZSd291ODkwTDZQZVlPdzBUdCtUeXIzSFA4NGY2NUxrSms2L3JSei9CQ2dCenJ0TnlBc29lRUdXYU0zYUxoalpoRHc1RXNMYkttMTV5Ky8vVUtIL3VyZldVc0lZZlJDTjFMbUpFWnZ2UVprWEhyRnZSYnc1NEc5ek43VTJ3dHpTanJYK2pMYmNZV0ZvL1pNQ0VLcUNoMHUY4MbVruIzSAA.&dlt=1778751198874&idt=2419&ppid=142e99cc7726b3a439aa50ec804b6bbe&uule=a%20cm9sZToxIHByb2R1Y2VyOjEyIGxvYzoiSDNCLENBIg%3D%3D&prev_scp=a%3D1%26iid1%3D6924024930410049%26eid%3D6924024930410049%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D1%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252F28rrtqxs0afdpk3%252FGambonanza-v1.0.16-full-apkvision.apk%252Ffile%26path%3D%252Ffile%252F28rrtqxs0afdpk3%252FGambonanza-v1.0.16-full-apkvision.apk%252Ffile%26ap%3D1100%26sap%3D1100%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D4%26at%3Dmbf%26adr%3D399%26ezosn%3D8%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-medrectangle-2%26tap%3Dmediafire_com-medrectangle-2-6924024930410049%26eb_br%3Dzero%26eba%3D0%26bv%3D12%26bvm%3D0%26bvr%3D2%26avc%3D49%26evc%3D35%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D0%26br2%3D34%26ezoic%3D1%26nmau%3D2%26mau%3D1%26stl%3D157%2C14%2C0%2C0%2C0%2C168%2C184%2C20%2C0%2C0%2C192%2C31%2C902%2C903%2C901%2C902%2C903%26deal1%3D18%2C1428%2C2693%2C3052%2C3053%2C3856%2C4276%2C7331%2C8229%2C8290%2C8296%2C8299%2C8333%2C8334%2C8335%26osb%3DLinux%252FChrome%26dbg%3Dadap%253A1%2Crc%253A6%26reqt%3D1778751203847&cust_params=li-module-enabled%3Dt0&adks=1277576459&frm=20&eo_id_str=ID%3D777f7e13823df6a9%3AT%3D1778751201%3ART%3D1778751201%3AS%3DAA-AfjYoKIs1prfKFD6uebUMaLzZ&pbbce=1

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=dd428baff9

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.155.155 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

yuiadrs-in-f155.1e100.net

Software

cafe /

Resource Hash

4e619a65afadc616566b4526824f8b3cffd0588c54ff43c0ad22992edac5cbd6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: dcb
google-lineitem-id: -2
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 14 May 2026 09:33:24 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.mediafire.com
content-length: 138
x-xss-protection: 0
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 496 B
160 B 279ms
278ms Fetch
text/plain 192.178.155.155
Google LLC

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=6265647328545851&correlator=322096796048709&eid=31098551&output=ldjh&gdfp_req=1&vrg=202605130101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=26&didk=1697938527&dids=div-gpt-ad-mediafire_com-box-2&adfs=2211965457&sfv=1-0-45&rcs=3&eri=1&sc=1&cookie=ID%3D4c907cf15727623e%3AT%3D1778751201%3ART%3D1778751201%3AS%3DALNI_MaDaZ5ZTDiSo5EJt4ZtmZyvBoaSXQ&gpic=UID%3D000013894fcd7a92%3AT%3D1778751201%3ART%3D1778751201%3AS%3DALNI_MYl5oJsAwAqe897fEVIZyg0ne9Asw&abxe=1&dt=1778751204521&lmt=1778751204&adxs=552&adys=10&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=4&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE0OC4wLjc3NzguMTY3IixudWxsLDAsbnVsbCwiNjQiLFtbIkNocm9taXVtIiwiMTQ4LjAuMC4wIl0sWyJHb29nbGUgQ2hyb21lIiwiMTQ4LjAuMC4wIl0sWyJOb3QtQS5CcmFuZCIsIjI0LjAuMC4wIl1dLDBd&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F28rrtqxs0afdpk3%2FGambonanza-v1.0.16-full-apkvision.apk%2Ffile&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&a3p=EqsBCgpjcml0ZW8uY29tEpoBcWlrbk5WOVpVM2hOYmxSdE5UaDFORVl5ZFhWUWNGSlhjV3g2VGsxWVdIVjZTMDVPVVRsUVRUQmpObmhXTVc5SFlubExlalZuYUZOSGQxazRNMDlaZUZORlRIRndNR1J4Um1KWmMzVlRUVVpqY1hKRGJHbzFaVGhVVkdkT2FqQk5UR2hsVERCVFQyOHhaVGx4U1RCMVVTVXpSQVgBEjYKDGFkc2VydmVyLm9yZxIkNTRkYjhjY2UtZjUzMy00ZDMyLThiMmYtY2Y1MDFjNGU2Zjc5WAESNAoKcHViY2lkLm9yZxIkM2I3MTc1OWUtNDk1ZC00ZGFmLTk4ODktZmNiOGQ1NjdlY2EzWAESHAoNY3J3ZGNudHJsLm5ldBiCwdWu4jNIAFICCGQSHQoOZXNwLmNyaXRlby5jb20YgsHVruIzSABSAghkEhgKCXlhaG9vLmNvbRjkxNWu4jNIAFICCG8SPgoFb3BlbngSLGV5SnBJam9pVUVWT1RrdzVhVmhSUTBOMWJETnNXR0pEYWxsWlFUMDlJbjA9GMzF1a7iM0gAEpYCCghydGJob3VzZRKAAlNmaVZqQWlld1l6cWh4ZTNnQVhGNlZxRGFMdnVVRW9VYkNlditvOHJ3MURhSThRVVo5eEVTczQrN0FRaEd2T0pBM0N3L1JPK3hVQlEvWmhsR1lMVndEdEtuRGNDVFFVcThrOWRkUVpjRTZSd291ODkwTDZQZVlPdzBUdCtUeXIzSFA4NGY2NUxrSms2L3JSei9CQ2dCenJ0TnlBc29lRUdXYU0zYUxoalpoRHc1RXNMYkttMTV5Ky8vVUtIL3VyZldVc0lZZlJDTjFMbUpFWnZ2UVprWEhyRnZSYnc1NEc5ek43VTJ3dHpTanJYK2pMYmNZV0ZvL1pNQ0VLcUNoMHUY4MbVruIzSAA.&dlt=1778751198874&idt=2419&ppid=142e99cc7726b3a439aa50ec804b6bbe&uule=a%20cm9sZToxIHByb2R1Y2VyOjEyIGxvYzoiSDNCLENBIg%3D%3D&prev_scp=a%3D1%26iid1%3D8206134848363251%26eid%3D8206134848363251%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D1%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252F28rrtqxs0afdpk3%252FGambonanza-v1.0.16-full-apkvision.apk%252Ffile%26path%3D%252Ffile%252F28rrtqxs0afdpk3%252FGambonanza-v1.0.16-full-apkvision.apk%252Ffile%26ap%3D1103%26sap%3D1103%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D4%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-box-2%26tap%3Dmediafire_com-box-2-8206134848363251%26eb_br%3Dbf9a045b836005b6c23b7b0749249612%26eba%3D0%26bv%3D51%26bvm%3D0%26bvr%3D12%26avc%3D93%26evc%3D46%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D26%26br2%3D46%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D157%2C168%2C0%2C0%2C0%2C168%2C184%2C20%2C0%2C0%2C192%2C31%2C902%2C903%2C901%2C902%2C903%26deal1%3D2693%2C3045%2C3053%2C4276%2C7330%2C7331%2C8290%2C8296%2C8299%2C8300%2C8303%2C8312%2C8334%2C8335%26osb%3DLinux%252FChrome%26dbg%3Drc%253A2%26reqt%3D1778751203843&cust_params=li-module-enabled%3Dt0&adks=3106951849&frm=20&eo_id_str=ID%3D777f7e13823df6a9%3AT%3D1778751201%3ART%3D1778751201%3AS%3DAA-AfjYoKIs1prfKFD6uebUMaLzZ&pbbce=1

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=dd428baff9

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.155.155 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

yuiadrs-in-f155.1e100.net

Software

cafe /

Resource Hash

28589d83684c01d7482be0f0d749f9dbb3cdb4a369342aea0e62d95c36571747

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: dcb
google-lineitem-id: -2
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 14 May 2026 09:33:24 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.mediafire.com
content-length: 130
x-xss-protection: 0
server: cafe

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame D33C 42 B
65 B 50ms
50ms Fetch
image/gif 142.251.167.157
Google LLC

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstXfN2zyWVMxoRjy3WvPEigA-tdzFok22n7JUVRVksmj8y2tElDQWup5e_XnxAP57fbbpxxb8D8NCpSF19vzte_aWb9FZCkzJzl-pdyeFmaqpA9cooUlMIuuPgDENdOeT5RA_z7AxyqLOCeLFU7r1E0q1zp3NOXBDMdZDN5qn8mlGPwHUaCqA&sig=Cg0ArKJSzNH3sFpgW5VcEAE&id=lidar2&mcvt=1000&p=300,0,900,160&tm=1010.5&tu=11&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20260513&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=966014519&rs=4&la=0&cr=0&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE0OC4wLjc3NzguMTY3IixudWxsLDAsbnVsbCwiNjQiLFtbIkNocm9taXVtIiwiMTQ4LjAuMC4wIl0sWyJHb29nbGUgQ2hyb21lIiwiMTQ4LjAuMC4wIl0sWyJOb3QtQS5CcmFuZCIsIjI0LjAuMC4wIl1dLDBd&vs=4&r=v&co=7468400300&rst=1778751203378&rpt=286&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&fle=0&vae=0&spb=0&sfl=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.157 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

ww-in-f157.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Thu, 14 May 2026 09:33:24 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 33 KB
12 KB 293ms
292ms Fetch
text/plain 192.178.155.155
Google LLC

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=6265647328545851&correlator=721333674270591&eid=31098551&output=ldjh&gdfp_req=1&vrg=202605130101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=27&didk=1697938527&dids=div-gpt-ad-mediafire_com-box-2&adfs=2211965457&sfv=1-0-45&rcs=4&eri=1&sc=1&cookie=ID%3D4c907cf15727623e%3AT%3D1778751201%3ART%3D1778751201%3AS%3DALNI_MaDaZ5ZTDiSo5EJt4ZtmZyvBoaSXQ&gpic=UID%3D000013894fcd7a92%3AT%3D1778751201%3ART%3D1778751201%3AS%3DALNI_MYl5oJsAwAqe897fEVIZyg0ne9Asw&abxe=1&dt=1778751205522&lmt=1778751205&adxs=552&adys=10&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=4&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE0OC4wLjc3NzguMTY3IixudWxsLDAsbnVsbCwiNjQiLFtbIkNocm9taXVtIiwiMTQ4LjAuMC4wIl0sWyJHb29nbGUgQ2hyb21lIiwiMTQ4LjAuMC4wIl0sWyJOb3QtQS5CcmFuZCIsIjI0LjAuMC4wIl1dLDBd&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F28rrtqxs0afdpk3%2FGambonanza-v1.0.16-full-apkvision.apk%2Ffile&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&a3p=EqsBCgpjcml0ZW8uY29tEpoBcWlrbk5WOVpVM2hOYmxSdE5UaDFORVl5ZFhWUWNGSlhjV3g2VGsxWVdIVjZTMDVPVVRsUVRUQmpObmhXTVc5SFlubExlalZuYUZOSGQxazRNMDlaZUZORlRIRndNR1J4Um1KWmMzVlRUVVpqY1hKRGJHbzFaVGhVVkdkT2FqQk5UR2hsVERCVFQyOHhaVGx4U1RCMVVTVXpSQVgBEjYKDGFkc2VydmVyLm9yZxIkNTRkYjhjY2UtZjUzMy00ZDMyLThiMmYtY2Y1MDFjNGU2Zjc5WAESNAoKcHViY2lkLm9yZxIkM2I3MTc1OWUtNDk1ZC00ZGFmLTk4ODktZmNiOGQ1NjdlY2EzWAESHAoNY3J3ZGNudHJsLm5ldBiCwdWu4jNIAFICCGQSHQoOZXNwLmNyaXRlby5jb20YgsHVruIzSABSAghkEhgKCXlhaG9vLmNvbRjkxNWu4jNIAFICCG8SPgoFb3BlbngSLGV5SnBJam9pVUVWT1RrdzVhVmhSUTBOMWJETnNXR0pEYWxsWlFUMDlJbjA9GMzF1a7iM0gAEpYCCghydGJob3VzZRKAAlNmaVZqQWlld1l6cWh4ZTNnQVhGNlZxRGFMdnVVRW9VYkNlditvOHJ3MURhSThRVVo5eEVTczQrN0FRaEd2T0pBM0N3L1JPK3hVQlEvWmhsR1lMVndEdEtuRGNDVFFVcThrOWRkUVpjRTZSd291ODkwTDZQZVlPdzBUdCtUeXIzSFA4NGY2NUxrSms2L3JSei9CQ2dCenJ0TnlBc29lRUdXYU0zYUxoalpoRHc1RXNMYkttMTV5Ky8vVUtIL3VyZldVc0lZZlJDTjFMbUpFWnZ2UVprWEhyRnZSYnc1NEc5ek43VTJ3dHpTanJYK2pMYmNZV0ZvL1pNQ0VLcUNoMHUY4MbVruIzSAA.&dlt=1778751198874&idt=2419&ppid=142e99cc7726b3a439aa50ec804b6bbe&uule=a%20cm9sZToxIHByb2R1Y2VyOjEyIGxvYzoiSDNCLENBIg%3D%3D&prev_scp=a%3D1%26iid1%3D8206134848363251%26eid%3D8206134848363251%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D1%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252F28rrtqxs0afdpk3%252FGambonanza-v1.0.16-full-apkvision.apk%252Ffile%26path%3D%252Ffile%252F28rrtqxs0afdpk3%252FGambonanza-v1.0.16-full-apkvision.apk%252Ffile%26ap%3D1103%26sap%3D1103%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D5%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-box-2%26tap%3Dmediafire_com-box-2-8206134848363251%26eb_br%3De29f69dd468d31a5514dc9b5587ce757%26eba%3D0%26bv%3D51%26bvm%3D0%26bvr%3D12%26avc%3D93%26evc%3D46%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D16%26br2%3D46%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D157%2C168%2C0%2C0%2C0%2C168%2C184%2C20%2C0%2C0%2C192%2C31%2C902%2C903%2C901%2C902%2C903%26deal1%3D18%2C1428%2C2693%2C3045%2C3052%2C3053%2C4276%2C7330%2C7331%2C8290%2C8296%2C8299%2C8300%2C8303%2C8312%2C8333%2C8334%2C8335%26osb%3DLinux%252FChrome%26dbg%3Drc%253A2%26reqt%3D1778751204858&cust_params=li-module-enabled%3Dt0&adks=3106951849&frm=20&eo_id_str=ID%3D777f7e13823df6a9%3AT%3D1778751201%3ART%3D1778751201%3AS%3DAA-AfjYoKIs1prfKFD6uebUMaLzZ&pbbce=1

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=dd428baff9

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.155.155 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

yuiadrs-in-f155.1e100.net

Software

cafe /

Resource Hash

c94a842a66efa5685dcaab82809f28dff21444029c497968fa84c9107fad0fde

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: dcb
google-lineitem-id: -1
observe-browsing-topics: ?1
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 14 May 2026 09:33:25 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -1
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.mediafire.com
content-length: 12452
x-xss-protection: 0
server: cafe

GET
H2 200 container.html Show response
409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/safeframe/1-0-45/html/ Frame A358 7 KB
0 0ms
0ms Document
text/html 142.251.163.132
Google LLC

General

Check archive.org

Download Go to

Full URL

https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202605130101/pubads_impl.js?cb=31098551

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.132 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

wv-in-f132.1e100.net

Software

sffe /

Resource Hash

f1a68bf826c55985468304f4284a09cb8a68e82503d764166e611a7c58a85a4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.mediafire.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 3121
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 14 May 2026 09:33:21 GMT
expires: Thu, 14 May 2026 09:33:21 GMT
last-modified: Thu, 08 May 2025 23:15:48 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 200 lcpm Show response
go.ezodn.com/ 12 B
436 B 56ms
54ms Fetch
application/json 104.21.87.79
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://go.ezodn.com/lcpm
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=dd428baff9
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.87.79 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 44c84fdb0f1d181f47b9fb0b88a159721fa24eb42054caad09d1c6d81017ef3a

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
Content-Type: application/json
sec-ch-ua-mobile: ?0

Response headers

nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-cache-status: DYNAMIC
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=KZoDIx4BSg%2FytEAGgjfzxJ%2B8kpCXe%2FuZR9DJZ7yZgqBAjdkdGCQufxMtAvnsgZaApIzQ6x87Zzm1kaBedJufTziX9%2Bw5eu%2FuFf1cgL%2FUW5QEewm%2FN0yW0W1hrrzwKwQ%3D"}]}
cf-ray: 9fb8e6bc8970a2d9-YYZ
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
content-length: 12
server-timing: cfExtPri
date: Thu, 14 May 2026 09:33:25 GMT
content-type: application/json
vary: Accept-Encoding
server: cloudflare
priority: u=1,i

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 36EE 652 B
254 B 187ms
74ms Document
text/html 172.253.63.155
Google LLC

General

Check archive.org

Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CI__1AIQoIHhnQIYwuGB4gEwAQ&v=APEucNXLP7JnI5hsBi9LCRRPX3AEFH9O2vWuThz1Thb3R3YP5cpNUfpBm5LFoAeWSglnMgkqJmilODxsu2jkyFRh2WxMB_9IKYIPYy6cc3KG1tl-UVOfXqw

Requested by

Host: 409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com
URL: https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.155 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

bi-in-f155.1e100.net

Software

cafe /

Resource Hash

8c04e118bdd5757192be2a1eb360786f9fa1c4b398806430b7f41f203f64d8e6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 234
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 14 May 2026 09:33:26 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame A358 104 KB
35 KB 55ms
54ms Script
text/javascript 142.251.167.157
Google LLC

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com
URL: https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.157 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

ww-in-f157.1e100.net

Software

cafe /

Resource Hash

f85281fb0d5bb6b5f0b523958ae876be0fafea67fdf7bf8c04c3d910e0a5feea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
etag: 13151205667520950133
x-content-type-options: nosniff
expires: Thu, 14 May 2026 09:33:25 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 14 May 2026 09:33:25 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 35998
x-xss-protection: 0
server: cafe

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame A358 42 B
63 B 47ms
46ms Image
image/gif 142.251.167.157
Google LLC

General

Check archive.org

Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DvCgSpVjHw_chNzur-iu0DgRqve5XybvdEpgXW5tw1VmQKGFG035IYlXvZTVb7HLWH6lMBrnXovfRkLgwnT_EvcwMrHm22TGDpAKFHR9NvSUVmrqE

Requested by

Host: 409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com
URL: https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.157 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

ww-in-f157.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Thu, 14 May 2026 09:33:25 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20260513/r20110914/client/ Frame A358 3 KB
0 1ms
1ms Script
text/javascript 142.251.167.132
Google LLC

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20260513/r20110914/client/window_focus_fy2021.js

Requested by

Host: 409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com
URL: https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.167.132 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

ww-in-f132.1e100.net

Software

cafe /

Resource Hash

8b925b4e5891d39f0ce66a499c87d39286e308916e3ad36dcd22b7548079d30f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
etag: 7208902950285533371
age: 2609
x-content-type-options: nosniff
expires: Thu, 28 May 2026 08:49:54 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 14 May 2026 08:49:54 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 1227
x-xss-protection: 0
server: cafe

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20260513/r20110914/client/ Frame A358 20 KB
0 0ms
0ms Script
text/javascript 142.251.167.132
Google LLC

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20260513/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com
URL: https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.167.132 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

ww-in-f132.1e100.net

Software

cafe /

Resource Hash

72869ba28dbe7dfde1cac4d1bd0ea84e491738e0fd578232aaaf90c693095b6c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
etag: 11196190604902853639
age: 2979
x-content-type-options: nosniff
expires: Thu, 28 May 2026 08:43:44 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 14 May 2026 08:43:44 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 8623
x-xss-protection: 0
server: cafe

GET l
www.google.com/ads/measurement/ Frame A358 0
0

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame A358 238 KB
0 1ms
1ms Script
text/javascript 142.251.167.157
Google LLC

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: 409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com
URL: https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.157 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

ww-in-f157.1e100.net

Software

cafe /

Resource Hash

05c031fcdb94d1b3a011bbd713d70122286841a6ecd3e4a6c480077c139792de

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
etag: 17047940826023111822
age: 824
x-content-type-options: nosniff
expires: Thu, 14 May 2026 10:19:39 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 14 May 2026 09:19:39 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 74908
x-xss-protection: 0
server: cafe

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame A358 0
20 B 47ms
46ms Ping
image/gif 142.251.167.157
Google LLC

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=6639716422147&version=m202604070101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.157 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

ww-in-f157.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 14 May 2026 09:33:25 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame A358 0
20 B 47ms
47ms Ping
image/gif 142.251.167.157
Google LLC

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=6639716422147&version=m202604070101&ct=77&x=1&cor=7421199761382883328

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.157 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

ww-in-f157.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 14 May 2026 09:33:25 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame A358 35 KB
20 KB 89ms
88ms Script
text/javascript 172.253.63.155
Google LLC

General

Check archive.org

Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Bep5NVUdlpG1cDpz7RzpumX0oIENY_loHlrTJfz8c1kFpulPzkGyGnqsFv9C3qDNgM9W8nvoZn7shpxitNCofo_8YOrE8_OxkpiTgvN17Lv3fSIXi2qnVJ3EHoVuVUYx2yB7pS25PoqlCQa-2AvGJu_nebwxtc119fF8nYmQ5ukDJWngUcHXu4GPdH0GCe-4Ypba-uBd9iw-7eEUOKVJlBQDvFCDdRyqUbq1-p68wcQnIVgMTSLYnDocT5yqIcBBhLoLFm8F9SrqthoxgZ7gvOLeiw7w&cry=1&dbm_d=AKAmf-AKvlw7PeIIE7DrySkSUYwblxpaUOMz7qs1Te3ax1oaLGd8C_L1okmCRCklqfdJsHABJ2Qvl3w65DwRetlHH5HMXZ_M4n4FYkGG9MGs8yGwC97DiVQfIMptZaxGYgNM7N6YlZNmk1X0wWrbEbHfmkrNB44G2OJZbY1FUFdBMT6Vz4cO92Ju444MbUutSMIOb1HiFpxpJ0Hvgq3b316-0vysCf5TFbN9We6nda2ousmdsqx8lg6yLdorFFqHtgQrr7mywb72TAxUyn8o2Nt91FT1GqQjtPvj3LCjVfwNiPy5vpAK4q2-MogT0ykXsRBzu37Bgj_Ce73DaQcq76KnAnHZJ0WxltER2-0eLKkmtRtJVQ8X1ry93Dj3cDiFy0Bvcojc3Q3dwVZ4dbpW0UX-OZZdk2YUTCSty_28-UyhgzUGO65k4rcJl5rQ7hmzgxdtuSXpsOXE75-9J9w_D4iXbcgdFv84O01xki0GLoWzXn75JYmvc6n1wb6MjvNWSBvY7SL0GaOr8V-6cgtz-7hdN8pXCGB4yKuBwVKNchGCbPcGRkCv5iKU59TgEcXnWt4xL7XXSApcJendsuKGNyTds8DgRCKQVVNcdvNQel8E0zacNQrZXXDm3x2t4oFoTHs53zT2UGpQsour0OH-ygaM05Zcnva4UE3A51mhurnq8PHaIwS18SF_0iY-WxXWKBW8wvjvQ64XCH1NuLYJpieMiJr2i1hnsk5zj_q2WPaYxjRLZdrpbabR3p01hbiYbR18RjSYn2jbuNx0-p_JSqoZ9RI9nAsmdP5VeV2ggtllYqR3E3a4CmFca4Wj6LgOutS5zOm0Mkq2T7piLYqRgg8zSrZHlCLBFWex3kkCerwwzpJw97kg60INZQDAzk4a3xrrhW0j3obuFv2UBTJyMeB3BtlBK8o-a-ORlSWNx7LKTc91hU94smZvurK9ELoHs8YRfd7vDf4-CL2-e2966i1gOrqYrnJ5-jzlCl92YFTs0YOORg7S49JY2rR92SlQHLebI70UKGKR4NZJpZbpgsct9hLtcX6Ycy-nBe0wVZD7J_mKRfQQdjCmCY7gFgQ-Tybvdayt0dEa3b9K4kGepjsz_Gbkk3YyiBu5kkc9iNlV9MZAbE_8P2lYZZ9HvG6zqHMqiz8cQLeQr6EAsR3GG6Z-M9M-DZU8T41uovM8uqEIUgUHEq4_3nKaCizeLE61zeh1HBus9CP-09vNsyTNVcLmMcRNHvFWB_edMFNfZC0jy923b6AC7KkzeOKUVwJ1O5awf7VMM0-s5b8_tueGWx1Z6X49ccJkiKxUN99WUHkmeYnYIwoBKW8-zyp3iw7S2FdgdRoaoFfZSeLWgDJFuJkBimkiWS56g407BJFo7eroLlkG9N6U92w2LXZtEbxMiJVCNi2NsPvC5tSZ9q763m1ysMupLpUAzOmc4vwR6XKlvOHv-Gri4mVLjvf_WRHrSFxKd7jEElaDbxMYwinA_9UB6ZnpGVYEQw0ljOUb4bXZz2j-wRXyXSGSWhWPEnfyyL69kVN91H5FEL5O2NKDKKYBFokkqvwju9hP0mGFy1BC7bNoVwklgZjp2Y_yzSS-SldNtxVaUaSPdIRm__a1P3Z8yvDfHqKATh_knAW9TOh1GcyC4MEKoSO1DH9ASKSC8Lyj6FPEhFusmpRJfS2l6HMRlpLFTPVPAdJjt3oFvYmTZWDEvtcqf5YXqGKpnZJMp3hZmP_yHg_TVVmCT2Ld6rQDw7r7PPhA8SLh2YxSlk0WzKxJPCJoSrPatAgQ1tvERPbm448EejaGr0M7LCDRHpHB9n5_kQ87sDiBKLBoa207-1vwJFxg43hPm5azyGWzSkMBTE4Ia3ckZ_4HkqlQbOLq98_MD8uSo0V8kWWK_cXmyUMCawzrblH3NoGyDN9Ng5mmNijLWH8QStLRo_7fa2Ol9sDU-4FjJU2OPGguOY12wb7kKCSv49n16arrqtHuD4uWxeSP0lettuyfj7iJwzfLTu8X5L7_SwqY2g4A3-jiqbdFeN7SYb4KYTK6vXacxepPgpET-YYm6RrmddbW9HcGPhJGAxVpNGJWZxwSj8Pb1-W0VN2YdUDesg6l-n837lBB1Q8wxHqQ3AUtryjwDkjm6l3eSZh6iWXvwyr6RTtIEfAo9oR-C7IDZjQOueHpF9iyWU7yjLiyGA3sxOxiGEDmWO6oxrNEpPo1w_nmIYvg8ogVaqmJ6wOLdb63UTlyqlX3LwJQKC-1xLzI_oMy8YsKJcji_9hhsToAkTwWyyKKuK2TID6g7Fdyrf9GXsL4_HDfSdD1UbPrytNnHSdlQIkdG5Ap-0Cwe3CNXRlF5_KiPO9Cp8KFGuR4USTngirJswQu2DtoMJiPunxQ9SnNDfhsh9DT8z2dVkaecpSxsIP3OOCiU2UiSk1pMYg8Us8dwh3uwxohCDKVNzjwRvSXnQN93M3WDHKlK2L1HoKQd5dmAm7HGqLUWO8pFodJEI0_zT0yZgl7U9vEYRJvx5NOThApmYgo4eLS5BAS3xD8N_51v_HLIyZtsY6LChACtLxTkfrfXP0K7Fc668d3Auqo_7eokkTrBzBzGFVsU0gtqPCf8ZP_kzjS1zixs1yLN24J3pIUy_T-XeNMhDTYAKPI_yQuZeDj5AiR2OjVN_hsG_K2zXVJ74L66Zd8Hb4GViFzXbOdbb-R3Zu_fkAaBnnKUrzkGF7Hed6qGDGelbJ6ouQ1nLr2TaGHd6qbQsZ_9g6O7eJL0kwqZX_QiyoHKmbK4BIrZSgLOe5jmEUNdkBqMVuPB3L8kr1FMoh6eAh8JzDmcI1zDrvrrHNpYR-Gnw6agzS2_S07FJ1XPEWxcFHyC4DW9orQHFwMnUZkJ-iQhQY5s9XR6e1ffAxTsb0M60HDV-9fMtOUEKbl19BuYzSa6m1dqg-i2nbUxBWWT2876f2_JxbCIoyTdH6iQYHn4hlgxg_lWufujzgd3E4vNwksjXvbT_f1yZrwbIxh_oieULAHu11CljvGfGmw7yFgkJ2WU0pjUZIvCTBxt5vVHnkHzt0YKD48CKvFPXDnlDL5fXVzG4LJLkmjducMKoXIvmkER7GpuP_g0zdmQSIWNTVqB1UNHWI-9-zvLCS2lChJkp_Xy8zRykf0enP96EGqBeZMS3L_t_ImN9TmYgkJXRXkVDo-trEmoRSpKRmZlGDVqMHg9jY3NxV7NHznxE8JsfFJwz8YYgYrbMPLDe0ZpHLwlEdzCPPGg6n3mjy2PGF4E1yoB3AQwXCZGZh52P_x9iAKKrYYmwhMi3AQqscMaJhRWZqYjyjOn11UZXl5fZ1KlZp_5vDSebSP4BPlW91x-710QavbFNXNtVNqQoG0YKm0HnZAB-5wOQlFW2rbLJA35bfsLOGR3TrTeH36d1waAOzM9vGv6XUJWH3aNa8C6MtsrkHe4K_w7W5138BQEC8im-KtyCVbWfTAwp_lKz3VmAUE3H7pe2u1OHw9txV-BCBpv1AOycfyaGyvpcU0AArKWMjS9zjUWPjiuwmW8WRMa9BP5w0ySmQ9qTNxagmnVw4BSnPeawiPd4_osMIszd9M4UGrB_pqKWaH3ODmdP3k_JhgDn2c-qa2WCFanhewzmnOVUVdLuRn_ic2fdt0ELiLM3RZm4CKOTJJuAnTduZ8xljN5o1XgbBalSSOEn_0c9-27QhvwLv5vO1DIAcR7LHUje1zKLEjd491z6TjJk3tG_lguK-epvkn3ifb2FJil-IwpEkkjfPyyUrNSscS2OZVoGBAU2mb6m3FwjnD19uWoiS6I0soOw2kRIT0WmcB3KpnUkQ28d66AiFqVgNDCikjFua7eXFdE_Mz0A2wGB-_RLKScDRqUgoEWZnnA4HxlZtV9xBmsuZtdFly8nZr0KmCJSVbATFq1YaaoQ4v0R6Pv3fawhAgoSaX05Rbe9XxSNUhSD5jnIGoEMI4tSj9wP_zocdunLKfT32xLGIl0KhOi9hSmxFWr7CDHCGwQDXeb7EJ1lECoBz4gkq-nYpmGR4TBKQCRQbxvYF8rR3av_TkfXFwCyPiFI_ds3WAAZmLKPvTOtH-nvRCPEtrpu_NffuSPEioSpft7UH0GAOZmKZtmrtBjAI2UVw9RWjdANOPjLmEanSGNfE578UtHCrv7yO-JTZp53j2mDhiCBcD6TGZo2km6gyClTiZhnQvRZTQ3pwp84Y6IBEY4Qt-dP004QcbfmtEGi9mb8Qa30TR0cpboAQFEaOiRVzHNfRdA8ZxALNvom3RClwYvltAyaPQyMAn3l65xvS5jKu-7n8VlaG9FbyUkhlRT4CbWV2pz2ti5vTeySTu-2lKj-wOesU3ioGQXoAdh1mqMj0XgIOSfIuMxJBsrBlEIoqMtNYaIaij3JqoSgUQDkwlIxNr7wrPQ5TVKUkujFkjRuWZt-UObV4-Zs_fxiH3U6v1r_GSZ_0Ru8-xH_LuSXfLB3L7nlGRLe6iRpTFLHWWzEk_7ZT6t8k4_VI5sSSx1KIpSQzVBCqMMn02gDXel_WNLIWwKCghmjWhIQb9MQTEPRJfWVa3TNYPGdvJI_ukCyALocR2qK39hrICBIaeM3QPl9nXux07zm8og1-MWVqzCIy9rIIdk3ey3U3Ff2Zk8EfwdzTCyqlFxTXSNFW8NjtKJ8KkWpN9ZPa67TL3NqnC9Eo_3v-DWdzdJcKZJoF_Z_zjT_Cgn_xjSghfK0ipFuZjJpk1sQvMtAyx2Ime3LoEsy4ap9i9NmjSu9C10dKbmuaG0ChYqNKQ-zrQE6zN_3BRh6WLYOmx3XsW9Kc6oisoAN_f3KE30Z0bbyVY0MQPADY9W_9br7TalPrSitZH-17a9yA_1dRqFEqpbQJqTmQyTP_F7hl-zcrQjCe57Flh0gAaWCw0Qe7pgb4oxahlJ35G2-ZaKqPkmm0kBHzgu9JIAdvDtxkENFqnAbAkgFAgPTfD0vCaaPo1cpnra7fEon30FROhuGg&cid=CAQS4gEABaugfQIRQr8HezWpJjRo4141VhO9j1YgEZG9b5tlPKhzAt-u2j4q7j8YDkLapQlz6WWvwxRnsc3_fhbghRjdqqvFVq8MzRJSpzraC_sujexacYZRgFKoh09GEKo8ndraVJU00_7yFpx0WVCmqd9x-MT9TjrA9II5CEc0r4uumTRkwds-4IaRlAeab5NhZJ1lCxKH1XofvQa8FLgYK3Y8NVHimSQdTooAiZLwbSHncraUt0u2c8PmKsKiQSsFsFjN-VAzskqrQHV5tff32OHiNnpbvC8AeUkTW9T5cFwmWkBhGAE&dv3_ver=m202604070101&nel=1&rfl=https%3A%2F%2Fwww.mediafire.com%2F&ds=l&xdt=1&ct=77&iif=1&cor=7421199761382883328&adk=3690638928&idt=62&cac=0&dtd=55

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.155 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

bi-in-f155.1e100.net

Software

cafe /

Resource Hash

af43031d404637c6e09945597ac464fd1744714167eb3e01ed42d26c60c413e9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 20721
date: Thu, 14 May 2026 09:33:26 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 36EE
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm&gdpr=0
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKSEMMQI3QAdNnf-aMhQJr4&google_cver=1&gdpr=0
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKSEMMQI3QAdNnf-aMhQJr4&google_cver=1&gdpr=0&C=1

43 B
744 B

45ms
45ms

Image
image/gif

104.18.27.193
Cloudflare

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKSEMMQI3QAdNnf-aMhQJr4&google_cver=1&gdpr=0&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CI__1AIQoIHhnQIYwuGB4gEwAQ&v=APEucNXLP7JnI5hsBi9LCRRPX3AEFH9O2vWuThz1Thb3R3YP5cpNUfpBm5LFoAeWSglnMgkqJmilODxsu2jkyFRh2WxMB_9IKYIPYy6cc3KG1tl-UVOfXqw
Protocol: H3
Server: 104.18.27.193 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cache-control: no-cache
nel: {"report_to":"cf-nel","success_fraction":0.01,"max_age":604800}
cf-cache-status: DYNAMIC
pragma: no-cache
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=0ArXb%2FjNQJWl2fk%2BPvwDKJ%2Ffo8PcJjDGZh2VHZzUvRUvCMa%2B2ddpSOvp5CTX3tjnuLNgjdEsbQhLNnz6g7Z8Zal9Y91w28IUk8dwfl4LVkGddCkQiI1746FUFevzENJHaA0DStQtIvRB6w%3D%3D"}]}
cf-ray: 9fb8e6bedeb0e403-YYZ
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Thu, 14 May 2026 09:33:26 GMT
content-type: image/gif
server: cloudflare
priority: u=2,i

Redirect headers

cache-control: no-cache
location: /rum?cm_dsp_id=45&external_user_id=CAESEKSEMMQI3QAdNnf-aMhQJr4&google_cver=1&gdpr=0&C=1
cf-cache-status: DYNAMIC
pragma: no-cache
nel: {"report_to":"cf-nel","success_fraction":0.01,"max_age":604800}
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=%2FirWoUFxCnNXNDA3FCzOdxlSe3NlfI41TC%2F0f23JwTLCkcQ1byX%2FjCFWC4wtQeb3WViAgm3ffugOJ6oRjmqB0t6G6vtolJbs5SI6bDuZ8Qcyrk7FuRcmdLkKwzgpQQKLq%2B7Ta6z5QINeVQ%3D%3D"}]}
cf-ray: 9fb8e6be8e33e403-YYZ
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Thu, 14 May 2026 09:33:26 GMT
server: cloudflare
priority: u=2,i

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 36EE
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&gdpr=0&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&gdpr=0&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=agWW5kt3udUAECBkAF3h5AAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKSEMMQI3QAdNnf-aMhQJr4&google_cver=1

43 B
745 B

44ms
44ms

Image
image/gif

104.18.27.193
Cloudflare

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKSEMMQI3QAdNnf-aMhQJr4&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CI__1AIQoIHhnQIYwuGB4gEwAQ&v=APEucNXLP7JnI5hsBi9LCRRPX3AEFH9O2vWuThz1Thb3R3YP5cpNUfpBm5LFoAeWSglnMgkqJmilODxsu2jkyFRh2WxMB_9IKYIPYy6cc3KG1tl-UVOfXqw
Protocol: H3
Server: 104.18.27.193 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cache-control: no-cache
nel: {"report_to":"cf-nel","success_fraction":0.01,"max_age":604800}
cf-cache-status: DYNAMIC
pragma: no-cache
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=erHMyAmpbluFyjMkUYAKHDZJ%2FsByi5UALr%2FzPxQvvWvw5p%2BPpdQbDuiUjJrxln8Hc5r3UqWeQqOuhg1tSlft7s0eNPRhKag1DphPr6WILmk7HMQnuBP%2FErM0lRfo%2B731xAJmJBk7GRbXhA%3D%3D"}]}
cf-ray: 9fb8e6bf3f58e403-YYZ
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Thu, 14 May 2026 09:33:26 GMT
content-type: image/gif
server: cloudflare
priority: u=2,i

Redirect headers

cache-control: no-cache, must-revalidate
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKSEMMQI3QAdNnf-aMhQJr4&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 313
date: Thu, 14 May 2026 09:33:26 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

setuid
ib.adnxs.com/ Frame 36EE
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm&gdpr=0
https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEIlgXo23Yfql0MKtD17dWPk&google_cver=1

43 B
1 KB

41ms
37ms

Image
image/gif

68.67.181.102
Xandr Inc.

General

Check archive.org

Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEIlgXo23Yfql0MKtD17dWPk&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CI__1AIQoIHhnQIYwuGB4gEwAQ&v=APEucNXLP7JnI5hsBi9LCRRPX3AEFH9O2vWuThz1Thb3R3YP5cpNUfpBm5LFoAeWSglnMgkqJmilODxsu2jkyFRh2WxMB_9IKYIPYy6cc3KG1tl-UVOfXqw

Protocol

Server

68.67.181.102 North Bergen, United States, ASN29990 (ASN-APPNEXUS - Xandr Inc., US),

Reverse DNS

1040.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.25.5 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin: 86.106.90.214; 86.106.90.214; 1040.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid: cf3973b6-10c3-427e-bb0e-e1947a1c2562
content-length: 43
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 14 May 2026 09:33:26 GMT
x-xss-protection: 0
content-type: image/gif
server: nginx/1.25.5

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEIlgXo23Yfql0MKtD17dWPk&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 301
date: Thu, 14 May 2026 09:33:26 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 36EE
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}&gdpr=0
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D%26gdpr%3D0
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjA3ODM3MjU2NDk3NjI3MzE0Mg%3D%3D&gdpr=0

170 B
188 B

51ms
51ms

Image
image/png

142.251.111.155
Google LLC

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjA3ODM3MjU2NDk3NjI3MzE0Mg%3D%3D&gdpr=0

Requested by

Protocol

Server

142.251.111.155 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

bk-in-f155.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 14 May 2026 09:33:26 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cache-control: no-store, no-cache, private
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjA3ODM3MjU2NDk3NjI3MzE0Mg%3D%3D&gdpr=0
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 86.106.90.214; 86.106.90.214; 1040.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 78f135f1-9c96-4fc8-8a8e-aacbff7f346b
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 14 May 2026 09:33:26 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.25.5

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20260513/r20110914/ Frame A358 28 KB
10 KB 39ms
38ms Script
text/javascript 142.251.167.157
Google LLC

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20260513/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Bep5NVUdlpG1cDpz7RzpumX0oIENY_loHlrTJfz8c1kFpulPzkGyGnqsFv9C3qDNgM9W8nvoZn7shpxitNCofo_8YOrE8_OxkpiTgvN17Lv3fSIXi2qnVJ3EHoVuVUYx2yB7pS25PoqlCQa-2AvGJu_nebwxtc119fF8nYmQ5ukDJWngUcHXu4GPdH0GCe-4Ypba-uBd9iw-7eEUOKVJlBQDvFCDdRyqUbq1-p68wcQnIVgMTSLYnDocT5yqIcBBhLoLFm8F9SrqthoxgZ7gvOLeiw7w&cry=1&dbm_d=AKAmf-AKvlw7PeIIE7DrySkSUYwblxpaUOMz7qs1Te3ax1oaLGd8C_L1okmCRCklqfdJsHABJ2Qvl3w65DwRetlHH5HMXZ_M4n4FYkGG9MGs8yGwC97DiVQfIMptZaxGYgNM7N6YlZNmk1X0wWrbEbHfmkrNB44G2OJZbY1FUFdBMT6Vz4cO92Ju444MbUutSMIOb1HiFpxpJ0Hvgq3b316-0vysCf5TFbN9We6nda2ousmdsqx8lg6yLdorFFqHtgQrr7mywb72TAxUyn8o2Nt91FT1GqQjtPvj3LCjVfwNiPy5vpAK4q2-MogT0ykXsRBzu37Bgj_Ce73DaQcq76KnAnHZJ0WxltER2-0eLKkmtRtJVQ8X1ry93Dj3cDiFy0Bvcojc3Q3dwVZ4dbpW0UX-OZZdk2YUTCSty_28-UyhgzUGO65k4rcJl5rQ7hmzgxdtuSXpsOXE75-9J9w_D4iXbcgdFv84O01xki0GLoWzXn75JYmvc6n1wb6MjvNWSBvY7SL0GaOr8V-6cgtz-7hdN8pXCGB4yKuBwVKNchGCbPcGRkCv5iKU59TgEcXnWt4xL7XXSApcJendsuKGNyTds8DgRCKQVVNcdvNQel8E0zacNQrZXXDm3x2t4oFoTHs53zT2UGpQsour0OH-ygaM05Zcnva4UE3A51mhurnq8PHaIwS18SF_0iY-WxXWKBW8wvjvQ64XCH1NuLYJpieMiJr2i1hnsk5zj_q2WPaYxjRLZdrpbabR3p01hbiYbR18RjSYn2jbuNx0-p_JSqoZ9RI9nAsmdP5VeV2ggtllYqR3E3a4CmFca4Wj6LgOutS5zOm0Mkq2T7piLYqRgg8zSrZHlCLBFWex3kkCerwwzpJw97kg60INZQDAzk4a3xrrhW0j3obuFv2UBTJyMeB3BtlBK8o-a-ORlSWNx7LKTc91hU94smZvurK9ELoHs8YRfd7vDf4-CL2-e2966i1gOrqYrnJ5-jzlCl92YFTs0YOORg7S49JY2rR92SlQHLebI70UKGKR4NZJpZbpgsct9hLtcX6Ycy-nBe0wVZD7J_mKRfQQdjCmCY7gFgQ-Tybvdayt0dEa3b9K4kGepjsz_Gbkk3YyiBu5kkc9iNlV9MZAbE_8P2lYZZ9HvG6zqHMqiz8cQLeQr6EAsR3GG6Z-M9M-DZU8T41uovM8uqEIUgUHEq4_3nKaCizeLE61zeh1HBus9CP-09vNsyTNVcLmMcRNHvFWB_edMFNfZC0jy923b6AC7KkzeOKUVwJ1O5awf7VMM0-s5b8_tueGWx1Z6X49ccJkiKxUN99WUHkmeYnYIwoBKW8-zyp3iw7S2FdgdRoaoFfZSeLWgDJFuJkBimkiWS56g407BJFo7eroLlkG9N6U92w2LXZtEbxMiJVCNi2NsPvC5tSZ9q763m1ysMupLpUAzOmc4vwR6XKlvOHv-Gri4mVLjvf_WRHrSFxKd7jEElaDbxMYwinA_9UB6ZnpGVYEQw0ljOUb4bXZz2j-wRXyXSGSWhWPEnfyyL69kVN91H5FEL5O2NKDKKYBFokkqvwju9hP0mGFy1BC7bNoVwklgZjp2Y_yzSS-SldNtxVaUaSPdIRm__a1P3Z8yvDfHqKATh_knAW9TOh1GcyC4MEKoSO1DH9ASKSC8Lyj6FPEhFusmpRJfS2l6HMRlpLFTPVPAdJjt3oFvYmTZWDEvtcqf5YXqGKpnZJMp3hZmP_yHg_TVVmCT2Ld6rQDw7r7PPhA8SLh2YxSlk0WzKxJPCJoSrPatAgQ1tvERPbm448EejaGr0M7LCDRHpHB9n5_kQ87sDiBKLBoa207-1vwJFxg43hPm5azyGWzSkMBTE4Ia3ckZ_4HkqlQbOLq98_MD8uSo0V8kWWK_cXmyUMCawzrblH3NoGyDN9Ng5mmNijLWH8QStLRo_7fa2Ol9sDU-4FjJU2OPGguOY12wb7kKCSv49n16arrqtHuD4uWxeSP0lettuyfj7iJwzfLTu8X5L7_SwqY2g4A3-jiqbdFeN7SYb4KYTK6vXacxepPgpET-YYm6RrmddbW9HcGPhJGAxVpNGJWZxwSj8Pb1-W0VN2YdUDesg6l-n837lBB1Q8wxHqQ3AUtryjwDkjm6l3eSZh6iWXvwyr6RTtIEfAo9oR-C7IDZjQOueHpF9iyWU7yjLiyGA3sxOxiGEDmWO6oxrNEpPo1w_nmIYvg8ogVaqmJ6wOLdb63UTlyqlX3LwJQKC-1xLzI_oMy8YsKJcji_9hhsToAkTwWyyKKuK2TID6g7Fdyrf9GXsL4_HDfSdD1UbPrytNnHSdlQIkdG5Ap-0Cwe3CNXRlF5_KiPO9Cp8KFGuR4USTngirJswQu2DtoMJiPunxQ9SnNDfhsh9DT8z2dVkaecpSxsIP3OOCiU2UiSk1pMYg8Us8dwh3uwxohCDKVNzjwRvSXnQN93M3WDHKlK2L1HoKQd5dmAm7HGqLUWO8pFodJEI0_zT0yZgl7U9vEYRJvx5NOThApmYgo4eLS5BAS3xD8N_51v_HLIyZtsY6LChACtLxTkfrfXP0K7Fc668d3Auqo_7eokkTrBzBzGFVsU0gtqPCf8ZP_kzjS1zixs1yLN24J3pIUy_T-XeNMhDTYAKPI_yQuZeDj5AiR2OjVN_hsG_K2zXVJ74L66Zd8Hb4GViFzXbOdbb-R3Zu_fkAaBnnKUrzkGF7Hed6qGDGelbJ6ouQ1nLr2TaGHd6qbQsZ_9g6O7eJL0kwqZX_QiyoHKmbK4BIrZSgLOe5jmEUNdkBqMVuPB3L8kr1FMoh6eAh8JzDmcI1zDrvrrHNpYR-Gnw6agzS2_S07FJ1XPEWxcFHyC4DW9orQHFwMnUZkJ-iQhQY5s9XR6e1ffAxTsb0M60HDV-9fMtOUEKbl19BuYzSa6m1dqg-i2nbUxBWWT2876f2_JxbCIoyTdH6iQYHn4hlgxg_lWufujzgd3E4vNwksjXvbT_f1yZrwbIxh_oieULAHu11CljvGfGmw7yFgkJ2WU0pjUZIvCTBxt5vVHnkHzt0YKD48CKvFPXDnlDL5fXVzG4LJLkmjducMKoXIvmkER7GpuP_g0zdmQSIWNTVqB1UNHWI-9-zvLCS2lChJkp_Xy8zRykf0enP96EGqBeZMS3L_t_ImN9TmYgkJXRXkVDo-trEmoRSpKRmZlGDVqMHg9jY3NxV7NHznxE8JsfFJwz8YYgYrbMPLDe0ZpHLwlEdzCPPGg6n3mjy2PGF4E1yoB3AQwXCZGZh52P_x9iAKKrYYmwhMi3AQqscMaJhRWZqYjyjOn11UZXl5fZ1KlZp_5vDSebSP4BPlW91x-710QavbFNXNtVNqQoG0YKm0HnZAB-5wOQlFW2rbLJA35bfsLOGR3TrTeH36d1waAOzM9vGv6XUJWH3aNa8C6MtsrkHe4K_w7W5138BQEC8im-KtyCVbWfTAwp_lKz3VmAUE3H7pe2u1OHw9txV-BCBpv1AOycfyaGyvpcU0AArKWMjS9zjUWPjiuwmW8WRMa9BP5w0ySmQ9qTNxagmnVw4BSnPeawiPd4_osMIszd9M4UGrB_pqKWaH3ODmdP3k_JhgDn2c-qa2WCFanhewzmnOVUVdLuRn_ic2fdt0ELiLM3RZm4CKOTJJuAnTduZ8xljN5o1XgbBalSSOEn_0c9-27QhvwLv5vO1DIAcR7LHUje1zKLEjd491z6TjJk3tG_lguK-epvkn3ifb2FJil-IwpEkkjfPyyUrNSscS2OZVoGBAU2mb6m3FwjnD19uWoiS6I0soOw2kRIT0WmcB3KpnUkQ28d66AiFqVgNDCikjFua7eXFdE_Mz0A2wGB-_RLKScDRqUgoEWZnnA4HxlZtV9xBmsuZtdFly8nZr0KmCJSVbATFq1YaaoQ4v0R6Pv3fawhAgoSaX05Rbe9XxSNUhSD5jnIGoEMI4tSj9wP_zocdunLKfT32xLGIl0KhOi9hSmxFWr7CDHCGwQDXeb7EJ1lECoBz4gkq-nYpmGR4TBKQCRQbxvYF8rR3av_TkfXFwCyPiFI_ds3WAAZmLKPvTOtH-nvRCPEtrpu_NffuSPEioSpft7UH0GAOZmKZtmrtBjAI2UVw9RWjdANOPjLmEanSGNfE578UtHCrv7yO-JTZp53j2mDhiCBcD6TGZo2km6gyClTiZhnQvRZTQ3pwp84Y6IBEY4Qt-dP004QcbfmtEGi9mb8Qa30TR0cpboAQFEaOiRVzHNfRdA8ZxALNvom3RClwYvltAyaPQyMAn3l65xvS5jKu-7n8VlaG9FbyUkhlRT4CbWV2pz2ti5vTeySTu-2lKj-wOesU3ioGQXoAdh1mqMj0XgIOSfIuMxJBsrBlEIoqMtNYaIaij3JqoSgUQDkwlIxNr7wrPQ5TVKUkujFkjRuWZt-UObV4-Zs_fxiH3U6v1r_GSZ_0Ru8-xH_LuSXfLB3L7nlGRLe6iRpTFLHWWzEk_7ZT6t8k4_VI5sSSx1KIpSQzVBCqMMn02gDXel_WNLIWwKCghmjWhIQb9MQTEPRJfWVa3TNYPGdvJI_ukCyALocR2qK39hrICBIaeM3QPl9nXux07zm8og1-MWVqzCIy9rIIdk3ey3U3Ff2Zk8EfwdzTCyqlFxTXSNFW8NjtKJ8KkWpN9ZPa67TL3NqnC9Eo_3v-DWdzdJcKZJoF_Z_zjT_Cgn_xjSghfK0ipFuZjJpk1sQvMtAyx2Ime3LoEsy4ap9i9NmjSu9C10dKbmuaG0ChYqNKQ-zrQE6zN_3BRh6WLYOmx3XsW9Kc6oisoAN_f3KE30Z0bbyVY0MQPADY9W_9br7TalPrSitZH-17a9yA_1dRqFEqpbQJqTmQyTP_F7hl-zcrQjCe57Flh0gAaWCw0Qe7pgb4oxahlJ35G2-ZaKqPkmm0kBHzgu9JIAdvDtxkENFqnAbAkgFAgPTfD0vCaaPo1cpnra7fEon30FROhuGg&cid=CAQS4gEABaugfQIRQr8HezWpJjRo4141VhO9j1YgEZG9b5tlPKhzAt-u2j4q7j8YDkLapQlz6WWvwxRnsc3_fhbghRjdqqvFVq8MzRJSpzraC_sujexacYZRgFKoh09GEKo8ndraVJU00_7yFpx0WVCmqd9x-MT9TjrA9II5CEc0r4uumTRkwds-4IaRlAeab5NhZJ1lCxKH1XofvQa8FLgYK3Y8NVHimSQdTooAiZLwbSHncraUt0u2c8PmKsKiQSsFsFjN-VAzskqrQHV5tff32OHiNnpbvC8AeUkTW9T5cFwmWkBhGAE&dv3_ver=m202604070101&nel=1&rfl=https%3A%2F%2Fwww.mediafire.com%2F&ds=l&xdt=1&ct=77&iif=1&cor=7421199761382883328&adk=3690638928&idt=62&cac=0&dtd=55

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.157 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

ww-in-f157.1e100.net

Software

cafe /

Resource Hash

873afe3b02d6b36f7ff288fc4e7ad7297a23ea4bab0798d8586a00c6f34b18f8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
etag: 13488613425844993610
age: 15476
x-content-type-options: nosniff
expires: Thu, 28 May 2026 05:15:30 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 14 May 2026 05:15:30 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 10690
x-xss-protection: 0
server: cafe

GET
H3 200 VFc2VJAc.js Show response
ep2.adtrafficquality.google/sodar/ Frame A358 43 KB
14 KB 41ms
40ms Script
text/javascript 64.233.180.132
Google LLC

General

Check archive.org

Download Go to

Full URL

https://ep2.adtrafficquality.google/sodar/VFc2VJAc.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

64.233.180.132 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

pe-in-f132.1e100.net

Software

sffe /

Resource Hash

54573654901c495ecf67cc8ffd30108dd6f3a3c7332fd4dba41ab13877b75b8d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
age: 985
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
x-content-type-options: nosniff
expires: Thu, 14 May 2026 10:07:01 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 14 May 2026 09:17:01 GMT
last-modified: Thu, 13 Mar 2025 04:28:00 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=3000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 14328
x-xss-protection: 0
server: sffe

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 441A 1 KB
0 0ms
0ms Document
text/html 142.251.167.157
Google LLC

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com
URL: https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.157 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

ww-in-f157.1e100.net

Software

cafe /

Resource Hash

bea1c5ab168f662fc9eb5bda3474e5b1bbd0d3ecc1d9c68e2a753f613c2ae0c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

age: 23616
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 812
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 14 May 2026 02:59:47 GMT
etag: 9725182468138058862
expires: Fri, 15 May 2026 02:59:47 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame A358 0
0 45ms
45ms Fetch
image/gif 142.251.167.157
Google LLC

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=fle-fetch-start2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.157 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

ww-in-f157.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 14 May 2026 09:33:26 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame A358 0
0 48ms
47ms Fetch
image/gif 142.251.167.157
Google LLC

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.157 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

ww-in-f157.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 14 May 2026 09:33:26 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
DATA 200
OK truncated
/ Frame A358 214 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 18b1530bf3f7ecb5fb54663c93383a236a156ccac3f5c17f378139ecdfee8928

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H3 200 reach_worklet.html Show response
www.googleadservices.com/pagead/managed/js/activeview/current/ Frame 9335 93 B
0 2ms
2ms Document
text/html 64.233.180.154
Google LLC

General

Check archive.org

Download Go to

Full URL

https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

64.233.180.154 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

on-in-f154.1e100.net

Software

cafe /

Resource Hash

136b3dfa7c254f92a9a3513c191c87c05f7c7ff7f82c6d648a33496c3c380593

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=3600, stale-while-revalidate=3600
content-encoding: br
content-length: 69
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 14 May 2026 09:33:23 GMT
etag: 9658810392779322030
expires: Thu, 14 May 2026 09:33:23 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK / Show response
servedby.flashtalking.com/imp/8/202464;7175118;201;jsappend;DV360;GCANCovidRecoveryTop6728x90ENnew/ Frame A358 2 KB
1 KB 236ms
165ms Script
text/javascript 23.48.203.240
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL

https://servedby.flashtalking.com/imp/8/202464;7175118;201;jsappend;DV360;GCANCovidRecoveryTop6728x90ENnew/?ftOBA=1&ft_domain=www.mediafire.com&ft_ifb=1&ft_agentEnv=0&ft_referrer=https%3A%2F%2Fwww.mediafire.com%2F&gdpr=0&us_privacy=${US_PRIVACY}&cachebuster=962173.7756605393

Requested by

Host: 409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com
URL: https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.48.203.240 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-48-203-240.deploy.static.akamaitechnologies.com

Software

prod-xre-app73.ash11 /

Resource Hash

01990f06561b81e0060854cd87626ebea619773dee6c943d362209ca53ba2e4c

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

Strict-Transport-Security: max-age=86400
Cache-Control: max-age=0, no-cache, no-store
Content-Encoding: gzip
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 14 May 2026 09:33:26 GMT
Content-Length: 921
Allow-Fenced-Frame-Automatic-Beacons: true
Date: Thu, 14 May 2026 09:33:26 GMT
Content-Type: text/javascript;charset=iso-8859-1
Vary: Accept-Encoding
Server: prod-xre-app73.ash11

GET
H3 200 reach_worklet.js Show response
www.googleadservices.com/pagead/managed/js/activeview/current/ Frame 9335 195 KB
0 1ms
1ms Script
text/javascript 64.233.180.154
Google LLC

General

Check archive.org

Download Go to

Full URL

https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.html

Protocol

Security

QUIC, , AES_128_GCM

Server

64.233.180.154 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

on-in-f154.1e100.net

Software

cafe /

Resource Hash

bed4d32b2c3440f32df8e267317ed6fed766b0f4c39eaf4a58bee428a1ebf6b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
etag: 5116508366472751509
x-content-type-options: nosniff
expires: Thu, 14 May 2026 09:33:23 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 14 May 2026 09:33:23 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 63024
x-xss-protection: 0
server: cafe

GET adxpm
pixelfnt-us.dsp-api.moloco.com/v1/cm/ Frame 441A 0
0

GET exptsync
ads.yieldmo.com/ Frame 441A 0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 441A
Redirect Chain

https://match.360yield.com/match/ebda?google_gid=CAESEPNFggCbH6hKAqCMsrx38z8&google_cver=1&google_push=AXcoOmRPYAIkTIpB06KDGlHwaEoHjWxDjQhgMQLFkI8niFWJ3ZruoTgmjFm_ZqLD4mf1bFVXUkVb_6wZdwKhH2zPtz3AKH...
https://match.360yield.com/ul_cb/match/ebda?google_gid=CAESEPNFggCbH6hKAqCMsrx38z8&google_cver=1&google_push=AXcoOmRPYAIkTIpB06KDGlHwaEoHjWxDjQhgMQLFkI8niFWJ3ZruoTgmjFm_ZqLD4mf1bFVXUkVb_6wZdwKhH2zP...
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=HHEQ3oz5T3mz6AbpDhCOCg&google_push=AXcoOmRPYAIkTIpB06KDGlHwaEoHjWxDjQhgMQLFkI8niFWJ3ZruoTgmjFm_ZqLD4mf1bFVXUkVb_6wZdwKhH2z...

170 B
188 B

50ms
49ms

Image
image/png

142.251.111.155
Google LLC

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=HHEQ3oz5T3mz6AbpDhCOCg&google_push=AXcoOmRPYAIkTIpB06KDGlHwaEoHjWxDjQhgMQLFkI8niFWJ3ZruoTgmjFm_ZqLD4mf1bFVXUkVb_6wZdwKhH2zPtz3AKHuW_mHPUK_WRQCTiBDcynNDle7FBnaNFjt4wWZUhRbZW2dl0paSlvg58qNO-Irm

Protocol

Server

142.251.111.155 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

bk-in-f155.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 14 May 2026 09:33:27 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

access-control-allow-origin: *
location: https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=HHEQ3oz5T3mz6AbpDhCOCg&google_push=AXcoOmRPYAIkTIpB06KDGlHwaEoHjWxDjQhgMQLFkI8niFWJ3ZruoTgmjFm_ZqLD4mf1bFVXUkVb_6wZdwKhH2zPtz3AKHuW_mHPUK_WRQCTiBDcynNDle7FBnaNFjt4wWZUhRbZW2dl0paSlvg58qNO-Irm
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
date: Thu, 14 May 2026 09:33:27 GMT
content-type: text/plain

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 441A
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&google_gid=CAESEJhWOR95tPRISSR_KmTdo_o&google_cver=1&google_push=AXcoOmSsDj8FQAzokElMsh0PNko1o4PYZdUZbNeUkg7tV6QCfOGjDxmUABnIXNLZx7LIXyA6-St_oh5zE-eSZMYIneLxi1ArNR...
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_push=AXcoOmSsDj8FQAzokElMsh0PNko1o4PYZdUZbNeUkg7tV6QCfOGjDxmUABnIXNLZx7LIXyA6-St_oh5zE-eSZMYIneLxi1ArNRKi1mX...

170 B
188 B

49ms
49ms

Image
image/png

142.251.111.155
Google LLC

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_push=AXcoOmSsDj8FQAzokElMsh0PNko1o4PYZdUZbNeUkg7tV6QCfOGjDxmUABnIXNLZx7LIXyA6-St_oh5zE-eSZMYIneLxi1ArNRKi1mX0LTREgaHaIn13nL0uxtbux3_fItrXLoV5klO5Jtxv9RSjxF1npx6q&google_hm=MjE2MzkyOTA5NzI4NDkyNjc2MDgyNg%3D%3D

Requested by

Host: 409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com
URL: https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Server

142.251.111.155 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

bk-in-f155.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 14 May 2026 09:33:26 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

date: Thu, 14 May 2026 09:33:26 GMT
location: https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_push=AXcoOmSsDj8FQAzokElMsh0PNko1o4PYZdUZbNeUkg7tV6QCfOGjDxmUABnIXNLZx7LIXyA6-St_oh5zE-eSZMYIneLxi1ArNRKi1mX0LTREgaHaIn13nL0uxtbux3_fItrXLoV5klO5Jtxv9RSjxF1npx6q&google_hm=MjE2MzkyOTA5NzI4NDkyNjc2MDgyNg%3D%3D
content-length: 0

GET
H2

200

report
sync.teads.tv/um/ Frame 441A
Redirect Chain

https://sync.teads.tv/um?ssb_provider_id=3&uid=&google_nid=teadstv_ab&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_ab%26google_hm%3D%5BVID_B64%5D&google_gid=CAESEHSMEtR85qmF...
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_ab&google_hm=NTNlZmVlOWMtNmExYS00ODVmLTgzYTUtYzYxZDA0YWYxYmVk&google_push=AXcoOmTGdQ5aWV0Ln5EsrkzPrCnaSAKqJ5cp_4o7fznYDGOMOXzSasHJNoGZt_gZM01AF...
https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab

23 B
91 B

32ms
31ms

Image
image/gif

151.101.2.132
Fastly

General

Check archive.org

Download Go to Show image

Full URL: https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
Protocol: H2
Server: 151.101.2.132 , United States, ASN54113 (FASTLY - Fastly, Inc., US),
Reverse DNS
Software: pekko-http/1.1.0 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

x-user-geo: US-EAST-1
cache-control: max-age=0, no-cache, no-store
x-timer: S1778751207.578941,VS0,VE15
x-check-cacheable: NO
via: 1.1 varnish
accept-ranges: bytes
x-cache: MISS
content-length: 23
date: Thu, 14 May 2026 09:33:26 GMT
content-type: image/gif
x-served-by: cache-yul1970022-YUL
server: pekko-http/1.1.0
x-cache-hits: 0
traffic-path: NVADC2, YUL, USA

Redirect headers

cache-control: no-cache, must-revalidate
location: https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 260
date: Thu, 14 May 2026 09:33:26 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 441A
Redirect Chain

https://www.temu.com/api/adx/cm/pixel-google?google_gid=CAESEFojXZmPP2fZKt7HgW57CT4&google_cver=1&google_push=AXcoOmTqVpFgSlIDx6mI-VPds0OQjv1a1DkkuApkLpAyKupZL0FNaCuGYbM1YzhFIaGbt9qUqVBI3JNxVllQA17...
https://cm.g.doubleclick.net/pixel?google_push=AXcoOmTqVpFgSlIDx6mI-VPds0OQjv1a1DkkuApkLpAyKupZL0FNaCuGYbM1YzhFIaGbt9qUqVBI3JNxVllQA17AZeXSoMsgdeGDaQNNRwGUKyyb_Ng8DVUVO31MAt367QWraMLFJ-nSquPstIoHJT...

170 B
188 B

50ms
49ms

Image
image/png

142.251.111.155
Google LLC

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_push=AXcoOmTqVpFgSlIDx6mI-VPds0OQjv1a1DkkuApkLpAyKupZL0FNaCuGYbM1YzhFIaGbt9qUqVBI3JNxVllQA17AZeXSoMsgdeGDaQNNRwGUKyyb_Ng8DVUVO31MAt367QWraMLFJ-nSquPstIoHJTNIuMPqVg&google_nid=temu_dsp2_

Requested by

Host: 409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com
URL: https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Server

142.251.111.155 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

bk-in-f155.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 14 May 2026 09:33:26 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

strict-transport-security: max-age=31536000
yak-timeinfo: 1778751206277|3
location: https://cm.g.doubleclick.net/pixel?google_push=AXcoOmTqVpFgSlIDx6mI-VPds0OQjv1a1DkkuApkLpAyKupZL0FNaCuGYbM1YzhFIaGbt9qUqVBI3JNxVllQA17AZeXSoMsgdeGDaQNNRwGUKyyb_Ng8DVUVO31MAt367QWraMLFJ-nSquPstIoHJTNIuMPqVg&google_nid=temu_dsp2_
content-security-policy-report-only: default-src 'none';script-src 'report-sample';report-uri /api/sec-csp/110000007/sec-gif
x-gateway-request-id: 1778751206277-3170827c953ce74e70f563019e25d57385-30
cip: 86.106.90.214
alt-svc: h3=":443"; ma=604800
content-length: 0
date: Thu, 14 May 2026 09:33:26 GMT
server: nginx

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 441A
Redirect Chain

https://s.seedtag.com/cs/cookiesync/google?google_gid=CAESEHryUqJDAkVYkiD2uYTJsLs&google_cver=1&google_push=AXcoOmSTgquJb-wtAM0IbrAFk1MIGZqdT_ZuvTBCDn5m84Ic89NfYSbS6jRHVjbUyPaW0POSptoQZ4hmj2IcsDSpC...
https://cm.g.doubleclick.net/pixel?google_nid=seedtag_beachfront&google_hm=019e25d5-7870-7735-8a84-73f065971538&google_push=AXcoOmSTgquJb-wtAM0IbrAFk1MIGZqdT_ZuvTBCDn5m84Ic89NfYSbS6jRHVjbUyPaW0POSp...

170 B
188 B

50ms
50ms

Image
image/png

142.251.111.155
Google LLC

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=seedtag_beachfront&google_hm=019e25d5-7870-7735-8a84-73f065971538&google_push=AXcoOmSTgquJb-wtAM0IbrAFk1MIGZqdT_ZuvTBCDn5m84Ic89NfYSbS6jRHVjbUyPaW0POSptoQZ4hmj2IcsDSpC8l6eEGZBDiinm0lkRT1iNW2jTw94VX5c8JOROOX8ctEjDwAxflbfpW2oMr20B94cKTr

Protocol

Server

142.251.111.155 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

bk-in-f155.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 14 May 2026 09:33:27 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=seedtag_beachfront&google_hm=019e25d5-7870-7735-8a84-73f065971538&google_push=AXcoOmSTgquJb-wtAM0IbrAFk1MIGZqdT_ZuvTBCDn5m84Ic89NfYSbS6jRHVjbUyPaW0POSptoQZ4hmj2IcsDSpC8l6eEGZBDiinm0lkRT1iNW2jTw94VX5c8JOROOX8ctEjDwAxflbfpW2oMr20B94cKTr
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS, DELETE, PUT, HEAD
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 302
date: Thu, 14 May 2026 09:33:27 GMT
content-type: text/plain; charset=utf-8
vary: Accept
server: openresty
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 441A 0
12 B 50ms
48ms Image
text/html 142.251.111.155
Google LLC

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Isa0YojJdLlctTRnFVWAOR1JS0S4mA453VswQ-SivUslizCh5GWPSPVXkI2Jea4sLzz4UNL0DD

Requested by

Host: 409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com
URL: https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.155 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

bk-in-f155.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Thu, 14 May 2026 09:33:26 GMT
x-xss-protection: 0
content-type: text/html
server: HTTP server (unknown)

GET
H3 200 Klz6NWr5.html Show response
ep2.adtrafficquality.google/sodar/ Frame C9FA 35 KB
12 KB 39ms
38ms Document
text/html 64.233.180.132
Google LLC

General

Check archive.org

Download Go to

Full URL

https://ep2.adtrafficquality.google/sodar/Klz6NWr5.html

Requested by

Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/VFc2VJAc.js

Protocol

Security

QUIC, , AES_128_GCM

Server

64.233.180.132 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

pe-in-f132.1e100.net

Software

sffe /

Resource Hash

2a5cfa356af90e4dc14d89477463deb2c098c826ebc6d74c1577eb3d5973cac9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

accept-ranges: bytes
age: 1900
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000
content-encoding: br
content-length: 12007
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 14 May 2026 09:01:46 GMT
expires: Thu, 14 May 2026 09:51:46 GMT
last-modified: Thu, 13 Mar 2025 04:28:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame A358 0
0 45ms
44ms Fetch
image/gif 142.251.167.157
Google LLC

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.157 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

ww-in-f157.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 14 May 2026 09:33:26 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame A358 0
0 45ms
44ms Fetch
image/gif 142.251.167.157
Google LLC

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACYANgBGgD

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.157 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

ww-in-f157.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 14 May 2026 09:33:26 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 model_person_country_code_CA_person_region_code_5175656265635f4d6f6e747265616c.json Show response
www.googletagservices.com/agrp/prod/ Frame 9335 632 KB
0 1ms
1ms Fetch
application/json 172.253.139.157
Google LLC

General

Check archive.org

Download Go to

Full URL

https://www.googletagservices.com/agrp/prod/model_person_country_code_CA_person_region_code_5175656265635f4d6f6e747265616c.json

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.139.157 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

yuiadsk-in-f157.1e100.net

Software

sffe /

Resource Hash

7dfb320f62f8e93b26f7760ed53ade019c720b1a267826a9672177c801223e5b

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-people-metrics-releaser
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.googleadservices.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
age: 1686
report-to: {"group":"ads-people-metrics-releaser","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-people-metrics-releaser"}]}
x-content-type-options: nosniff
expires: Fri, 15 May 2026 09:05:18 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 14 May 2026 09:05:18 GMT
last-modified: Tue, 30 Jul 2024 19:25:57 GMT
content-type: application/json
vary: Accept-Encoding
content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-people-metrics-releaser
cache-control: public, max-age=86400
cross-origin-opener-policy: same-origin; report-to="ads-people-metrics-releaser"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
content-length: 87370
x-xss-protection: 0
server: sffe

POST
H3 200 report-shared-storage
www.googleadservices.com/.well-known/private-aggregation/ Frame 9335 0
0 71ms
68ms Fetch
text/html 64.233.180.154
Google LLC

General

Check archive.org

Download Go to

Full URL

https://www.googleadservices.com/.well-known/private-aggregation/report-shared-storage

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js

Protocol

Security

QUIC, , AES_128_GCM

Server

64.233.180.154 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

on-in-f154.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
Content-Type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0

Response headers

timing-allow-origin: *
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 14 May 2026 09:33:26 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: cafe

POST
H3 200 report-shared-storage
www.googleadservices.com/.well-known/private-aggregation/ Frame 9335 0
0 82ms
80ms Fetch
text/html 64.233.180.154
Google LLC

General

Check archive.org

Download Go to

Full URL

https://www.googleadservices.com/.well-known/private-aggregation/report-shared-storage

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js

Protocol

Security

QUIC, , AES_128_GCM

Server

64.233.180.154 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

on-in-f154.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
Content-Type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0

Response headers

timing-allow-origin: *
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 14 May 2026 09:33:26 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: cafe

POST
H3 200 report-shared-storage
www.googleadservices.com/.well-known/private-aggregation/ Frame 9335 0
0 83ms
80ms Fetch
text/html 64.233.180.154
Google LLC

General

Check archive.org

Download Go to

Full URL

https://www.googleadservices.com/.well-known/private-aggregation/report-shared-storage

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js

Protocol

Security

QUIC, , AES_128_GCM

Server

64.233.180.154 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

on-in-f154.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
Content-Type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0

Response headers

timing-allow-origin: *
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 14 May 2026 09:33:26 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9335 0
0 47ms
45ms Fetch
image/gif 142.251.167.157
Google LLC

General

Check archive.org

Download Go to

Full URL

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.157 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

ww-in-f157.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.googleadservices.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 14 May 2026 09:33:26 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9335 0
0 45ms
44ms Fetch
image/gif 142.251.167.157
Google LLC

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAIgATpTbW9kZWxfcGVyc29uX2NvdW50cnlfY29kZV9DQV9wZXJzb25fcmVnaW9uX2NvZGVfNTE3NTY1NjI2NTYzNWY0ZDZmNmU3NDcyNjU2MTZjLmpzb25IyAFSGkNKeVBoYzY4dUpRREZmZ3RIQUFkQlUwYU1BWiQIzBAQm50BGOyYPSCmhakEKEAwAjgBXQAAgD%2FqAQYIZBhkIGQ%3D

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.157 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

ww-in-f157.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.googleadservices.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 14 May 2026 09:33:26 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 P9vpWbmGpuiyn9VBbdh3beNMwhoBhGMWvyzziabIui0.js Show response
ep1.adtrafficquality.google/bg/ Frame C9FA 58 KB
22 KB 79ms
38ms Script
text/javascript 192.178.155.155
Google LLC

General

Check archive.org

Download Go to

Full URL

https://ep1.adtrafficquality.google/bg/P9vpWbmGpuiyn9VBbdh3beNMwhoBhGMWvyzziabIui0.js

Requested by

Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/Klz6NWr5.html

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.155.155 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

yuiadrs-in-f155.1e100.net

Software

sffe /

Resource Hash

3fdbe959b986a6e8b29fd5416dd8776de34cc21a01846316bf2cf389a6c8ba2d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://ep2.adtrafficquality.google/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
age: 16911
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
x-content-type-options: nosniff
expires: Fri, 14 May 2027 04:51:35 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 14 May 2026 04:51:35 GMT
last-modified: Mon, 11 May 2026 14:38:00 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=31536000
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
accept-ranges: bytes
content-length: 22535
x-xss-protection: 0
server: sffe

GET
H2 200 ftUtils.js Show response
ajs-assets.ftstatic.com/ Frame A358 100 KB
31 KB 102ms
33ms Script
application/javascript 3.170.19.129
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://ajs-assets.ftstatic.com/ftUtils.js
Requested by: Host: servedby.flashtalking.com
URL: https://servedby.flashtalking.com/imp/8/202464;7175118;201;jsappend;DV360;GCANCovidRecoveryTop6728x90ENnew/?ftOBA=1&ft_domain=www.mediafire.com&ft_ifb=1&ft_agentEnv=0&ft_referrer=https%3A%2F%2Fwww.mediafire.com%2F&gdpr=0&us_privacy=${US_PRIVACY}&cachebuster=962173.7756605393
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.170.19.129 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-3-170-19-129.iad61.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 372f795823a54a3bc659d4e3b9f8ca82caaa75577dbbc64dbf08bfed0e0b7915

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

access-control-max-age: 3000
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
content-encoding: gzip
etag: W/"b62697b3a90a4c737930e79a194afe1a"
age: 8843
access-control-allow-methods: GET
x-varnish: 1307946
x-cache: Hit from cloudfront
x-amz-cf-id: KkSzDgMszpE_szsOd3cIdnw8KPFBVtpWi3Y50mnJrLOsEanfRp_72w==
date: Thu, 14 May 2026 07:06:03 GMT
content-type: application/javascript
vary: Accept-Encoding,Accept-Encoding
last-modified: Mon, 08 Dec 2025 15:51:15 GMT
cache-control: max-age=86400
via: 1.1 prod-web-edge4.ash11.ftdns.net (Varnish/trunk), 1.1 8861f667e8c2cb75496b6b7283d951cc.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
x-amz-cf-pop: IAD61-P9
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H3 204 gen_204
ep1.adtrafficquality.google/pagead/ Frame C9FA 0
20 B 53ms
52ms Image
image/gif 192.178.155.155
Google LLC

General

Check archive.org

Download Go to Show image

Full URL

https://ep1.adtrafficquality.google/pagead/gen_204?id=sodar&v=46&t=2&bgai=BTLBc5pYFaq-iAvTMjrgP1dSu0AMAAAAAOAHgBAI&bg=!kZKlkvDNAAa9vLwKnbw7AEcBe5WfOIC9k5Ckrzl3W3o9iMhl-UelIpcFbwXR5H3vAZ73SoEnM-vIT7C5egPxJgCox66wRSR8lxyeZJFlk1Rbe1dgvrXRogIAAABfUgAAAARoAQd-ADVpiiJmJ_3diIwRcHyZjTd05WHyjwxJ63zKE7QEmImPYM8ewwsNNxzGXv1PArLcwyoRppX675kCnjMzBGl2L5qTxrBnzJOnGR4E7svc-K1ndY6i_Et8DHdhXzO45iX8dJjqazsbJQzKw1eARySdIHzgXMNaAfSJBaM-r6nj4ym3EReyFK2-kJToR9X5YSqJR-PRP3Wjj4vb81xlp1g04Bu59kegpjvsTXL3pYqHsQtzY4X5SeiFuV1Vo4dxM03DxZupTRdK94PtbjMWVlCzwjQnIwiZVCCMZENUuGlDHXGl0Qxbvm7Jum2ZP7gnJpoEOY2Mi--aNDQ9dfEuPi3oBvdEM4d5mN-nvSbLbwolz1YRkk6Sf40qGTWmtqzqoD9xp1D4TC1sauni1IJG7xXNp4PJzAKiaDJIx8xBvxlcbwaWjYhMCrbB-7BhN7FLEKMK96mspYZw72VXyTnG-OUNuKCi73xsJ3bD8lS7zdxKIFmjmpp_zFzbVFtnZhoP_8YlCGM9T08s0W8Mw0I125xazBhvKtAbu7t9cFGGIBZdXYGcA1Do9pvQ7AANC0oC-FpUQqepF4xTuRBon-2Oll0HbifwdvcLY90LuP7trPAnt7F_fg1f4b6rezLGqYrh4hHvkKEtC9AIyh6_ERI3T3ifVvV25b9nIHUw372EcQVOr-L1xbx6KG-UNGUVKFAfobfr5HV-naHfBWeRStzoqUtEUCkQrW__D7lMYyt9YPpQbyF_VFmFL4ghgMisYJ4NnbbGCEyAmaWwzU1WofaNo-yqm6bihC4bwVADbQc4Ek0wlaNL4Ua1tPfV0rRZ3lJpw7I27Z8lD56t5Nq9A0Sn5HnUTW_x3WJOzeAVAlR6rE-MxSm1p0hqnXpzVhMtXfH2VHIohOyVN07uwgco2-aZ4eZRYu476B5CN1ILWvY8wtqcsgcrt6nwF6NcljtYSKkbI9K2tRTJSe9Dj48

Requested by

Host: 409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com
URL: https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

192.178.155.155 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

yuiadrs-in-f155.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://ep2.adtrafficquality.google/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 14 May 2026 09:33:26 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 3176836.json Show response
agen-assets.ftstatic.com/display/7175118/ Frame A358 2 KB
2 KB 105ms
32ms XHR
application/json 18.154.227.73
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://agen-assets.ftstatic.com/display/7175118/3176836.json
Requested by: Host: ajs-assets.ftstatic.com
URL: https://ajs-assets.ftstatic.com/ftUtils.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.154.227.73 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-18-154-227-73.iad55.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: bcb8e237785c687d9a5b641d3459b274fc5d6f06241337af000c0c0542fdc769

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

access-control-max-age: 3000
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
content-encoding: gzip
etag: W/"b69ed4434cd21933b301b46f7eb2c8b5"
age: 563
access-control-allow-methods: GET
x-varnish: 3602545
x-cache: Hit from cloudfront
x-amz-cf-id: nmsVezr6j95z3pmut4tg9Oitu4tIfNxMdcNXEAJosNmTPQIN9KYHqg==
date: Thu, 14 May 2026 09:25:26 GMT
content-type: application/json
vary: Accept-Encoding,Accept-Encoding
last-modified: Thu, 25 Sep 2025 13:44:45 GMT
cache-control: max-age=30
via: 1.1 prod-web-edge3.sjc11.ftdns.net (Varnish/trunk), 1.1 1f388679bb0ce4d64f0beb74575c14c6.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
x-amz-cf-pop: IAD55-P5
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 index.html Show response
cdn.flashtalking.com/118908/3176836/ Frame 7D27 105 KB
106 KB 60ms
18ms Document
text/html 3.162.3.14
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://cdn.flashtalking.com/118908/3176836/index.html
Requested by: Host: ajs-assets.ftstatic.com
URL: https://ajs-assets.ftstatic.com/ftUtils.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.162.3.14 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-3-162-3-14.yul62.r.cloudfront.net
Software: Flashtalking (AKA) /
Resource Hash: 4743a1c744e3d26f476bb2e80868e8f178ef9a2652c00abd0a9255c0dc50452f

Request headers

Referer: https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

accept-ranges: bytes
cache-control: max-age=1200
content-type: text/html
date: Thu, 14 May 2026 09:20:37 GMT
etag: W/"a0c7767fb827660e06d03c49ad9fbfeb"
last-modified: Tue, 08 Sep 2020 22:02:39 GMT
server: Flashtalking (AKA)
vary: Origin
via: 1.1 prod-web-edge1.dub11.ftdns.net (Varnish/trunk), 1.1 b9608c5d714fa42feebf61497cac7bd4.cloudfront.net (CloudFront)
x-amz-cf-id: 8Wf-0K2syrviqfY9PXpGxwZ8xGAlyn9PhKnwUhF3j-t7mYffbf5Ahw==
x-amz-cf-pop: YUL62-P2
x-cache: Hit from cloudfront
x-varnish: 15027471

GET
H/1.1 200
OK /
servedby.flashtalking.com/state/7175118;3176836;0;271;31CEBFAA-7B90-A6AB-5626-207FEF21DD1C/ Frame A358 42 B
387 B 78ms
77ms Image
image/gif 23.48.203.240
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to Show image

Full URL

https://servedby.flashtalking.com/state/7175118;3176836;0;271;31CEBFAA-7B90-A6AB-5626-207FEF21DD1C/?cachebuster=519827715

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.48.203.240 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-48-203-240.deploy.static.akamaitechnologies.com

Software

prod-xre-app12.ash11 /

Resource Hash

47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

Strict-Transport-Security: max-age=86400
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 14 May 2026 09:33:26 GMT
Content-Length: 42
Allow-Fenced-Frame-Automatic-Beacons: true
Date: Thu, 14 May 2026 09:33:26 GMT
Content-Type: image/gif
Server: prod-xre-app12.ash11

GET
H2 200 html5API.js Show response
cdn.flashtalking.com/frameworks/js/api/2/10/ Frame 7D27 94 KB
29 KB 21ms
18ms Script
application/javascript 3.162.3.14
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://cdn.flashtalking.com/frameworks/js/api/2/10/html5API.js
Requested by: Host: cdn.flashtalking.com
URL: https://cdn.flashtalking.com/118908/3176836/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.162.3.14 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-3-162-3-14.yul62.r.cloudfront.net
Software: Flashtalking (AKA) /
Resource Hash: 97fc5230d5cb8391cb09df4345a494801c20ca27ae5b75deb632acba3b28a774

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://cdn.flashtalking.com/118908/3176836/index.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: max-age=86400
content-encoding: gzip
etag: W/"6902a9fbc25c24031ca54349bc766ef2"
via: 1.1 prod-web-edge6.ash11.ftdns.net (Varnish/trunk), 1.1 b9608c5d714fa42feebf61497cac7bd4.cloudfront.net (CloudFront)
accept-ranges: bytes
x-varnish: 14424794 9909882
x-cache: Hit from cloudfront
content-length: 29491
x-amz-cf-id: CoEQH4d0ZIi56Q3sEIQMkyG3wq3NJhnvYt--pxNY8m-eYXipB271eg==
date: Thu, 14 May 2026 08:26:28 GMT
content-type: application/javascript
last-modified: Tue, 24 Feb 2026 16:12:36 GMT
server: Flashtalking (AKA)
x-amz-cf-pop: YUL62-P2
vary: Origin

GET
H2 200 manifest.js Show response
cdn.flashtalking.com/118908/3176836/ Frame 7D27 98 B
512 B 26ms
25ms Script
application/x-javascript 3.162.3.14
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://cdn.flashtalking.com/118908/3176836/manifest.js
Requested by: Host: cdn.flashtalking.com
URL: https://cdn.flashtalking.com/frameworks/js/api/2/10/html5API.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.162.3.14 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-3-162-3-14.yul62.r.cloudfront.net
Software: Flashtalking (AKA) /
Resource Hash: ca2fec6d9168102da4b08fad54e45776c3ac91fead7a22ffbf0ff78c37e05b2a

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://cdn.flashtalking.com/118908/3176836/index.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: max-age=1200
etag: W/"21d18ebfda5d005e0fe378aaddd7e680"
via: 1.1 prod-web-edge4.ore11.ftdns.net (Varnish/trunk), 1.1 b9608c5d714fa42feebf61497cac7bd4.cloudfront.net (CloudFront)
accept-ranges: bytes
x-varnish: 1417058
x-cache: Hit from cloudfront
content-length: 98
x-amz-cf-id: JDgpVl8sT-g0dV5fRQ_XKAfCXffdF20EnKfZqPd1v3zboyq6P7w-8g==
date: Thu, 14 May 2026 09:16:44 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Sep 2020 22:02:39 GMT
server: Flashtalking (AKA)
x-amz-cf-pop: YUL62-P2
vary: Origin

GET
H2 200 Grainger_Logo.svg
cdn.flashtalking.com/118908/3176836/ Frame 7D27 5 KB
2 KB 25ms
15ms Image
image/svg+xml 3.162.3.14
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://cdn.flashtalking.com/118908/3176836/Grainger_Logo.svg
Requested by: Host: cdn.flashtalking.com
URL: https://cdn.flashtalking.com/118908/3176836/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.162.3.14 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-3-162-3-14.yul62.r.cloudfront.net
Software: Flashtalking (AKA) /
Resource Hash: 6fb2ad50ba8d60e90b29e50785549ce250761d9136c5b6fad6dd52c2852d5e43

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://cdn.flashtalking.com/118908/3176836/index.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: max-age=1200
content-encoding: gzip
etag: W/"a18d267162c0650e158c600afd87b8f3"
via: 1.1 prod-web-edge3.sjc11.ftdns.net (Varnish/trunk), 1.1 b9608c5d714fa42feebf61497cac7bd4.cloudfront.net (CloudFront)
accept-ranges: bytes
x-varnish: 3333525 3761762
x-cache: Hit from cloudfront
content-length: 1893
x-amz-cf-id: joruR8VbnembE8vyfJrbyroXQ5SD_r60rslFG2JpqLOCgf0-6Yqwig==
date: Thu, 14 May 2026 09:16:44 GMT
content-type: image/svg+xml
last-modified: Tue, 08 Sep 2020 22:02:38 GMT
server: Flashtalking (AKA)
x-amz-cf-pop: YUL62-P2
vary: Origin

GET
H2 200 cta.svg
cdn.flashtalking.com/118908/3176836/ Frame 7D27 3 KB
3 KB 26ms
16ms Image
image/svg+xml 3.162.3.14
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://cdn.flashtalking.com/118908/3176836/cta.svg
Requested by: Host: cdn.flashtalking.com
URL: https://cdn.flashtalking.com/118908/3176836/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.162.3.14 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-3-162-3-14.yul62.r.cloudfront.net
Software: Flashtalking (AKA) /
Resource Hash: bbda649998226703a575555e1afa2688e16528f2a8341bbba1ad3df1eebba21b

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://cdn.flashtalking.com/118908/3176836/index.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: max-age=1200
etag: W/"a032a835feb96b7b81359528f650be04"
via: 1.1 prod-web-edge2.ore11.ftdns.net (Varnish/trunk), 1.1 b9608c5d714fa42feebf61497cac7bd4.cloudfront.net (CloudFront)
accept-ranges: bytes
x-varnish: 17208159
x-cache: Hit from cloudfront
x-amz-cf-id: saDOGnqZGu8-r0AmAyIM_PLKm_S8eItwBX0Bvk0N89X6ftYEuUF5SQ==
date: Thu, 14 May 2026 09:26:15 GMT
content-type: image/svg+xml
last-modified: Tue, 08 Sep 2020 22:02:39 GMT
server: Flashtalking (AKA)
x-amz-cf-pop: YUL62-P2
vary: Origin

GET
H2 200 hl.svg
cdn.flashtalking.com/118908/3176836/ Frame 7D27 15 KB
16 KB 28ms
19ms Image
image/svg+xml 3.162.3.14
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://cdn.flashtalking.com/118908/3176836/hl.svg
Requested by: Host: cdn.flashtalking.com
URL: https://cdn.flashtalking.com/118908/3176836/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.162.3.14 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-3-162-3-14.yul62.r.cloudfront.net
Software: Flashtalking (AKA) /
Resource Hash: bbc31eea89e876c8c6366affa5b49f27b4206be3d98462a14491b35bde3585c5

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://cdn.flashtalking.com/118908/3176836/index.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: max-age=1200
etag: W/"1c8367e7fe6993b8518ed41e662f335f"
via: 1.1 prod-web-edge7.ash11.ftdns.net (Varnish/trunk), 1.1 b9608c5d714fa42feebf61497cac7bd4.cloudfront.net (CloudFront)
accept-ranges: bytes
x-varnish: 2267654
x-cache: Hit from cloudfront
x-amz-cf-id: uT9nQAX2uej-ix0QkoKMaF1P8pD4CxCOyB_MQmOF_b3cfJ_GcaiL7w==
date: Thu, 14 May 2026 09:16:44 GMT
content-type: image/svg+xml
last-modified: Tue, 08 Sep 2020 22:02:39 GMT
server: Flashtalking (AKA)
x-amz-cf-pop: YUL62-P2
vary: Origin

GET
H2 200 red_stripes.svg
cdn.flashtalking.com/118908/3176836/ Frame 7D27 864 B
1 KB 27ms
18ms Image
image/svg+xml 3.162.3.14
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://cdn.flashtalking.com/118908/3176836/red_stripes.svg
Requested by: Host: cdn.flashtalking.com
URL: https://cdn.flashtalking.com/118908/3176836/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.162.3.14 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-3-162-3-14.yul62.r.cloudfront.net
Software: Flashtalking (AKA) /
Resource Hash: a79560135c9efbac8274a89b26d3be0bd031bf4d42a342e8e8c1a917948d05ec

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://cdn.flashtalking.com/118908/3176836/index.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: max-age=1200
etag: W/"e31f6f95feaa85cc8e2417d11fc1a6fc"
via: 1.1 prod-web-edge2.ash11.ftdns.net (Varnish/trunk), 1.1 b9608c5d714fa42feebf61497cac7bd4.cloudfront.net (CloudFront)
accept-ranges: bytes
x-varnish: 20835488
x-cache: Hit from cloudfront
x-amz-cf-id: U_afoi2zh4deC_h6q9bbNKQOZFHJh_tGra6TP3m1-IYKOok5AzTNFA==
date: Thu, 14 May 2026 09:16:44 GMT
content-type: image/svg+xml
last-modified: Tue, 08 Sep 2020 22:02:39 GMT
server: Flashtalking (AKA)
x-amz-cf-pop: YUL62-P2
vary: Origin

GET
H2 200 safety-bundle.jpg
cdn.flashtalking.com/118908/3176836/ Frame 7D27 4 KB
4 KB 31ms
22ms Image
image/jpeg 3.162.3.14
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://cdn.flashtalking.com/118908/3176836/safety-bundle.jpg
Requested by: Host: cdn.flashtalking.com
URL: https://cdn.flashtalking.com/118908/3176836/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.162.3.14 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-3-162-3-14.yul62.r.cloudfront.net
Software: Flashtalking (AKA) /
Resource Hash: a76686c80cd9c97632b8c3f2aca15a394466e680dfafef316d7b191dc4e09c6d

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://cdn.flashtalking.com/118908/3176836/index.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: max-age=1200
etag: W/"eafbef1c8b7c9927df8370a77a752f33"
via: 1.1 prod-web-edge4.ore11.ftdns.net (Varnish/trunk), 1.1 b9608c5d714fa42feebf61497cac7bd4.cloudfront.net (CloudFront)
accept-ranges: bytes
x-varnish: 400915
x-cache: Hit from cloudfront
x-amz-cf-id: IH5TqjVob8VUuw3u8i7XSMdk1kquRHAQiAustzWGsBJmI7J3jY4eUw==
date: Thu, 14 May 2026 09:31:04 GMT
content-type: image/jpeg
last-modified: Tue, 08 Sep 2020 22:02:39 GMT
server: Flashtalking (AKA)
x-amz-cf-pop: YUL62-P2
vary: Origin

GET
H2 200 cleaning-bundle.jpg
cdn.flashtalking.com/118908/3176836/ Frame 7D27 3 KB
4 KB 28ms
19ms Image
image/jpeg 3.162.3.14
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://cdn.flashtalking.com/118908/3176836/cleaning-bundle.jpg
Requested by: Host: cdn.flashtalking.com
URL: https://cdn.flashtalking.com/118908/3176836/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.162.3.14 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-3-162-3-14.yul62.r.cloudfront.net
Software: Flashtalking (AKA) /
Resource Hash: 2cf973145da09fe2c5a346c06bb0147b8ce67f619cdc6212fb591c4068acb6fd

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://cdn.flashtalking.com/118908/3176836/index.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: max-age=1200
etag: W/"ca788f05dd7cb3a8c1a09935136dd989"
via: 1.1 prod-web-edge2.sjc11.ftdns.net (Varnish/trunk), 1.1 b9608c5d714fa42feebf61497cac7bd4.cloudfront.net (CloudFront)
accept-ranges: bytes
x-varnish: 152782194
x-cache: Hit from cloudfront
x-amz-cf-id: Rw-XrGjn-ldXelzUmtIj2VtBBEyZukBcYCUUmmbozgZbNxeZr8P41A==
date: Thu, 14 May 2026 09:24:50 GMT
content-type: image/jpeg
last-modified: Tue, 08 Sep 2020 22:02:39 GMT
server: Flashtalking (AKA)
x-amz-cf-pop: YUL62-P2
vary: Origin

GET
H2 200 powertools-bundle.jpg
cdn.flashtalking.com/118908/3176836/ Frame 7D27 4 KB
4 KB 31ms
22ms Image
image/jpeg 3.162.3.14
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://cdn.flashtalking.com/118908/3176836/powertools-bundle.jpg
Requested by: Host: cdn.flashtalking.com
URL: https://cdn.flashtalking.com/118908/3176836/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.162.3.14 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-3-162-3-14.yul62.r.cloudfront.net
Software: Flashtalking (AKA) /
Resource Hash: 9687e9a36083f2e04ee131d06f8f0757a1ea5b5a21f1e9ec279e667aa7eff44e

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://cdn.flashtalking.com/118908/3176836/index.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: max-age=1200
content-encoding: gzip
etag: W/"ade1b87284574943db2b4c445cccb475"
via: 1.1 prod-web-edge3.ore11.ftdns.net (Varnish/trunk), 1.1 b9608c5d714fa42feebf61497cac7bd4.cloudfront.net (CloudFront)
accept-ranges: bytes
x-varnish: 38058430 37540013
x-cache: Hit from cloudfront
content-length: 3904
x-amz-cf-id: hrsAuQjh6d5GtH6aQjxc6baSruddC-HNUEaDQ48lc7DhX4uZ6cp0Ew==
date: Thu, 14 May 2026 09:29:25 GMT
content-type: image/jpeg
last-modified: Tue, 08 Sep 2020 22:02:39 GMT
server: Flashtalking (AKA)
x-amz-cf-pop: YUL62-P2
vary: Origin

GET
H2 200 plumbing-bundle.jpg
cdn.flashtalking.com/118908/3176836/ Frame 7D27 4 KB
4 KB 29ms
21ms Image
image/jpeg 3.162.3.14
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://cdn.flashtalking.com/118908/3176836/plumbing-bundle.jpg
Requested by: Host: cdn.flashtalking.com
URL: https://cdn.flashtalking.com/118908/3176836/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.162.3.14 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-3-162-3-14.yul62.r.cloudfront.net
Software: Flashtalking (AKA) /
Resource Hash: a3590465414b1de167b0c78f675d26356cdae86af81776ad069ee7e6bb5cc3f4

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://cdn.flashtalking.com/118908/3176836/index.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: max-age=1200
etag: W/"81c8852e5f557b6bfb85bf4b06a59ff7"
via: 1.1 prod-web-edge8.dub11.ftdns.net (Varnish/trunk), 1.1 b9608c5d714fa42feebf61497cac7bd4.cloudfront.net (CloudFront)
accept-ranges: bytes
x-varnish: 3676221
x-cache: Hit from cloudfront
x-amz-cf-id: qT9D0ZcswxPcfT2eYRdAB53oBx6kPz6fKoHM8EjHLv_KWRBXbgIeUg==
date: Thu, 14 May 2026 09:23:57 GMT
content-type: image/jpeg
last-modified: Tue, 08 Sep 2020 22:02:39 GMT
server: Flashtalking (AKA)
x-amz-cf-pop: YUL62-P2
vary: Origin

GET
H2 200 welding-bundle.jpg
cdn.flashtalking.com/118908/3176836/ Frame 7D27 4 KB
4 KB 28ms
21ms Image
image/jpeg 3.162.3.14
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://cdn.flashtalking.com/118908/3176836/welding-bundle.jpg
Requested by: Host: cdn.flashtalking.com
URL: https://cdn.flashtalking.com/118908/3176836/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.162.3.14 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-3-162-3-14.yul62.r.cloudfront.net
Software: Flashtalking (AKA) /
Resource Hash: 554440727751c94747c5af4538f331196eba67c3de1e14121a403c467734190c

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://cdn.flashtalking.com/118908/3176836/index.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: max-age=1200
etag: W/"d47a0e311016cdded03fbc647041a122"
via: 1.1 prod-web-edge2.ore11.ftdns.net (Varnish/trunk), 1.1 b9608c5d714fa42feebf61497cac7bd4.cloudfront.net (CloudFront)
accept-ranges: bytes
x-varnish: 30587552
x-cache: Hit from cloudfront
x-amz-cf-id: VmD-bVRRcA00lmdW22ScfQa82f5C_d46XWSa4Intn-O3geb29oHUnQ==
date: Thu, 14 May 2026 09:16:44 GMT
content-type: image/jpeg
last-modified: Tue, 08 Sep 2020 22:02:39 GMT
server: Flashtalking (AKA)
x-amz-cf-pop: YUL62-P2
vary: Origin

GET
H2 200 fastening-bundle.jpg
cdn.flashtalking.com/118908/3176836/ Frame 7D27 3 KB
4 KB 40ms
32ms Image
image/jpeg 3.162.3.14
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://cdn.flashtalking.com/118908/3176836/fastening-bundle.jpg
Requested by: Host: cdn.flashtalking.com
URL: https://cdn.flashtalking.com/118908/3176836/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.162.3.14 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-3-162-3-14.yul62.r.cloudfront.net
Software: Flashtalking (AKA) /
Resource Hash: 274a38c68eb3352af867ec81816b7584fb2256d3af3553ecb0ec1334b79c3457

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://cdn.flashtalking.com/118908/3176836/index.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: max-age=1200
content-encoding: gzip
etag: W/"2db9ea52e738019a957554d3b288643a"
via: 1.1 prod-web-edge3.ore11.ftdns.net (Varnish/trunk), 1.1 b9608c5d714fa42feebf61497cac7bd4.cloudfront.net (CloudFront)
accept-ranges: bytes
x-varnish: 38603082 37379693
x-cache: Hit from cloudfront
content-length: 3175
x-amz-cf-id: SJIJ_2EUpe5cDSqjxIu-T-qrfWeS-GUY8NUPQmoSX41e40qWmi1hrw==
date: Thu, 14 May 2026 09:16:44 GMT
content-type: image/jpeg
last-modified: Tue, 08 Sep 2020 22:02:39 GMT
server: Flashtalking (AKA)
x-amz-cf-pop: YUL62-P2
vary: Origin

GET
H2 200 safety.svg
cdn.flashtalking.com/118908/3176836/ Frame 7D27 2 KB
2 KB 41ms
33ms Image
image/svg+xml 3.162.3.14
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://cdn.flashtalking.com/118908/3176836/safety.svg
Requested by: Host: cdn.flashtalking.com
URL: https://cdn.flashtalking.com/118908/3176836/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.162.3.14 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-3-162-3-14.yul62.r.cloudfront.net
Software: Flashtalking (AKA) /
Resource Hash: b02c807236e2e4ef7afdfd1527da16c937d9103e80784233786edfd01ac75164

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://cdn.flashtalking.com/118908/3176836/index.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: max-age=1200
etag: W/"88e2137f3c84d70f3a1b2bbc98c3a181"
via: 1.1 prod-web-edge2.sjc11.ftdns.net (Varnish/trunk), 1.1 b9608c5d714fa42feebf61497cac7bd4.cloudfront.net (CloudFront)
accept-ranges: bytes
x-varnish: 135597032
x-cache: Hit from cloudfront
x-amz-cf-id: syp3yOqe6e7T80vVsImu0kijdBH8s9F3uvka_JR0Yh5fSZChhbHJqA==
date: Thu, 14 May 2026 09:16:44 GMT
content-type: image/svg+xml
last-modified: Tue, 08 Sep 2020 22:02:39 GMT
server: Flashtalking (AKA)
x-amz-cf-pop: YUL62-P2
vary: Origin

GET
H2 200 cleaning.svg
cdn.flashtalking.com/118908/3176836/ Frame 7D27 2 KB
1 KB 42ms
33ms Image
image/svg+xml 3.162.3.14
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://cdn.flashtalking.com/118908/3176836/cleaning.svg
Requested by: Host: cdn.flashtalking.com
URL: https://cdn.flashtalking.com/118908/3176836/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.162.3.14 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-3-162-3-14.yul62.r.cloudfront.net
Software: Flashtalking (AKA) /
Resource Hash: 16e779a136da13ffed806f54fba67a7adf0cf8a3d81e0b81788c8b81714ac798

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://cdn.flashtalking.com/118908/3176836/index.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: max-age=1200
content-encoding: gzip
etag: W/"22f363c12fb1e1cfaae90f9cc055f83d"
via: 1.1 prod-web-edge3.sjc11.ftdns.net (Varnish/trunk), 1.1 b9608c5d714fa42feebf61497cac7bd4.cloudfront.net (CloudFront)
x-varnish: 124979614
accept-ranges: bytes
x-cache: Hit from cloudfront
x-amz-cf-id: YDgdQCs4Esk-CTz6s0s6hHchjr2E04roIC3-vB7pEyiHH9oOxXknuA==
date: Thu, 14 May 2026 09:14:09 GMT
content-type: image/svg+xml
last-modified: Tue, 08 Sep 2020 22:02:39 GMT
server: Flashtalking (AKA)
x-amz-cf-pop: YUL62-P2
vary: Origin

GET
H2 200 powertools_stacked.svg
cdn.flashtalking.com/118908/3176836/ Frame 7D27 4 KB
4 KB 41ms
31ms Image
image/svg+xml 3.162.3.14
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://cdn.flashtalking.com/118908/3176836/powertools_stacked.svg
Requested by: Host: cdn.flashtalking.com
URL: https://cdn.flashtalking.com/118908/3176836/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.162.3.14 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-3-162-3-14.yul62.r.cloudfront.net
Software: Flashtalking (AKA) /
Resource Hash: eeebadd506dfcd38fdbb110d87de80da27a3d2e62a5d6afa655836b903734ba8

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://cdn.flashtalking.com/118908/3176836/index.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: max-age=1200
etag: W/"d1aa2d673b1be797abf5e02b19431f04"
via: 1.1 prod-web-edge3.ore11.ftdns.net (Varnish/trunk), 1.1 b9608c5d714fa42feebf61497cac7bd4.cloudfront.net (CloudFront)
accept-ranges: bytes
x-varnish: 102612876
x-cache: Hit from cloudfront
x-amz-cf-id: wjS2FLeVnIeZ7K3iHk0JCS9vUDkj8jDJjg1k3ZKrLHADLKbMSwKd5A==
date: Thu, 14 May 2026 09:16:44 GMT
content-type: image/svg+xml
last-modified: Tue, 08 Sep 2020 22:02:39 GMT
server: Flashtalking (AKA)
x-amz-cf-pop: YUL62-P2
vary: Origin

GET
H2 200 plumbing.svg
cdn.flashtalking.com/118908/3176836/ Frame 7D27 2 KB
3 KB 41ms
32ms Image
image/svg+xml 3.162.3.14
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://cdn.flashtalking.com/118908/3176836/plumbing.svg
Requested by: Host: cdn.flashtalking.com
URL: https://cdn.flashtalking.com/118908/3176836/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.162.3.14 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-3-162-3-14.yul62.r.cloudfront.net
Software: Flashtalking (AKA) /
Resource Hash: 0f08574ce96b2c4a97be677a25b7cebc8e2aaa2cb482b7a24a63d22a209293ea

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://cdn.flashtalking.com/118908/3176836/index.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: max-age=1200
etag: W/"2d3c8b1037c4091411cf41b86dad830f"
via: 1.1 prod-web-edge2.sjc11.ftdns.net (Varnish/trunk), 1.1 b9608c5d714fa42feebf61497cac7bd4.cloudfront.net (CloudFront)
accept-ranges: bytes
x-varnish: 83642224
x-cache: Hit from cloudfront
x-amz-cf-id: arcXIjPz2hPzB9YzFUDDZDCcC1QxD1VHuROyrs2315LOwoVUCIXImw==
date: Thu, 14 May 2026 09:26:19 GMT
content-type: image/svg+xml
last-modified: Tue, 08 Sep 2020 22:02:39 GMT
server: Flashtalking (AKA)
x-amz-cf-pop: YUL62-P2
vary: Origin

GET
H2 200 welding.svg
cdn.flashtalking.com/118908/3176836/ Frame 7D27 2 KB
2 KB 42ms
34ms Image
image/svg+xml 3.162.3.14
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://cdn.flashtalking.com/118908/3176836/welding.svg
Requested by: Host: cdn.flashtalking.com
URL: https://cdn.flashtalking.com/118908/3176836/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.162.3.14 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-3-162-3-14.yul62.r.cloudfront.net
Software: Flashtalking (AKA) /
Resource Hash: 03b0704780aed6d82c9621d0aa02d128d15b7d4804c78ec73deb5d79f483b365

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://cdn.flashtalking.com/118908/3176836/index.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: max-age=1200
etag: W/"53fa7ab559d85988ae057f0fe244d766"
via: 1.1 prod-web-edge1.ore11.ftdns.net (Varnish/trunk), 1.1 b9608c5d714fa42feebf61497cac7bd4.cloudfront.net (CloudFront)
accept-ranges: bytes
x-varnish: 10727468
x-cache: Hit from cloudfront
x-amz-cf-id: 9wLsz8kHmdUHKlbSir-Pa5GJzxf91UHXpKtPrTZkPmar-UKMWDtGhg==
date: Thu, 14 May 2026 09:31:04 GMT
content-type: image/svg+xml
last-modified: Tue, 08 Sep 2020 22:02:39 GMT
server: Flashtalking (AKA)
x-amz-cf-pop: YUL62-P2
vary: Origin

GET
H2 200 fasteners.svg
cdn.flashtalking.com/118908/3176836/ Frame 7D27 3 KB
2 KB 41ms
33ms Image
image/svg+xml 3.162.3.14
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://cdn.flashtalking.com/118908/3176836/fasteners.svg
Requested by: Host: cdn.flashtalking.com
URL: https://cdn.flashtalking.com/118908/3176836/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.162.3.14 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-3-162-3-14.yul62.r.cloudfront.net
Software: Flashtalking (AKA) /
Resource Hash: 8c8caa8d2b531f001065d46bf1ca904810818d86b1d68e2e0aab9f0b62422098

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://cdn.flashtalking.com/118908/3176836/index.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: max-age=1200
content-encoding: gzip
etag: W/"01d0d3bc7a9f4adf2c6278b52b76e9c0"
via: 1.1 prod-web-edge3.ore11.ftdns.net (Varnish/trunk), 1.1 b9608c5d714fa42feebf61497cac7bd4.cloudfront.net (CloudFront)
accept-ranges: bytes
x-varnish: 116141483 116861326
x-cache: Hit from cloudfront
content-length: 1113
x-amz-cf-id: peWj13YD0Hg7oO-b-6o2HdOvdbEKmTSyeaU6wG_ioK7miMMyHXKOaA==
date: Thu, 14 May 2026 09:26:19 GMT
content-type: image/svg+xml
last-modified: Tue, 08 Sep 2020 22:02:39 GMT
server: Flashtalking (AKA)
x-amz-cf-pop: YUL62-P2
vary: Origin

GET
H3 200 audins.js Show response
go.ezodn.com/detroitchicago/ 516 B
776 B 31ms
31ms Script
application/javascript 104.21.87.79
Cloudflare

General

Check archive.org

Download Go to

Full URL: https://go.ezodn.com/detroitchicago/audins.js?cb=3
Requested by: Host: www.mediafire.com
URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.87.79 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: bcf7993523efcd42f5599e1c210b6433e35a39de688c9e5ae90829741937df71

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-robots-tag: noindex, follow
content-encoding: br
cf-cache-status: HIT
age: 97514
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=BIZ2Wp6NEIAVO8C3iMAnGXfqmzEhpynrQ2SLEGZfB7M4F04qoHhlnFUSF7WbYQkWF%2BshdGYf0D%2B4hDyjhOcBtSo%2BiebdcOky0uCK2N%2By69rPbcBVZ%2Bgr3u8E2q3Klb8%3D"}]}
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 14 May 2026 09:33:26 GMT
x-middleton-display: sol-js
last-modified: Wed, 13 May 2026 10:06:21 GMT
content-type: application/javascript
vary: Accept-Encoding
priority: u=3,i=?0
cache-control: public, max-age=31536000
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray: 9fb8e6c39d5eab5a-YYZ
accept-ranges: bytes
content-length: 275
server: cloudflare

GET
H2 200 quant.js Show response
secure.quantserve.com/ 33 KB
12 KB 114ms
31ms Script
application/javascript 192.184.68.228
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://secure.quantserve.com/quant.js
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/audins.js?cb=3
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.184.68.228 , United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
Software: /
Resource Hash: dab57fd1fa79022a4fc26533b9c0d5d2f59ae80d86a2a0d72ca53639b2f633c3

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: private, max-age=86400
content-encoding: gzip
etag: "ynV3urHYPJfGyLW/1QBWiQ=="
expires: Fri, 15 May 2026 09:33:27 GMT
accept-ranges: bytes
date: Thu, 14 May 2026 09:33:27 GMT
content-type: application/javascript
vary: Accept-Encoding

GET
H2 200 rules-p-31iz6hfFutd16.js Show response
rules.quantcount.com/ 160 B
634 B 113ms
30ms Script
application/javascript 13.226.238.59
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://rules.quantcount.com/rules-p-31iz6hfFutd16.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.226.238.59 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-226-238-59.iad61.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4718dd9f68e969d1cb5e1b6172206b7150ad1d8cd5c5c1fe5812dd0e1646d426

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

etag: "af15ecfe46737cb2a37226fd060f23a6"
age: 39
access-control-allow-methods: GET
x-cache: Hit from cloudfront
x-amz-cf-id: CtGIbXVXvLz-7FFQCMM5AtBzGnuwEuZmfShtbPtJtdsm-EMgMQNiVQ==
date: Thu, 14 May 2026 09:32:49 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Fri, 14 Oct 2022 00:41:49 GMT
cache-control: max-age=3600
cross-origin-resource-policy: cross-origin
via: 1.1 fd24baa8ef28b0365696ab4b52922460.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 160
x-amz-cf-pop: IAD61-P13
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2

200

cs Show response
pixel.quantserve.com/
Redirect Chain

https://pixel.quantserve.com/cs?a=p-31iz6hfFutd16&gdpr=0
https://pixel.quantserve.com/cs?a=p-31iz6hfFutd16&gdpr=0&__qcmcs=1

666 B
933 B

32ms
32ms

Fetch
application/json

192.184.68.228
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://pixel.quantserve.com/cs?a=p-31iz6hfFutd16&gdpr=0&__qcmcs=1
Protocol: H2
Server: 192.184.68.228 , United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
Software: /
Resource Hash: 2c60eb04353098545f24cf0ef5e9409c7093b27df3d1ad341ec685b17a992418

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

access-control-allow-origin: https://www.mediafire.com
content-length: 666
date: Thu, 14 May 2026 09:33:27 GMT
content-type: application/json
vary: Origin
access-control-allow-credentials: true

Redirect headers

strict-transport-security: max-age=86400
cache-control: private, no-store, proxy-revalidate
location: https://pixel.quantserve.com/cs?a=p-31iz6hfFutd16&gdpr=0&__qcmcs=1
access-control-allow-credentials: true
access-control-allow-origin: https://www.mediafire.com
content-length: 0
date: Thu, 14 May 2026 09:33:27 GMT
vary: Origin

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame A358 42 B
65 B 61ms
61ms Fetch
image/gif 142.251.167.157
Google LLC

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsv9Oia8Q4fwhLX8b-pzDa7oUEfXm85fj_V5PY5hgpIC_APVo4bbri_7_ElAKMHHqzH6JOPHt-ru9Cp7LFx_mBr5ZcNyoL9KcxW_7t6dviaTelM1dxPktG0eNxYZkKl5wRmMDTqWB26htfOZ9LZM8vZLTBAVPP-3TkOKkHvuZADiR_HF-pIZ-UkcmYbssr6i0EypG4668V6VJGFwRwi21A&sai=AMfl-YR11w91iuZ9H9bs7ESC818pvg-5H7pUftFJBh6j2iho6EAB2_PRnCOeWXw7QY37EZMTF-Jv1rynqKQ_QoOYAURHDoRfZPHYwm5uZjH87irouUlMcfhiqji6FBAXwMq45Iu7pz-uDteikOpYf39m1Ao26EE54TQb-Ld-c26jNse7mhVMpfqxTaE7oOx15oUoMhlvzdq1FvoWHi3BwKRE520UMVA9N26GjP0XH8uWDNdiEOlHmw2yw0CUIcNMxbap7DvGOiMRyqtPryYHp4mFJJDfgihgjChUMEDZYGfAzHtDS84gNwPtCyuqEwqEVo6qd-WZsCu0l6wEE_pUAgMOSe53ilhM6_o&sig=Cg0ArKJSzLHNXqthHfgsEAE&cid=CAQS4gEABaugfQIRQr8HezWpJjRo4141VhO9j1YgEZG9b5tlPKhzAt-u2j4q7j8YDkLapQlz6WWvwxRnsc3_fhbghRjdqqvFVq8MzRJSpzraC_sujexacYZRgFKoh09GEKo8ndraVJU00_7yFpx0WVCmqd9x-MT9TjrA9II5CEc0r4uumTRkwds-4IaRlAeab5NhZJ1lCxKH1XofvQa8FLgYK3Y8NVHimSQdTooAiZLwbSHncraUt0u2c8PmKsKiQSsFsFjN-VAzskqrQHV5tff32OHiNnpbvC8AeUkTW9T5cFwmWkBhGAE&id=lidar2&mcvt=1001&p=10,552,100,1280&tm=1024.099998474121&tu=22.900001525878906&mtos=1001,1001,1001,1001,1001&tos=1001,0,0,0,0&v=20260513&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=3106951849&rs=4&la=0&cr=0&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE0OC4wLjc3NzguMTY3IixudWxsLDAsbnVsbCwiNjQiLFtbIkNocm9taXVtIiwiMTQ4LjAuMC4wIl0sWyJHb29nbGUgQ2hyb21lIiwiMTQ4LjAuMC4wIl0sWyJOb3QtQS5CcmFuZCIsIjI0LjAuMC4wIl1dLDBd&vs=4&r=v&co=7468400600&rst=1778751205827&rpt=316&isd=0&lsd=0&met=ce&wmsd=0&pbe=0&fle=0&vae=0&spb=0&sfl=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.157 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

ww-in-f157.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Thu, 14 May 2026 09:33:27 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2

200

sync
pippio.com/api/
Redirect Chain

https://idsync.rlcdn.com/380609.gif?gdpr=0&partner_uid=PFTZVTMDjFcnB9ACOlbEVD1Q2VQnDdpWPwO8aJS_
https://idsync.rlcdn.com/1000.gif?memo=CMGdFxIzCi8IARCfOBooUEZUWlZUTURqRmNuQjlBQ09sYkVWRDFRMlZRbkRkcFdQd084YUpTXxAAGg0I6K2W0AYSBQjoBxAAQgBKAA
https://pippio.com/api/sync?pid=5324&it=1&iv=3eeb214efffd8cdbf7c9cc682a207f52955b9d20ac98ed5645699ddaa9a1b716791426b5417dce21&_=2

42 B
572 B

270ms
73ms

Image
image/gif

107.178.254.65
Google LLC

General

Check archive.org

Download Go to Show image

Full URL: https://pippio.com/api/sync?pid=5324&it=1&iv=3eeb214efffd8cdbf7c9cc682a207f52955b9d20ac98ed5645699ddaa9a1b716791426b5417dce21&_=2
Protocol: H2
Server: 107.178.254.65 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS: 65.254.178.107.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
Referer: https://www.mediafire.com/

Response headers

cache-control: no-cache, no-store
timing-allow-origin: *
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 42
date: Thu, 14 May 2026 09:33:28 GMT
content-type: image/gif

Redirect headers

cache-control: no-cache, no-store
timing-allow-origin: *
location: https://pippio.com/api/sync?pid=5324&it=1&iv=3eeb214efffd8cdbf7c9cc682a207f52955b9d20ac98ed5645699ddaa9a1b716791426b5417dce21&_=2
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 0
date: Thu, 14 May 2026 09:33:28 GMT

GET rum
dsum-sec.casalemedia.com/ 0
0

GET
H2 200 Pug
image2.pubmatic.com/AdServer/ 42 B
594 B 1115ms
28ms Image
image/gif 207.65.32.88
PubMatic

General

Check archive.org

Download Go to Show image

Full URL

https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=Sjm360Vu4ulRar68TDuq6ks9t-pRYLToSW5vD1fN

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

207.65.32.88 , United States, ASN62713 (AS-PUBMATIC - PubMatic, Inc., US),

Reverse DNS

Software

nginx /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400; includeSubDomains

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=16070400; includeSubDomains
cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 14 May 2026 09:33:28 GMT
content-type: image/gif; charset=utf-8
server: nginx

GET
H/1.1 200
OK tap.php
pixel.rubiconproject.com/ 42 B
1 KB 1471ms
33ms Image
image/gif 216.19.192.2
Magnite

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=4939&nid=1902&gdpr=0&put=9jckK_lgcSntZC188DU5KvczJCrtbico9WDp3c0T
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 216.19.192.2 , United States, ASN26667 (RUBICONPROJECT - Magnite, Inc., US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: d782fa60f159de8718ae1b5885d7671b
Pragma: no-cache
content-length: 42
Content-Type: image/gif

GET pixel
cm.g.doubleclick.net/ 0
0

GET
H2 200 pixel;r=848789293;labels=Domain.mediafire_com%2CDomainId.484470;rf=0;a=p-31iz6hfFutd16;url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F28rrtqxs0afdpk3%2FGambonanza-v1.0.16-full-apkvision.apk%2Ffile;ns...
pixel.quantserve.com/ 35 B
160 B 32ms
32ms Image
image/gif 192.184.68.228
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL

https://pixel.quantserve.com/pixel;r=848789293;labels=Domain.mediafire_com%2CDomainId.484470;rf=0;a=p-31iz6hfFutd16;url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F28rrtqxs0afdpk3%2FGambonanza-v1.0.16-full-apkvision.apk%2Ffile;ns=0;ce=1;qjs=1;qv=cb91e2be-20260407153927;ref=;dst=1;et=1778751207263;tzo=420;ogl=type.website%2Csite_name.MediaFire%2Clocale.en_US%2Curl.https%3A%2F%2Fwww%252Emediafire%252Ecom%2Ffile%2F28rrtqxs0afdpk3%2FGambonanza-v1%252E0%252E16-full-apkvision%2Ctitle.Gambonanza-v1%252E0%252E16-full-apkvision%2Cimage.https%3A%2F%2Fstatic%252Emediafire%252Ecom%2Fimages%2Ffiletype%2Fdownload%2Fzip%252Ejpg%2Cdescription.;d=mediafire.com;uht=2;fpan=1;fpa=P1-6f1c6cb0-69fd-4c26-967a-8bbcef7d8522;pbc=;_ses=207798d9-f286-4593-9587-fceb1d9fb644;_seg=0;_ss=1;_gacid=1798214675.1778751200;_gasid=K68XP6D85D_1778751200;gdpr=0;mdl=

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.184.68.228 , United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=86400
cache-control: private, no-store, proxy-revalidate
content-length: 35
date: Thu, 14 May 2026 09:33:27 GMT
content-type: image/gif

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame A358 0
20 B 47ms
46ms Ping
image/gif 142.251.167.157
Google LLC

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=6639716422147&version=m202604070101&ct=77&x=1&cor=7421199761382883328

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.157 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

ww-in-f157.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 14 May 2026 09:33:27 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H/1.1 200
OK /
servedby.flashtalking.com/state/7175118;3176836;0;202;31CEBFAA-7B90-A6AB-5626-207FEF21DD1C/ Frame A358 42 B
387 B 65ms
64ms Image
image/gif 23.48.203.240
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to Show image

Full URL

https://servedby.flashtalking.com/state/7175118;3176836;0;202;31CEBFAA-7B90-A6AB-5626-207FEF21DD1C/?cachebuster=992192101

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.48.203.240 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-48-203-240.deploy.static.akamaitechnologies.com

Software

prod-xre-app98.ash11 /

Resource Hash

47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

Strict-Transport-Security: max-age=86400
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 14 May 2026 09:33:27 GMT
Content-Length: 42
Allow-Fenced-Frame-Automatic-Beacons: true
Date: Thu, 14 May 2026 09:33:27 GMT
Content-Type: image/gif
Server: prod-xre-app98.ash11

OPTIONS
H3 200 log
translate.googleapis.com/element/ Frame 0
0 122ms
44ms Preflight
text/plain 142.251.16.95
Google LLC

General

Check archive.org

Download Go to

Full URL

https://translate.googleapis.com/element/log?format=json&hasfast=true&authuser=0

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.95 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

bl-in-f95.1e100.net

Software

Playlog /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: content-encoding,content-type,x-goog-authuser
Access-Control-Request-Method: POST
Origin: https://www.mediafire.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web,authorization,content-encoding,content-type,x-goog-authuser,origin
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://www.mediafire.com
access-control-max-age: 86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/plain; charset=UTF-8
date: Thu, 14 May 2026 09:33:30 GMT
server: Playlog
x-frame-options: SAMEORIGIN
x-xss-protection: 0

POST
H3 200 log Show response
translate.googleapis.com/element/ 131 B
151 B 49ms
48ms Fetch
text/plain 142.251.16.95
Google LLC

General

Check archive.org

Download Go to

Full URL

https://translate.googleapis.com/element/log?format=json&hasfast=true&authuser=0

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=dd428baff9

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.95 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

bl-in-f95.1e100.net

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
Content-Encoding: gzip
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
Content-Type: application/binary
X-Goog-AuthUser: 0

Response headers

x-frame-options: SAMEORIGIN
content-encoding: gzip
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.mediafire.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 131
date: Thu, 14 May 2026 09:33:30 GMT
x-xss-protection: 0
content-type: text/plain; charset=UTF-8
server: Playlog
access-control-allow-headers: X-Playlog-Web

POST
H3 204 collect
analytics.google.com/g/ 0
0 65ms
65ms Fetch
text/plain 216.239.32.181
Google LLC

General

Check archive.org

Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-K68XP6D85D&gtm=45je65c0v887485693za20gzb6304663zd6304663&_p=1778751198976&gcs=G111&gcd=13n3n3l3l5l1&npa=0&dma=0&tcfd=10000&_eu=AEIAAGQC&are=1&cid=1798214675.1778751200&frm=0&pscdl=noapi&rcb=2&sr=1600x1200&uaa=x86&uab=64&uafvl=Chromium%3B148.0.0.0%7CGoogle%2520Chrome%3B148.0.0.0%7CNot-A.Brand%3B24.0.0.0&uam=&uamb=0&uap=Linux&uapv=&uaw=0&ul=en-ca&gaf=2&_s=3&tag_exp=0~115938466~115938468&sid=1778751200&sct=1&seg=0&dl=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F28rrtqxs0afdpk3%2FGambonanza-v1.0.16-full-apkvision.apk%2Ffile&dt=Gambonanza-v1.0.16-full-apkvision&en=ad_impression&ep.query_id=CJyPhc68uJQDFfgtHAAdBU0aMA&_et=2432&tfd=12589
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=dd428baff9
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 216.239.32.181 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.mediafire.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="148", "Google Chrome";v="148", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:196:0
report-to: {"group":"ascnsrsggc:196:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:196:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.mediafire.com
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:196:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 14 May 2026 09:33:30 GMT
content-type: text/plain
server: Golfe2

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: id5-sync.com
URL: https://id5-sync.com/bounce

Domain: id5-sync.com
URL: https://id5-sync.com/gm/v3

Domain: id5-sync.com
URL: https://id5-sync.com/gm/v3

Domain: id5-sync.com
URL: https://id5-sync.com/g/v2/457.json

Domain: ups.analytics.yahoo.com
URL: https://ups.analytics.yahoo.com/ups/58934/cms

Domain: www.google.com
URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTp96HpGm0s3i3DhJbZhYFY0hkk1mQZE63B9w2q3-LDE9OBc_4VV3oq0CtTpNwQCdRdgqCBXpQsS0Pk6T4ZYoSPCMLtvQ

Domain: id5-sync.com
URL: https://id5-sync.com/gm/v3

Domain: ups.analytics.yahoo.com
URL: https://ups.analytics.yahoo.com/ups/58933/cms?google_gid=CAESEMOmSelp7W-yYOzzNW2C3Ok&google_cver=1&google_push=AXcoOmSirVSh_b1HnhZ0KiRihi7eSUaHePiz0fo4f4G_Fcc2dm7uO3LiqsaHZKLLd1So3fOzMCww8GxqSGkKeO0Wfe35HpkLOPI

Domain: id5-sync.com
URL: https://id5-sync.com/g/v2/457.json

Domain: www.google.com
URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSolNGCNdfofnT3qGAC8MG1DiPARCmD16XdE-x9-QSdsKQS_LN416vwPB7JS6wOMqSPsKLJafBx4HDIIwkwnmQqtSlwGQ

Domain: pixelfnt-us.dsp-api.moloco.com
URL: https://pixelfnt-us.dsp-api.moloco.com/v1/cm/adxpm?google_gid=CAESEPRGVnWwT7sf629y2tQZtpg&google_cver=1&google_push=AXcoOmQ556arqEQEuAzzxnjhjs0DZP0GPwiHxXQ4rNnlY1sSZQU4AwtkhmabY2FzuTDD-WuEetCwF8xu3wefNEX2JHGPpr2qdKs0Zs1NXlI4FqnCI8VwleUPn6EVPcbH6m2w3BzkzrhVlAHzPSEAUqi17Snk

Domain: ads.yieldmo.com
URL: https://ads.yieldmo.com/exptsync?google_gid=CAESEGCB9hgxFODcFwnJ4xkQHNk&google_cver=1&google_push=AXcoOmSodEM42FeiJIlEy-dyhkEv22sk8LUtzhBzNv8IHOZTJHOMjSj-6W90oqQ7GFVaDvzC_oUKCzTImz84fsvWgOrVjprpngo2OIGVlIE0Crto2JEGlpmnoZDePwOwntGbfKC4P0gzqTusE1QaOQFlyao

Domain: dsum-sec.casalemedia.com
URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=81&gdpr=0&external_user_id=5jH0tulmobT9Yv3h4DPpt-c19Lf9aPe15WYpQRrc

Domain: cm.g.doubleclick.net
URL: https://cm.g.doubleclick.net/pixel?gdpr=0&google_nid=B765081F39B1F7&google_push=&google_hm=b537pFumro3JdZScdza3QQ

Verdicts & Comments Add Verdict or Comment

482 JavaScript Window variables

These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.

127 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk	1969-12-31 23:59:59	Name: g36FastPopSessionRequestNumber Value: 1
www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk	1970-01-21 22:51:27	Name: ezux_lpl_484470 Value: 1778751201954\|61a626e9-5149-4521-bf3a-89f22190776a\|false
.criteo.com/dis	1970-01-21 23:27:27	Name: cto_bundle Value: wRHVxl9pOGdKVkxpUHNXMVp5dHZqbmZ0WW9IcHdDc3RJN2NJYSUyQldkU1dCSHZFMUlsQmo4WXlpWGdpRTZLVVpneVhWbUhrWDMxcUJRbG1vUGFFRkVxMnFHV29zWFZiY29nSnZUY05nWWxtN0dtZmpkT1clMkJLNzdHTW5rTyUyRnRhNWFhUTFwdGJQVHZlaEtSNmRzYUslMkJmQU1oWUJFUSUzRCUzRA
.mediafire.com/	1970-01-21 23:41:51	Name: ukey Value: dmq9004q6q4xx1muz98fl6y6weqwfu5q
.mediafire.com/	1970-01-21 14:49:03	Name: conv_tracking_data-2 Value: %7B%22mf_source%22%3A%22regular_download-59%22%2C%22mf_content%22%3A%22Free%22%2C%22mf_medium%22%3A%22linux%5C%2FChrome%22%2C%22mf_campaign%22%3A%2228rrtqxs0afdpk3%22%2C%22mf_term%22%3A%2216fda11878238ddd1f273eabac8e0fb0%22%7D
www.mediafire.com/	1970-01-21 14:15:55	Name: chkout_src Value: eyJ0ZW1wbGF0ZUlkIjoiNTkiLCJydWxlSWQiOiIxMTkifQ%3D%3D
.mediafire.com/	1970-01-21 22:51:27	Name: amp_28916b Value: DfrI3dXX4Sg3lzOTbhBh66...1joitalt5.1joitalt6.0.1.1
.mediafire.com/	1970-01-21 22:51:27	Name: cf_clearance Value: sK8HNHi6fW4WTC84evBNPgFx3M07d_BVkYScE.t0BUY-1778751199-1.2.1.1-07JTDUfkRR6o7Ibvv8uxWEQZqRsyqiJEHgwFfGmQ0OU_gyYN1VG.3FqZxn3oi6Dp0UVLsdyTGQmzo.1FZ8AFeyU5naIFRhV2gbqvDrUebWZmu4lxjqgUoy3vLMVC735qdiZ5n7bTGYWrbPUyksD6bvRNGoczLPw.1lQi6TQwiXVBbryE59CJZcVWFACXpkIRqUy_wmIO9xvmrWpiTzOvG9ECWj8sGD0eZf8qBzv0a2iPwYo4fmR_H1mf5HqArlSTHBVw1YjuXYgOVbRVZJEH58XrihcPdIpd.kAmiQncxcS2rs0KZm_TZUOytsTz64TsSvLaaZ449Hy_FgNYYdTShw
.mediafire.com/	1970-01-21 14:05:52	Name: __cf_bm Value: WzFEAEm9z9l80IOJAGj.0VkCGnfIqX5pyfUotGikICg-1778751199.2526236-1.0.1.1-gJ45RoQN4pCOVrCXmsVO_eux4cW6br1pJeOZgXrDUO8EAjSTZn26qWTcE.QKNLshU2W1uF35XX52krrRElB6A9V8jlOCRGjlERpHUnueY4CUWISybUGUZ.WQLbQ6sDlC
.mediafire.com/	1970-01-21 14:05:52	Name: ezfs_484470 Value: 2964641782
.mediafire.com/	1970-01-21 14:05:58	Name: ezoab_484470 Value: mod1
.mediafire.com/	1970-01-21 14:08:43	Name: ezovuuidtime_484470 Value: 1778751199
.mediafire.com/	1970-01-21 14:05:53	Name: lp_484470 Value: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file
.mediafire.com/	1970-01-21 14:05:53	Name: ezovuuid_484470 Value: 128281cf-0191-4363-4ff3-25a7a0ad1727
.mediafire.com/	1970-01-21 14:05:53	Name: ezoref_484470 Value:
www.mediafire.com/	1970-01-21 14:08:43	Name: ezstandaloneuser Value: true
econventa.com/	1969-12-31 23:59:59	Name: IKSR Value: %7B%7D
econventa.com/	1969-12-31 23:59:59	Name: INF_DFL8 Value: false
econventa.com/	1970-01-21 23:41:51	Name: IUID Value: f808029a-77d4-407c-aaf1-89640624e7c3
econventa.com/	1969-12-31 23:59:59	Name: ISSH Value: 8356DD
econventa.com/	1969-12-31 23:59:59	Name: VMI Value:
econventa.com/	1970-01-21 23:41:51	Name: IPLH Value: %23%7B%7D
econventa.com/	1970-01-21 23:41:51	Name: IPLH_Q Value: %23%5B%5D
econventa.com/	1970-01-21 23:41:51	Name: CHN Value: %23%5B%5D
econventa.com/	1970-01-21 23:41:51	Name: MSSH Value: %23%7B%7D
econventa.com/	1970-01-21 23:41:51	Name: MSRH Value: %23%7B%7D
econventa.com/	1970-01-21 23:41:51	Name: IPMPLU Value: %2301%2F01%2F0001%2000%3A00%3A00
econventa.com/	1970-01-21 23:41:51	Name: IPMUID Value: %23
econventa.com/	1970-01-21 23:41:51	Name: BSWUID Value: %23
econventa.com/	1970-01-21 23:41:51	Name: IBL Value: %23%5B%5D
econventa.com/	1970-01-21 23:41:51	Name: IOPT Value: %23%5B%5D
econventa.com/	1970-01-21 23:41:51	Name: IPLSH Value: %23%7B%7D
econventa.com/	1970-01-21 23:41:51	Name: IPLSH_Q Value: %23%5B%5D
econventa.com/	1970-01-21 23:41:51	Name: IZH Value: %23%7B%7D
econventa.com/	1970-01-21 23:41:51	Name: IZH_Q Value: %23%5B%5D
econventa.com/	1970-01-21 23:41:51	Name: IMCH Value: %23%7B%7D
econventa.com/	1970-01-21 23:41:51	Name: IMCH_Q Value: %23%5B%5D
econventa.com/	1970-01-21 23:41:51	Name: IMH Value: %23%7B%7D
econventa.com/	1970-01-21 23:41:51	Name: IMH_Q Value: %23%5B%5D
econventa.com/	1970-01-21 23:41:51	Name: ISH Value: %23%7B%22101%22%3A%5B%7B%22SId%22%3A%228356DD%22%2C%22D%22%3A%2226%2F5%2F14T9%3A33%3A19%22%7D%5D%7D
econventa.com/	1970-01-21 23:41:51	Name: ISH_Q Value: %23%5B101%5D
econventa.com/	1970-01-21 23:41:51	Name: ISPH Value: %23%7B%7D
econventa.com/	1970-01-21 23:41:51	Name: ISPH_Q Value: %23%5B%5D
econventa.com/	1970-01-21 23:41:51	Name: ICH Value: %23%7B%7D
econventa.com/	1970-01-21 23:41:51	Name: ICH_Q Value: %23%5B%5D
www.mediafire.com/	1970-01-21 14:49:03	Name: _ezli_enabled Value: false
www.mediafire.com/	1970-01-21 23:41:51	Name: ezds Value: ffid%3D1%2Cw%3D1600%2Ch%3D1200
www.mediafire.com/	1970-01-21 23:41:51	Name: ezohw Value: w%3D1600%2Ch%3D1200
.mediafire.com/	1970-01-21 14:07:17	Name: _gid Value: GA1.2.1648740218.1778751200
.mediafire.com/	1970-01-21 14:05:51	Name: _gat_gtag_UA_829541_1 Value: 1
.mediafire.com/	1970-01-21 23:41:51	Name: _ga Value: GA1.1.1798214675.1778751200
.ezoic.net/	1970-01-21 22:51:27	Name: ezoid Value: cbdd8b16-7438-40d4-488f-1a470a3a966c
.mediafire.com/	1970-01-21 14:05:58	Name: ezorab_484470 Value: rmod50
.mediafire.com/	1970-01-21 22:51:27	Name: ezoid Value: cbdd8b16-7438-40d4-488f-1a470a3a966c
.mediafire.com/	1970-01-21 14:08:44	Name: active_template::484470 Value: pub_site.1778751200
.mediafire.com/	1970-01-21 14:05:53	Name: ezopvc_484470 Value: 2
.mediafire.com/	1970-01-21 22:51:27	Name: _sharedid Value: 3b71759e-495d-4daf-9889-fcb8d567eca3
.mediafire.com/	1970-01-21 22:51:27	Name: _sharedid_cst Value: SBp4Zg%3D%3D
www.mediafire.com/	1970-01-21 14:05:54	Name: _lr_retry_request Value: true
www.mediafire.com/	1970-01-21 14:49:03	Name: _lr_env_src_ats Value: false
.adsrvr.org/	1970-01-21 22:51:27	Name: TDID Value: 54db8cce-f533-4d32-8b2f-cf501c4e6f79
.crwdcntrl.net/	1970-01-21 20:34:37	Name: _cc_dc Value: 0
.crwdcntrl.net/	1970-01-21 20:34:37	Name: _cc_id Value: 25a23376e7dca02d17d91a54d35a8a6a
.crwdcntrl.net/	1970-01-21 20:34:39	Name: _cc_cc Value: "ACZ4nGNQMDJNNDI2NjdLNU9JTjQwSjE0T7E0TDQ1STE2TbRINEtkAIIs1mkPGRAAAFAxCrs%3D"
.crwdcntrl.net/	1970-01-21 20:34:39	Name: _cc_aud Value: "ABR4nGNgYGDIYp32kAEOABbSAec%3D"
www.mediafire.com/	1970-01-21 20:34:39	Name: ezppid_ck Value: 142e99cc7726b3a439aa50ec804b6bbe
.criteo.com/	1970-01-21 23:27:27	Name: uid Value: eafd1c2e-093c-4fef-95e0-b6b1cbc0c7b9
.id5-sync.com/	1970-01-21 16:15:27	Name: id5 Value: a8e58b0f-f1c8-76c3-be0a-9ed37d2098fd#1778751201410#1
www.mediafire.com/	1970-01-21 15:32:15	Name: pbjs-unifiedid Value: %7B%22TDID%22%3A%2254db8cce-f533-4d32-8b2f-cf501c4e6f79%22%2C%22TDID_LOOKUP%22%3A%22FALSE%22%2C%22TDID_CREATED_AT%22%3A%222026-05-14T09%3A33%3A21%22%7D
www.mediafire.com/	1970-01-21 15:32:15	Name: pbjs-unifiedid_cst Value: SBp4Zg%3D%3D
.mediafire.com/	1970-01-21 14:07:17	Name: panoramaId_expiry Value: 1778837601307
.mediafire.com/	1970-01-21 20:34:39	Name: _cc_id Value: 25a23376e7dca02d17d91a54d35a8a6a
.ads.bidsystem.ai/	1970-01-21 14:26:00	Name: BSID Value: MG2ZedT5cxtLdvGsY1Oft
.flashtalking.com/	1970-01-21 22:51:27	Name: _D9J Value: fd73f351095f4bae8e0fef7169bd6f48
.openx.net/	1970-01-21 22:51:27	Name: i Value: 3c434d2f-d897-4020-ae97-79576c28d860\|1778751201
.mediafire.com/	1970-01-21 23:27:27	Name: __gads Value: ID=4c907cf15727623e:T=1778751201:RT=1778751201:S=ALNI_MaDaZ5ZTDiSo5EJt4ZtmZyvBoaSXQ
.mediafire.com/	1970-01-21 23:27:27	Name: __gpi Value: UID=000013894fcd7a92:T=1778751201:RT=1778751201:S=ALNI_MYl5oJsAwAqe897fEVIZyg0ne9Asw
.mediafire.com/	1970-01-21 18:25:03	Name: __eoi Value: ID=777f7e13823df6a9:T=1778751201:RT=1778751201:S=AA-AfjYoKIs1prfKFD6uebUMaLzZ
.openx.net/	1970-01-21 14:27:27	Name: pd Value: v2\|1778751202\|gyvMkWxhhE
.doubleclick.net/	1970-01-21 23:41:51	Name: IDE Value: AHWqTUngrJHpmCPmey5FVHvdanZxqai15dmgQjkTv0jDIbBKgFQ9K_bQueyvsfZSviQ
.adsrvr.org/	1970-01-21 22:51:27	Name: TDCPM Value: IAEoAg..
.turn.com/	1970-01-21 18:25:03	Name: uid Value: 4534177538656440189
.mediafire.com/	1970-01-21 22:51:27	Name: connectId Value: %7B%22ttl%22%3A86400000%2C%22lastUsed%22%3A1778751203233%2C%22lastSynced%22%3A1778751202001%7D
www.mediafire.com/	1970-01-21 22:51:27	Name: _tfpvi Value: MjM1ZThlOWEtYjlmNy00MzlhLWIwYzEtYzJmMzc2Y2YwYmRhIzgtNg%3D%3D
.criteo.com/	1970-01-21 23:27:27	Name: cto_bundle Value: TBccN19kRTNVeGNqRFRla3Z0N2VQd1gwNXR5eVZTZUdIRUh6N3dnSmQlMkZ6WHc4dUJ4MWNpYmtrN0dGRmlDM2VYcDRBQmpxaFRoVUtNMUNhWGtGNnlZaU1aRUJPYlc3V3NINDY1MFQlMkZ3MHVaR2dENmZubmJjbkk5UmFtZVBBalhiZ0pBMDZDaGR3QXp4dFFnTUhFczF4REFEWHZBJTNEJTNE
.mediafire.com/	1970-01-21 23:27:02	Name: cto_bundle Value: q4IJ2l9qWEM4RGhoS1hpdjJ0VzZnQ2RNbVZFdmRFRHlBU0ZHJTJCWlJPOUpWWEclMkJHWGthdE8lMkJCOU1JSzJtQWJRYXIlMkJkV2ZtVVVIdGFBbUNkaEdua1gwcWw3SmhWdGVUb0RabmhwZHVnUG9EQUhYbkdodHRxNmcyQUlpdUw5enFneGJaYUdySU1WODA4d0dwNGdTUW1udm5GQzQ2QSUzRCUzRA
.mediafire.com/	1970-01-21 23:27:02	Name: cto_bidid Value: qiknNV9ZU3hNblRtNTh1NEYydXVQcFJXcWx6Tk1YWHV6S05OUTlQTTBjNnhWMW9HYnlLejVnaFNHd1k4M09ZeFNFTHFwMGRxRmJZc3VTTUZjcXJDbGo1ZThUVGdOajBNTGhlTDBTT28xZTlxSTB1USUzRA
.jackery.com/	1970-01-21 16:15:27	Name: fingerprint Value: cokdate%3D05%2F14%2F2026+09%3A33%3A23%26userid%3D5977ffe7-4ec9-4b01-8374-dfb562078c5a%26rank%3D100%26icrank%3D1000%26icount%3D1%26ccount%3D0%26csranka%3D0%26csrankb%3D0%26vsranka%3D0%26vsrankb%3D0%26ip%3D86.106.90.214%26p%3D%26ty%3D0
.jackery.com/	1970-01-21 15:32:15	Name: 64763_viewnew Value: date%3D05%2F14%2F2026+09%3A33%3A23%26subid%3Dbid_%7ECM.64763%7ESZ.160%7ETS.pdx%7Edv.3%7EST.25%7EBI.110886972959%7EDI.549644393848595698_DSPLY%26size%3D229897%26campaignid%3D64763%26impressionid%3D177875120356130088219090588575129964405347%26bidid%3DSzgTu3RRxqKCkzjVPvPEqw%26bs%3D7734b055-33a1-4592-b7af-2e39fea0f9c2%26gid%3DCAESEGrYkJ1W1pvBUXBc2koO5_8%26ex%3Dpdx%26refURL%3Dmediafire.com
.jackery.com/	1970-01-21 15:32:15	Name: _pre\|64763 Value: 64763%7C0%7C177875120356130088219090588575129964405347%7C5977ffe7-4ec9-4b01-8374-dfb562078c5a%7C160%7C7734b055-33a1-4592-b7af-2e39fea0f9c2%7Chttps%3A%2F%2Fwww.mediafire.com%2Ffile%2F28rrtqxs0afdpk3%2FGambonanza-v1.0.16-full-apkvision.apk%2Ffile%7Cbid_%7ECM.64763%7ESZ.160%7ETS.pdx%7Edv.3%7EST.25%7EBI.110886972959%7EDI.549644393848595698_DSPLY%7C0%7C20260514+09%3A33%3A23
.dotomi.com/	1970-01-21 14:05:51	Name: DotomiTest Value: 57189083323175429
.3lift.com/	1970-01-21 16:15:27	Name: tluid Value: 2163929097284926760826
.1rx.io/	1970-01-21 22:51:27	Name: _rxuuid Value: %7B%22rx_uuid%22%3A%22RX-887cccaf-2990-4ba0-a4b3-657242c1e091-005%22%7D
.targeting.unrulymedia.com/	1970-01-21 22:51:27	Name: _rxuuid Value: %7B%22rx_uuid%22%3A%22RX-887cccaf-2990-4ba0-a4b3-657242c1e091-005%22%7D
.outbrain.com/	1970-01-21 16:15:27	Name: obuid Value: 192f0b7e-f292-47c6-9a00-833903b21c7d
.c.appier.net/	1970-01-21 22:51:27	Name: _auid Value: FtY1gnfxCvW9g9qA5ZYFag
.c.appier.net/	1970-01-21 14:49:03	Name: _gu Value: CAESEONEhbZtuvtFMB1Rbk-dPMc
.mediafire.com/	1970-01-21 23:41:51	Name: _ga_K68XP6D85D Value: GS2.1.s1778751200$o1$g0$t1778751205$j58$l0$h0
.doubleclick.net/	1970-01-21 18:25:03	Name: APC Value: AfxxVi7XfK7ww3TAepmJkzBD5fqhbSMtzAP-soNK_9KFhK6oivwDVg
.adnxs.com/	1970-01-21 16:15:27	Name: XANDR_PANID Value: wNMiOSyYhpRx8LWGxBZXEfPo31O-Nivrw0SAXU1ZmGtKfa57Meu30h6EmF-CXuxFVVKdRXEKddfPPfeYUEdtAbZjVAMQqG2rgunD_kvlZtc.
.adnxs.com/	1970-01-21 16:15:27	Name: uuid2 Value: 2078372564976273142
.adnxs.com/	1970-01-21 16:15:27	Name: anj Value: dTM7k!M41.D>6NRF']wIg2E?cu9q2y!]tbPl1M>e)ZlrFUfJ+tGXxoT>6tAFSeAt<DC/tFKHZ9SKyR@L`dX8[ip:ow3If)y3KL9D3I?+A+(BP@
.casalemedia.com/	1970-01-21 16:15:27	Name: CMPS Value: 6027
.casalemedia.com/	1970-01-21 22:51:27	Name: CMID Value: agWW5tHM6zEAF2UpASRjfQAA
.casalemedia.com/	1970-01-21 16:15:27	Name: CMPRO Value: 6027
.flashtalking.com/	1970-01-21 23:35:15	Name: flashtalkingad1 Value: "GUID=67089B4FBDE3AE"
.teads.tv/	1970-01-21 22:50:00	Name: tt_viewer Value: 53efee9c-6a1a-485f-83a5-c61d04af1bed
.quantserve.com/	1970-01-21 23:36:05	Name: mc Value: 6a0596e7-29b0c-47e04-83656
.quantserve.com/	1970-01-21 16:15:27	Name: sp Value: CggIiQ0SAxCVEgoICJ4NEgMQlRIKCAjZZRIDEJUSCgkI0aYCEgMQlRIKCQiF_wISAxCVEg==
.360yield.com/	1970-01-21 16:15:27	Name: tuuid Value: 1c7110de-8cf9-4f79-b3e8-06e90e108e0a
.360yield.com/	1970-01-21 16:15:27	Name: tuuid_lu Value: 1778751207
.mediafire.com/	1970-01-21 23:30:20	Name: __qca Value: P1-6f1c6cb0-69fd-4c26-967a-8bbcef7d8522
.seedtag.com/	1970-01-21 22:44:15	Name: st_uid Value: 019e25d5-7870-7735-8a84-73f065971538
.seedtag.com/	1969-12-31 23:59:59	Name: st_usi Value: 1
.pubmatic.com/	1970-01-21 16:15:27	Name: KRTBCOOKIE_153 Value: 19420-Sjm360Vu4ulRar68TDuq6ks9t-pRYLToSW5vD1fN&KRTB&22979-Sjm360Vu4ulRar68TDuq6ks9t-pRYLToSW5vD1fN&KRTB&23462-Sjm360Vu4ulRar68TDuq6ks9t-pRYLToSW5vD1fN&KRTB&23661-Sjm360Vu4ulRar68TDuq6ks9t-pRYLToSW5vD1fN
.pubmatic.com/	1970-01-21 14:49:03	Name: PugT Value: 1778751208
.rlcdn.com/	1970-01-21 22:51:27	Name: rlas3 Value: GbL/CXPhRXPiFMr4dOXCKi4Z3c+6DFhP8cqVkwPfHmc=
.rlcdn.com/	1970-01-21 15:32:15	Name: pxrc Value: COitltAGEgUI6AcQABIFCOhHEAA=
.rubiconproject.com/	1970-01-21 22:51:27	Name: audit_p Value: 1\|7bbC/8OaTEKijt5eR6T/vQXxTBzL5w7xLTUWtUFU2w+ODjOcNmWxM1wnjZz0QawgpmMBCYOt37yM1KxoLazIt+FVxDHbQllAxKbtwwKGtDqLw3sECZpCB6HRB1T8Otrlm+5mtdPBe/W5Un6kw5flqya1/cRXvtKCrwhl0Ny6xKuM7xtRlP2U2iFwYvlTl0qppmvllXEtYN4=
.rubiconproject.com/	1970-01-21 22:51:27	Name: khaos Value: MP5AJKKV-7-DSG7
.rubiconproject.com/	1970-01-21 22:51:27	Name: khaos_p Value: MP5AJKKV-7-DSG7
.rubiconproject.com/	1970-01-21 22:51:27	Name: audit Value: 1\|7bbC/8OaTEKijt5eR6T/vQXxTBzL5w7xLTUWtUFU2w+ODjOcNmWxM1wnjZz0QawgpmMBCYOt37yM1KxoLazIt+FVxDHbQllAxKbtwwKGtDqLw3sECZpCB6HRB1T8Otrlm+5mtdPBe/W5Un6kw5flqya1/cRXvtKCrwhl0Ny6xKuM7xtRlP2U2iFwYvlTl0qppmvllXEtYN4=
.rubiconproject.com/	1970-01-21 16:15:27	Name: receive-cookie-deprecation Value: 1
.pippio.com/	1970-01-21 22:51:27	Name: did Value: Gntl-GHrEp14HRCh
.pippio.com/	1970-01-21 22:51:27	Name: didts Value: 1778751208
.pippio.com/	1970-01-21 15:32:15	Name: nnls Value:
.pippio.com/	1970-01-21 15:32:15	Name: pxrc Value: CAA=

20 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file(Line 1393) Message: document.domain mutation is ignored because the surrounding agent cluster is origin-keyed.
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'bluetooth'.
network	error	URL: https://www.mediafiredls.com/onclick/0 Message: Failed to load resource: the server responded with a status of 404 ()
rendering	warning	URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file Message: [GroupMarkerNotSet(crbug.com/242999)!:3AEC0964E0A0]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader (about:flags#enable-unsafe-swiftshader) flag to opt in to lower security guarantees for trusted content.
javascript	error	URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file Message: Access to fetch at 'https://id5-sync.com/bounce' from origin 'https://www.mediafire.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://id5-sync.com/bounce Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file Message: Access to XMLHttpRequest at 'https://id5-sync.com/gm/v3' from origin 'https://www.mediafire.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://id5-sync.com/gm/v3 Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file Message: Access to XMLHttpRequest at 'https://id5-sync.com/gm/v3' from origin 'https://www.mediafire.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://id5-sync.com/gm/v3 Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file Message: Access to fetch at 'https://id5-sync.com/g/v2/457.json' from origin 'https://www.mediafire.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://id5-sync.com/g/v2/457.json Message: Failed to load resource: net::ERR_FAILED
rendering	warning	URL: https://ep2.adtrafficquality.google/sodar/sodar2/254/runner.html Message: [GroupMarkerNotSet(crbug.com/242999)!:3AEC0021B0A0]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader (about:flags#enable-unsafe-swiftshader) flag to opt in to lower security guarantees for trusted content.
javascript	error	URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file Message: Access to XMLHttpRequest at 'https://id5-sync.com/gm/v3' from origin 'https://www.mediafire.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://id5-sync.com/gm/v3 Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://www.mediafire.com/file/28rrtqxs0afdpk3/Gambonanza-v1.0.16-full-apkvision.apk/file Message: Access to fetch at 'https://id5-sync.com/g/v2/457.json' from origin 'https://www.mediafire.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://id5-sync.com/g/v2/457.json Message: Failed to load resource: net::ERR_FAILED
other	error	URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.html Message: Attestation check for Shared Storage on https://www.googleadservices.com failed.
other	error	URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.html Message: Attestation check for Shared Storage on https://www.googleadservices.com failed.
rendering	warning	URL: https://ep2.adtrafficquality.google/sodar/Klz6NWr5.html Message: [GroupMarkerNotSet(crbug.com/242999)!:3AEC0BB6B0A0]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader (about:flags#enable-unsafe-swiftshader) flag to opt in to lower security guarantees for trusted content.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=0
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

409c85ce9932642869d313eae13aa4c6.safeframe.googlesyndication.com
a.c.appier.net
ab.dns-finder.com
ad-delivery.net
ad.doubleclick.net
ad.turn.com
ads.bidsystem.ai
ads.yieldmo.com
agen-assets.ftstatic.com
ajs-assets.ftstatic.com
analytics.google.com
api.amplitude.com
api.btloader.com
api.rlcdn.com
at.teads.tv
b1sync.outbrain.com
ban.jackery.com
bid.2trk.info
btloader.com
carbon-cdn.ccgateway.net
cdn.2trk.info
cdn.amplitude.com
cdn.api.btloader.com
cdn.btloader.com
cdn.econventa.com
cdn.flashtalking.com
cdn.id5-sync.com
cdn.jsdelivr.net
cm.g.doubleclick.net
cmp.gatekeeperconsent.com
connectid.analytics.yahoo.com
d-code.liadm.com
d9.flashtalking.com
dclk-match.dotomi.com
dis.criteo.com
dsum-sec.casalemedia.com
eb2.3lift.com
econventa.com
ep1.adtrafficquality.google
ep2.adtrafficquality.google
esp.rtbhouse.com
fonts.gstatic.com
g.ezoic.net
go.ezodn.com
google-bidout-d.openx.net
googleads.g.doubleclick.net
gum.criteo.com
ib.adnxs.com
id.a-mx.com
id.crwdcntrl.net
id.hadron.ad.gt
id5-sync.com
idsync.rlcdn.com
image2.pubmatic.com
image6.pubmatic.com
invstatic101.creativecdn.com
lb.eu-1-id5-sync.com
lbs.eu-1-id5-sync.com
lexicon.33across.com
link.rubiconproject.com
match.360yield.com
match.adsrvr.org
oa.openxcdn.net
oajs.openx.net
pagead2.googlesyndication.com
pippio.com
pixel.quantserve.com
pixel.rubiconproject.com
pixelfnt-us.dsp-api.moloco.com
privacy-location-edge.ccgateway.net
privacy.gatekeeperconsent.com
rules.quantcount.com
s.seedtag.com
secure.quantserve.com
securepubads.g.doubleclick.net
servedby.flashtalking.com
static.cloudflareinsights.com
static.criteo.net
static.mediafire.com
static.xx.fbcdn.net
stats.g.doubleclick.net
sync.1rx.io
sync.targeting.unrulymedia.com
sync.teads.tv
tags.crwdcntrl.net
the.gatekeeperconsent.com
tpc.googlesyndication.com
translate-pa.googleapis.com
translate.google.com
translate.googleapis.com
ups.analytics.yahoo.com
us-u.openx.net
www.ezojs.com
www.facebook.com
www.google-analytics.com
www.google.ca
www.google.com
www.googleadservices.com
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
www.mediafire.com
www.mediafiredls.com
www.temu.com
ads.yieldmo.com
cm.g.doubleclick.net
dsum-sec.casalemedia.com
id5-sync.com
pixelfnt-us.dsp-api.moloco.com
ups.analytics.yahoo.com
www.google.com
100.26.96.211
100.31.225.118
104.16.80.73
104.17.147.83
104.18.27.193
104.20.20.189
104.20.23.13
104.21.3.76
104.21.63.106
104.21.87.79
107.178.254.65
108.138.64.116
13.226.238.59
130.211.23.194
135.125.170.95
135.125.170.98
142.251.111.155
142.251.153.119
142.251.16.157
142.251.16.95
142.251.163.101
142.251.163.132
142.251.163.94
142.251.167.132
142.251.167.155
142.251.167.157
15.197.193.217
151.101.1.229
151.101.194.132
151.101.2.132
156.146.43.72
159.127.42.73
172.104.105.5
172.253.139.102
172.253.139.157
172.253.63.155
172.253.63.94
172.253.63.95
172.66.148.140
172.66.148.159
172.66.171.133
172.67.199.186
172.67.68.154
172.67.69.81
172.67.73.78
18.154.227.73
18.239.6.97
192.178.155.149
192.178.155.154
192.178.155.155
192.178.155.157
192.178.155.97
192.184.68.228
20.157.93.108
207.65.32.88
216.19.192.2
216.239.32.181
23.222.201.103
23.48.203.240
3.162.3.14
3.167.37.97
3.170.19.129
3.170.42.102
3.237.175.195
34.102.146.192
34.107.165.188
34.120.107.143
34.149.50.64
34.36.200.111
34.96.70.87
34.98.64.218
35.190.34.69
35.190.39.111
35.244.154.8
37.19.206.161
44.254.178.46
50.16.131.99
52.2.73.27
52.223.40.198
52.91.215.149
54.85.8.229
57.144.172.1
57.144.172.128
64.202.112.127
64.233.180.132
64.233.180.154
64.233.180.94
68.67.181.102
69.147.92.12
69.194.240.13
69.194.242.12
74.119.117.47
74.119.117.57
74.119.117.62
8.28.7.81
01990f06561b81e0060854cd87626ebea619773dee6c943d362209ca53ba2e4c
03b0704780aed6d82c9621d0aa02d128d15b7d4804c78ec73deb5d79f483b365
03c8d2dc7d985c3004ff2cd6d8148dd03560f37ed15efdf6c2d7f4d771d0e599
05c031fcdb94d1b3a011bbd713d70122286841a6ecd3e4a6c480077c139792de
05cfe92d9794a54258a19bfec7ae0faa73f61b66416983136594b4f95bb114dd
06c87cfc79d31896761b14ed789b3f747f1b885dac0ed193c16fb8d1d305083d
07a54e49f65745ec3e0c0bfec9c0005b787370f8f65476b8da936e14d9ceaaa1
0984f7c40a7b6064c7c023f91167e33e19d63e01fff5557a664b6e30a84e7057
0a9da3cf7efd1a7499a1c888d44ab103ca6c92a9ab354e17e146384b39cead50
0b7603ffd726854c0eff9970c3aad07a691042f49291df71f6d0b9c1708aa887
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0ba5dbef7513c0f9ba69b894042e2609a3aba34d2cd92c3b8d130be699aaa378
0ecbd1374ebd05d9733e3230e6ccaefadbfd8907cd151221d8af6fdf881b4e09
0f08574ce96b2c4a97be677a25b7cebc8e2aaa2cb482b7a24a63d22a209293ea
0f29e071004f949cd1062714ccc9b0bc950b34c07f0af10ad5a3ce2504ba152d
136b3dfa7c254f92a9a3513c191c87c05f7c7ff7f82c6d648a33496c3c380593
150d066300aa46b8f74af291442cf5b58c25691e4ecd92cb4d4eafb8d0039da6
151c3f58e6c03a20daccec9f9a05806c6222e002a9f700822ea313e3e17b02d2
16e779a136da13ffed806f54fba67a7adf0cf8a3d81e0b81788c8b81714ac798
18120a6bee05cd823d5f4ab0c52006863a059a5d6c535c790a31bdd2ee8c45e7
18b1530bf3f7ecb5fb54663c93383a236a156ccac3f5c17f378139ecdfee8928
1a5f47be4022fbf22229416f64f12dbedcb685306e54a476cd524d8df18a24dd
1a68b4ed311f1f0008b1d021e4186774365b849f7a3aec3dd4bc967998fd4e72
1b7c4edd444f73d828aacb88e0f35efd212c8378d07e5ff848d699adf68ba550
1c6ba1010c2cc88c59de9e9584728da124770fa399643ffc1beffcec54b84be7
1f0eaf56b1f181194ca996ec9d07da4e006dc9e1837dcc07f7bbc3a7a6d7b7c5
20d9446b589f06289e3a2f62cd749f76b571c6acc63ec6e1e93710854017c6bf
24434236112e2c40b190268b75b5a499d50fa6a4cd93664b9ec82f7852865ebf
2450e5580136f94bda7ccf95e3167b57e15b05b513a430967943a50036fa47a4
247e4518237746ef63caccfdeb6cf7e939b40eb4137859bc372bea52ebe2a0d7
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
274a38c68eb3352af867ec81816b7584fb2256d3af3553ecb0ec1334b79c3457
28589d83684c01d7482be0f0d749f9dbb3cdb4a369342aea0e62d95c36571747
296a27fb10e9408a3da81d8199df73aa6f8a1416b37e165b09f7522c244dbce5
2a5cfa356af90e4dc14d89477463deb2c098c826ebc6d74c1577eb3d5973cac9
2bc354a9cd190461ea50cff92441010aef928bb4747bec778b612e0d55bb1b7f
2c60eb04353098545f24cf0ef5e9409c7093b27df3d1ad341ec685b17a992418
2ce6e5b04061617aeacd5c1b16004fbdc2fb510dcd7ccb92e1df8bcefbe2354d
2cf973145da09fe2c5a346c06bb0147b8ce67f619cdc6212fb591c4068acb6fd
2e5f5cb912c0619933ea6c3ad8ac1466a005f792e3338d96a8432d144c63520f
2ff49aca4944561b63e2611c79e9aab4f69d6b69353df913ccffe1b15e85943c
30865570b5f459633282b0b92999d36084a7ed90dfc5b043d8335269dcf25591
308887d614c91ca8e01bae9d9079d1957f9617e9ff715b65b3e916e2d23744f7
30afe7dffe3205be4f42ca739b4818867b997aac986b43be75943958695208bc
30be558393bd8b0585c806a6eaed6d6f5b51d1ca63c0113061dfe35eaa128ce3
31ee626bbcefde898154acc86c90b8d6335d43e582f0dad56dd666a6520c0699
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7
345dbaad5cd394bb195e79a7d835ee2af91c02c76413d974f2e7fd3b9fcbfe39
355474edae19c91b8508ab5483713a18ae97cad7cf90bafa0fecf2e73ed98266
36ce068a4107077cee7072231c246281cd2a208444ed215337b5c3f4ec1b9a3e
372f795823a54a3bc659d4e3b9f8ca82caaa75577dbbc64dbf08bfed0e0b7915
3a81ec63bc5f6514e53912cea2d2fad4d8173561b6743b0177d6aaadd08a9681
3a9f306824d6e118cf7248a9331b18520750b67af9096c6cb7b026651b419d3b
3c28c089e67098ecef89ffebdaa206e3ac75f17e7123630f885b8bf2757d77e6
3db1df8e9763f3440dc8595e7b4c99ae4b2dbab0dbf1624f2da5800a5e62026e
3ede315dfd2fa841e6c775010ef2c2429745efac7e5f7770db2268999f7ae442
3f124cdc02a40817853db0a92e2dd20e0d4342c9b3532edb34429a78a2bbac54
3f58fc6a1358253c2ae06e44b8bda5b4294a1f0ad3da306a1e5170531d279c2f
3fdbe959b986a6e8b29fd5416dd8776de34cc21a01846316bf2cf389a6c8ba2d
3ffe92946fd71e550b2c6da4d0605bcfa9863bae24bdccdf74585b18ad2ae7e8
4065c400cc21c48d18812442dd54621ae668379e1889dce5845bd60471010539
41636f65a7fada6396727ca7cf78fe609cfd07d2422fa1a3303e1622a601b828
42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2
4342feac38021c4fe3069eba0edf1c2e1b4345e2b548b0afb7ab21b7369b3bc8
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
4448e430d3c53bad548a5d135e1c7e2f9593e806ba47892640d430ea752e979e
446a24acf9272b37cf14bf847684201154b6648113a148f1381b7489db6294f3
44b848ce1bea5ca25251a1c22058f8df660f1c8161c21ebc13a9ba55ec479d10
44c84fdb0f1d181f47b9fb0b88a159721fa24eb42054caad09d1c6d81017ef3a
459ca76bb15524277447818595d3633447cf2f7b70e4d60dfcdf31f2f0b978e2
47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292
4718dd9f68e969d1cb5e1b6172206b7150ad1d8cd5c5c1fe5812dd0e1646d426
4743a1c744e3d26f476bb2e80868e8f178ef9a2652c00abd0a9255c0dc50452f
476cca556c4e2d3e83ac0a724905d02b9eb154b55483d4dfec2bd351b34bf3bc
4938d2c9a69bc934406d692db0c2100e996225ef1fece07c60376861461ee901
49564e322b2146898f9b8c4bc4daf5b84ffdff6e4caa07ea40ecb03452d16fc2
4b5759dbc8de321134bbf7d25def0ee87454559310dcb8a192b9344b7603d0f0
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4b77eae349a8cbcea7133cf3640a64ebf1f69d54d8f6469d7be6fdc188ca4ca4
4c95e84767aed248594e7d485707c7ed904fd2fe4ec3ea98687fc2de59ddf231
4dac0026fbfa2615dce30c0af12830863fe885f84387a0147b9e338f548d5d82
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4e619a65afadc616566b4526824f8b3cffd0588c54ff43c0ad22992edac5cbd6
4f9c9b58f7afd13f9db7613ddad39a9ab40038fb9c00e7a6876b56ad86073228
4fdef4d0781bf1700ef5095ea7f80a10fcc49a613e5be4b86e0fe9e123b8306e
502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358
50a63bf06dcdc62ce03de6a07d10770dc80cfa47ef2b63db1e9f6a5fbd786a7d
544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9
54573654901c495ecf67cc8ffd30108dd6f3a3c7332fd4dba41ab13877b75b8d
554440727751c94747c5af4538f331196eba67c3de1e14121a403c467734190c
56351c084d8d56437d41f1e58b7eb184b563871e88bab60f6b15486c39f13996
57cc1c9137aafed5c0e134a1b985bad322811fdced91b2139c486184ebb8cf93
59f4e0057c651cb962d4637e70ff0d239f2b9c2cf4b31345d0145e03320b5b5a
5adfa8fdf36805dec0395a90e3347559da75fe8fc8830c48e22c94b18f8d9753
5b03993da08ad46dced1836ab4ae0c79e1425a3c6f807b5fdfa75798312af92c
5d66f8a47b3547cfa4f9e7f5d060d9e42373009ef01aee65aeffdb2e90540c35
5e136dbee7f7bac9df1fc7147f391f8e4bfa79df02f595a017baeaffd27144b6
6318394f737c66f0e2ccfcd88e3935c6667633a1b95fa29fba2b75431d55eef2
6a163c9c1e18a0fae78f3ce587d463c4aa6d39991639580d1106a9fa0774b8e8
6b9ae1fa0d1fc51ee0ad3feb565083bee200289c71bb346020f9b3d80cf73636
6ca54890dd41b6c684142bea43cd60c5a77c908e4d71b0c344af74b06a3c8155
6e7698ae74315d2d24f5d21d8b11fb84ad157e0e760dec622cdb3369ea819b2b
6fb2ad50ba8d60e90b29e50785549ce250761d9136c5b6fad6dd52c2852d5e43
7152b1a8f92e12ba387acd309b9099e2832891fd848b514b284b1bb8eebabd63
720671166ac43aba99e3952b0b9341ab4e0fee1fd891db54e2a07f05db653142
72869ba28dbe7dfde1cac4d1bd0ea84e491738e0fd578232aaaf90c693095b6c
730513f1782bade420d056d7cc92c1d2bce293a644430e54ad14ac65c8c6360b
7ba1bc2084def769e77a7dbf97cd91d68fe6c6d55b5d183a7d36630da8da2b02
7c05738565e57009f34d8b82fbb45d2fb408e8360903530074b6e174c62c407f
7d8011f93d7f0642471d84aeaa0685e449311f5f45d3cbfc97c733a3f2c2364c
7dfb320f62f8e93b26f7760ed53ade019c720b1a267826a9672177c801223e5b
7e1fc3bd3f6fdac2f28dbb7f190ec0b997499a59b8b1080204614981c2e82796
7ff5779bf5434a0ffc31ce0d01df8ffbf9482ac3b55fc018cce03634b4c1054b
802ff97397b3c47f5379227a443f4548622a1e41e6b5fd186d0b04c09933e6ea
82b94716473aa225e715e117802145c5d2d725aa1ba9d476d61a5d3da16a8c26
82df847d47ee8d3da6c2a70ed3eddca63183eeae76c2604100357546521099ca
8335d293f354a547ba3d73f16fd6291fc47dc083af674de0cd021b3ab9d9abad
83e54922aeb50ffb130041d1ee72bb1337f0c6518bf57130dbc01ac4ed4e0820
841bfbea28055cfe7f8c125ccaec87a9807866998072a09ae9a3702d8f0f2ad1
8539c91ae0a82f8cab27d481ea38ac4e66d1e5b36701fe295bcba4399b9255bd
8568a18d2ec89dbad8ca3fade3195e0e98a99ad6a2d12f2421f79689f6e399b6
873afe3b02d6b36f7ff288fc4e7ad7297a23ea4bab0798d8586a00c6f34b18f8
88e6a0820d28a7f35f2040b6148ba8a546f4fc3317665216d01633e6370d90a4
893719087a8bc6dcdfabc4e1d54fd6d724953d40da2ad369f8b4fb5f689394d7
8952b91af1705fc7fddb2a9bcc53534d55f136755e48e957711d85b038287542
8a056fd192a8ea16fcc3cc2cb33e093440ec225dc7e23584d7ee139efd15e0f1
8a0afff8cfdd6cabc97565177aa3f7c83efcad80f7920a83b2670a4bcebe74f8
8af2d4d39123c52a7c0ab7f7e4fbf96c5bfeb969ccce59ceb2bc7c96a7624f2b
8b925b4e5891d39f0ce66a499c87d39286e308916e3ad36dcd22b7548079d30f
8c04e118bdd5757192be2a1eb360786f9fa1c4b398806430b7f41f203f64d8e6
8c34599808e4da9e86775b694fdadd5bf0856637602c896c21aef15e9783308e
8c8caa8d2b531f001065d46bf1ca904810818d86b1d68e2e0aab9f0b62422098
8cf6a4c31fa2d18422547a79c358d008d2ffb1988bf14415627b32f60482c217
8d29511efaf9437ab09d682f6710db1be0b4f5082d6bc782c994f777322a1c2a
8fb0902cb2d17d83fa68fa9a81a2e2872675c67bac55f2aced4aa2c5540f6655
9011f03376c6bcb2ae49b26f2462c373826d54a6fcab34304e6284d23cdd85c8
915d3f4a44f3e2a32a31e413092bf7bfd3f1c85e2449adf9b48dd7b288ee6d19
9170a8b2fb3234baa721bf8b3de5935d8d160f6f987215b83b07a49a403e5e74
953ae0b28b4a6e7d9ec5f1b878b2b77a8d76fba506cf8e5df854ed56540b27bf
9687e9a36083f2e04ee131d06f8f0757a1ea5b5a21f1e9ec279e667aa7eff44e
96cec99c62e04eb51ee65dc72ebaff2e27985160abaf825f5592af2ce0031fd0
97fc5230d5cb8391cb09df4345a494801c20ca27ae5b75deb632acba3b28a774
990b9290243b6a567be547695e6c7e19e01029c8568b5d122202c0aa0b52f8df
9c8d07e7330bce5cf95ebcc0e3dc86a81ffd411665bf468a0ba667ff5b8ad660
9f9c4427d27d49d2b1340250c6b606135eda8b4bb3699308d0093a0c99854a29
a01e6e8ed2eae582de0d9f2cdb353f97721aa0400aeb1cb6787d882ccafb6072
a09179dd962df38a01440ce2e4748c37bd832fe1ac2f65ad974490a89d63d129
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a3590465414b1de167b0c78f675d26356cdae86af81776ad069ee7e6bb5cc3f4
a3cb2c4b19504b47f0c990ac34f9764e0cea778760cf1066eb70b012695a1778
a76686c80cd9c97632b8c3f2aca15a394466e680dfafef316d7b191dc4e09c6d
a79560135c9efbac8274a89b26d3be0bd031bf4d42a342e8e8c1a917948d05ec
aa8a5c4a92b78ce2c775274d190dafb720a44b4facce02c94e63f63c90c60a57
ab5c23a05e39deed14d9d8262b0dce9f024f86105a27196cad37d14a3f516e09
ac5a4a0937632f257b63ebd53a656fd045529bc506cf4abb880bec8421e8eb60
aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
af43031d404637c6e09945597ac464fd1744714167eb3e01ed42d26c60c413e9
afc222aabf430f1be68418c8a2b29e3423d64530dbcd9032ab9b1c5d49f67b36
b02c807236e2e4ef7afdfd1527da16c937d9103e80784233786edfd01ac75164
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b2d1b792e8f907b6a0be526d54a14957c07ea665826e9bbc3e0d97515b071797
b40dceeaa34bd1ba5a6f9b2e1c883f2fd80e1ab661d1322c46bcd0fc802b8437
b6b001190f17df21f71a97f8022106776e3aa76e48eb8d3dcc794efba5c9aa93
b837449c7254dd5887b620b7903bb4dbafbf2424ae3eb25e7a9f3471ff105365
b8f0ca68362cf245f891fc09ddfa50806d195e78e196cf96ac5d9cf72be2577a
bbc31eea89e876c8c6366affa5b49f27b4206be3d98462a14491b35bde3585c5
bbda649998226703a575555e1afa2688e16528f2a8341bbba1ad3df1eebba21b
bbe519344742e92f95ad65a1eb23b2a23bd55059fcc3fc02f4339c9df6fb5c11
bca47f32db64890bfe823be924f8523713184dc64aa54c21f09eaeb4ffb97b71
bcb8e237785c687d9a5b641d3459b274fc5d6f06241337af000c0c0542fdc769
bcf0ad7f14a8164cd2cced6dca68f0199c44606f9a167bd03b2152940713f1b8
bcf7993523efcd42f5599e1c210b6433e35a39de688c9e5ae90829741937df71
bea1c5ab168f662fc9eb5bda3474e5b1bbd0d3ecc1d9c68e2a753f613c2ae0c2
bed4d32b2c3440f32df8e267317ed6fed766b0f4c39eaf4a58bee428a1ebf6b2
bfd4b869068a5c8f4c21a435e2c8f9daa937326894b23268523c81f7de8f2698
bfe136e0e6d681e63caaa9fceb9901bb354882676852df6a08bd61e0e92bc503
c03c74e3dfa5656dcd9841f61549cec816a1b2ec377dcc439761ca77a46ab1e2
c656d50263d423e681e4963066e86f087cb646cab3b440b3b082a0da28eb79ea
c6c094bc0054f9cbe34102ff49f86b3928b5ac09f3d2ac87e170d0500675921f
c700c58e763a5ae34f446713819957ed9755025d35b8497ec1150f428f5ff227
c7b4e0ead046aaf8bf5ccbfc2cacb1034484502f3edef69134a060f49edda834
c94a842a66efa5685dcaab82809f28dff21444029c497968fa84c9107fad0fde
ca2fec6d9168102da4b08fad54e45776c3ac91fead7a22ffbf0ff78c37e05b2a
cb6c1a2d4e9a1239a7887de158b87d86ecbd7047e9ed8214f367406762730003
cb8d603426932f2666666f4bd32b3dde726161c7f7413e385d2e124e6e03039c
cdc78cc8b2994712a041a2a4cb02f488afbab00981771bdd3a8036c2dddf540f
cec3f4c833f0b4805febeaef70c44d4a48e700f8cbaec417f237d8a900a78a3d
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
cfd403f898eab46a5540f9c7b0d50ff086c81b8a15facd3824bfaa8af50079e4
d13456a4570f3bba2950266c5092620990422a988bc0c4cf20ad0f2af6ef2921
d1466a7684ac9b1af90477f554e4c50ec51a87a78275468ed2b9e3aba915b5de
d278d0867e1dab846b070ef0ebfa6413dc008178bf7d12d72a228ab75ebc42e0
d5f3b0b14d09909398ca69f59408911181d25700a0dd9203fd20417d968747cc
d6e4b62659dfeb8565e75a7f8ed955e44fcb30eb78beaa2717b1e684e08b8c93
d91b0d2e4d5cad7ebdc5dd2224d4359285c001ba188951e60a61d7b934406c32
d92fdbca4cf04d6ca524a8443eefa70b755a0ec237ebdd19ad1816b1afa4a9df
d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8
dab57fd1fa79022a4fc26533b9c0d5d2f59ae80d86a2a0d72ca53639b2f633c3
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
e12bc1fca47f992f263407fdc0b3d6cb30d860ab0ed5e93a662387174e597d7b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e814d50a228f54aecf40d8a58e41d48ce1dfc4376fd5fbedc28078fe0a8c5526
ee42952553dceadfd93352659c897004635efb6e3a051affa8f723902e61d9f7
eeebadd506dfcd38fdbb110d87de80da27a3d2e62a5d6afa655836b903734ba8
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f011a3b90cc534fb02b140f039bef2579f5874997079349598890c6f7055cf0f
f104f0bc9687bcc861ac96cf17531f6ce25dd2cab1b74fda3e12986e939459e7
f1a61277e3f902f50ab42015d8b07218db9b7601bb0967e54a52bfdcb4fa7e81
f1a67642fc97b508ce07cf6df329022bf5184a1c573044dc021e0d6e64688c64
f1a68bf826c55985468304f4284a09cb8a68e82503d764166e611a7c58a85a4b
f52a0c7d9fa7ae8e45916c491ae7193f9a1e289f128f05264122c53d8da970db
f85281fb0d5bb6b5f0b523958ae876be0fafea67fdf7bf8c04c3d910e0a5feea
f87faa1a8a9d8dbc9295850876b8eaea1535a2445869942f3aef330c93750d49
f917a9105c311331b1d40f4d2bdbf11233c1c465616c1a9c46232f451463b061
fb77c7aea0ddff558d0d8914f8cae4da96ba0b87292eac8bb8997c4562b6b123
fcee3d7b1484077513a22cd07a88f2baf4389e83459b59d6e20a8a4e3242d369
fe2eddeaa8adad53d570fdeeb04412a07ec65ad99b25fe5beb092dfe4fb78cc9
fedf6cae088b1d6a484aa46adf6498e281e2d32f79c8f681f32f8ac9c169fd77

www.mediafire.com 104.17.147.83 Public Scan Open in urlscan Pro

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

329 Requests

89 %HTTPS

0 %IPv6

68 Domains

104 Subdomains

84 IPs

4 Countries

3387 kBTransfer

12956 kBSize

127 Cookies

16 Outgoing links

Redirected requests

329 HTTP transactions Everything HTML Script Fetch XHR CSS Image Font Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.mediafire.com
104.17.147.83 Public Scan Open in urlscan Pro

Screenshot
Live screenshot

Full Image

329
Requests

89 %
HTTPS

0 %
IPv6

68
Domains

104
Subdomains

84
IPs

4
Countries

3387 kB
Transfer

12956 kB
Size

127
Cookies

329 HTTP transactions
2 data transactions