URL:
https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125 13yr old
Submission: On June 13 via manual (June 13th 2026, 12:38:47 pm UTC) from JP — Scanned from JP

Summary

This website contacted 74 IPs in 9 countries across 59 domains to perform 294 HTTP transactions. The main IP is 104.17.147.83, located in Ascension Island and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is www.mediafire.com. The Cisco Umbrella rank of the primary domain is 47382. 13yr old
TLS certificate: Issued by Sectigo Public Server Authentication ... on August 5th 2025. Valid for: 1yr.
This is the only time www.mediafire.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 19 104.17.147.83 104.17.147.83 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
3 172.67.199.186 172.67.199.186 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
3 2404:6800:400... 2404:6800:400b:c005::61 15169 (GOOGLE) (GOOGLE - Google LLC)
1 18.65.207.116 18.65.207.116 16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
3 2606:4700:10:... 2606:4700:10::6814:14bd 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
4 172.67.170.144 172.67.170.144 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1 2404:6800:400... 2404:6800:400b:c005::64 15169 (GOOGLE) (GOOGLE - Google LLC)
1 44.230.239.150 44.230.239.150 16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
11 2606:4700:10:... 2606:4700:10::ac42:948c 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
7 142.251.24.149 142.251.24.149 15169 (GOOGLE) (GOOGLE - Google LLC)
2 34.36.200.111 34.36.200.111 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM - Google LLC)
1 2606:4700:10:... 2606:4700:10::ac42:ab85 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
30 2406:da18:9d0... 2406:da18:9d0:143f:2124:4e9c:36a9:d9de 16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
15 172.67.142.121 172.67.142.121 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
2 172.67.69.81 172.67.69.81 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1 2606:4700::68... 2606:4700::6810:5049 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
3 130.211.23.194 130.211.23.194 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM - Google LLC)
1 57.144.44.1 57.144.44.1 32934 (FACEBOOK) (FACEBOOK - Facebook)
3 2404:6800:400... 2404:6800:400b:c00e::5e 15169 (GOOGLE) (GOOGLE - Google LLC)
1 2404:6800:400... 2404:6800:400b:c005::5f 15169 (GOOGLE) (GOOGLE - Google LLC)
1 2404:6800:400... 2404:6800:400a:1002::8b 15169 (GOOGLE) (GOOGLE - Google LLC)
2 57.144.44.128 57.144.44.128 32934 (FACEBOOK) (FACEBOOK - Facebook)
2 2606:4700:10:... 2606:4700:10::ac42:a937 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1 142.250.23.94 142.250.23.94 15169 (GOOGLE) (GOOGLE - Google LLC)
1 2001:4860:480... 2001:4860:4802:32::223 15169 (GOOGLE) (GOOGLE - Google LLC)
2 2001:4860:480... 2001:4860:4802:34::181 15169 (GOOGLE) (GOOGLE - Google LLC)
1 2404:6800:400... 2404:6800:400b:c015::9d 15169 (GOOGLE) (GOOGLE - Google LLC)
2 142.251.24.94 142.251.24.94 15169 (GOOGLE) (GOOGLE - Google LLC)
32 142.251.23.157 142.251.23.157 15169 (GOOGLE) (GOOGLE - Google LLC)
1 2600:140b:1c0... 2600:140b:1c00:38a::2300 20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.)
1 2606:4700:20:... 2606:4700:20::681a:3ad 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
3 6 2406:2600:4::13 2406:2600:4::13 55569 (CRITEO-AS-AP) (CRITEO-AS-AP - Criteo APAC)
1 2a04:4e42::485 2a04:4e42::485 54113 (FASTLY) (FASTLY - Fastly)
2 37.19.206.163 37.19.206.163 60068 (CDN77 Dat...) (CDN77 Datacamp Limited)
2 4 2400:52e0:150... 2400:52e0:1500::1180:1 200325 (BunnyCDN ...) (BunnyCDN BUNNYWAY)
2 2 2400:52e0:150... 2400:52e0:1500::869:1 200325 (BunnyCDN ...) (BunnyCDN BUNNYWAY)
2 2406:2000:a4:... 2406:2000:a4:807:: 10230 (YAHOO-SG) (YAHOO-SG - internet content provider)
5 182.161.74.19 182.161.74.19 55569 (CRITEO-AS-AP) (CRITEO-AS-AP - Criteo APAC)
2 35.74.31.108 35.74.31.108 16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2 2606:4700:10:... 2606:4700:10::ac42:949f 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
7 13 135.125.170.104 135.125.170.104 16276 (OVH OVH SAS) (OVH OVH SAS)
1 34.107.165.188 34.107.165.188 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM - Google LLC)
2 207.65.34.81 207.65.34.81 62713 (AS-PUBMATIC) (AS-PUBMATIC - PubMatic)
2 151.101.130.132 151.101.130.132 54113 (FASTLY) (FASTLY - Fastly)
2 4 3.33.220.150 3.33.220.150 16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
7 34.224.42.28 34.224.42.28 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1 3 142.251.24.154 142.251.24.154 15169 (GOOGLE) (GOOGLE - Google LLC)
1 34.102.146.192 34.102.146.192 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM - Google LLC)
1 3.173.219.76 3.173.219.76 16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1 151.101.129.229 151.101.129.229 54113 (FASTLY) (FASTLY - Fastly)
1 2406:2600:4::2e 2406:2600:4::2e 55569 (CRITEO-AS-AP) (CRITEO-AS-AP - Criteo APAC)
1 34.96.70.87 34.96.70.87 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM - Google LLC)
1 2600:9000:26a... 2600:9000:26a6:1200:10:dd8:5e40:93a1 16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2 142.250.23.132 142.250.23.132 15169 (GOOGLE) (GOOGLE - Google LLC)
1 2001:41d0:72f... 2001:41d0:72f:6100:: 16276 (OVH OVH SAS) (OVH OVH SAS)
1 135.125.170.106 135.125.170.106 16276 (OVH OVH SAS) (OVH OVH SAS)
3 4 52.76.86.147 52.76.86.147 16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1 2 34.120.107.143 34.120.107.143 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM - Google LLC)
1 35.190.39.111 35.190.39.111 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM - Google LLC)
15 2404:6800:400... 2404:6800:400b:c005::84 15169 (GOOGLE) (GOOGLE - Google LLC)
11 2404:6800:400... 2404:6800:400b:c006::84 15169 (GOOGLE) (GOOGLE - Google LLC)
1 18.212.140.196 18.212.140.196 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
7 142.251.24.157 142.251.24.157 15169 (GOOGLE) (GOOGLE - Google LLC)
1 142.251.155.119 142.251.155.119 15169 (GOOGLE) (GOOGLE - Google LLC)
3 142.251.24.155 142.251.24.155 15169 (GOOGLE) (GOOGLE - Google LLC)
5 35.244.159.8 35.244.159.8 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM - Google LLC)
2 2 3.173.238.102 3.173.238.102 16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2 2 82.145.213.8 82.145.213.8 39832 (NO-OPERA ...) (NO-OPERA Opera Norway AS)
1 1 162.159.141.246 162.159.141.246 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
3 3 34.111.113.62 34.111.113.62 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM - Google LLC)
2 2 4.243.157.74 4.243.157.74 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation)
1 1 54.254.71.150 54.254.71.150 16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1 1 74.121.143.245 74.121.143.245 30419 (PAEDAE-INC) (PAEDAE-INC - PaeDae)
2 2 34.36.216.150 34.36.216.150 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM - Google LLC)
18 44.227.112.76 44.227.112.76 16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1 4 2620:116:800e... 2620:116:800e:21:6c50:dbee:bef5:203d 16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1 2600:9000:295... 2600:9000:2957:2000:6:44e3:f8c0:93a1 16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2 2 35.244.154.8 35.244.154.8 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM - Google LLC)
1 107.178.254.65 107.178.254.65 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM - Google LLC)
1 2 104.18.27.193 104.18.27.193 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1 207.65.34.80 207.65.34.80 62713 (AS-PUBMATIC) (AS-PUBMATIC - PubMatic)
1 69.173.158.64 69.173.158.64 26667 (RUBICONPR...) (RUBICONPROJECT - Magnite)
1 142.251.23.139 142.251.23.139 15169 (GOOGLE) (GOOGLE - Google LLC)
294 74
Apex Domain
Subdomains
Transfer
44 doubleclick.net 1 redirects
ad.doubleclick.net — Cisco Umbrella Rank: 222 10yr old
stats.g.doubleclick.net — Cisco Umbrella Rank: 197 10yr old
securepubads.g.doubleclick.net — Cisco Umbrella Rank: 315 10yr old
cm.g.doubleclick.net — Cisco Umbrella Rank: 303 10yr old
googleads.g.doubleclick.net Failed 10yr old
289 KB
30 ezoic.net
g.ezoic.net — Cisco Umbrella Rank: 14400 11yr old
81 KB
26 ccgateway.net
carbon-cdn.ccgateway.net — Cisco Umbrella Rank: 7069 8yr old
privacy-location-edge.ccgateway.net — Cisco Umbrella Rank: 8073 5yr old
script-api.ccgateway.net — Cisco Umbrella Rank: 7799 5yr old
pb-ing-02.ccgateway.net — Cisco Umbrella Rank: 7475 1yr old
67 KB
19 mediafire.com 1 redirects
www.mediafire.com — Cisco Umbrella Rank: 47382 13yr old
static.mediafire.com — Cisco Umbrella Rank: 72167 9yr old
192 KB
17 googlesyndication.com
e9be73191e89464b00225c44fbcba626.safeframe.googlesyndication.com 1mo old
tpc.googlesyndication.com — Cisco Umbrella Rank: 247 13yr old
pagead2.googlesyndication.com — Cisco Umbrella Rank: 138 10yr old
395 KB
15 ampproject.org
cdn.ampproject.org — Cisco Umbrella Rank: 441 10yr old
104 KB
15 id5-sync.com 7 redirects
cdn.id5-sync.com — Cisco Umbrella Rank: 884 7yr old
id5-sync.com — Cisco Umbrella Rank: 576 9yr old
82 KB
15 ezodn.com
go.ezodn.com — Cisco Umbrella Rank: 16432 6yr old
510 KB
11 criteo.com 3 redirects
gum.criteo.com — Cisco Umbrella Rank: 489 10yr old
mug.criteo.com — Cisco Umbrella Rank: 2398 8yr old
10 KB
11 ad-delivery.net
ad-delivery.net — Cisco Umbrella Rank: 1497 9yr old
2 KB
7 openx.net 1 redirects
oajs.openx.net — Cisco Umbrella Rank: 2137 6yr old
google-bidout-d.openx.net — Cisco Umbrella Rank: 2085 7yr old
us-u.openx.net — Cisco Umbrella Rank: 647 10yr old
jp-u.openx.net — Cisco Umbrella Rank: 13481 10yr old
u.openx.net — Cisco Umbrella Rank: 934 10yr old
2 KB
7 btloader.com
btloader.com — Cisco Umbrella Rank: 1349 6yr old
cdn.btloader.com — Cisco Umbrella Rank: 1809 2yr old
cdn.api.btloader.com — Cisco Umbrella Rank: 1831 3mo old
api.btloader.com — Cisco Umbrella Rank: 1547 6yr old
34 KB
5 adtrafficquality.google
ep1.adtrafficquality.google — Cisco Umbrella Rank: 248 2yr old
ep2.adtrafficquality.google — Cisco Umbrella Rank: 264 2yr old
27 KB
5 crwdcntrl.net
id.crwdcntrl.net Failed 6yr old
tags.crwdcntrl.net — Cisco Umbrella Rank: 1127 13yr old
bcp.crwdcntrl.net — Cisco Umbrella Rank: 1237 10yr old
sync.crwdcntrl.net — Cisco Umbrella Rank: 1023 8yr old
15 KB
5 google.com
translate.google.com — Cisco Umbrella Rank: 1474 10yr old
analytics.google.com — Cisco Umbrella Rank: 177 9yr old
www.google.com — Cisco Umbrella Rank: 3 13yr old
27 KB
4 quantserve.com 1 redirects
secure.quantserve.com — Cisco Umbrella Rank: 2408 10yr old
pixel.quantserve.com — Cisco Umbrella Rank: 1492 10yr old
14 KB
4 adsrvr.org 2 redirects
match.adsrvr.org — Cisco Umbrella Rank: 413 10yr old
2 KB
4 a-mx.com 2 redirects
id.a-mx.com — Cisco Umbrella Rank: 1419 5yr old
3 KB
4 gstatic.com
www.gstatic.com — Cisco Umbrella Rank: 9 10yr old
fonts.gstatic.com — Cisco Umbrella Rank: 39 10yr old
11 KB
4 ezojs.com
www.ezojs.com — Cisco Umbrella Rank: 17094 9yr old
308 KB
3 tapad.com 3 redirects
pixel.tapad.com — Cisco Umbrella Rank: 653 10yr old
1 KB
3 pubmatic.com
image6.pubmatic.com — Cisco Umbrella Rank: 922 10yr old
image2.pubmatic.com — Cisco Umbrella Rank: 1043 10yr old
932 B
3 rlcdn.com 2 redirects
api.rlcdn.com — Cisco Umbrella Rank: 1280 8yr old
idsync.rlcdn.com — Cisco Umbrella Rank: 667 10yr old
1 KB
3 yahoo.com
ups.analytics.yahoo.com — Cisco Umbrella Rank: 547 7yr old
connectid.analytics.yahoo.com — Cisco Umbrella Rank: 2336 4yr old
10 KB
3 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 53 13yr old
436 KB
3 gatekeeperconsent.com
cmp.gatekeeperconsent.com — Cisco Umbrella Rank: 22765 1yr old
the.gatekeeperconsent.com — Cisco Umbrella Rank: 21138 3yr old
privacy.gatekeeperconsent.com — Cisco Umbrella Rank: 26807 3yr old
4 KB
2 casalemedia.com 1 redirects
dsum-sec.casalemedia.com — Cisco Umbrella Rank: 753 12yr old
2 KB
2 sitescout.com 2 redirects
pixel-sync.sitescout.com — Cisco Umbrella Rank: 901 8yr old
1 KB
2 adnxs.com 2 redirects
ib.adnxs.com — Cisco Umbrella Rank: 308 10yr old
2 KB
2 opera.com 2 redirects
t.adx.opera.com — Cisco Umbrella Rank: 943 5yr old
t.oa.opera.com — Cisco Umbrella Rank: 1146 6mo old
2 KB
2 ladsp.com 2 redirects
cr-p3.ladsp.com — Cisco Umbrella Rank: 17349 4yr old
865 B
2 eu-1-id5-sync.com
lbs.eu-1-id5-sync.com — Cisco Umbrella Rank: 1225 4yr old
lb.eu-1-id5-sync.com — Cisco Umbrella Rank: 999 4yr old
498 B
2 teads.tv
at.teads.tv — Cisco Umbrella Rank: 4862 5yr old
765 B
2 ad.gt
id.hadron.ad.gt — Cisco Umbrella Rank: 2681 4yr old
271 B
2 flashtalking.com
d9.flashtalking.com — Cisco Umbrella Rank: 1766 11yr old
11 KB
2 a-mo.net 2 redirects
c3.a-mo.net — Cisco Umbrella Rank: 15264 3yr old
2 KB
2 33across.com
lexicon.33across.com — Cisco Umbrella Rank: 1886 5yr old
3 KB
2 jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 283 13yr old
2 KB
2 rubiconproject.com
link.rubiconproject.com — Cisco Umbrella Rank: 8956 1yr old
pixel.rubiconproject.com — Cisco Umbrella Rank: 478 10yr old
2 KB
2 google.co.jp
www.google.co.jp — Cisco Umbrella Rank: 4657 10yr old
126 B
2 fbcdn.net
static.xx.fbcdn.net — Cisco Umbrella Rank: 894 10yr old
802 B
2 googleapis.com
translate.googleapis.com — Cisco Umbrella Rank: 929 10yr old
translate-pa.googleapis.com — Cisco Umbrella Rank: 1529 5yr old
126 KB
2 econventa.com
cdn.econventa.com — Cisco Umbrella Rank: 75592 1yr old
econventa.com — Cisco Umbrella Rank: 67684 1yr old
50 KB
2 dns-finder.com
ab.dns-finder.com — Cisco Umbrella Rank: 1732 9mo old
233 B
2 amplitude.com
cdn.amplitude.com — Cisco Umbrella Rank: 2251 9yr old
api.amplitude.com — Cisco Umbrella Rank: 4354 10yr old
22 KB
1 pippio.com
pippio.com — Cisco Umbrella Rank: 1206 12yr old
570 B
1 quantcount.com
rules.quantcount.com — Cisco Umbrella Rank: 2647 9yr old
632 B
1 mathtag.com 1 redirects
sync.mathtag.com — Cisco Umbrella Rank: 1250 10yr old
881 B
1 gumgum.com 1 redirects
rtb.gumgum.com — Cisco Umbrella Rank: 1782 10yr old
287 B
1 temu.com 1 redirects
www.temu.com — Cisco Umbrella Rank: 780 5yr old
714 B
1 rtbhouse.com
esp.rtbhouse.com — Cisco Umbrella Rank: 2003 4yr old
594 B
1 creativecdn.com
invstatic101.creativecdn.com — Cisco Umbrella Rank: 1862 4yr old
3 KB
1 criteo.net
static.criteo.net — Cisco Umbrella Rank: 902 13yr old
15 KB
1 openxcdn.net
oa.openxcdn.net — Cisco Umbrella Rank: 1964 7yr old
8 KB
1 mediafiredls.com
www.mediafiredls.com — Cisco Umbrella Rank: 71296 2yr old
522 B
1 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 90 13yr old
21 KB
1 facebook.com
www.facebook.com — Cisco Umbrella Rank: 119 11yr old
7 KB
1 cloudflareinsights.com
static.cloudflareinsights.com — Cisco Umbrella Rank: 326 7yr old
11 KB
0 eyeota.net Failed
ps.eyeota.net Failed 13yr old
294 59
Domain Requested by
32 securepubads.g.doubleclick.net securepubads.g.doubleclick.net
go.ezodn.com
www.mediafire.com
30 g.ezoic.net www.ezojs.com
www.mediafire.com
go.ezodn.com
18 pb-ing-02.ccgateway.net go.ezodn.com
15 cdn.ampproject.org securepubads.g.doubleclick.net
15 go.ezodn.com www.mediafire.com
13 id5-sync.com 7 redirects go.ezodn.com
11 ad-delivery.net btloader.com
go.ezodn.com
11 static.mediafire.com www.mediafire.com
9 tpc.googlesyndication.com www.mediafire.com
securepubads.g.doubleclick.net
8 www.mediafire.com 1 redirects www.mediafire.com
go.ezodn.com
7 pagead2.googlesyndication.com ep2.adtrafficquality.google
go.ezodn.com
www.mediafire.com
7 ad.doubleclick.net btloader.com
go.ezodn.com
6 script-api.ccgateway.net carbon-cdn.ccgateway.net
6 gum.criteo.com 3 redirects static.criteo.net
5 mug.criteo.com www.mediafire.com
4 cm.g.doubleclick.net 1 redirects securepubads.g.doubleclick.net
google-bidout-d.openx.net
4 match.adsrvr.org 2 redirects go.ezodn.com
4 id.a-mx.com 2 redirects www.mediafire.com
4 www.ezojs.com www.mediafire.com
www.ezojs.com
3 pixel.quantserve.com 1 redirects
3 sync.crwdcntrl.net 3 redirects
3 pixel.tapad.com 3 redirects
3 ep2.adtrafficquality.google securepubads.g.doubleclick.net
ep2.adtrafficquality.google
3 analytics.google.com www.googletagmanager.com
go.ezodn.com
3 www.gstatic.com www.mediafire.com
www.gstatic.com
3 api.btloader.com btloader.com
go.ezodn.com
3 www.googletagmanager.com www.mediafire.com
www.googletagmanager.com
2 dsum-sec.casalemedia.com 1 redirects
2 idsync.rlcdn.com 2 redirects
2 pixel-sync.sitescout.com 2 redirects
2 ib.adnxs.com 2 redirects
2 cr-p3.ladsp.com 2 redirects
2 us-u.openx.net google-bidout-d.openx.net
2 ep1.adtrafficquality.google go.ezodn.com
2 oajs.openx.net 1 redirects
2 at.teads.tv go.ezodn.com
2 image6.pubmatic.com go.ezodn.com
2 id.hadron.ad.gt go.ezodn.com
2 d9.flashtalking.com go.ezodn.com
2 ups.analytics.yahoo.com go.ezodn.com
2 c3.a-mo.net 2 redirects
2 lexicon.33across.com go.ezodn.com
2 cdn.jsdelivr.net go.ezodn.com
securepubads.g.doubleclick.net
2 www.google.co.jp www.mediafire.com
2 cdn.id5-sync.com www.ezojs.com
go.ezodn.com
2 static.xx.fbcdn.net www.facebook.com
2 ab.dns-finder.com btloader.com
go.ezodn.com
2 btloader.com www.mediafire.com
btloader.com
1 pixel.rubiconproject.com
1 image2.pubmatic.com
1 pippio.com
1 rules.quantcount.com secure.quantserve.com
1 secure.quantserve.com go.ezodn.com
1 sync.mathtag.com 1 redirects
1 rtb.gumgum.com 1 redirects
1 u.openx.net google-bidout-d.openx.net
1 t.oa.opera.com 1 redirects
1 www.temu.com 1 redirects
1 t.adx.opera.com 1 redirects
1 jp-u.openx.net google-bidout-d.openx.net
1 google-bidout-d.openx.net oa.openxcdn.net
1 www.google.com ep2.adtrafficquality.google
www.mediafire.com
1 privacy-location-edge.ccgateway.net go.ezodn.com
1 esp.rtbhouse.com go.ezodn.com
1 bcp.crwdcntrl.net go.ezodn.com
1 lb.eu-1-id5-sync.com go.ezodn.com
1 lbs.eu-1-id5-sync.com go.ezodn.com
1 e9be73191e89464b00225c44fbcba626.safeframe.googlesyndication.com securepubads.g.doubleclick.net
1 connectid.analytics.yahoo.com securepubads.g.doubleclick.net
1 invstatic101.creativecdn.com securepubads.g.doubleclick.net
1 static.criteo.net securepubads.g.doubleclick.net
1 tags.crwdcntrl.net securepubads.g.doubleclick.net
1 oa.openxcdn.net securepubads.g.doubleclick.net
1 carbon-cdn.ccgateway.net link.rubiconproject.com
1 api.rlcdn.com go.ezodn.com
1 www.mediafiredls.com www.mediafire.com
1 link.rubiconproject.com
1 stats.g.doubleclick.net www.googletagmanager.com
1 translate-pa.googleapis.com
1 fonts.gstatic.com www.mediafire.com
1 econventa.com cdn.econventa.com
1 www.google-analytics.com www.googletagmanager.com
1 translate.googleapis.com go.ezodn.com
1 www.facebook.com www.mediafire.com
1 static.cloudflareinsights.com www.mediafire.com
1 cdn.econventa.com www.mediafire.com
1 cdn.api.btloader.com btloader.com
1 cdn.btloader.com btloader.com
1 api.amplitude.com cdn.amplitude.com
1 translate.google.com www.mediafire.com
1 cdn.amplitude.com www.mediafire.com
1 privacy.gatekeeperconsent.com the.gatekeeperconsent.com
1 the.gatekeeperconsent.com www.mediafire.com
1 cmp.gatekeeperconsent.com www.mediafire.com
0 ps.eyeota.net Failed
0 googleads.g.doubleclick.net Failed
0 id.crwdcntrl.net Failed go.ezodn.com
294 97
Subject Issuer Validity Valid
*.mediafire.com
Sectigo Public Server Authentication CA DV R36
2025-08-05 -
2026-07-30
1yr crt.sh
gatekeeperconsent.com
WE1
2026-06-02 -
2026-08-31
3mo crt.sh
*.google-analytics.com
WR2
2026-05-25 -
2026-08-17
3mo crt.sh
cdn.amplitude.com
Amazon RSA 2048 M01
2025-10-15 -
2026-11-13
1yr crt.sh
btloader.com
WE1
2026-05-30 -
2026-08-28
3mo crt.sh
www.ezojs.com
WE1
2026-06-10 -
2026-09-08
3mo crt.sh
*.google.com
WR2
2026-05-25 -
2026-08-17
3mo crt.sh
*.amplitude.com
Amazon RSA 2048 M04
2025-12-02 -
2026-12-30
1yr crt.sh
ad-delivery.net
WE1
2026-04-26 -
2026-07-25
3mo crt.sh
*.doubleclick.net
WR2
2026-05-25 -
2026-08-17
3mo crt.sh
ab.dns-finder.com
WR3
2026-05-26 -
2026-08-24
3mo crt.sh
ezoic.net
E8
2026-05-09 -
2026-08-07
3mo crt.sh
ezodn.com
WE1
2026-05-30 -
2026-08-28
3mo crt.sh
econventa.com
WE1
2026-05-08 -
2026-08-06
3mo crt.sh
cloudflareinsights.com
WE1
2026-04-17 -
2026-07-16
3mo crt.sh
api.btloader.com
WR3
2026-05-01 -
2026-07-30
3mo crt.sh
*.facebook.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2026-03-22 -
2026-06-20
3mo crt.sh
*.gstatic.com
WR2
2026-05-25 -
2026-08-17
3mo crt.sh
upload.video.google.com
WR2
2026-05-25 -
2026-08-17
3mo crt.sh
id5-sync.com
WE1
2026-05-14 -
2026-08-12
3mo crt.sh
*.g.doubleclick.net
WR2
2026-05-25 -
2026-08-17
3mo crt.sh
*.google.co.jp
WR2
2026-05-25 -
2026-08-17
3mo crt.sh
*.rubiconproject.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2026-03-25 -
2026-09-30
6mo crt.sh
mediafiredls.com
WE1
2026-04-28 -
2026-07-27
3mo crt.sh
*.criteo.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2026-06-04 -
2026-09-02
3mo crt.sh
jsdelivr.net
GlobalSign Atlas R3 DV TLS CA 2026 Q2
2026-05-20 -
2026-12-05
7mo crt.sh
*.33across.com
Sectigo Public Server Authentication CA DV R36
2025-09-12 -
2026-09-30
1yr crt.sh
*.pubgw.ads.yahoo.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2026-06-01 -
2026-07-22
2mo crt.sh
*.flashtalking.com
Amazon RSA 2048 M02
2025-07-15 -
2026-08-13
1yr crt.sh
id.hadron.ad.gt
WE1
2026-05-03 -
2026-08-01
3mo crt.sh
*.rlcdn.com
Sectigo Public Server Authentication CA DV R36
2026-02-05 -
2027-03-05
1yr crt.sh
*.pubmatic.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2026-02-18 -
2027-03-19
1yr crt.sh
*.teads.tv
Thawte TLS RSA CA G1
2026-03-29 -
2026-10-13
7mo crt.sh
*.adsrvr.org
GlobalSign GCC R3 DV TLS CA 2020
2026-03-04 -
2027-04-02
1yr crt.sh
*.ccgateway.net
Amazon RSA 2048 M04
2026-04-06 -
2026-10-20
7mo crt.sh
oa.openxcdn.net
WR3
2026-06-11 -
2026-09-09
3mo crt.sh
*.crwdcntrl.net
Amazon RSA 2048 M04
2025-08-09 -
2026-09-07
1yr crt.sh
*.criteo.net
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2026-05-14 -
2026-08-16
3mo crt.sh
invstatic101.creativecdn.com
WR3
2026-05-18 -
2026-08-16
3mo crt.sh
connectid.analytics.yahoo.com
GlobalSign ECC OV SSL CA 2018
2026-06-09 -
2026-12-03
6mo crt.sh
eu-1-id5-sync.com
R12
2026-05-01 -
2026-07-30
3mo crt.sh
esp.rtbhouse.com
WR3
2026-05-08 -
2026-08-06
3mo crt.sh
misc-sni.google.com
WR2
2026-05-25 -
2026-08-17
3mo crt.sh
tpc.googlesyndication.com
WR2
2026-05-25 -
2026-08-17
3mo crt.sh
ccgateway.net
E8
2026-05-18 -
2026-08-16
3mo crt.sh
adtrafficquality.google
WR2
2026-05-25 -
2026-08-17
3mo crt.sh
*.openx.net
RapidSSL TLS RSA CA G1
2025-08-12 -
2026-08-19
1yr crt.sh
quantserve.com
R13
2026-04-15 -
2026-07-14
3mo crt.sh

This page contains 15 frames:

Primary Page: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Frame ID: 028C5FE4593AD5197CDBA44772F71BC8
Requests: 226 HTTP requests in this frame

Frame: https://cdn.btloader.com/cchecker.html?upapi=true
Frame ID: F6780423A9B73A2AC4D2F2215CCDEAF0
Requests: 1 HTTP requests in this frame

Frame: https://btloader.com/trustedIframe.html?o=5678961798414336&upapi=true
Frame ID: 516538F66927BC03E6E42026020DF5D1
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/plugins/like.php?href=http://www.facebook.com/MediaFire&width=193&layout=button_count&action=like&show_faces=false&share=true&height=30&appId=124578887583575
Frame ID: F21AFD9794AD7D561A9200AC03065763
Requests: 3 HTTP requests in this frame

Frame: https://www.mediafire.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/8fc8ed1d8752/main.js
Frame ID: A594DFCD4678459454DE9102243B9EA3
Requests: 2 HTTP requests in this frame

Frame: https://translate-pa.googleapis.com/v1/supportedLanguages?client=te&display_language=ja&key=AIzaSyBWDj0QJvVIx8XOhRegXX5_SrRWxhT5Hs4&callback=callback
Frame ID: 775FC12A87FE569E7ACA7D6FA470CA16
Requests: 1 HTTP requests in this frame

Frame: https://cm.g.doubleclick.net/partnerpixels?gdpr=0&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F41kkjh07tibblti%2FAINCRAD%2BFF%2BINJECTOR.apk%2Ffile%3Fdkey%3Drv5x6b8wlt0%26r%3D125
Frame ID: 98C5493776822443D2EF0FEFACA9514C
Requests: 1 HTTP requests in this frame

Frame: https://e9be73191e89464b00225c44fbcba626.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html
Frame ID: BC3B040F7C057899A1E1081D22C32552
Requests: 1 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=www.mediafire.com&gdpr=0&gdpr_consent=
Frame ID: 4FAAC321262A777654B2B557EDBA5108
Requests: 2 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012605071401000/amp4ads-v0.mjs
Frame ID: 7FE72E977B1EABCA33BC4995A7F86F9E
Requests: 13 HTTP requests in this frame

Frame: https://ep2.adtrafficquality.google/sodar/sodar2/254/runner.html
Frame ID: 523B8AC45845845F5AA525517D9BF1F9
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 2D025A3DE29240EA610E8AADF5DBBDD2
Requests: 2 HTTP requests in this frame

Frame: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Frame ID: 29A89246C2386D9288AB1D9D4C83A456
Requests: 6 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012605071401000/amp4ads-v0.mjs
Frame ID: 1C40246D530AE2889503C887B95F4ADF
Requests: 13 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012605071401000/amp4ads-v0.mjs
Frame ID: 73454413641DB044BA8C07490812CA80
Requests: 14 HTTP requests in this frame

Screenshot

Page Title

🔥 𝗔𝗜𝗡𝗖𝗥𝗔𝗗 𝗠𝗢𝗗𝗦 𝗙𝗙 𝗠𝗔𝗫 😲 𝗡𝗢 𝗕𝗔𝗡 🛡️

Detected technologies

(Mobile frameworks)
Overall confidence: 100%
Detected patterns
  • (/.*onsen.*min\.js|.*angular-onsenui\.min\.js)

(Analytics)
Overall confidence: 50%
Detected patterns
  • sp\.js

(Advertising)
Overall confidence: 100%
Detected patterns
  • \.33across\.com/

(Analytics)
Overall confidence: 100%
Detected patterns
  • cdn\.(?:segment.+)?amplitude(?:\.com|-plugins)

(Security)
Overall confidence: 100%
Detected patterns

(Analytics)
Overall confidence: 100%
Detected patterns
  • static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

(Advertising)
Overall confidence: 100%
Detected patterns
  • \.doubleclick\.net

(Analytics)
Overall confidence: 100%
Detected patterns
  • \.ezo(?:js|ic|dn)\.(?:com|net)

(Advertising)
Overall confidence: 100%
Detected patterns
  • googlesyndication\.com/

(Analytics)
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtag/js
  • google-analytics\.com/(?:ga|urchin|analytics)\.js

(Advertising)
Overall confidence: 100%
Detected patterns
  • securepubads\.g\.doubleclick.net/tag/js/gpt\.js

(Tag managers)
Overall confidence: 100%
Detected patterns
  • \.googletagmanager\.com/
  • googletagmanager\.com/gtm\.js

(Advertising)
Overall confidence: 100%
Detected patterns
  • ^https://(?:cdn\.)?id5-sync\.com/

(CDN)
Overall confidence: 100%
Detected patterns
  • cdn\.jsdelivr\.net

(Advertising)
Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.openx\.net

(Advertising)
Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.pubmatic\.com

(Analytics)
Overall confidence: 100%
Detected patterns
  • \.quantserve\.com/quant\.js

(Advertising)
Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.rubiconproject\.com

(Advertising)
Overall confidence: 100%
Detected patterns
  • teads\.tv

(Advertising)
Overall confidence: 100%
Detected patterns
  • \.adsrvr\.org/

Page Statistics

294
Requests

90 %
HTTPS

35 %
IPv6

59
Domains

97
Subdomains

74
IPs

9
Countries

2897 kB
Transfer

9254 kB
Size

134
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 47
  • https://www.mediafire.com/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
  • https://www.mediafire.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/8fc8ed1d8752/main.js
Request Chain 95
  • https://id.a-mx.com/sync/?tagId=&ref=null&u=https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125&tl=https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125&nf=0&rt=true&v=10.23.0&av=2.0&vg=epbjs&us_privacy=null&am=null&gdpr=0&gdpr_consent= HTTP 302
  • https://c3.a-mo.net/b?uid=f3595a37%2D4a9d%2D4b24%2D9cd9%2D94bf18e66c2c&sh=id%2Ea%2Dmx%2Ecom&gdpr=0& HTTP 302
  • https://id.a-mx.com/set?oid=f3595a37-4a9d-4b24-9cd9-94bf18e66c2c&uid=f3595a37-4a9d-4b24-9cd9-94bf18e66c2c&
Request Chain 97
  • https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.mediafire.com%2F&domain=www.mediafire.com&cw=1&lsw=1&gdpr=0 HTTP 302
  • https://mug.criteo.com/sid?cpp=e486NnwvTW84QUh2V3JsSTRUWEF4aTJtVEtjTmdVZjFiYVFJbHJ2YWI5ZS9XU3cwSDNXUGQrcndTTUhmeDhjN0orTGpqQ0RObGttaEZGVUhvZGVlSzR2VE8zN25PQU5FSFFkQ2tiOXptR0t5OWJpZWhNTXozRmdnbWxIcG9OTUFjQ0VxdzZIaGR6eFJmWjMvNnJOaVlyc1JQaGZBWnBEYmIvR1BySjh6SktXeTBCSHEvUmw2QlhueHF6UGFMTVU0QnR3dGE5OHBiMlBPKzZkZXFvNW9zNi9XZHA3MjZMUmFpMEgxTlF6bkcvQmRjeFJXalRIMlVTbnhid1JmaTdXRUc4NVRZfA&cppv=2
Request Chain 133
  • https://oajs.openx.net/esp?url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F41kkjh07tibblti%2FAINCRAD%2BFF%2BINJECTOR.apk%2Ffile%3Fdkey%3Drv5x6b8wlt0%26r%3D125&rid=esp HTTP 302
  • https://oajs.openx.net/esp?url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F41kkjh07tibblti%2FAINCRAD%2BFF%2BINJECTOR.apk%2Ffile%3Fdkey%3Drv5x6b8wlt0%26r%3D125&rid=esp&cc=1
Request Chain 135
  • https://gum.criteo.com/sid/json?origin=publishertagids&domain=www.mediafire.com&sn=ChromeSyncframe&so=0&topUrl=www.mediafire.com HTTP 302
  • https://mug.criteo.com/sid?cpp=wrNh8Hw4dFdHZXJIL2FIY01rM1hnWXVLdVRhRG5VeUFFTHpaTGZETkg4ZXorVGpDaXVqYWNJWlZzOFBoUDF0b29wZDFSNFdiZ0M4aWxwbHM5bGJtMmcrQkVONllUZ0l6dWlDSkEvc1dlVDRvWVNMYlR5NGhYSTkydTdCbWxKUDltYndqSWJQQVBGS0puMjNmR2dlbHE3WXhJTERSMUlMNEFha0FsRlJVZ3k2aW8wTkhoRmVuK3Iybkg3cUpVempiMWtDYnNNT3Z0V29RVWg2WmdOd1RPL2lYcUxYS3dYdXJ3dUgydWVDWjNvdFgwcnRKV01vRUFvUG5ndG1QdlljQ3pGMFZYdlNXcGU5eEhtVWpsZUR1OE05S0ZPZ0JKVEhvNlNjRmZWblZRRVdXM1lFdHoyRG5OYXVwSVdld3k0ZVl6ZUlobXw&cppv=2
Request Chain 155
  • https://www.google.com/pagead/drt/ui HTTP 302
  • https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Request Chain 176
  • https://id5-sync.com/i/457/8.gif?o=api&id5id=ID5*2BKGCmvglNTKHQFTn07tHCcEg6i_BVEa5P-F05APPgn__2otT1taAAEBCmotT1oAuKdvnv_krGSQhoNFtPbzhQ&gdpr_consent=&gdpr=false HTTP 302
  • https://eb2.3lift.com/getuid?redir=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F170%2F7%2F2.gif%3Fpuid%3D%24UID%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&cmp_cs= HTTP 302
  • https://eb2.3lift.com/getuid?ld=1&gdpr=0&cmp_cs=&us_privacy=&redir=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F170%2F7%2F2.gif%3Fpuid%3D%24UID%26gdpr%3D0%26gdpr_consent%3D HTTP 302
  • https://id5-sync.com/c/457/170/7/2.gif?puid=1442466936165105232497&gdpr=0&gdpr_consent= HTTP 302
  • https://pixel.tapad.com/idsync/ex/push?partner_id=2922&partner_url=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F108%2F6%2F3.gif%3Fpuid%3D%24%7BTA_DEVICE_ID%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP 302
  • https://id5-sync.com/c/457/108/6/3.gif?puid=1a939850-f88b-4746-a81a-76f7cf5f305d&gdpr=0&gdpr_consent= HTTP 302
  • https://ib.adnxs.com/getuid?https://id5-sync.com/c/457/2/5/4.gif?puid=$UID&gdpr=0&gdpr_consent= HTTP 302
  • https://id5-sync.com/c/457/2/5/4.gif?puid=1314968767185625243&gdpr=0&gdpr_consent= HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=8h9u11h&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
  • https://id5-sync.com/k/264.gif?puid=0f517120-683c-4ce9-92ad-cd19266d6ded&ttl=%%TTL%% HTTP 302
  • https://rtb.gumgum.com/getuid/id5?r=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F441%2F3%2F6.gif%3Fpuid%3D%5BUID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP 302
  • https://id5-sync.com/c/457/441/3/6.gif?puid=a_b01e4b5c-f5af-49cf-92e1-8a10bc11d763&gdpr=0&gdpr_consent= HTTP 302
  • https://sync.crwdcntrl.net/map/c=13953/tp=IDFI/gdpr=0/gdpr_consent=?https://id5-sync.com/c/457/19/2/7.gif?puid=${profile_id}&gdpr=0&gdpr_consent= HTTP 302
  • https://id5-sync.com/c/457/19/2/7.gif?puid=522f503f52da3f25f1c2a54198675e&gdpr=0&gdpr_consent= HTTP 302
  • https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&bid=1mpr7m0&r=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F123%2F1%2F8.gif%3Fpuid%3D%7BUUID%7D%26gdpr%3D0%26gdpr_consent%3D
Request Chain 183
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEGlm34Y5ApLFiNBAukIbsnE&google_cver=1
Request Chain 185
  • https://cr-p3.ladsp.com/cookiesender/3 HTTP 302
  • https://cr-p3.ladsp.com/cookiesender/3?cr=true HTTP 302
  • https://jp-u.openx.net/w/1.0/sd?id=537072451&val=AZEi0ZY5q8Ynks8AKW9v0-cKEs8AAAGewP38tA
Request Chain 186
  • https://match.adsrvr.org/track/cmf/openx?oxid=bf8ed1b5-0c31-7b0c-e6d6-1d50daecf8cb&gdpr=0 HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072971&val=0f517120-683c-4ce9-92ad-cd19266d6ded&ttd_puid=bf8ed1b5-0c31-7b0c-e6d6-1d50daecf8cb&gdpr=0&gdpr_consent=
Request Chain 187
  • https://t.adx.opera.com/pub/sync?pubid=pub9322105895424 HTTP 302
  • https://www.temu.com/api/adx/cm/pixel-opera?adx_uid=64b12eda3b3567f6&gdpr=&gdpr_consent=&us_privacy=&redir=https%3A%2F%2Ft.oa.opera.com%2Fsync%3Fvendor%3D60369%26pubid%3Dpub9322105895424%26gdpr%3D%26consent%3D%26us_privacy%3D%26custom_data%3D HTTP 302
  • https://t.oa.opera.com/sync?vendor=60369&pubid=pub9322105895424&gdpr=&consent=&us_privacy=&custom_data= HTTP 302
  • https://u.openx.net/w/1.0/sd?gdpr=&gdpr_consent=&id=559546607&val=OPU641eaebb53714bc7a8270d3a66a5d1f0
Request Chain 193
  • https://id5-sync.com/i/457/8.gif?o=api&id5id=ID5*_3ym8UyOtC_tcyGouCDN5wBqo1OYa3Hhw5GlKLdhHvL__2otT1taAAEBCmotT1oAuKfyieyJTjJg7VG1V7EDdw&gdpr_consent=&gdpr=false HTTP 302
  • https://pixel.tapad.com/idsync/ex/push?partner_id=2922&partner_url=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F108%2F7%2F2.gif%3Fpuid%3D%24%7BTA_DEVICE_ID%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP 302
  • https://pixel.tapad.com/idsync/ex/push/check?partner_id=2922&partner_url=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F108%2F7%2F2.gif%3Fpuid%3D%24%7BTA_DEVICE_ID%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP 302
  • https://id5-sync.com/c/457/108/7/2.gif?puid=1a939850-f88b-4746-a81a-76f7cf5f305d&gdpr=0&gdpr_consent= HTTP 302
  • https://ib.adnxs.com/getuid?https://id5-sync.com/c/457/2/6/3.gif?puid=$UID&gdpr=0&gdpr_consent= HTTP 307
  • https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fid5-sync.com%2Fc%2F457%2F2%2F6%2F3.gif%3Fpuid%3D%24UID%26gdpr%3D0%26gdpr_consent%3D HTTP 302
  • https://id5-sync.com/c/457/2/6/3.gif?puid=1314968767185625243&gdpr=0&gdpr_consent= HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=8h9u11h&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
  • https://id5-sync.com/k/264.gif?puid=0f517120-683c-4ce9-92ad-cd19266d6ded&ttl=%%TTL%% HTTP 302
  • https://rtb.gumgum.com/getuid/id5?r=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F441%2F3%2F6.gif%3Fpuid%3D%5BUID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP 302
  • https://id5-sync.com/c/457/441/3/6.gif?puid=a_f0fcce9b-945f-4ed3-8943-9f61262313ef&gdpr=0&gdpr_consent= HTTP 302
  • https://sync.crwdcntrl.net/map/c=13953/tp=IDFI/gdpr=0/gdpr_consent=?https://id5-sync.com/c/457/19/2/7.gif?puid=${profile_id}&gdpr=0&gdpr_consent= HTTP 302
  • https://id5-sync.com/c/457/19/2/7.gif?puid=522f503f52da3f25f1c2a54198675e&gdpr=0&gdpr_consent= HTTP 302
  • https://sync.mathtag.com/sync/img?mt_exid=10089&mt_exuid=ID5-1b83gpAq7SNtv2p2PlMlznQ9kVZ17yMNjzvqeX-AMA&redir=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F3%2F1%2F8.gif%3Fpuid%3D%5BUUID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP 302
  • https://id5-sync.com/c/457/3/1/8.gif?puid=255b6a2d-4f5d-4000-99ab-c292ff5b11b2&gdpr=0&gdpr_consent= HTTP 302
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=108&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F826%2F0%2F9.gif%3Fpuid%3D%7BuserId%7D%26gdpr%3D0%26gdpr_consent%3D HTTP 302
  • https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=108&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F826%2F0%2F9.gif%3Fpuid%3D%7BuserId%7D%26gdpr%3D0%26gdpr_consent%3D HTTP 302
  • https://pixel.tapad.com/idsync/ex/push?partner_id=2499&partner_device_id=dedddd13-148e-41df-ab45-c0a1f4c23902-6a2d4f5e-4a50&partner_url=https%3A%2F%2Fsync.crwdcntrl.net%2Fqmap%3Fc%3D1389%26tp%3DSTSC%26tpid%3Ddedddd13-148e-41df-ab45-c0a1f4c23902-6a2d4f5e-4a50%26gdpr%3D0%26gdpr_consent%3D%26d%3Dhttps%253A%252F%252Fid5-sync.com%252Fc%252F457%252F826%252F0%252F9.gif%253Fpuid%253Ddedddd13-148e-41df-ab45-c0a1f4c23902-6a2d4f5e-4a50%2526gdpr%253D0%2526gdpr_consent%253D HTTP 302
  • https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=dedddd13-148e-41df-ab45-c0a1f4c23902-6a2d4f5e-4a50&gdpr=0&gdpr_consent=&d=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F826%2F0%2F9.gif%3Fpuid%3Ddedddd13-148e-41df-ab45-c0a1f4c23902-6a2d4f5e-4a50%26gdpr%3D0%26gdpr_consent%3D HTTP 302
  • https://id5-sync.com/c/457/826/0/9.gif?puid=dedddd13-148e-41df-ab45-c0a1f4c23902-6a2d4f5e-4a50&gdpr=0&gdpr_consent=
Request Chain 216
  • https://sync.crwdcntrl.net/qmap?c=18513&tp=MGNI&tpid=9b68d783-d333-44c9-b65b-8e99d95257a9&d=https%3A%2F%2Fpb-ing-02.ccgateway.net%2Fv1.0%2Fparent%2F0dae949f4b%2Fengagement%2Ftrigger%2Fuser_sync%3Fsrc%3Dlotame%26puid%3D$%7Bprofile_id%7D%26id%3Dwww.mediafire.com%26parentId%3D0dae949f4b%26ccsid%3D4823239f-dab8-43f2-afac-812a4b24d12d%26ccuid%3D9b68d783-d333-44c9-b65b-8e99d95257a9%26ccpt%3D0%26pvid%3De0627e70-d7ff-483d-af85-d9da43e3c1a7%26engid%3Dc367127e-5bf8-4990-82e0-e4c596340357%26engcount%3D0%26engttl%3D60 HTTP 302
  • https://pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/user_sync?src=lotame&puid=522f503f52da3f25f1c2a54198675e&id=www.mediafire.com&parentId=0dae949f4b&ccsid=4823239f-dab8-43f2-afac-812a4b24d12d&ccuid=9b68d783-d333-44c9-b65b-8e99d95257a9&ccpt=0&pvid=e0627e70-d7ff-483d-af85-d9da43e3c1a7&engid=c367127e-5bf8-4990-82e0-e4c596340357&engcount=0&engttl=60
Request Chain 220
  • https://id.a-mx.com/sync/?tagId=&ref=null&u=https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125&tl=https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125&nf=0&rt=true&v=10.23.0&av=2.0&vg=epbjs&us_privacy=null&am=null&gdpr=0&gdpr_consent= HTTP 302
  • https://c3.a-mo.net/b?uid=f3595a37%2D4a9d%2D4b24%2D9cd9%2D94bf18e66c2c&sh=id%2Ea%2Dmx%2Ecom&gdpr=0& HTTP 302
  • https://id.a-mx.com/set?oid=f3595a37-4a9d-4b24-9cd9-94bf18e66c2c&uid=f3595a37-4a9d-4b24-9cd9-94bf18e66c2c&
Request Chain 221
  • https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.mediafire.com%2F&domain=www.mediafire.com&bundle=sFbEPF9oaW9XS2olMkZ5SEhIa2tmSU9MbGpPOGVyWGE3NCUyRnRzd2luYnIxJTJGa3JBR1ZIamZSdU1JWkxnV2pZTkpjWnhGMlNyT1puVlBjQkhnZ3F5NnprMmNlZ2glMkZ1ejVJUnlqUyUyRjFQNUVwTUswaXFFUlF2emVQTFBQUElkVXlJdGo2c3VvNzQ&cw=1&pbt=1&lsw=1&gdpr=0 HTTP 302
  • https://mug.criteo.com/sid?cpp=eQUcWHw2a1AwcmFhb2daOFQrOURFc2tWNE1DUCs0cm1tbzZBcVR4dkZmanR5aVlKMGg3enh3S2xTMVE4bStKYmdIa3ZZTWlEOTFjeUw1VHVjVHNwQjN6N1E2L2QwbW1rYXhGNHJYcFVsdTZuaTBvM3hrRzd4aXY1dVo2YkFXelZkSXB6TzFBWDhvMnJFVUZSamNoNFpyb2NuZFJ1OUQvNU8rbldoTTVvYWpwY1NRZzdSUlRkOHZqcUFQREZRNFRWK0ZBdHo5bm1IY1ZKUENlZ3I0Z1lITURoY1JDUW4wRHZZZ1VhT2lJMkxwazZzdHVLRXBZTzhFcEJKcTBxR3cvUE53MlZxQjdwQ1AvYlpNdWkrZDJYaXFEajVobng2K1gwWXJmYm5GbkJGZXFMdlBid3RmVDF0UXRnTm5rSXc3ZUpSK01JTVdNNy9uNHAvdmVjRTYvSDU3UWZoS1E9PXw&cppv=2
Request Chain 267
  • https://pixel.quantserve.com/cs?a=p-31iz6hfFutd16&gdpr=0&sf2=1 HTTP 302
  • https://pixel.quantserve.com/cs?a=p-31iz6hfFutd16&gdpr=0&sf2=1&__qcmcs=1
Request Chain 270
  • https://idsync.rlcdn.com/380609.gif?gdpr=0&partner_uid=nvl1Epz-cUaFq3VPzf1qQpCpc0eF-iROzK5s9AWc HTTP 307
  • https://idsync.rlcdn.com/1000.gif?memo=CMGdFxIzCi8IARCfOBoobnZsMUVwei1jVWFGcTNWUHpmMXFRcENwYzBlRi1pUk96SzVzOUFXYxAAGg0I4J610QYSBQjoBxAAQgBKAA HTTP 307
  • https://pippio.com/api/sync?pid=5324&it=1&iv=a3ab3322fe014925833aff72e406fb782fd6781bf37a27d79971593cdf2e5967791426b5417dce21&_=2
Request Chain 271
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=81&gdpr=0&external_user_id=HRWQjB8SlNgGR5DRThGP3BNFltkGFsHQT0Lk8T7Z HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=81&gdpr=0&external_user_id=HRWQjB8SlNgGR5DRThGP3BNFltkGFsHQT0Lk8T7Z&C=1

294 HTTP transactions
3 data transactions

Method
Protocol
Status Resource
Path
Size
x-fer
Time
Latency
Type
MIME-Type
IP
Location
GET
H3
200
Primary Request file Show response
www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/
331 KB
87 KB
561ms
551ms
Document
text/html
104.17.147.83
Cloudflare
General
Full URL
https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.147.83 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
af4afc0b356a3d01670e4234b685e6c5c269b39dd25f1946bfe6579d5941e794
Security Headers
Name Value
Strict-Transport-Security max-age=0
X-Frame-Options SAMEORIGIN

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Linux"

Response headers

access-control-allow-methods
OPTIONS, POST, GET
access-control-allow-origin
https://www.mediafire.com
alt-svc
h3=":443"; ma=86400
cache-control
no-cache, no-store, must-revalidate, max-age=0, post-check=0, pre-check=0
cf-cache-status
DYNAMIC
cf-ray
a0b12782ed3df277-NRT
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Sat, 13 Jun 2026 12:38:48 GMT
expires
0
pragma
no-cache
priority
u=0,i
server
cloudflare
server-timing
cfCacheStatus;desc="DYNAMIC" cfEdge;dur=9,cfOrigin;dur=0,cfWorker;dur=536 cfExtPri
strict-transport-security
max-age=0
vary
Accept-Encoding
x-by
x-frame-options
SAMEORIGIN
x-mf-env
liveApi
x-mf-fe
mf1
x-robots-tag
noindex, nofollow
GET
H3
200
min.js Show response
cmp.gatekeeperconsent.com/
1 KB
802 B
38ms
10ms
Script
application/javascript
172.67.199.186
Cloudflare
General
Full URL
https://cmp.gatekeeperconsent.com/min.js
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.199.186 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
345dbaad5cd394bb195e79a7d835ee2af91c02c76413d974f2e7fd3b9fcbfe39

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-encoding
zstd
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=pbRoDqWABC3ny19lH59ylAS%2B32BrohLJfNe%2FO30BjWOGFH80cdyoR5QcVk2vcY3zptuJFqyMFGC1NGvHl6nk%2BsOScSqtshqOSeU2o56OAWE6IJcyHl%2F6csD3Rn%2FnenYgU4VMBYh1evILWUAj"}]}
cf-ray
a0b127890c112821-NRT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sat, 13 Jun 2026 12:38:48 GMT
content-type
application/javascript
server
cloudflare
priority
u=1,i=?0
GET
H3
200
cmp.min.js Show response
the.gatekeeperconsent.com/
8 KB
3 KB
31ms
10ms
Script
application/javascript
172.67.199.186
Cloudflare
General
Full URL
https://the.gatekeeperconsent.com/cmp.min.js
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.199.186 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
06c87cfc79d31896761b14ed789b3f747f1b885dac0ed193c16fb8d1d305083d

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-robots-tag
noindex, follow
content-encoding
gzip
cf-cache-status
HIT
age
124
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=jOYZ60uAUJIS3BU2KlnghKrBvhCZlPe0xJ9ktgatAdn7nEsWKxbt6wB0jZY3rZXTgN8X2ey%2FaXBNT%2Fh98vCI1Z3O6uQZ5q7WnqJGmKaEGSM%2FsUZLlny2KsvhsLdiTK%2FEGeTjcqp%2B3JHapCKg"}]}
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sat, 13 Jun 2026 12:38:48 GMT
x-middleton-display
sol-js
last-modified
Sat, 13 Jun 2026 12:36:44 GMT
content-type
application/javascript
vary
Accept-Encoding
priority
u=1,i=?0
cache-control
max-age=300, public
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray
a0b12788fc102821-NRT
server
cloudflare
GET
H3
200
consent_modules.json Show response
privacy.gatekeeperconsent.com/
2 B
489 B
33ms
14ms
XHR
application/json
172.67.199.186
Cloudflare
General
Full URL
https://privacy.gatekeeperconsent.com/consent_modules.json
Requested by
Host: the.gatekeeperconsent.com
URL: https://the.gatekeeperconsent.com/cmp.min.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.199.186 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
max-age=15780000, public
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=cR87Kp%2FCQLuhRn9VTyNK%2BnWFukXVlaDu1hXWCKY033qgULBOmfVn3ZXwdWLnnmWlz5aZSed27KJdz4Gq8io7PvQ%2BBPHSSWdhdjbBWdZcBM87cvjC8o2xV5VwQ9cfkXRQLfuLjxKNdRie7tp3%2FGdpqA%3D%3D"}]}
cf-ray
a0b12789484a0eee-NRT
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
content-length
2
server-timing
cfExtPri
date
Sat, 13 Jun 2026 12:38:48 GMT
content-type
application/json;charset=UTF-8
server
cloudflare
priority
u=1,i
GET
H2
200
js Show response
www.googletagmanager.com/gtag/
325 KB
118 KB
68ms
43ms
Script
application/javascript
2404:6800:400b:c005::61
Google LLC
General
Full URL
https://www.googletagmanager.com/gtag/js?id=UA-829541-1
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:400b:c005::61 , Japan, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
3e9ef1f1c1e7933c4e0548e703e96fc3fcd7f8c5cd3811b0957cfe9c2dbd4511
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
zstd
expires
Sat, 13 Jun 2026 12:38:48 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 13 Jun 2026 12:38:48 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
last-modified
Sat, 13 Jun 2026 12:00:00 GMT
access-control-allow-headers
Cache-Control
strict-transport-security
max-age=31536000; includeSubDomains
cache-control
private, max-age=900
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
*
content-length
120534
x-xss-protection
0
server
Google Tag Manager
GET
H2
200
amplitude-8.5.0-min.gz.js Show response
cdn.amplitude.com/libs/
68 KB
22 KB
26ms
2ms
Script
application/javascript
18.65.207.116
Amazon.com
General
Full URL
https://cdn.amplitude.com/libs/amplitude-8.5.0-min.gz.js
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.65.207.116 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-18-65-207-116.nrt57.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
2450e5580136f94bda7ccf95e3167b57e15b05b513a430967943a50036fa47a4

Request headers

Origin
https://www.mediafire.com
sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

access-control-max-age
3000
content-encoding
gzip
etag
"660c3b546f2a131de50b69b91f26c636"
x-amz-version-id
NY8_7uBz3xoXYJBVsMSBAGHOz8ixMBS3
age
223353
access-control-allow-methods
GET, HEAD
x-cache
Hit from cloudfront
x-amz-cf-id
cgI3eJPRdIyi3UFQJKkQ4hp7hIDstgrDzbC88Z-9x-Pzuu1xu1iyJg==
date
Wed, 10 Jun 2026 22:36:16 GMT
content-type
application/javascript
vary
Origin,Access-Control-Request-Headers,Access-Control-Request-Method
last-modified
Fri, 13 Aug 2021 22:37:42 GMT
cache-control
max-age=31536000
via
1.1 26f81727519c342aad4ccd47b72fd7cc.cloudfront.net (CloudFront)
accept-ranges
bytes
access-control-allow-origin
*
content-length
22154
x-amz-cf-pop
NRT57-P3
server
AmazonS3
x-amz-server-side-encryption
AES256
GET
H2
200
tag Show response
btloader.com/
94 KB
31 KB
31ms
11ms
Script
application/javascript
2606:4700:10::6814:14bd
Cloudflare
General
Full URL
https://btloader.com/tag?o=5678961798414336&upapi=true
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:14bd -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
f560890e55f5238f5bede1aa9eb78ac22a16ae0b3a814b5b3ae8c64db672dd22

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-robots-tag
noindex, nofollow
cache-control
public, max-age=300, stale-if-error=3600, stale-while-revalidate=300
content-encoding
br
cf-cache-status
HIT
etag
W/"ae8ba5e49538e0dbc0c04acb02bb1aa9"
via
1.1 google
cf-ray
a0b1278958a93bb3-NRT
access-control-allow-origin
*
date
Sat, 13 Jun 2026 12:38:48 GMT
content-type
application/javascript
last-modified
Sat, 13 Jun 2026 11:34:41 GMT
server
cloudflare
vary
Accept-Encoding, X-Acceptable-Ads, DNT
GET
H3
200
sa.min.js Show response
www.ezojs.com/ezoic/
337 KB
99 KB
28ms
9ms
Script
application/javascript
172.67.170.144
Cloudflare
General
Full URL
https://www.ezojs.com/ezoic/sa.min.js
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.170.144 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
315d41c6369ea71cc48eb9922a31c8dac638660b6ddd83a2091f56e65f6d972e

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-robots-tag
noindex, follow
content-encoding
gzip
cf-cache-status
HIT
etag
W/"55909a72f73e9890b9afb6e1c231775a"
age
180
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=uYIvYPcQAvIWxhI8ZsrJzUEr5VTvN4QSHIFQjKj9Byd%2Bw14J667UbsYI7qfKSzx%2B7W40gHUehUF7MfRLqZtoV3ENGHJsB7%2Fn%2Fhh0RmELFTrNZnlyh1d4JemV4wDOk8Ti"}]}
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sat, 13 Jun 2026 12:38:48 GMT
x-middleton-display
sol-js
content-type
application/javascript
vary
Accept-Encoding
priority
u=3,i=?0
cache-control
public, max-age=600, stale-while-revalidate=3600
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray
a0b1278959524b7a-NRT
server
cloudflare
GET
H2
200
gtm.js Show response
www.googletagmanager.com/
432 KB
139 KB
59ms
40ms
Script
application/javascript
2404:6800:400b:c005::61
Google LLC
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-53LP4T
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:400b:c005::61 , Japan, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
2d7b2dff34fbaa4e7532a1cd5616015b9c83a75116384a66366c59bb7ac6ddd4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
zstd
expires
Sat, 13 Jun 2026 12:38:48 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 13 Jun 2026 12:38:48 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
last-modified
Sat, 13 Jun 2026 12:00:00 GMT
access-control-allow-headers
Cache-Control
strict-transport-security
max-age=31536000; includeSubDomains
cache-control
private, max-age=900
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
*
content-length
141505
x-xss-protection
0
server
Google Tag Manager
GET
H3
200
mf_logo_full_color.svg
static.mediafire.com/images/backgrounds/header/
3 KB
2 KB
21ms
12ms
Image
image/svg+xml
104.17.147.83
Cloudflare
General
Full URL
https://static.mediafire.com/images/backgrounds/header/mf_logo_full_color.svg
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.147.83 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
8539c91ae0a82f8cab27d481ea38ac4e66d1e5b36701fe295bcba4399b9255bd

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
cf-cache-status
HIT
etag
W/"5813cfb2-d1d"
age
13317
access-control-allow-methods
OPTIONS, POST, GET
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
x-mf-env
liveApi
date
Sat, 13 Jun 2026 12:38:48 GMT
content-type
image/svg+xml
last-modified
Fri, 28 Oct 2016 22:22:42 GMT
priority
u=3,i
x-mf-fe
mf1
cf-ray
a0b127895be1f277-NRT
access-control-allow-origin
*
server
cloudflare
GET
H3
200
file-zip-v3.png
static.mediafire.com/images/filetype/
2 KB
2 KB
20ms
12ms
Image
image/png
104.17.147.83
Cloudflare
General
Full URL
https://static.mediafire.com/images/filetype/file-zip-v3.png
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.147.83 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
4448e430d3c53bad548a5d135e1c7e2f9593e806ba47892640d430ea752e979e

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cf-cache-status
HIT
etag
"62deda56-750"
age
13748
access-control-allow-methods
OPTIONS, POST, GET
expires
Mon, 13 Jul 2026 08:49:39 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
x-mf-env
liveApi
date
Sat, 13 Jun 2026 12:38:48 GMT
content-type
image/png
last-modified
Mon, 25 Jul 2022 18:00:54 GMT
priority
u=3,i
cache-control
max-age=2592000
x-mf-fe
mf1
cf-ray
a0b127895bddf277-NRT
accept-ranges
bytes
access-control-allow-origin
*
content-length
1872
server
cloudflare
GET
H3
200
icons_sprite.svg
www.mediafire.com/images/icons/svg_light/
36 KB
9 KB
39ms
33ms
Image
image/svg+xml
104.17.147.83
Cloudflare
General
Full URL
https://www.mediafire.com/images/icons/svg_light/icons_sprite.svg
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.147.83 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
7ba1bc2084def769e77a7dbf97cd91d68fe6c6d55b5d183a7d36630da8da2b02

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
cf-cache-status
HIT
etag
W/"62deda56-90ab"
age
13937
access-control-allow-methods
OPTIONS, POST, GET
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
x-mf-env
liveApi
date
Sat, 13 Jun 2026 12:38:48 GMT
content-type
image/svg+xml
last-modified
Mon, 25 Jul 2022 18:00:54 GMT
vary
Accept-Encoding
priority
u=3,i
cf-ray
a0b127895bd6f277-NRT
x-mf-fe
mf2
access-control-allow-origin
*
server
cloudflare
GET
H3
200
arrow_dropdown.svg
www.mediafire.com/images/icons/svg_dark/
315 B
496 B
29ms
25ms
Image
image/svg+xml
104.17.147.83
Cloudflare
General
Full URL
https://www.mediafire.com/images/icons/svg_dark/arrow_dropdown.svg
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.147.83 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
82b94716473aa225e715e117802145c5d2d725aa1ba9d476d61a5d3da16a8c26

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
cf-cache-status
HIT
etag
W/"62deda56-13b"
age
11485
access-control-allow-methods
OPTIONS, POST, GET
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
x-mf-env
liveApi
date
Sat, 13 Jun 2026 12:38:48 GMT
content-type
image/svg+xml
last-modified
Mon, 25 Jul 2022 18:00:54 GMT
vary
Accept-Encoding
priority
u=3,i
cf-ray
a0b127895bd9f277-NRT
x-mf-fe
mf1
access-control-allow-origin
*
server
cloudflare
GET
H3
200
check_circle_green.svg
static.mediafire.com/images/icons/svg_dark/
444 B
534 B
16ms
12ms
Image
image/svg+xml
104.17.147.83
Cloudflare
General
Full URL
https://static.mediafire.com/images/icons/svg_dark/check_circle_green.svg
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.147.83 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
03c8d2dc7d985c3004ff2cd6d8148dd03560f37ed15efdf6c2d7f4d771d0e599

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
cf-cache-status
HIT
etag
W/"62deda56-1bc"
age
1057
access-control-allow-methods
OPTIONS, POST, GET
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
x-mf-env
liveApi
date
Sat, 13 Jun 2026 12:38:48 GMT
content-type
image/svg+xml
last-modified
Mon, 25 Jul 2022 18:00:54 GMT
priority
u=3,i
x-mf-fe
mf1
cf-ray
a0b127895bdff277-NRT
access-control-allow-origin
*
server
cloudflare
GET
H3
200
fb_16x16.png
static.mediafire.com/images/backgrounds/download/social/
181 B
438 B
13ms
13ms
Image
image/png
104.17.147.83
Cloudflare
General
Full URL
https://static.mediafire.com/images/backgrounds/download/social/fb_16x16.png
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.147.83 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
720671166ac43aba99e3952b0b9341ab4e0fee1fd891db54e2a07f05db653142

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cf-cache-status
HIT
etag
"62deda56-b5"
age
9052
access-control-allow-methods
OPTIONS, POST, GET
expires
Mon, 13 Jul 2026 10:07:55 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
x-mf-env
liveApi
date
Sat, 13 Jun 2026 12:38:48 GMT
content-type
image/png
last-modified
Mon, 25 Jul 2022 18:00:54 GMT
priority
u=3,i
cache-control
max-age=2592000
x-mf-fe
mf2
cf-ray
a0b127899cb1f277-NRT
accept-ranges
bytes
access-control-allow-origin
*
content-length
181
server
cloudflare
GET
H2
200
element.js Show response
translate.google.com/translate_a/
75 KB
27 KB
75ms
58ms
Script
text/javascript
2404:6800:400b:c005::64
Google LLC
General
Full URL
https://translate.google.com/translate_a/element.js?cb=googFooterTranslate
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:400b:c005::64 , Japan, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
0a4b3d40394f9bd80ee9c1b885bdf66e066783a4cf59d6649a773909793821fd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy
same-origin-allow-popups
content-encoding
gzip
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Mon, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 13 Jun 2026 12:38:48 GMT
x-xss-protection
0
content-type
text/javascript; charset=utf-8
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
server
ESF
x-frame-options
SAMEORIGIN
GET
H3
200
footerIcons.png
static.mediafire.com/images/backgrounds/footer/social/
583 B
841 B
12ms
12ms
Image
image/png
104.17.147.83
Cloudflare
General
Full URL
https://static.mediafire.com/images/backgrounds/footer/social/footerIcons.png
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.147.83 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
f917a9105c311331b1d40f4d2bdbf11233c1c465616c1a9c46232f451463b061

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cf-cache-status
HIT
etag
"62deda56-247"
age
3059
access-control-allow-methods
OPTIONS, POST, GET
expires
Mon, 13 Jul 2026 11:47:48 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
x-mf-env
liveApi
date
Sat, 13 Jun 2026 12:38:48 GMT
content-type
image/png
last-modified
Mon, 25 Jul 2022 18:00:54 GMT
priority
u=3,i
cache-control
max-age=2592000
x-mf-fe
mf2
cf-ray
a0b12789acfef277-NRT
accept-ranges
bytes
access-control-allow-origin
*
content-length
583
server
cloudflare
POST
H2
200
/ Show response
api.amplitude.com/
7 B
137 B
431ms
144ms
XHR
text/html
44.230.239.150
Amazon.com
General
Full URL
https://api.amplitude.com/
Requested by
Host: cdn.amplitude.com
URL: https://cdn.amplitude.com/libs/amplitude-8.5.0-min.gz.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
44.230.239.150 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-44-230-239-150.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
Content-Type
application/x-www-form-urlencoded; charset=UTF-8
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=15768000
access-control-allow-origin
*
content-length
7
date
Sat, 13 Jun 2026 12:38:48 GMT
content-type
text/html;charset=utf-8
GET
H2
200
cchecker.html Show response
cdn.btloader.com/ Frame F678
366 B
778 B
29ms
13ms
Document
text/html
2606:4700:10::6814:14bd
Cloudflare
General
Full URL
https://cdn.btloader.com/cchecker.html?upapi=true
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:14bd -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
c700c58e763a5ae34f446713819957ed9755025d35b8497ec1150f428f5ff227

Request headers

Referer
https://www.mediafire.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Linux"

Response headers

access-control-allow-origin
*
access-control-expose-headers
*, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
age
72722
cache-control
public, max-age=86400, immutable
cf-cache-status
HIT
cf-ray
a0b1278a1d2b95ba-NRT
content-encoding
br
content-type
text/html
date
Sat, 13 Jun 2026 12:38:48 GMT
expires
Sat, 13 Jun 2026 16:11:56 GMT
last-modified
Thu, 16 Apr 2026 14:02:40 GMT
server
cloudflare
x-goog-generation
1776348160499015
x-goog-hash
crc32c=/3eT+A== md5=WtMW8Jy4XJceDGzQqhOktA==
x-goog-metageneration
1
x-goog-storage-class
MULTI_REGIONAL
x-goog-stored-content-encoding
identity
x-goog-stored-content-length
366
x-guploader-uploadid
AJ5rDhG74r41QN0j4sheVofXa8YfPVr9hITo44Ym2emANU3Z9Sp8rfSc_Xk1zCpYkXOQpG7KWLDKDDk
GET
H2
200
px.gif Show response
ad-delivery.net/
43 B
109 B
21ms
7ms
Fetch
image/gif
2606:4700:10::ac42:948c
Cloudflare
General
Full URL
https://ad-delivery.net/px.gif?ch=2&e=0.2676797926438723
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac42:948c -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-goog-metageneration
5
access-control-expose-headers
*, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash
crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status
HIT
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3"
age
2
x-goog-stored-content-encoding
identity
expires
Fri, 12 Jun 2026 20:23:44 GMT
x-goog-stored-content-length
43
date
Sat, 13 Jun 2026 12:38:48 GMT
content-type
image/gif
last-modified
Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid
AAwnv3JMXkz3ZUQsLqzogVLXRUh4YB_2iVspb_DjiQ0uSiq9ZDNuQengWG2u3JEhwP_0kkXX
cache-control
public, max-age=86400
x-goog-storage-class
MULTI_REGIONAL
cf-ray
a0b1278a1f3c9501-NRT
accept-ranges
bytes
access-control-allow-origin
*
x-goog-generation
1620242732037093
content-length
43
server
cloudflare
GET
H3
200
favicon.ico Show response
ad.doubleclick.net/
1 KB
129 B
50ms
38ms
Fetch
image/x-icon
142.251.24.149
Google LLC
General
Full URL
https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.08463077464822366
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.24.149 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
rj-in-f149.1e100.net
Software
sffe /
Resource Hash
d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options
nosniff
expires
Sun, 14 Jun 2026 12:38:48 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 13 Jun 2026 12:38:48 GMT
content-type
image/x-icon
vary
Accept-Encoding
last-modified
Tue, 08 May 2012 13:08:06 GMT
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
content-length
104
x-xss-protection
0
server
sffe
GET
H2
200
px.gif Show response
ad-delivery.net/
43 B
607 B
18ms
5ms
Fetch
image/gif
2606:4700:10::ac42:948c
Cloudflare
General
Full URL
https://ad-delivery.net/px.gif?ch=1&e=0.27262359656182
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac42:948c -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-goog-metageneration
5
access-control-expose-headers
*, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash
crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status
HIT
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3"
age
2
x-goog-stored-content-encoding
identity
expires
Fri, 12 Jun 2026 20:23:44 GMT
x-goog-stored-content-length
43
date
Sat, 13 Jun 2026 12:38:48 GMT
content-type
image/gif
last-modified
Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid
AAwnv3JMXkz3ZUQsLqzogVLXRUh4YB_2iVspb_DjiQ0uSiq9ZDNuQengWG2u3JEhwP_0kkXX
cache-control
public, max-age=86400
x-goog-storage-class
MULTI_REGIONAL
cf-ray
a0b1278a1f3f9501-NRT
accept-ranges
bytes
access-control-allow-origin
*
x-goog-generation
1620242732037093
content-length
43
server
cloudflare
GET
H2
200
dns Show response
ab.dns-finder.com/meta/
2 B
233 B
165ms
151ms
Fetch
text/plain
34.36.200.111
Google LLC
General
Full URL
https://ab.dns-finder.com/meta/dns
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.36.200.111 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS
111.200.36.34.bc.googleusercontent.com
Software
/
Resource Hash
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
private, max-age=180, stale-if-error=180, stale-while-revalidate=180
access-control-expose-headers
X-Resolver
x-resolver
default
via
1.1 google
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
2
date
Sat, 13 Jun 2026 12:38:48 GMT
content-type
text/plain; charset=utf-8
vary
Origin
GET
H2
200
trustedIframe.html Show response
btloader.com/ Frame 5165
6 KB
2 KB
22ms
14ms
Document
text/html
2606:4700:10::ac42:ab85
Cloudflare
General
Full URL
https://btloader.com/trustedIframe.html?o=5678961798414336&upapi=true
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac42:ab85 -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
76b14705bcd5752ac05035c95c7f53bfe8e65dda03bc77662e0aff067e3258e7

Request headers

Referer
https://www.mediafire.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Linux"

Response headers

cache-control
public, max-age=3600, stale-while-revalidate=3600
cf-ray
a0b1278a1bcfe373-NRT
content-encoding
br
content-type
text/html
date
Sat, 13 Jun 2026 12:38:48 GMT
server
cloudflare
GET
H2
200
device Show response
cdn.api.btloader.com/
87 B
295 B
107ms
95ms
Fetch
application/json
2606:4700:10::6814:14bd
Cloudflare
General
Full URL
https://cdn.api.btloader.com/device?orgid=5678961798414336&fullVersionList=%5B%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22149.0.0.0%22%7D%2C%7B%22brand%22%3A%22Google+Chrome%22%2C%22version%22%3A%22149.0.0.0%22%7D%2C%7B%22brand%22%3A%22Not-A.Brand%22%2C%22version%22%3A%2224.0.0.0%22%7D%5D&upapi=true
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:14bd -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
35fdf7828a207f57fbacc0019a0bf07b7f25e5e0b4e82151776362191848849f

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=3600
content-encoding
br
cf-cache-status
DYNAMIC
x-ratelimit-reset
1781354329
via
1.1 google
cf-ray
a0b1278a1a67b9dd-NRT
x-ratelimit-remaining
93
access-control-allow-origin
*
date
Sat, 13 Jun 2026 12:38:48 GMT
x-ratelimit-limit
100
content-type
application/json
vary
Origin
server
cloudflare
GET
H3
200
ezorca.min.js Show response
www.ezojs.com/ezoic/
405 KB
108 KB
7ms
7ms
Script
application/javascript
172.67.170.144
Cloudflare
General
Full URL
https://www.ezojs.com/ezoic/ezorca.min.js
Requested by
Host: www.ezojs.com
URL: https://www.ezojs.com/ezoic/sa.min.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.170.144 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
c73c612fac1b3a7e0b0f62fa464e3932d3463aa79557205221e6551d8c62d662

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-robots-tag
noindex, follow
content-encoding
gzip
cf-cache-status
HIT
etag
W/"da22f3479b2bd6b39bf53ece10fd13a1"
age
181
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=LpJN%2B5nt7Ijr3YUM%2B5UQlvSSwhoJkQBTIs67fTvZ8aeahQjGF6byp5Nmg3JUSXYiBoaq%2Bpt20R%2FyA5KSOa5lLKFtPndJhoP2%2BucoUX%2FVmOOVqQz6ZoyRXH6FFJpfyxWC"}]}
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sat, 13 Jun 2026 12:38:48 GMT
x-middleton-display
sol-js
content-type
application/javascript
vary
Accept-Encoding
priority
u=1,i=?0
cache-control
public, max-age=600, stale-while-revalidate=3600
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray
a0b1278a69874b7a-NRT
server
cloudflare
GET
H3
200
columbus.js Show response
www.ezojs.com/detroitchicago/
108 B
607 B
80ms
80ms
Script
application/javascript
172.67.170.144
Cloudflare
General
Full URL
https://www.ezojs.com/detroitchicago/columbus.js
Requested by
Host: www.ezojs.com
URL: https://www.ezojs.com/ezoic/sa.min.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.170.144 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e46d6ebbbc492b3e687b408f201fa80e9757aaac62e37fac626776cabc8bbc82

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-robots-tag
noindex, follow
content-encoding
gzip
cf-cache-status
BYPASS
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=CunUS9VxtJlY3TcBmIkkavdrQ8KNG8hGbyzcQc7p2csMjilBOgoixjzVdTwovETXe2pkwbfO%2F5TP%2FHXpUBE5LMgLzBnKmfM0d7E%2Fy9PvXhSRRDtRtoqx0TtZidYQoCpW"}]}
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sat, 13 Jun 2026 12:38:48 GMT
x-middleton-display
sol-js
content-type
application/javascript
vary
Accept-Encoding
priority
u=3,i=?0
cache-control
private, max-age=0, must-revalidate, no-cache, no-store
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray
a0b1278a69884b7a-NRT
content-length
99
server
cloudflare
POST
H2
200
saa.go Show response
g.ezoic.net/
66 KB
18 KB
288ms
78ms
XHR
text/javascript
2406:da18:9d0:143f:2124:4e9c:36a9:d9de
Amazon.com
General
Full URL
https://g.ezoic.net/saa.go
Requested by
Host: www.ezojs.com
URL: https://www.ezojs.com/ezoic/sa.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2406:da18:9d0:143f:2124:4e9c:36a9:d9de Singapore, Singapore, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
/
Resource Hash
79b7571ea8e8bea10d979e9d170a96673bce36db591affde3f4d21d2ac8debcb

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
Content-Type
text/plain
sec-ch-ua-mobile
?0

Response headers

x-robots-tag
noindex
access-control-max-age
1728000
cache-control
private, max-age=0, must-revalidate, no-cache, no-store
content-encoding
br
access-control-allow-credentials
true
access-control-allow-methods
GET, POST, PUT, OPTIONS
expires
Fri, 12 Jun 2026 12:38:48 GMT
access-control-allow-origin
https://www.mediafire.com
date
Sat, 13 Jun 2026 12:38:48 GMT
content-type
text/javascript
vary
Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
access-control-allow-headers
Content-Type
OPTIONS
H2
200
ezconfig
g.ezoic.net/detroitchicago/ Frame
0
0
213ms
70ms
Preflight
2406:da18:9d0:143f:2124:4e9c:36a9:d9de
Amazon.com
General
Full URL
https://g.ezoic.net/detroitchicago/ezconfig
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2406:da18:9d0:143f:2124:4e9c:36a9:d9de Singapore, Singapore, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.mediafire.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
content-type
access-control-allow-methods
GET, POST, PUT, OPTIONS
access-control-allow-origin
https://www.mediafire.com
access-control-max-age
1728000
content-length
0
date
Sat, 13 Jun 2026 12:38:49 GMT
vary
Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
GET
H3
200
boise.js Show response
go.ezodn.com/detroitchicago/
860 B
931 B
30ms
11ms
Script
application/javascript
172.67.142.121
Cloudflare
General
Full URL
https://go.ezodn.com/detroitchicago/boise.js?gcb=195-16&cb=5
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.142.121 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
c656d50263d423e681e4963066e86f087cb646cab3b440b3b082a0da28eb79ea

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-robots-tag
noindex, follow
content-encoding
br
cf-cache-status
HIT
age
363962
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=NuzjovOtIc6pYFvz%2FxZBnJfB4ef4apPYO4Zep7fZknlPwHvG5XaT27e1cFESsk%2F2lNqAwm%2Fy%2B9PHCLkEckPTg6AZwMwkWxOpbAKGFYSPiEkKR0SS23%2BvJyFLs7hTZeE%3D"}]}
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sat, 13 Jun 2026 12:38:49 GMT
x-middleton-display
sol-js
last-modified
Wed, 10 Jun 2026 23:16:11 GMT
content-type
application/javascript
vary
Accept-Encoding
priority
u=3,i=?0
cache-control
public, max-age=31536000
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray
a0b1278ce9e57076-NRT
accept-ranges
bytes
content-length
429
server
cloudflare
GET
H3
200
mulvane.js Show response
go.ezodn.com/parsonsmaize/
1 KB
1 KB
27ms
9ms
Script
application/javascript
172.67.142.121
Cloudflare
General
Full URL
https://go.ezodn.com/parsonsmaize/mulvane.js?gcb=195-16&cb=e75e48eec0
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.142.121 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
6a163c9c1e18a0fae78f3ce587d463c4aa6d39991639580d1106a9fa0774b8e8

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-robots-tag
noindex, follow
content-encoding
br
cf-cache-status
HIT
age
352099
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=R21G0Un8%2FJaRpCF8jweNErtxHNwGdkBzsfdGD6k1hGF2p%2FLI64EWEr70shBb%2BiA06vHzxY78P4xtEo%2BN%2Bw4g08UqrPL9GsMdoZVU%2B6%2B8%2BU2dqlvJK%2BCyoDr8Xm5ytbE%3D"}]}
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sat, 13 Jun 2026 12:38:49 GMT
x-middleton-display
sol-js
last-modified
Tue, 09 Jun 2026 17:02:33 GMT
content-type
application/javascript
vary
Accept-Encoding
priority
u=3,i=?0
cache-control
public, max-age=31536000
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray
a0b1278ce9e47076-NRT
accept-ranges
bytes
content-length
526
server
cloudflare
GET
H3
200
birmingham.js Show response
go.ezodn.com/detroitchicago/
752 B
880 B
29ms
11ms
Script
application/javascript
172.67.142.121
Cloudflare
General
Full URL
https://go.ezodn.com/detroitchicago/birmingham.js?gcb=195-16&cb=539c47377c
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.142.121 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
30be558393bd8b0585c806a6eaed6d6f5b51d1ca63c0113061dfe35eaa128ce3

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-robots-tag
noindex, follow
content-encoding
br
cf-cache-status
HIT
age
2637190
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=ZUWXrXqG6r4U6U3rJ2DRn3o5ZfAKE2b9u%2FsvEzs0JRqCYT8fK109fCV4lrGaIMlNYBhm7CsZzTLzkC8%2Bz7htOI3I4%2BhrpUfyPa4uQyDDBgBBWzcK6WTETJdEXkC5ZyM%3D"}]}
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sat, 13 Jun 2026 12:38:49 GMT
x-middleton-display
sol-js
last-modified
Wed, 10 Jun 2026 20:57:52 GMT
content-type
application/javascript
vary
Accept-Encoding
priority
u=3,i=?0
cache-control
public, max-age=31536000
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray
a0b1278ce9e67076-NRT
accept-ranges
bytes
content-length
380
server
cloudflare
GET
H3
200
ezoicanalytics.js Show response
go.ezodn.com/
2 KB
1 KB
28ms
11ms
Script
application/javascript
172.67.142.121
Cloudflare
General
Full URL
https://go.ezodn.com/ezoicanalytics.js?cb=1&dcb=195-16&shcb=34
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.142.121 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e814d50a228f54aecf40d8a58e41d48ce1dfc4376fd5fbedc28078fe0a8c5526

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-robots-tag
noindex, follow
content-encoding
br
cf-cache-status
HIT
age
22216
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=6rdkX%2BYLqDj1%2Fva1fV6sH8b3zkYgZAW0PwkdKYDs0QAVVGTwfsSbbiWUPSDP%2FvkPJ%2BgYRTl1nIKsbXAnOnSfZ0dLEyOmAW7TImFAs%2FiOBW%2B3qmi5GgiJP3GzQIkI6cg%3D"}]}
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sat, 13 Jun 2026 12:38:49 GMT
x-middleton-display
sol-js
last-modified
Sat, 13 Jun 2026 06:28:35 GMT
content-type
application/javascript
vary
Accept-Encoding
priority
u=3,i=?0
cache-control
public, max-age=86400
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray
a0b1278ce9e77076-NRT
server
cloudflare
GET
H3
200
identity.js Show response
www.ezojs.com/
347 KB
100 KB
12ms
11ms
Script
application/javascript
172.67.170.144
Cloudflare
General
Full URL
https://www.ezojs.com/identity.js
Requested by
Host: www.ezojs.com
URL: https://www.ezojs.com/ezoic/sa.min.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.170.144 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
f735895129e780b83844afa73d27bd9de32471fbe243fa9ec72b9e37aff04a6f

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-robots-tag
noindex, follow
content-encoding
gzip
cf-cache-status
HIT
etag
W/"7c1006cb6a59e39c18c270b4b201af9f"
age
182
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=g6RdHXVDpbKE9gEj1leK7ZjShmxR%2BD4o6hFZR%2FQvKYzrP1JQyojUd%2FWEZAAPnWT5KkfL6YwjjkpR15WYzrlbb2LZc2uuyWmV03cziv3bqQCqHclhWsEIV5Jyl4%2F5H%2Fqt"}]}
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sat, 13 Jun 2026 12:38:49 GMT
x-middleton-display
sol-js
content-type
application/javascript
vary
Accept-Encoding
priority
u=3,i=?0
cache-control
public, max-age=900, stale-while-revalidate=3600
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray
a0b1278cd9d34b7a-NRT
server
cloudflare
POST
H2
200
ezconfig Show response
g.ezoic.net/detroitchicago/
92 B
124 B
72ms
70ms
Fetch
application/json
2406:da18:9d0:143f:2124:4e9c:36a9:d9de
Amazon.com
General
Full URL
https://g.ezoic.net/detroitchicago/ezconfig
Requested by
Host: www.ezojs.com
URL: https://www.ezojs.com/ezoic/sa.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2406:da18:9d0:143f:2124:4e9c:36a9:d9de Singapore, Singapore, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
/
Resource Hash
1b7c4edd444f73d828aacb88e0f35efd212c8378d07e5ff848d699adf68ba550

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
Content-Type
application/json
sec-ch-ua-mobile
?0

Response headers

access-control-max-age
1728000
content-encoding
br
access-control-allow-credentials
true
access-control-allow-methods
GET, POST, PUT, OPTIONS
access-control-allow-origin
https://www.mediafire.com
content-length
66
date
Sat, 13 Jun 2026 12:38:49 GMT
content-type
application/json
vary
Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
access-control-allow-headers
Content-Type
GET
H2
200
ezintegration
g.ezoic.net/
43 B
167 B
72ms
72ms
Image
image/gif
2406:da18:9d0:143f:2124:4e9c:36a9:d9de
Amazon.com
General
Full URL
https://g.ezoic.net/ezintegration?d=www.mediafire.com&ts=1781354328698
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2406:da18:9d0:143f:2124:4e9c:36a9:d9de Singapore, Singapore, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
/
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

expires
Fri, 12 Jun 2026 12:38:49 GMT
cache-control
private, max-age=0, must-revalidate, no-cache, no-store
content-length
43
date
Sat, 13 Jun 2026 12:38:49 GMT
x-middleton-display
integration_verify
content-type
image/gif
vary
Accept-Encoding
GET
H3
200
infinity.js.aspx Show response
cdn.econventa.com/Scripts/
160 KB
47 KB
18ms
8ms
Script
text/javascript
172.67.69.81
Cloudflare
General
Full URL
https://cdn.econventa.com/Scripts/infinity.js.aspx?guid=5ff0fb62-0643-4ff1-aaee-c737f9ffc0e0
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.69.81 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
6df984f948e3979f54a89506b99e18bec9a79ee1b49b008fc613579157999f23

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

last-modified
Sat, 13 Jun 2026 12:25:23 GMT
cache-control
max-age=1200, no-transform
content-encoding
gzip
cf-cache-status
HIT
age
814
cf-ray
a0b1278d2a01e373-NRT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sat, 13 Jun 2026 12:38:49 GMT
content-type
text/javascript
vary
Accept-Encoding
server
cloudflare
priority
u=3,i=?0
GET
H2
200
v833ccba57c9e4d2798f2e76cebdd09a11778172276447 Show response
static.cloudflareinsights.com/beacon.min.js/
32 KB
11 KB
23ms
10ms
Script
text/javascript
2606:4700::6810:5049
Cloudflare
General
Full URL
https://static.cloudflareinsights.com/beacon.min.js/v833ccba57c9e4d2798f2e76cebdd09a11778172276447
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5049 -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
aca73fc574e12740e3368860b88a284d01b643456f3ed6a06322ecb47750563f

Request headers

Origin
https://www.mediafire.com
sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=86400
content-encoding
gzip
etag
W/"2026.5.0"
cross-origin-resource-policy
cross-origin
cf-ray
a0b1278d9c244423-NRT
access-control-allow-origin
*
date
Sat, 13 Jun 2026 12:38:49 GMT
content-type
text/javascript;charset=UTF-8
last-modified
Thu, 07 May 2026 16:44:36 GMT
server
cloudflare
POST
H2
204
exd
api.btloader.com/
0
0
166ms
152ms
Fetch
130.211.23.194
Google LLC
General
Full URL
https://api.btloader.com/exd?tid=3cx3J3ev-wmzF7dOhX-9ec0fdf239&sid=bqPjyzVFSR-jo4xQCMD-9ec0fdf239&cv=2.1.189-1-gf2b7278&upapi=true
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
130.211.23.194 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS
194.23.211.130.bc.googleusercontent.com
Software
/
Resource Hash

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

via
1.1 google
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
alt-svc
h3=":443"; ma=2592000
date
Sat, 13 Jun 2026 12:38:49 GMT
vary
Origin
GET
H3
200
like.php Show response
www.facebook.com/plugins/ Frame F21A
18 KB
7 KB
158ms
150ms
Document
text/html
57.144.44.1
Facebook
General
Full URL
https://www.facebook.com/plugins/like.php?href=http://www.facebook.com/MediaFire&width=193&layout=button_count&action=like&show_faces=false&share=true&height=30&appId=124578887583575
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
57.144.44.1 Tokyo, Japan, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
edge-star-mini-shv-01-nrt6.facebook.com
Software
/
Resource Hash
c648cd5f984a8f4e9d6fab93264e476a0ffe8710cc077587e4e0bc5776679ffe
Security Headers
Name Value
Content-Security-Policy default-src blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net *.facebook.net *.whatsapp.com *.whatsapp.net;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'nonce-H7WzUQOL' blob: 'self' connect.facebook.net 'wasm-unsafe-eval' https://accounts.google.com https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://accounts.google.com https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com *.instagram.com https://accounts.google.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;child-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net accounts.meta.com *.accounts.meta.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;manifest-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;object-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.mediafire.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Linux"

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
private, no-cache, no-store, must-revalidate
content-encoding
zstd
content-security-policy
default-src blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net *.facebook.net *.whatsapp.com *.whatsapp.net;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'nonce-H7WzUQOL' blob: 'self' connect.facebook.net 'wasm-unsafe-eval' https://accounts.google.com https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://accounts.google.com https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com *.instagram.com https://accounts.google.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;child-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net accounts.meta.com *.accounts.meta.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;manifest-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;object-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
content-type
text/html; charset="utf-8"
cross-origin-opener-policy
unsafe-none
cross-origin-resource-policy
cross-origin
date
Sat, 13 Jun 2026 12:38:49 GMT
document-policy
force-load-at-top include-js-call-stacks-in-crash-reports
expires
Sat, 01 Jan 2000 00:00:00 GMT
origin-agent-cluster
?1
permissions-policy
accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self "https://www.fbsbx.com"), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
pragma
no-cache
priority
u=0,i
report-to
{"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7650858586794766516&cpp=C3&cv=1041422772&st=1781354329302"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
reporting-endpoints
coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7650858586794766516&cpp=C3&cv=1041422772&st=1781354329302", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
strict-transport-security
max-age=15552000; preload
vary
Accept-Encoding
x-content-type-options
nosniff
x-fb-connection-quality
EXCELLENT; q=0.9, rtt=3, rtx=0, c=24, mss=1232, tbw=5186, tp=9, tpl=0, uplat=146, ullat=0
x-fb-debug
Pu7B0Wws0gYHgeqfVU2UEOSleDbHypTG5Y3WXZihLr3glPN4i57GibH0meqDdLdgXMd7SDcsPTrnJFMgaNaGfw==
x-xss-protection
0
GET
H3
200
world.svg
static.mediafire.com/images/backgrounds/download/additional_content/
143 KB
53 KB
42ms
42ms
Image
image/svg+xml
104.17.147.83
Cloudflare
General
Full URL
https://static.mediafire.com/images/backgrounds/download/additional_content/world.svg
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.147.83 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
4342feac38021c4fe3069eba0edf1c2e1b4345e2b548b0afb7ab21b7369b3bc8

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
cf-cache-status
HIT
etag
W/"62deda56-23ce2"
age
5747
access-control-allow-methods
OPTIONS, POST, GET
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
x-mf-env
liveApi
date
Sat, 13 Jun 2026 12:38:49 GMT
content-type
image/svg+xml
last-modified
Mon, 25 Jul 2022 18:00:54 GMT
priority
u=3,i
x-mf-fe
mf2
cf-ray
a0b1278da991f277-NRT
access-control-allow-origin
*
server
cloudflare
GET
H3
200
continent-na.svg
static.mediafire.com/images/backgrounds/download/additional_content/
50 KB
19 KB
22ms
20ms
Image
image/svg+xml
104.17.147.83
Cloudflare
General
Full URL
https://static.mediafire.com/images/backgrounds/download/additional_content/continent-na.svg
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.147.83 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
05cfe92d9794a54258a19bfec7ae0faa73f61b66416983136594b4f95bb114dd

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
cf-cache-status
HIT
etag
W/"62deda56-c817"
age
8287
access-control-allow-methods
OPTIONS, POST, GET
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
x-mf-env
liveApi
date
Sat, 13 Jun 2026 12:38:49 GMT
content-type
image/svg+xml
last-modified
Mon, 25 Jul 2022 18:00:54 GMT
priority
u=3,i
x-mf-fe
mf1
cf-ray
a0b1278da999f277-NRT
access-control-allow-origin
*
server
cloudflare
GET
H3
200
usa.svg
static.mediafire.com/images/flags_svg/
1 KB
698 B
15ms
13ms
Image
image/svg+xml
104.17.147.83
Cloudflare
General
Full URL
https://static.mediafire.com/images/flags_svg/usa.svg
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.147.83 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
8bacb685be7cec7f41a0270e694fa90c0fb448b2c0ded5f1734baf51050d695c

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
cf-cache-status
HIT
etag
W/"62deda56-5c7"
age
11888
access-control-allow-methods
OPTIONS, POST, GET
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
x-mf-env
liveApi
date
Sat, 13 Jun 2026 12:38:49 GMT
content-type
image/svg+xml
last-modified
Mon, 25 Jul 2022 18:00:54 GMT
priority
u=3,i
x-mf-fe
mf2
cf-ray
a0b1278da9a2f277-NRT
access-control-allow-origin
*
server
cloudflare
GET
H3
200
flag.svg
static.mediafire.com/images/backgrounds/download/additional_content/
234 B
440 B
13ms
12ms
Image
image/svg+xml
104.17.147.83
Cloudflare
General
Full URL
https://static.mediafire.com/images/backgrounds/download/additional_content/flag.svg
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.147.83 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
f52a0c7d9fa7ae8e45916c491ae7193f9a1e289f128f05264122c53d8da970db

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
cf-cache-status
HIT
etag
W/"62deda56-ea"
age
573
access-control-allow-methods
OPTIONS, POST, GET
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
x-mf-env
liveApi
date
Sat, 13 Jun 2026 12:38:49 GMT
content-type
image/svg+xml
last-modified
Mon, 25 Jul 2022 18:00:54 GMT
priority
u=3,i
x-mf-fe
mf2
cf-ray
a0b1278da9a6f277-NRT
access-control-allow-origin
*
server
cloudflare
GET
H3
200
mf_round.svg
static.mediafire.com/images/backgrounds/download/additional_content/
1 KB
1 KB
16ms
15ms
Image
image/svg+xml
104.17.147.83
Cloudflare
General
Full URL
https://static.mediafire.com/images/backgrounds/download/additional_content/mf_round.svg
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.147.83 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
f1a67642fc97b508ce07cf6df329022bf5184a1c573044dc021e0d6e64688c64

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
cf-cache-status
HIT
etag
W/"62deda56-5b1"
age
14007
access-control-allow-methods
OPTIONS, POST, GET
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
x-mf-env
liveApi
date
Sat, 13 Jun 2026 12:38:49 GMT
content-type
image/svg+xml
last-modified
Mon, 25 Jul 2022 18:00:54 GMT
priority
u=3,i
x-mf-fe
mf1
cf-ray
a0b1278da9a9f277-NRT
access-control-allow-origin
*
server
cloudflare
GET
H3
200
browser_chrome.svg
static.mediafire.com/images/backgrounds/download/additional_content/
8 KB
2 KB
15ms
14ms
Image
image/svg+xml
104.17.147.83
Cloudflare
General
Full URL
https://static.mediafire.com/images/backgrounds/download/additional_content/browser_chrome.svg
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.147.83 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
1c6ba1010c2cc88c59de9e9584728da124770fa399643ffc1beffcec54b84be7

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
cf-cache-status
HIT
etag
W/"62deda56-1e24"
age
13306
access-control-allow-methods
OPTIONS, POST, GET
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
x-mf-env
liveApi
date
Sat, 13 Jun 2026 12:38:49 GMT
content-type
image/svg+xml
last-modified
Mon, 25 Jul 2022 18:00:54 GMT
priority
u=3,i
x-mf-fe
mf1
cf-ray
a0b1278da9acf277-NRT
access-control-allow-origin
*
server
cloudflare
GET
H2
200
m=el_main_css
www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.zZZZhVqDDCw.L.W.O/am=BBBAEw/d=0/rs=AN8SPfpg2wPCELPSNQ-JdhuRpXMrWQt6Ow/
22 KB
5 KB
72ms
16ms
Stylesheet
text/css
2404:6800:400b:c00e::5e
Google LLC
General
Full URL
https://www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.zZZZhVqDDCw.L.W.O/am=BBBAEw/d=0/rs=AN8SPfpg2wPCELPSNQ-JdhuRpXMrWQt6Ow/m=el_main_css
Requested by
Host:
URL: /_/translate_http/_/js/k=translate_http.tr.ja.0byMJGaW2BE.O/am=BBBAEw/d=1/rs=AN8SPfrB0yXHSZPBhbvL0YsZoiqrdZvV1Q/m=el_conf
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:400b:c00e::5e , Japan, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
0ecbd1374ebd05d9733e3230e6ccaefadbfd8907cd151221d8af6fdf881b4e09
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
age
103177
report-to
{"group":"rosetta","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/rosetta"}]}
x-content-type-options
nosniff
expires
Sat, 12 Jun 2027 07:59:12 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Fri, 12 Jun 2026 07:59:12 GMT
last-modified
Thu, 09 Apr 2026 01:12:55 GMT
content-type
text/css; charset=UTF-8
vary
Accept-Encoding
cache-control
public, max-age=31536000
cross-origin-opener-policy
same-origin; report-to="rosetta"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/rosetta
accept-ranges
bytes
access-control-allow-origin
*
content-length
4160
x-xss-protection
0
server
sffe
GET
H2
200
m=el_main Show response
translate.googleapis.com/_/translate_http/_/js/k=translate_http.tr.ja.0byMJGaW2BE.O/am=BBBAEw/d=1/exm=el_conf/ed=1/rs=AN8SPfrB0yXHSZPBhbvL0YsZoiqrdZvV1Q/
423 KB
122 KB
18ms
4ms
Script
text/javascript
2404:6800:400b:c005::5f
Google LLC
General
Full URL
https://translate.googleapis.com/_/translate_http/_/js/k=translate_http.tr.ja.0byMJGaW2BE.O/am=BBBAEw/d=1/exm=el_conf/ed=1/rs=AN8SPfrB0yXHSZPBhbvL0YsZoiqrdZvV1Q/m=el_main
Requested by
Host:
URL: /_/translate_http/_/js/k=translate_http.tr.ja.0byMJGaW2BE.O/am=BBBAEw/d=1/rs=AN8SPfrB0yXHSZPBhbvL0YsZoiqrdZvV1Q/m=el_conf
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2404:6800:400b:c005::5f , Japan, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
bc4e0cbab332daab268a3dbee01019d0026b3a3817b58d846e9781cd8b0bfa1a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
age
155324
report-to
{"group":"rosetta","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/rosetta"}]}
x-content-type-options
nosniff
expires
Fri, 11 Jun 2027 17:30:05 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Thu, 11 Jun 2026 17:30:05 GMT
last-modified
Wed, 10 Jun 2026 03:49:40 GMT
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
cache-control
public, max-age=31536000
cross-origin-opener-policy
same-origin; report-to="rosetta"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/rosetta
accept-ranges
bytes
access-control-allow-origin
*
content-length
124489
x-xss-protection
0
server
sffe
GET
H3
200
main.js Show response
www.mediafire.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/8fc8ed1d8752/ Frame A594
Redirect Chain
  • https://www.mediafire.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
  • https://www.mediafire.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/8fc8ed1d8752/main.js?
25 KB
11 KB
9ms
9ms
Script
application/javascript
104.17.147.83
Cloudflare
General
Full URL
https://www.mediafire.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/8fc8ed1d8752/main.js?
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H3
Server
104.17.147.83 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
25bbe4a504be526e3861291e6afd0f641c9a9ac7b6cf0f48b969495a5eabf1f1
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Referer

Response headers

cache-control
max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public
content-encoding
gzip
x-content-type-options
nosniff
cf-ray
a0b1278dda73f277-NRT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sat, 13 Jun 2026 12:38:49 GMT
content-type
application/javascript; charset=UTF-8
server
cloudflare
priority
u=3,i=?0

Redirect headers

cache-control
max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public
location
/cdn-cgi/challenge-platform/h/g/scripts/jsd/8fc8ed1d8752/main.js?
cf-ray
a0b1278dba00f277-NRT
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
content-length
0
server-timing
cfExtPri
date
Sat, 13 Jun 2026 12:38:49 GMT
server
cloudflare
priority
u=3,i=?0
GET
H2
200
analytics.js Show response
www.google-analytics.com/
51 KB
21 KB
45ms
11ms
Script
text/javascript
2404:6800:400a:1002::8b
Google LLC
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-829541-1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:400a:1002::8b , Japan, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
f1a61277e3f902f50ab42015d8b07218db9b7601bb0967e54a52bfdcb4fa7e81
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
age
6095
report-to
{"group":"ascnsrsgac:225:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:225:0"}],}
x-content-type-options
nosniff
expires
Sat, 13 Jun 2026 12:57:14 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 13 Jun 2026 10:57:14 GMT
last-modified
Tue, 15 Jul 2025 00:44:26 GMT
content-type
text/javascript
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:225:0
cross-origin-opener-policy-report-only
same-origin; report-to=ascnsrsgac:225:0
content-length
20802
server
Golfe2
POST
H3
200
a0b12782ed3df277 Show response
www.mediafire.com/cdn-cgi/challenge-platform/h/g/jsd/oneshot/8fc8ed1d8752/0.39680754301934396:1781352322:wMu4zj7DKcpJID0g1e7Obw4N38rh54imlc5sArcKxsw/ Frame A594
0
869 B
11ms
6ms
XHR
text/plain
104.17.147.83
Cloudflare
General
Full URL
https://www.mediafire.com/cdn-cgi/challenge-platform/h/g/jsd/oneshot/8fc8ed1d8752/0.39680754301934396:1781352322:wMu4zj7DKcpJID0g1e7Obw4N38rh54imlc5sArcKxsw/a0b12782ed3df277
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.147.83 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
Content-Type
text/plain;charset=UTF-8
sec-ch-ua-mobile
?0

Response headers

timing-allow-origin
https://www.mediafire.com
cf-ray
a0b1278e6c11f277-NRT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
content-length
0
cf-chl-out-s
0BbTCpSvSaoPbtD2aHDXbw==$fPmfRDZOFJhAOJo97oawqw==
date
Sat, 13 Jun 2026 12:38:49 GMT
content-type
text/plain; charset=UTF-8
server
cloudflare
priority
u=1,i
GET
H2
200
px.gif Show response
ad-delivery.net/
43 B
135 B
6ms
6ms
Fetch
image/gif
2606:4700:10::ac42:948c
Cloudflare
General
Full URL
https://ad-delivery.net/px.gif?ch=1&e=0.061122489551761694
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac42:948c -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-goog-metageneration
5
access-control-expose-headers
*, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash
crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status
HIT
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3"
age
3
x-goog-stored-content-encoding
identity
expires
Fri, 12 Jun 2026 20:23:44 GMT
x-goog-stored-content-length
43
date
Sat, 13 Jun 2026 12:38:49 GMT
content-type
image/gif
last-modified
Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid
AAwnv3JMXkz3ZUQsLqzogVLXRUh4YB_2iVspb_DjiQ0uSiq9ZDNuQengWG2u3JEhwP_0kkXX
cache-control
public, max-age=86400
x-goog-storage-class
MULTI_REGIONAL
cf-ray
a0b1278e79859501-NRT
accept-ranges
bytes
access-control-allow-origin
*
x-goog-generation
1620242732037093
content-length
43
server
cloudflare
GET
H3
200
aSF1HWkDHx7.css
static.xx.fbcdn.net/rsrc.php/v5/yJ/l/0,ja_JP/ Frame F21A
232 B
376 B
12ms
4ms
Stylesheet
text/css
57.144.44.128
Facebook
General
Full URL
https://static.xx.fbcdn.net/rsrc.php/v5/yJ/l/0,ja_JP/aSF1HWkDHx7.css
Requested by
Host: www.facebook.com
URL: https://www.facebook.com/plugins/like.php?href=http://www.facebook.com/MediaFire&width=193&layout=button_count&action=like&show_faces=false&share=true&height=30&appId=124578887583575
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
57.144.44.128 Tokyo, Japan, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
xx-fbcdn-shv-01-nrt6.fbcdn.net
Software
/
Resource Hash
30f1570e0bca7ac216d47126b186e268719195f4967fb017d8cae01004a07c03
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Origin
https://www.facebook.com
sec-ch-ua-platform
"Linux"
Referer
https://www.facebook.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-md5
mxrgSWsB/7u6Nw5IFanwKg==
report-to
{"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options
nosniff
expires
Sat, 12 Jun 2027 09:12:52 GMT
alt-svc
h3=":443"; ma=86400
date
Sat, 13 Jun 2026 12:38:49 GMT
content-type
text/css; charset=utf-8
last-modified
Mon, 01 Jan 2001 08:00:00 GMT
x-fb-debug
vU/ETP+qSGVAtn+1Ox1HGjCS90e3U/CynCApJrU2C/q0iKJY3y/tn7uXvs2EscQ2crpyJ48R6At7NQsYBtTHHA==
priority
u=0
vary
Origin
reporting-endpoints
permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
cache-control
public,max-age=31536000,immutable
timing-allow-origin
*
x-fb-connection-quality
EXCELLENT; q=0.9, rtt=1, rtx=0, c=23, mss=1232, tbw=4929, tp=8, tpl=0, uplat=0, ullat=-1
cross-origin-resource-policy
cross-origin
permissions-policy
accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy
force-load-at-top, include-js-call-stacks-in-crash-reports
access-control-allow-origin
https://www.facebook.com
content-length
232
origin-agent-cluster
?1
GET
H3
200
ARUN3D9gcNG.css
static.xx.fbcdn.net/rsrc.php/v5/yr/l/0,ja_JP/ Frame F21A
496 B
426 B
13ms
6ms
Stylesheet
text/css
57.144.44.128
Facebook
General
Full URL
https://static.xx.fbcdn.net/rsrc.php/v5/yr/l/0,ja_JP/ARUN3D9gcNG.css
Requested by
Host: www.facebook.com
URL: https://www.facebook.com/plugins/like.php?href=http://www.facebook.com/MediaFire&width=193&layout=button_count&action=like&show_faces=false&share=true&height=30&appId=124578887583575
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
57.144.44.128 Tokyo, Japan, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
xx-fbcdn-shv-01-nrt6.fbcdn.net
Software
/
Resource Hash
09d2b2627320c673aac1db56db4d500f3e7e462ce6cba816f27bec0ec305fa0f
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Origin
https://www.facebook.com
sec-ch-ua-platform
"Linux"
Referer
https://www.facebook.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-md5
25ZSt7qBjUKFNKoTOM49vQ==
content-encoding
zstd
report-to
{"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options
nosniff
expires
Wed, 09 Jun 2027 00:12:56 GMT
alt-svc
h3=":443"; ma=86400
date
Sat, 13 Jun 2026 12:38:49 GMT
content-type
text/css; charset=utf-8
last-modified
Mon, 01 Jan 2001 08:00:00 GMT
x-fb-debug
QOXt9ZFVU/Nw9txS7AnpCEJHmAmk66veQ1ZigtEii40rTL4zp5jgCd7sDXBzPeHwBx3oBVO2ndpyD2MoJTlCQA==
priority
u=0
vary
Origin
reporting-endpoints
permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
cache-control
public,max-age=31536000,immutable
timing-allow-origin
*
x-fb-connection-quality
EXCELLENT; q=0.9, rtt=1, rtx=0, c=23, mss=1232, tbw=6673, tp=11, tpl=0, uplat=0, ullat=-1
cross-origin-resource-policy
cross-origin
permissions-policy
accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy
force-load-at-top, include-js-call-stacks-in-crash-reports
access-control-allow-origin
https://www.facebook.com
content-length
285
origin-agent-cluster
?1
GET
H2
200
js Show response
www.googletagmanager.com/gtag/
554 KB
179 KB
51ms
49ms
Script
application/javascript
2404:6800:400b:c005::61
Google LLC
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-K68XP6D85D&cx=c&gtm=4e66a1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-53LP4T
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:400b:c005::61 , Japan, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
0d0d88d0f6ba67df0491df41ea3c956b200b73066d19954e0c37ab9ebb6afe5e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
cache-control
private, max-age=900
content-encoding
zstd
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
expires
Sat, 13 Jun 2026 12:38:49 GMT
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
183581
date
Sat, 13 Jun 2026 12:38:49 GMT
x-xss-protection
0
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
server
Google Tag Manager
access-control-allow-headers
Cache-Control
POST
H2
200
sa.go Show response
g.ezoic.net/
206 KB
35 KB
126ms
123ms
XHR
text/javascript
2406:da18:9d0:143f:2124:4e9c:36a9:d9de
Amazon.com
General
Full URL
https://g.ezoic.net/sa.go
Requested by
Host: www.ezojs.com
URL: https://www.ezojs.com/ezoic/sa.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2406:da18:9d0:143f:2124:4e9c:36a9:d9de Singapore, Singapore, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
/
Resource Hash
4f80695681b18a07d94035985cb04ead72840e5c5e2f0147cf0f38d1392653c0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
Content-Type
text/plain
sec-ch-ua-mobile
?0

Response headers

x-robots-tag
noindex
access-control-max-age
1728000
x-ezidgraph-status
disabled
cache-control
private, max-age=0, must-revalidate, no-cache, no-store
content-encoding
br
access-control-allow-credentials
true
access-control-allow-methods
GET, POST, PUT, OPTIONS
expires
Fri, 12 Jun 2026 12:38:49 GMT
access-control-allow-origin
https://www.mediafire.com
date
Sat, 13 Jun 2026 12:38:49 GMT
content-type
text/javascript
vary
Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
access-control-allow-headers
Content-Type
POST
H2
200
analytics Show response
g.ezoic.net/ezais/
16 KB
5 KB
156ms
149ms
Fetch
text/plain
2406:da18:9d0:143f:2124:4e9c:36a9:d9de
Amazon.com
General
Full URL
https://g.ezoic.net/ezais/analytics?cb=1
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/ezoicanalytics.js?cb=1&dcb=195-16&shcb=34
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2406:da18:9d0:143f:2124:4e9c:36a9:d9de Singapore, Singapore, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
/
Resource Hash
58519eda1b841f9c3ce898c2dc7755881ad8953312b43b0c8f83008324f52935

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
Content-Type
text/plain
sec-ch-ua-mobile
?0

Response headers

x-robots-tag
noindex
access-control-max-age
1728000
content-encoding
br
access-control-allow-credentials
true
access-control-allow-methods
GET, POST, PUT, OPTIONS
access-control-allow-origin
https://www.mediafire.com
date
Sat, 13 Jun 2026 12:38:49 GMT
content-type
text/plain; charset=utf-8
vary
Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
access-control-allow-headers
Content-Type
GET
H2
200
id5-api.js Show response
cdn.id5-sync.com/api/1.0/
117 KB
35 KB
24ms
9ms
Script
text/javascript
2606:4700:10::ac42:a937
Cloudflare
General
Full URL
https://cdn.id5-sync.com/api/1.0/id5-api.js
Requested by
Host: www.ezojs.com
URL: https://www.ezojs.com/identity.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac42:a937 -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
18120a6bee05cd823d5f4ab0c52006863a059a5d6c535c790a31bdd2ee8c45e7
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-amz-id-2
vTSnzxsjCw4p2Evo8/vntMzlKX91E51FQc/jHSlJRmxKijzuECSZv9u/npu94Sx8dS4XAa6ngB1QruUNhbJsn/R05VKTH9O4lAwjaAWBEuQ=
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=3600
content-encoding
br
cf-cache-status
HIT
etag
W/"78d670c3a2facd95b81a836b6857d830"
age
2
x-amz-request-id
XX33NSQ1PBFZF6PZ
cf-ray
a0b1278f4eef49f9-NRT
date
Sat, 13 Jun 2026 12:38:49 GMT
content-type
text/javascript;charset=utf-8
last-modified
Wed, 18 Mar 2026 12:22:23 GMT
server
cloudflare
x-amz-server-side-encryption
AES256
POST
H2
200
ezconfig Show response
g.ezoic.net/detroitchicago/
49 B
109 B
104ms
103ms
Fetch
application/json
2406:da18:9d0:143f:2124:4e9c:36a9:d9de
Amazon.com
General
Full URL
https://g.ezoic.net/detroitchicago/ezconfig
Requested by
Host: www.ezojs.com
URL: https://www.ezojs.com/identity.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2406:da18:9d0:143f:2124:4e9c:36a9:d9de Singapore, Singapore, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
/
Resource Hash
50a63bf06dcdc62ce03de6a07d10770dc80cfa47ef2b63db1e9f6a5fbd786a7d

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
Content-Type
application/json
sec-ch-ua-mobile
?0

Response headers

access-control-max-age
1728000
content-encoding
gzip
access-control-allow-credentials
true
access-control-allow-methods
GET, POST, PUT, OPTIONS
access-control-allow-origin
https://www.mediafire.com
content-length
73
date
Sat, 13 Jun 2026 12:38:49 GMT
content-type
application/json
vary
Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
access-control-allow-headers
Content-Type
POST
H2
200
ezconfig Show response
g.ezoic.net/detroitchicago/
29 B
60 B
102ms
100ms
Fetch
application/json
2406:da18:9d0:143f:2124:4e9c:36a9:d9de
Amazon.com
General
Full URL
https://g.ezoic.net/detroitchicago/ezconfig
Requested by
Host: www.ezojs.com
URL: https://www.ezojs.com/identity.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2406:da18:9d0:143f:2124:4e9c:36a9:d9de Singapore, Singapore, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
/
Resource Hash
893719087a8bc6dcdfabc4e1d54fd6d724953d40da2ad369f8b4fb5f689394d7

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
Content-Type
application/json
sec-ch-ua-mobile
?0

Response headers

access-control-max-age
1728000
access-control-allow-credentials
true
access-control-allow-methods
GET, POST, PUT, OPTIONS
access-control-allow-origin
https://www.mediafire.com
content-length
29
date
Sat, 13 Jun 2026 12:38:49 GMT
content-type
application/json
vary
Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
access-control-allow-headers
Content-Type
GET
H3
200
Tag.engine Show response
econventa.com/
2 KB
3 KB
160ms
155ms
Script
application/json
172.67.69.81
Cloudflare
General
Full URL
https://econventa.com/Tag.engine?time=-540&id=5ff0fb62-0643-4ff1-aaee-c737f9ffc0e0&rand=43658&ver=async&referrerUrl=&fingerPrint=123&abr=false&stdTime=540&fpe=1&bw=1600&bh=1200&res=1600x1200&curl=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F41kkjh07tibblti%2FAINCRAD%2BFF%2BINJECTOR.apk%2Ffile%3Fdkey%3Drv5x6b8wlt0%26r%3D125&kw=online%20storage%2Cfree%20storage%2Ccloud%20storage%2Ccollaboration%2Cbackup%20file%20sharing%2Cshare%20files%2Cphoto%20backup%2Cphoto%20sharing%2Cftp%20replacement%2Ccross%20platform%2Cremote%20access%2Cmobile%20access%2Csend%20large%20files%2Crecover%20files%2Cfile%20versioning%2Cundelete%2Cwindows%2Cpc%2Cmac%2Cos%20x%2Clinux%2Ciphone
Requested by
Host: cdn.econventa.com
URL: https://cdn.econventa.com/Scripts/infinity.js.aspx?guid=5ff0fb62-0643-4ff1-aaee-c737f9ffc0e0
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.69.81 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
d50ac2d5a45de14775079aebb08671f8be6d828e2a4f976d1b7faeb09fd92dce

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
cf-cache-status
DYNAMIC
accept-ch
Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version
cf-ray
a0b1278f6a66e373-NRT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sat, 13 Jun 2026 12:38:49 GMT
content-type
application/json
vary
Accept-Encoding
server
cloudflare
priority
u=3,i=?0
GET
H3
200
24px.svg
fonts.gstatic.com/s/i/productlogos/translate/v14/
6 KB
3 KB
13ms
5ms
Image
image/svg+xml
142.250.23.94
Google LLC
General
Full URL
https://fonts.gstatic.com/s/i/productlogos/translate/v14/24px.svg
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.23.94 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
zj-in-f94.1e100.net
Software
sffe /
Resource Hash
ab5c23a05e39deed14d9d8262b0dce9f024f86105a27196cad37d14a3f516e09
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
age
190159
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Fri, 11 Jun 2027 07:49:30 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Thu, 11 Jun 2026 07:49:30 GMT
last-modified
Wed, 20 Apr 2022 14:24:23 GMT
content-type
image/svg+xml
vary
Accept-Encoding
cache-control
public, max-age=31536000
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
3340
x-xss-protection
0
server
sffe
GET
H2
200
googlelogo_color_42x16dp.png
www.gstatic.com/images/branding/googlelogo/1x/
910 B
1 KB
5ms
4ms
Image
image/png
2404:6800:400b:c00e::5e
Google LLC
General
Full URL
https://www.gstatic.com/images/branding/googlelogo/1x/googlelogo_color_42x16dp.png
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:400b:c00e::5e , Japan, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
6318394f737c66f0e2ccfcd88e3935c6667633a1b95fa29fba2b75431d55eef2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

age
304004
report-to
{"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
x-content-type-options
nosniff
expires
Thu, 10 Jun 2027 00:12:05 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 10 Jun 2026 00:12:05 GMT
last-modified
Thu, 02 Nov 2023 22:48:00 GMT
content-type
image/png
vary
Origin
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="static-on-bigtable"
content-length
910
x-xss-protection
0
server
sffe
GET
H2
200
translate_24dp.png
www.gstatic.com/images/branding/product/2x/
2 KB
2 KB
5ms
5ms
Image
image/png
2404:6800:400b:c00e::5e
Google LLC
General
Full URL
https://www.gstatic.com/images/branding/product/2x/translate_24dp.png
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.zZZZhVqDDCw.L.W.O/am=BBBAEw/d=0/rs=AN8SPfpg2wPCELPSNQ-JdhuRpXMrWQt6Ow/m=el_main_css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:400b:c00e::5e , Japan, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
4dac0026fbfa2615dce30c0af12830863fe885f84387a0147b9e338f548d5d82
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.zZZZhVqDDCw.L.W.O/am=BBBAEw/d=0/rs=AN8SPfpg2wPCELPSNQ-JdhuRpXMrWQt6Ow/m=el_main_css
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

age
12586
report-to
{"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
x-content-type-options
nosniff
expires
Sun, 13 Jun 2027 09:09:03 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 13 Jun 2026 09:09:03 GMT
last-modified
Thu, 14 Oct 2021 09:08:00 GMT
content-type
image/png
vary
Origin
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="static-on-bigtable"
content-length
1842
x-xss-protection
0
server
sffe
GET
H2
200
px.gif Show response
ad-delivery.net/
43 B
110 B
7ms
5ms
Fetch
image/gif
2606:4700:10::ac42:948c
Cloudflare
General
Full URL
https://ad-delivery.net/px.gif?ch=2&e=0.6728949832380928
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac42:948c -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-goog-metageneration
5
access-control-expose-headers
*, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash
crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status
HIT
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3"
age
3
x-goog-stored-content-encoding
identity
expires
Fri, 12 Jun 2026 20:23:44 GMT
x-goog-stored-content-length
43
date
Sat, 13 Jun 2026 12:38:49 GMT
content-type
image/gif
last-modified
Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid
AAwnv3JMXkz3ZUQsLqzogVLXRUh4YB_2iVspb_DjiQ0uSiq9ZDNuQengWG2u3JEhwP_0kkXX
cache-control
public, max-age=86400
x-goog-storage-class
MULTI_REGIONAL
cf-ray
a0b1278fac1e9501-NRT
accept-ranges
bytes
access-control-allow-origin
*
x-goog-generation
1620242732037093
content-length
43
server
cloudflare
GET
H3
200
favicon.ico Show response
ad.doubleclick.net/
1 KB
129 B
40ms
39ms
Fetch
image/x-icon
142.251.24.149
Google LLC
General
Full URL
https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.04431650254181263
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.24.149 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
rj-in-f149.1e100.net
Software
sffe /
Resource Hash
d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options
nosniff
expires
Sun, 14 Jun 2026 12:38:49 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 13 Jun 2026 12:38:49 GMT
content-type
image/x-icon
vary
Accept-Encoding
last-modified
Tue, 08 May 2012 13:08:06 GMT
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
content-length
104
x-xss-protection
0
server
sffe
GET
H2
200
supportedLanguages Show response
translate-pa.googleapis.com/v1/ Frame 775F
35 KB
4 KB
76ms
58ms
Script
text/javascript
2001:4860:4802:32::223
Google LLC
General
Full URL
https://translate-pa.googleapis.com/v1/supportedLanguages?client=te&display_language=ja&key=AIzaSyBWDj0QJvVIx8XOhRegXX5_SrRWxhT5Hs4&callback=callback
Requested by
Host:
URL: about:srcdoc
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2001:4860:4802:32::223 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
7e7814b89942a3f9fd5b75c10616363d313d902b3ccfd19ac5ab7437cbdde013
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
private
content-encoding
gzip
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Sat, 13 Jun 2026 12:38:49 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
CP="This is not a P3P policy! See g.co/p3phelp for more info."
content-length
3117
date
Sat, 13 Jun 2026 12:38:49 GMT
x-xss-protection
0
content-type
text/javascript; charset=UTF-8
vary
Origin, X-Origin, Referer
server
ESF
x-frame-options
SAMEORIGIN
POST
H2
204
collect
analytics.google.com/g/
0
0
55ms
37ms
Fetch
text/plain
2001:4860:4802:34::181
Google LLC
General
Full URL
https://analytics.google.com/g/collect?v=2&tid=G-K68XP6D85D&gtm=45je66a1v887485693z86304663za20gzb6304663zd6304663&_p=1781354328508&_gaz=1&gcd=13l3l3l3l1l1&npa=0&dma=0&tcfd=10000&_eu=AAAAAGAC&are=1&cid=56541922.1781354330&frm=0&pscdl=noapi&rcb=19&sr=1600x1200&uaa=x86&uab=64&uafvl=Chromium%3B149.0.0.0%7CGoogle%2520Chrome%3B149.0.0.0%7CNot-A.Brand%3B24.0.0.0&uam=&uamb=0&uap=Linux&uapv=&uaw=0&ul=ja-jp&gaf=2&_s=1&tag_exp=115616985~115938465~115938469~118012008~119392696~119392704~119456239~119456247&sid=1781354329&sct=1&seg=0&dl=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F41kkjh07tibblti%2FAINCRAD%2BFF%2BINJECTOR.apk%2Ffile%3Fdkey%3Drv5x6b8wlt0%26r%3D125&dt=%F0%9F%94%A5%20%F0%9D%97%94%F0%9D%97%9C%F0%9D%97%A1%F0%9D%97%96%F0%9D%97%A5%F0%9D%97%94%F0%9D%97%97%20%F0%9D%97%A0%F0%9D%97%A2%F0%9D%97%97%F0%9D%97%A6%20%F0%9D%97%99%F0%9D%97%99%20%F0%9D%97%A0%F0%9D%97%94%F0%9D%97%AB%20%F0%9F%98%B2%20%F0%9D%97%A1%F0%9D%97%A2%20%F0%9D%97%95%F0%9D%97%94%F0%9D%97%A1%20%F0%9F%9B%A1%EF%B8%8F&en=page_view&_fv=1&_ss=1&up.page_url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F41kkjh07tibblti%2FAINCRAD%2BFF%2BINJECTOR.apk%2Ffile%3Fdkey%3Drv5x6b8wlt0%26r%3D125&tfd=2176
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-K68XP6D85D&cx=c&gtm=4e66a1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:34::181 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:196:0
report-to
{"group":"ascnsrsggc:196:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:196:0"}],}
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
https://www.mediafire.com
cross-origin-opener-policy-report-only
same-origin; report-to=ascnsrsggc:196:0
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 13 Jun 2026 12:38:49 GMT
content-type
text/plain
server
Golfe2
POST
H2
204
collect
stats.g.doubleclick.net/g/
0
550 B
50ms
38ms
Ping
text/plain
2404:6800:400b:c015::9d
Google LLC
General
Full URL
https://stats.g.doubleclick.net/g/collect?v=2&tid=G-K68XP6D85D&cid=56541922.1781354330&gtm=45je66a1v887485693z86304663za20gzb6304663zd6304663&rcb=19&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=0&tag_exp=115616985~115938465~115938469~118012008~119392696~119392704~119456239~119456247
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-K68XP6D85D&cx=c&gtm=4e66a1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:400b:c015::9d , Japan, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:164:0
report-to
{"group":"ascnsrsggc:164:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:164:0"}],}
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
https://www.mediafire.com
cross-origin-opener-policy-report-only
same-origin; report-to=ascnsrsggc:164:0
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 13 Jun 2026 12:38:49 GMT
content-type
text/plain
server
Golfe2
GET
H3
200
ga-audiences
www.google.co.jp/ads/
42 B
63 B
36ms
29ms
Image
image/gif
142.251.24.94
Google LLC
General
Full URL
https://www.google.co.jp/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-K68XP6D85D&cid=56541922.1781354330&gtm=45je66a1v887485693z86304663za20gzb6304663zd6304663&rcb=19&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=0&tag_exp=115616985~115938465~115938469~118012008~119392696~119392704~119456239~119456247&z=766191926
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.24.94 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
rj-in-f94.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
42
date
Sat, 13 Jun 2026 12:38:49 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
GET
H3
200
jellyfish.js Show response
go.ezodn.com/porpoiseant/
28 KB
8 KB
8ms
8ms
Script
application/javascript
172.67.142.121
Cloudflare
General
Full URL
https://go.ezodn.com/porpoiseant/jellyfish.js?a=a&cb=22&dcb=195-16&shcb=34
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.142.121 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
1f0eaf56b1f181194ca996ec9d07da4e006dc9e1837dcc07f7bbc3a7a6d7b7c5

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-robots-tag
noindex, follow
content-encoding
br
cf-cache-status
HIT
age
2570008
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=c903jJTub%2FJE%2F7KpYt%2F7MUdgZH1LuikFiSxIvaczgs%2F8k%2F%2FIDDiV12rY1AZaUD%2FKoam01VK6Q7FkVnZdfyO0iT1vqFbcEz2eQNydlmbnklsSOaUlVYXQyxy97R%2BD2qg%3D"}]}
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sat, 13 Jun 2026 12:38:49 GMT
x-middleton-display
sol-js
last-modified
Tue, 09 Jun 2026 12:34:36 GMT
content-type
application/javascript
vary
Accept-Encoding
priority
u=3,i=?0
cache-control
public, max-age=31536000
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray
a0b127908a737076-NRT
server
cloudflare
GET
H3
200
anchorfix.js Show response
go.ezodn.com/detroitchicago/
2 KB
1 KB
8ms
8ms
Script
application/javascript
172.67.142.121
Cloudflare
General
Full URL
https://go.ezodn.com/detroitchicago/anchorfix.js?cb=29&gcb=195-16
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.142.121 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
5b03993da08ad46dced1836ab4ae0c79e1425a3c6f807b5fdfa75798312af92c

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-robots-tag
noindex, follow
content-encoding
br
cf-cache-status
HIT
age
3083387
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=YDXLkup89YatevPmsYQOCXq%2BXbkHL2j46Ke5PFvOYiDUtX9EY8xe8zkIqkuyw%2Fjal4BB0ScvWbYwXjN0NJmxPnBA0E8o9aWppN6sivAT7IBiEM1T3mqT81L3yRIJL3w%3D"}]}
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sat, 13 Jun 2026 12:38:49 GMT
x-middleton-display
sol-js
last-modified
Sat, 16 May 2026 01:59:11 GMT
content-type
application/javascript
vary
Accept-Encoding
priority
u=3,i=?0
cache-control
public, max-age=31536000
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray
a0b127908a757076-NRT
accept-ranges
bytes
content-length
679
server
cloudflare
GET
H3
200
sidebarwall.js Show response
go.ezodn.com/detroitchicago/
9 KB
3 KB
9ms
9ms
Script
application/javascript
172.67.142.121
Cloudflare
General
Full URL
https://go.ezodn.com/detroitchicago/sidebarwall.js?gcb=16&cb=25
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.142.121 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
cb6c1a2d4e9a1239a7887de158b87d86ecbd7047e9ed8214f367406762730003

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-robots-tag
noindex, follow
content-encoding
br
cf-cache-status
HIT
age
372725
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=o8MVLxz%2FelCAtZt1lUI1jCTZn7bGhh9DNQeV4LtvU3sYdyNS35vl9Bzp3bl9T%2B2kOi2ddetgkU%2BOuuyB6KhiqqV6qXzqwrgpPA4FYbZIBubc5T9sHGOLgiQcPpcF7Jc%3D"}]}
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sat, 13 Jun 2026 12:38:49 GMT
x-middleton-display
sol-js
last-modified
Tue, 09 Jun 2026 15:00:13 GMT
content-type
application/javascript
vary
Accept-Encoding
priority
u=3,i=?0
cache-control
public, max-age=31536000
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray
a0b127908a767076-NRT
server
cloudflare
GET
H3
200
dall.js Show response
go.ezodn.com/hb/
792 KB
243 KB
10ms
10ms
Script
application/javascript
172.67.142.121
Cloudflare
General
Full URL
https://go.ezodn.com/hb/dall.js?cb=195-16-179
Requested by
Host:
URL: ez-standalone.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.142.121 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
1723c7ced14c0a75280f6ef41b3249858fe97b0f750d8fe83c00e3b1ca6d2b03

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

last-modified
Wed, 10 Jun 2026 18:01:40 GMT
cache-control
public, max-age=31536000
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-encoding
br
cf-cache-status
HIT
age
239845
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=osll1atdxPqoTGrJgYUaKJYfGbbscioKMd2ye4lCx0qv0mXTaibuGVyZd2l%2Bu7XBUrIE0AmntGVQYQfsvzpSpuZtQRVGCrspobscsx3ZHH%2BsuhR%2B7o5V4MiL5UIJqJg%3D"}]}
cf-ray
a0b127908a787076-NRT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sat, 13 Jun 2026 12:38:49 GMT
content-type
application/javascript
vary
Accept-Encoding
server
cloudflare
priority
u=1,i=?0
GET
H3
200
gpt.js Show response
securepubads.g.doubleclick.net/tag/js/
111 KB
35 KB
23ms
13ms
Script
text/javascript
142.251.23.157
Google LLC
General
Full URL
https://securepubads.g.doubleclick.net/tag/js/gpt.js
Requested by
Host:
URL: ez-standalone.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.23.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
rl-in-f157.1e100.net
Software
cafe /
Resource Hash
2a23e36756513502777f853fccedfe57bc5ffb7c25d540c1ed215b5ade49e41a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
etag
829 / 20617 / m202606090101 / config-hash: 2702882756065043728
x-content-type-options
nosniff
expires
Sat, 13 Jun 2026 12:38:49 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sat, 13 Jun 2026 12:38:49 GMT
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
content-disposition
attachment; filename="f.txt"
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
content-length
35539
x-xss-protection
0
server
cafe
GET
H3
200
kenai.js Show response
go.ezodn.com/detroitchicago/
22 KB
7 KB
10ms
10ms
Script
application/javascript
172.67.142.121
Cloudflare
General
Full URL
https://go.ezodn.com/detroitchicago/kenai.js?gcb=16&cb=2e4c23d672
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.142.121 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
6677729edaa19336effedec3661ae22bcaa33a79c41edd9db159a6d9f3901a1f

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-robots-tag
noindex, follow
content-encoding
br
cf-cache-status
HIT
age
371131
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=lSzDmL2lL9l3hVEjtBZbPsOhu5M3DrgP8xR1B8uUuUVcOqPp%2B11WT2oatZlVVGiU2%2FiX4vXYcw%2F4K3GyFpB3OEeKOcsA1GnXB8otgmpqS3CLyeEYv0%2B6D7LKh0vFFXY%3D"}]}
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sat, 13 Jun 2026 12:38:49 GMT
x-middleton-display
sol-js
last-modified
Tue, 09 Jun 2026 19:55:25 GMT
content-type
application/javascript
vary
Accept-Encoding
priority
u=3,i=?0
cache-control
public, max-age=31536000
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray
a0b127908a797076-NRT
server
cloudflare
GET
H3
200
portland.js Show response
go.ezodn.com/detroitchicago/
366 KB
76 KB
34ms
34ms
Script
application/javascript
172.67.142.121
Cloudflare
General
Full URL
https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.142.121 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
f4160beaedaafd7b8b2218473f2ea847bf3f385cf9df106f06132d2afdb9b1b7

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-robots-tag
noindex, follow
content-encoding
br
cf-cache-status
HIT
age
124887
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=COKX%2F%2F%2Fmwda6eWYGvVvznrEPBLp%2FhBFoq3gsY89qXKTHFapCjY37qqAhuSBPR%2Buj8helTfxMJ8NBZI5Fm5BGgZ53htkRvnmjzlycig7oUuM3H8C9PsNrdFnzyVXQwn8%3D"}]}
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sat, 13 Jun 2026 12:38:49 GMT
x-middleton-display
sol-js
last-modified
Sat, 13 Jun 2026 00:02:42 GMT
content-type
application/javascript
vary
Accept-Encoding
priority
u=3,i=?0
cache-control
public, max-age=31536000
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray
a0b127908a7a7076-NRT
server
cloudflare
GET
H3
200
ezadloadrewarded.js Show response
go.ezodn.com/porpoiseant/
294 KB
70 KB
10ms
10ms
Script
application/javascript
172.67.142.121
Cloudflare
General
Full URL
https://go.ezodn.com/porpoiseant/ezadloadrewarded.js?cb=1113&gcb=195-16
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.142.121 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2fefe95d72c358e17861e136a809e2ae3a6359cd23f8f008a31d05f724ef0889

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-robots-tag
noindex, follow
content-encoding
br
cf-cache-status
HIT
age
48870
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=60UMH6wFd08y6JwEETlbhrbi6lbrshOU75pAyZguH1qYhHMJISWEc9jQxYv%2BIpeTiB37FyZI5NKV7CF1jZzBU8sAWJbkQ3fHzUy2Gnlg7jVvCQ1OJvvKZtqj9N45Rpc%3D"}]}
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sat, 13 Jun 2026 12:38:49 GMT
x-middleton-display
sol-js
last-modified
Fri, 12 Jun 2026 23:04:19 GMT
content-type
application/javascript
vary
Accept-Encoding
priority
u=3,i=?0
cache-control
public, max-age=31536000
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray
a0b127908a7b7076-NRT
server
cloudflare
GET
H3
200
reportads.js Show response
go.ezodn.com/detroitchicago/
6 KB
2 KB
10ms
9ms
Script
application/javascript
172.67.142.121
Cloudflare
General
Full URL
https://go.ezodn.com/detroitchicago/reportads.js?gcb=195-16&cb=8
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.142.121 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
36ef51309485a22f2c3dfc9b3ec7249384174589bdbb6c62062137c91bdbd1d9

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-robots-tag
noindex, follow
content-encoding
br
cf-cache-status
HIT
age
591350
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=Fm4cDvhupfpKW1JIKtjW%2FuK8ZvTwSzFHsHjmgQ5WydJmBkfLiqcKzJes4anrP4vkUZvLpYgMrBkq5QDpo3%2FWOCqMTAqAOsG%2F5Nh%2Fuw1qk0Y0l9eWxO21WUQaa1jc%2FAc%3D"}]}
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sat, 13 Jun 2026 12:38:49 GMT
x-middleton-display
sol-js
last-modified
Tue, 09 Jun 2026 06:18:06 GMT
content-type
application/javascript
vary
Accept-Encoding
priority
u=3,i=?0
cache-control
public, max-age=31536000
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray
a0b127908a7d7076-NRT
server
cloudflare
GET
H2
200
21150.js Show response
link.rubiconproject.com/magnite/
1 KB
855 B
70ms
3ms
Script
text/javascript
2600:140b:1c00:38a::2300
AKAMAI-ASN1 Akama...
General
Full URL
https://link.rubiconproject.com/magnite/21150.js
Requested by
Host:
URL: ez-standalone.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:140b:1c00:38a::2300 Tokyo, Japan, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software
Apache/2.4.65 (Debian) PHP/8.3.24 OpenSSL/3.5.1 / PHP/8.3.24
Resource Hash
3a9f306824d6e118cf7248a9331b18520750b67af9096c6cb7b026651b419d3b

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
max-age=27057
content-encoding
gzip
expires
Sat, 13 Jun 2026 20:09:46 GMT
content-length
636
date
Sat, 13 Jun 2026 12:38:49 GMT
last-modified
Wed, 19 Nov 2025 14:07:59 GMT
x-powered-by
PHP/8.3.24
server
Apache/2.4.65 (Debian) PHP/8.3.24 OpenSSL/3.5.1
content-type
text/javascript;charset=UTF-8
vary
Accept-Encoding
GET
H3
200
ezoic.png
go.ezodn.com/utilcave_com/
1 KB
2 KB
10ms
10ms
Image
image/png
172.67.142.121
Cloudflare
General
Full URL
https://go.ezodn.com/utilcave_com/ezoic.png
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.142.121 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
07a54e49f65745ec3e0c0bfec9c0005b787370f8f65476b8da936e14d9ceaaa1

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cf-cache-status
HIT
age
44260
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=f096hx21FegglHer7G4MzSuaQIcAdVUDs3UL79x5a2oLQ5QJKAMz0Tf6lhUeSo4fztx5mnFiglXfUB1xXHvOWytJ5n2Y6UEA2LKqaPQv%2FLQLEpT8Vvq5wCqvDT894Qo%3D"}]}
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sat, 13 Jun 2026 12:38:49 GMT
last-modified
Sat, 13 Jun 2026 00:21:11 GMT
content-type
image/png
vary
Accept-Encoding
priority
u=3,i
cache-control
public, max-age=86400
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray
a0b127908a7e7076-NRT
accept-ranges
bytes
content-length
1426
server
cloudflare
GET
H2
200
olathe.js Show response
g.ezoic.net/parsonsmaize/
2 KB
957 B
73ms
71ms
Script
application/javascript
2406:da18:9d0:143f:2124:4e9c:36a9:d9de
Amazon.com
General
Full URL
https://g.ezoic.net/parsonsmaize/olathe.js?gcb=195-16&cb=30
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2406:da18:9d0:143f:2124:4e9c:36a9:d9de Singapore, Singapore, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
/
Resource Hash
8af2d4d39123c52a7c0ab7f7e4fbf96c5bfeb969ccce59ceb2bc7c96a7624f2b

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-robots-tag
noindex, follow
cache-control
max-age=31536000, public
content-encoding
br
date
Sat, 13 Jun 2026 12:38:49 GMT
x-middleton-display
sol-js
content-type
application/javascript
vary
Accept-Encoding
GET
H2
200
et.js Show response
g.ezoic.net/porpoiseant/
2 KB
655 B
74ms
72ms
Script
application/javascript
2406:da18:9d0:143f:2124:4e9c:36a9:d9de
Amazon.com
General
Full URL
https://g.ezoic.net/porpoiseant/et.js?gcb=195-16&cb=4
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2406:da18:9d0:143f:2124:4e9c:36a9:d9de Singapore, Singapore, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
/
Resource Hash
8fb0902cb2d17d83fa68fa9a81a2e2872675c67bac55f2aced4aa2c5540f6655

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-robots-tag
noindex, follow
cache-control
max-age=31536000, public
content-encoding
br
content-length
624
date
Sat, 13 Jun 2026 12:38:49 GMT
x-middleton-display
sol-js
content-type
application/javascript
vary
Accept-Encoding
GET
H2
200
reno.js Show response
g.ezoic.net/detroitchicago/
2 KB
807 B
74ms
71ms
Script
application/javascript
2406:da18:9d0:143f:2124:4e9c:36a9:d9de
Amazon.com
General
Full URL
https://g.ezoic.net/detroitchicago/reno.js?gcb=195-16&cb=0bf9e049ca
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2406:da18:9d0:143f:2124:4e9c:36a9:d9de Singapore, Singapore, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
/
Resource Hash
c03c74e3dfa5656dcd9841f61549cec816a1b2ec377dcc439761ca77a46ab1e2

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-robots-tag
noindex, follow
cache-control
max-age=31536000, public
content-encoding
br
date
Sat, 13 Jun 2026 12:38:49 GMT
x-middleton-display
sol-js
content-type
application/javascript
vary
Accept-Encoding
GET
H2
200
overlandpark.js Show response
g.ezoic.net/detroitchicago/
1 KB
522 B
74ms
72ms
Script
application/javascript
2406:da18:9d0:143f:2124:4e9c:36a9:d9de
Amazon.com
General
Full URL
https://g.ezoic.net/detroitchicago/overlandpark.js?gcb=195-16&cb=301bbdaf04
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2406:da18:9d0:143f:2124:4e9c:36a9:d9de Singapore, Singapore, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
/
Resource Hash
ac5a4a0937632f257b63ebd53a656fd045529bc506cf4abb880bec8421e8eb60

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-robots-tag
noindex, follow
cache-control
max-age=31536000, public
content-encoding
br
content-length
491
date
Sat, 13 Jun 2026 12:38:49 GMT
x-middleton-display
sol-js
content-type
application/javascript
vary
Accept-Encoding
GET
H2
200
denver.js Show response
g.ezoic.net/detroitchicago/
2 KB
1 KB
74ms
72ms
Script
application/javascript
2406:da18:9d0:143f:2124:4e9c:36a9:d9de
Amazon.com
General
Full URL
https://g.ezoic.net/detroitchicago/denver.js?gcb=195-16&cb=4ff75c6f00
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2406:da18:9d0:143f:2124:4e9c:36a9:d9de Singapore, Singapore, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
/
Resource Hash
dc987a618ea91a37323b1432cfef45dba1292483a0d5e75e8f2cb05b45f64e4f

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-robots-tag
noindex, follow
cache-control
max-age=31536000, public
content-encoding
br
date
Sat, 13 Jun 2026 12:38:49 GMT
x-middleton-display
sol-js
content-type
application/javascript
vary
Accept-Encoding
GET
H2
200
wichita.js Show response
g.ezoic.net/detroitchicago/
2 KB
982 B
75ms
73ms
Script
application/javascript
2406:da18:9d0:143f:2124:4e9c:36a9:d9de
Amazon.com
General
Full URL
https://g.ezoic.net/detroitchicago/wichita.js?gcb=195-16&cb=e49d8d9bca
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2406:da18:9d0:143f:2124:4e9c:36a9:d9de Singapore, Singapore, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
/
Resource Hash
b837449c7254dd5887b620b7903bb4dbafbf2424ae3eb25e7a9f3471ff105365

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-robots-tag
noindex, follow
cache-control
max-age=31536000, public
content-encoding
br
date
Sat, 13 Jun 2026 12:38:49 GMT
x-middleton-display
sol-js
content-type
application/javascript
vary
Accept-Encoding
GET
H2
200
vitals.js Show response
g.ezoic.net/tardisrocinante/
11 KB
4 KB
75ms
73ms
Script
application/javascript
2406:da18:9d0:143f:2124:4e9c:36a9:d9de
Amazon.com
General
Full URL
https://g.ezoic.net/tardisrocinante/vitals.js?gcb=16&cb=5
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2406:da18:9d0:143f:2124:4e9c:36a9:d9de Singapore, Singapore, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
/
Resource Hash
0a9da3cf7efd1a7499a1c888d44ab103ca6c92a9ab354e17e146384b39cead50

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-robots-tag
noindex, follow
cache-control
max-age=31536000, public
content-encoding
br
date
Sat, 13 Jun 2026 12:38:49 GMT
x-middleton-display
sol-js
content-type
application/javascript
vary
Accept-Encoding
GET
H2
200
chanute.js Show response
g.ezoic.net/parsonsmaize/
21 KB
5 KB
75ms
74ms
Script
application/javascript
2406:da18:9d0:143f:2124:4e9c:36a9:d9de
Amazon.com
General
Full URL
https://g.ezoic.net/parsonsmaize/chanute.js?a=a&cb=19&dcb=195-16&shcb=34
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2406:da18:9d0:143f:2124:4e9c:36a9:d9de Singapore, Singapore, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
/
Resource Hash
e12bc1fca47f992f263407fdc0b3d6cb30d860ab0ed5e93a662387174e597d7b

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-robots-tag
noindex, follow
cache-control
max-age=31536000, public
content-encoding
br
date
Sat, 13 Jun 2026 12:38:49 GMT
x-middleton-display
sol-js
content-type
application/javascript
vary
Accept-Encoding
GET
H2
200
jellyfish.js Show response
g.ezoic.net/porpoiseant/
28 KB
7 KB
76ms
74ms
Script
application/javascript
2406:da18:9d0:143f:2124:4e9c:36a9:d9de
Amazon.com
General
Full URL
https://g.ezoic.net/porpoiseant/jellyfish.js?a=a&cb=22&dcb=195-16&shcb=34
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2406:da18:9d0:143f:2124:4e9c:36a9:d9de Singapore, Singapore, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
/
Resource Hash
1f0eaf56b1f181194ca996ec9d07da4e006dc9e1837dcc07f7bbc3a7a6d7b7c5

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-robots-tag
noindex, follow
cache-control
max-age=31536000, public
content-encoding
br
date
Sat, 13 Jun 2026 12:38:49 GMT
x-middleton-display
sol-js
content-type
application/javascript
vary
Accept-Encoding
GET
H3
200
pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202606090101/
603 KB
189 KB
6ms
6ms
Script
text/javascript
142.251.23.157
Google LLC
General
Full URL
https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202606090101/pubads_impl.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.23.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
rl-in-f157.1e100.net
Software
cafe /
Resource Hash
7464e0ac888a78474a72e61d604a76946c2fa2854a0ae3b3d060040edd8630cc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
etag
2613404238777948273
age
2976
x-content-type-options
nosniff
expires
Sun, 13 Jun 2027 11:49:13 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sat, 13 Jun 2026 11:49:13 GMT
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
cache-control
public, immutable, max-age=31536000
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
content-length
193975
x-xss-protection
0
server
cafe
GET
H2
404
0 Show response
www.mediafiredls.com/onclick/
5 B
522 B
18ms
4ms
XHR
text/plain
2606:4700:20::681a:3ad
Cloudflare
General
Full URL
https://www.mediafiredls.com/onclick/0
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:3ad -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
c6c094bc0054f9cbe34102ff49f86b3928b5ac09f3d2ac87e170d0500675921f
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=m5XLSwzktRfkM26YqUKCmnrmRHoyICuwjG1a2JXkE9aYgBBb%2BuikE0%2F4%2FUYJKwJTksEBfINx4poruDfNn22R0e5nOhuwjqYmGq31f29MrdFa1KKYWbLF8uLn7Q1R%2FeHAUl%2BEY58QMJLv9nZsoLtyL7%2Fx"}]}
referrer-policy
same-origin
cf-ray
a0b127920d92d77f-NRT
expires
Thu, 01 Jan 1970 00:00:01 GMT
access-control-allow-origin
*
content-length
5
date
Sat, 13 Jun 2026 12:38:49 GMT
content-type
text/plain
server
cloudflare
x-frame-options
SAMEORIGIN
OPTIONS
H2
200
json
gum.criteo.com/sid/ Frame
0
0
47ms
2ms
Preflight
application/json
2406:2600:4::13
Criteo APAC
General
Full URL
https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.mediafire.com%2F&domain=www.mediafire.com&cw=1&lsw=1&gdpr=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2406:2600:4::13 , Japan, ASN55569 (CRITEO-AS-AP - Criteo APAC, JP),
Reverse DNS
Software
Kestrel /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
GET
Origin
https://www.mediafire.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
content-type
access-control-allow-methods
GET
access-control-allow-origin
https://www.mediafire.com
cache-control
no-cache, no-store, must-revalidate
content-encoding
gzip
content-type
application/json; charset=utf-8
date
Sat, 13 Jun 2026 12:38:49 GMT
expires
0
pragma
no-cache
server
Kestrel
server-processing-duration-in-ticks
215365
strict-transport-security
max-age=31536000; preload;
vary
Accept-Encoding
GET
H3
200
indy.js Show response
go.ezodn.com/detroitchicago/
347 KB
95 KB
9ms
8ms
Script
application/javascript
172.67.142.121
Cloudflare
General
Full URL
https://go.ezodn.com/detroitchicago/indy.js?cb=125&gcb=0
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.142.121 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
79c11813ce33697436f915958c84f8e219608cacf74158e1fdb347c32342f067

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-robots-tag
noindex, follow
content-encoding
br
cf-cache-status
HIT
age
124884
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=V23gbehoFlTFHjNoVSaZPB9Sfpb09jbN9%2BBzcfROc6bn3TdkBb%2BTIdQGaiuemPFLtMsLFXFGblrq1Mnp9PmM9qzuIc%2BHD5QhMQGobPwOKIQhH5L1jk5DFGvyWcZ7cP4%3D"}]}
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sat, 13 Jun 2026 12:38:49 GMT
x-middleton-display
sol-js
last-modified
Fri, 12 Jun 2026 01:57:25 GMT
content-type
application/javascript
vary
Accept-Encoding
priority
u=3,i=?0
cache-control
public, max-age=31536000
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray
a0b127925aa57076-NRT
server
cloudflare
GET
H2
200
latest.json Show response
cdn.jsdelivr.net/gh/prebid/currency-file@1/
2 KB
1 KB
14ms
3ms
Fetch
application/json
2a04:4e42::485
Fastly
General
Full URL
https://cdn.jsdelivr.net/gh/prebid/currency-file@1/latest.json
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-16-179
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42::485 , United States, ASN54113 (FASTLY - Fastly, Inc., US),
Reverse DNS
Software
/
Resource Hash
b6197626a798e196b76a19dd8a211666d8305affab15261747755056235c703e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
content-type
text/plain
sec-ch-ua-mobile
?0

Response headers

access-control-expose-headers
*
content-encoding
br
etag
W/"60b-T2h3JJtm7SY9auC3luSesyZtlso"
age
34670
x-content-type-options
nosniff
x-jsd-version-type
version
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-cache
HIT, HIT
date
Sat, 13 Jun 2026 12:38:49 GMT
content-type
application/json; charset=utf-8
x-served-by
cache-fra-etou8220102-FRA, cache-nrt-rjtt7900069-NRT
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
public, max-age=604800, s-maxage=43200
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
content-length
797
x-jsd-version
1.0.2821
GET
H2
200
envelope Show response
lexicon.33across.com/v1/
1 KB
2 KB
529ms
171ms
Fetch
application/json
37.19.206.163
CDN77 Datacamp Li...
General
Full URL
https://lexicon.33across.com/v1/envelope?pid=0010b00002MpnPqAAJ&gdpr=0&src=pbjs&ver=10.23.0&coppa=0
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-16-179
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
37.19.206.163 Ashburn, United States, ASN60068 (CDN77 Datacamp Limited, GB),
Reverse DNS
unn-37-19-206-163.datapacket.com
Software
/
Resource Hash
7bb75772b56f70600178314460caa184424aa0314b54a534769d0f9f02e8dcde

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
content-type
text/plain
sec-ch-ua-mobile
?0

Response headers

access-control-allow-origin
https://www.mediafire.com
content-length
1528
content-type
application/json
vary
origin
access-control-allow-credentials
true
GET
H2
200
set Show response
id.a-mx.com/
Redirect Chain
  • https://id.a-mx.com/sync/?tagId=&ref=null&u=https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125&tl=https://www.mediafire.com/file/41kkjh07tibblti/AINC...
  • https://c3.a-mo.net/b?uid=f3595a37%2D4a9d%2D4b24%2D9cd9%2D94bf18e66c2c&sh=id%2Ea%2Dmx%2Ecom&gdpr=0&
  • https://id.a-mx.com/set?oid=f3595a37-4a9d-4b24-9cd9-94bf18e66c2c&uid=f3595a37-4a9d-4b24-9cd9-94bf18e66c2c&
99 B
870 B
67ms
66ms
Fetch
application/json
2400:52e0:1500::1180:1
BunnyCDN BUNNYWAY
General
Full URL
https://id.a-mx.com/set?oid=f3595a37-4a9d-4b24-9cd9-94bf18e66c2c&uid=f3595a37-4a9d-4b24-9cd9-94bf18e66c2c&
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H2
Server
2400:52e0:1500::1180:1 , Singapore, ASN200325 (BunnyCDN BUNNYWAY, informacijske storitve d.o.o., SI),
Reverse DNS
Software
BunnyCDN-SG1-1180 /
Resource Hash
789a0b260659565f639a7079d607c835feac8fde7413014ed6255a81e989cee4

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

cdn-status
200
date
Sat, 13 Jun 2026 12:38:50 GMT
cdn-cache
BYPASS
content-type
application/json
cdn-cachedat
06/13/2026 12:38:50
cdn-requestpullcode
200
cache-control
public, max-age=0
cdn-requestpullsuccess
True
cdn-requesttime
0
cdn-requestid
7a068376f2cf65c76e81e552231307f8
access-control-allow-credentials
true
cdn-pullzone
5497800
cdn-proxyver
1.57
access-control-allow-origin
null
content-length
99
cdn-edgestorageid
782
server
BunnyCDN-SG1-1180
cdn-requestcountrycode
JP

Redirect headers

cdn-status
302
date
Sat, 13 Jun 2026 12:38:50 GMT
cdn-cache
BYPASS
cdn-cachedat
06/13/2026 12:38:50
cdn-requestpullcode
302
cache-control
public, max-age=0
location
https://id.a-mx.com/set?oid=f3595a37-4a9d-4b24-9cd9-94bf18e66c2c&uid=f3595a37-4a9d-4b24-9cd9-94bf18e66c2c&
cdn-requestpullsuccess
True
cdn-requestid
a275421e6a687992be95029b7c8582b2
access-control-allow-credentials
true
cdn-pullzone
5497800
cdn-proxyver
1.57
cdn-requesttime
0
access-control-allow-origin
null
content-length
0
cdn-edgestorageid
988
server
BunnyCDN-SG1-869
cdn-requestcountrycode
JP
GET
H2
400
fed Show response
ups.analytics.yahoo.com/ups/58713/
0
416 B
486ms
203ms
Fetch
application/json
2406:2000:a4:807::
internet content ...
General
Full URL
https://ups.analytics.yahoo.com/ups/58713/fed?v=1&1p=0&gdpr=0&gdpr_consent=&us_privacy=&url=https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file&pixelId=58713
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-16-179
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2406:2000:a4:807:: , Taiwan, ASN10230 (YAHOO-SG - internet content provider, SG),
Reverse DNS
Software
ATS /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
content-type
text/plain
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=31536000
age
0
access-control-allow-credentials
true
x-content-type-options
nosniff
referrer-policy
no-referrer-when-downgrade
access-control-allow-origin
https://www.mediafire.com
content-length
0
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date
Sat, 13 Jun 2026 12:38:50 GMT
content-type
application/json
vary
Origin
server
ATS
GET
H2
200
sid Show response
mug.criteo.com/
Redirect Chain
  • https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.mediafire.com%2F&domain=www.mediafire.com&cw=1&lsw=1&gdpr=0
  • https://mug.criteo.com/sid?cpp=e486NnwvTW84QUh2V3JsSTRUWEF4aTJtVEtjTmdVZjFiYVFJbHJ2YWI5ZS9XU3cwSDNXUGQrcndTTUhmeDhjN0orTGpqQ0RObGttaEZGVUhvZGVlSzR2VE8zN25PQU5FSFFkQ2tiOXptR0t5OWJpZWhNTXozRmdnbWxIcG...
365 B
936 B
8ms
3ms
Fetch
application/json
182.161.74.19
Criteo APAC
General
Full URL
https://mug.criteo.com/sid?cpp=e486NnwvTW84QUh2V3JsSTRUWEF4aTJtVEtjTmdVZjFiYVFJbHJ2YWI5ZS9XU3cwSDNXUGQrcndTTUhmeDhjN0orTGpqQ0RObGttaEZGVUhvZGVlSzR2VE8zN25PQU5FSFFkQ2tiOXptR0t5OWJpZWhNTXozRmdnbWxIcG9OTUFjQ0VxdzZIaGR6eFJmWjMvNnJOaVlyc1JQaGZBWnBEYmIvR1BySjh6SktXeTBCSHEvUmw2QlhueHF6UGFMTVU0QnR3dGE5OHBiMlBPKzZkZXFvNW9zNi9XZHA3MjZMUmFpMEgxTlF6bkcvQmRjeFJXalRIMlVTbnhid1JmaTdXRUc4NVRZfA&cppv=2
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H2
Server
182.161.74.19 , Singapore, ASN55569 (CRITEO-AS-AP - Criteo APAC, JP),
Reverse DNS
Software
Kestrel /
Resource Hash
d72fa312a40a9aa7e847e5c2dbd6babdb6cb567992ff2d1c83c4baf833ff9687
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

strict-transport-security
max-age=31536000; preload;
cache-control
no-cache, no-store, must-revalidate
content-encoding
gzip
pragma
no-cache
access-control-allow-credentials
true
access-control-allow-methods
GET
server-processing-duration-in-ticks
434143
expires
0
access-control-allow-origin
null
date
Sat, 13 Jun 2026 12:38:50 GMT
content-type
application/json; charset=utf-8
vary
Accept-Encoding
server
Kestrel

Redirect headers

strict-transport-security
max-age=31536000; preload;
cache-control
no-cache, no-store, must-revalidate
location
https://mug.criteo.com/sid?cpp=e486NnwvTW84QUh2V3JsSTRUWEF4aTJtVEtjTmdVZjFiYVFJbHJ2YWI5ZS9XU3cwSDNXUGQrcndTTUhmeDhjN0orTGpqQ0RObGttaEZGVUhvZGVlSzR2VE8zN25PQU5FSFFkQ2tiOXptR0t5OWJpZWhNTXozRmdnbWxIcG9OTUFjQ0VxdzZIaGR6eFJmWjMvNnJOaVlyc1JQaGZBWnBEYmIvR1BySjh6SktXeTBCSHEvUmw2QlhueHF6UGFMTVU0QnR3dGE5OHBiMlBPKzZkZXFvNW9zNi9XZHA3MjZMUmFpMEgxTlF6bkcvQmRjeFJXalRIMlVTbnhid1JmaTdXRUc4NVRZfA&cppv=2
pragma
no-cache
access-control-allow-credentials
true
access-control-allow-methods
GET
server-processing-duration-in-ticks
359506
expires
0
access-control-allow-origin
https://www.mediafire.com
content-length
0
date
Sat, 13 Jun 2026 12:38:49 GMT
server
Kestrel
GET
H2
200
d9core Show response
d9.flashtalking.com/
11 KB
11 KB
42ms
7ms
Script
application/javascript
35.74.31.108
Amazon.com
General
Full URL
https://d9.flashtalking.com/d9core
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-16-179
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.74.31.108 Tokyo, Japan, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-35-74-31-108.ap-northeast-1.compute.amazonaws.com
Software
Apache/2.4.66 (Amazon Linux) OpenSSL/3.5.5 /
Resource Hash
79ddd28426bb771b99d42145307e5c9fe7a0fdf39fabb5f8dbcb154215969fd8

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
private, must-revalidate, proxy-revalidate, max-age=172800
etag
5bc31bf7d4a298e1bef9d35fce222bfc
access-control-allow-credentials
true
access-control-allow-methods
GET,POST,SERVER
access-control-allow-origin
d9.flashtalking.com
p3p
policyref="localhost/w3c/D9_p3p_.xml", CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"
date
Sat, 13 Jun 2026 12:38:50 GMT
content-type
application/javascript;charset=utf-8
server
Apache/2.4.66 (Amazon Linux) OpenSSL/3.5.5
GET
H2
200
pbhid Show response
id.hadron.ad.gt/api/v1/
2 B
271 B
164ms
121ms
Fetch
application/json
2606:4700:10::ac42:949f
Cloudflare
General
Full URL
https://id.hadron.ad.gt/api/v1/pbhid?partner_id=524&_it=prebid&t=1&src=id&domain=www.mediafire.com&gdpr=0
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-16-179
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac42:949f -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
content-type
text/plain
sec-ch-ua-mobile
?0

Response headers

cache-control
max-age=604800
cf-cache-status
DYNAMIC
access-control-allow-credentials
true
access-control-allow-methods
HEAD,GET,POST,PUT,DELETE,OPTIONS
cf-ray
a0b12792cd01817d-NRT
access-control-allow-origin
*
content-length
2
date
Sat, 13 Jun 2026 12:38:50 GMT
content-type
application/json; charset=utf8
server
cloudflare
access-control-allow-headers
authorization,content-type
POST
H2
200
prebid Show response
id5-sync.com/api/config/
194 B
654 B
693ms
223ms
Fetch
application/json
135.125.170.104
OVH OVH SAS
General
Full URL
https://id5-sync.com/api/config/prebid
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-16-179
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
135.125.170.104 , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS
ns3270128.ip-135-125-170.eu
Software
/
Resource Hash
446a24acf9272b37cf14bf847684201154b6648113a148f1381b7489db6294f3
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
Content-Type
text/plain;charset=UTF-8
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
content-encoding
gzip
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
p3p
CP="CAO PSA OUR"
date
Sat, 13 Jun 2026 12:38:50 GMT
content-type
application/json;charset=UTF-8
vary
origin,access-control-request-method,access-control-request-headers,accept-encoding
GET
H2
200
id5PrebidModule.js Show response
cdn.id5-sync.com/api/1.0/
100 KB
29 KB
13ms
9ms
Script
text/javascript
2606:4700:10::ac42:a937
Cloudflare
General
Full URL
https://cdn.id5-sync.com/api/1.0/id5PrebidModule.js
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-16-179
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac42:a937 -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
5adfa8fdf36805dec0395a90e3347559da75fe8fc8830c48e22c94b18f8d9753
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-amz-id-2
cZ5TsP6kWvRLHdpTpKs3OI/traEdtIVcIN/zISuv3fypJwHH7gCX2g05Wo6dCrMmsGiggpwdC1oF10x6wRNIRZZuz2p94lqEkjemeOhqveU=
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=3600
content-encoding
br
cf-cache-status
HIT
etag
W/"dc5fa4f92eff1fb575f1de07a68916ea"
age
1831
x-amz-request-id
RSJC0M4GERV8JFBE
cf-ray
a0b1279298f749f9-NRT
date
Sat, 13 Jun 2026 12:38:50 GMT
content-type
text/javascript;charset=utf-8
last-modified
Wed, 18 Mar 2026 12:22:23 GMT
server
cloudflare
x-amz-server-side-encryption
AES256
GET
H2
204
envelope Show response
api.rlcdn.com/api/identity/
0
261 B
182ms
152ms
Fetch
34.107.165.188
Google LLC
General
Full URL
https://api.rlcdn.com/api/identity/envelope?pid=14067
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-16-179
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.107.165.188 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS
188.165.107.34.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
content-type
text/plain
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, no-store
timing-allow-origin
*
access-control-allow-credentials
true
access-control-allow-methods
GET, OPTIONS
via
1.1 google
access-control-allow-origin
https://www.mediafire.com
alt-svc
h3=":443"; ma=2592000
date
Sat, 13 Jun 2026 12:38:50 GMT
access-control-allow-headers
Accept, Authorization, Content-Type, Cookie, Origin, X-Requested-With
GET

id
id.crwdcntrl.net/
0
0


GET
H2
200
UCookieSetPug Show response
image6.pubmatic.com/AdServer/
0
269 B
42ms
8ms
Fetch
text/html
207.65.34.81
PubMatic
General
Full URL
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=5&p=156983&publisherId=156983&gdpr=0&gdpr_consent=&src=pbjs_uid&ver=1&coppa=0&us_privacy=&gpp=&gpp_sid=
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-16-179
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
207.65.34.81 , United States, ASN62713 (AS-PUBMATIC - PubMatic, Inc., US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=16070400; includeSubDomains

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
content-type
text/plain
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=16070400; includeSubDomains
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
0
date
Sat, 13 Jun 2026 12:38:50 GMT
content-type
text/html; charset=UTF-8
GET
H2
200
fpc Show response
at.teads.tv/
56 B
492 B
30ms
11ms
Fetch
text/plain
151.101.130.132
Fastly
General
Full URL
https://at.teads.tv/fpc?analytics_tag_id=PUB_13877&tfpvi=&gdpr_consent=&gdpr_status=0&gdpr_reason=0&ccpa_consent=&sv=prebid-v1
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-16-179
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.130.132 , United States, ASN54113 (FASTLY - Fastly, Inc., US),
Reverse DNS
Software
/
Resource Hash
f478d280d06f28fd8e5fc61c4cf0fcbd650da49b1954f4a1dfa88723e29ffa7c
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
content-type
text/plain
sec-ch-ua-mobile
?0

Response headers

x-check-cacheable
NO
x-cache
MISS
date
Sat, 13 Jun 2026 12:38:50 GMT
content-type
text/plain; charset=UTF-8
x-served-by
cache-nrt-rjaa8190049-NRT
x-cache-hits
0
x-u
/fpc?analytics_tag_id=PUB_13877&tfpvi=&gdpr_consent=&gdpr_status=0&gdpr_reason=0&ccpa_consent=&sv=prebid-v1
x-b
ylOjgn7Xd9Ovs8YIkDlH51--F_at_apne1_teads_tv
strict-transport-security
max-age=300
vary
Accept-Encoding
cache-control
max-age=0, no-cache, no-store
x-timer
S1781354330.055331,VS0,VE8
access-control-allow-credentials
true
via
1.1 varnish
x-ff
146.70.201.96
accept-ranges
bytes
access-control-allow-origin
https://www.mediafire.com
content-length
56
traffic-path
TKDC2
GET
H2
200
rid Show response
match.adsrvr.org/track/
109 B
574 B
22ms
4ms
Fetch
application/json
3.33.220.150
Amazon.com
General
Full URL
https://match.adsrvr.org/track/rid?ttd_pid=muno13d&fmt=json
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-16-179
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.33.220.150 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
a12b7a488abeaa9e4.awsglobalaccelerator.com
Software
Kestrel /
Resource Hash
b2e52ac1d50555583c8124e598f510f48a937f7427b5161bfcce214ba687645d

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
content-type
text/plain
sec-ch-ua-mobile
?0

Response headers

cache-control
private
content-encoding
gzip
access-control-allow-credentials
true
expires
Mon, 13 Jul 2026 12:38:50 GMT
access-control-allow-origin
https://www.mediafire.com
date
Sat, 13 Jun 2026 12:38:50 GMT
content-type
application/json
vary
Origin,Accept-Encoding
server
Kestrel
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept, x-integration-type
GET
H2
200
script Show response
carbon-cdn.ccgateway.net/
33 KB
33 KB
579ms
163ms
Script
text/javascript
34.224.42.28
Amazon.com
General
Full URL
https://carbon-cdn.ccgateway.net/script?id=www.mediafire.com&parentId=0dae949f4b
Requested by
Host: link.rubiconproject.com
URL: https://link.rubiconproject.com/magnite/21150.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.224.42.28 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-224-42-28.compute-1.amazonaws.com
Software
/
Resource Hash
99a1838e99f86fb86e3fbbef8719ebd9fc0a8632781bdc9c6c8cb72d5a195f9d

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
private,max-age=900
content-length
33396
date
Sat, 13 Jun 2026 12:38:50 GMT
content-type
text/javascript; charset=utf-8
GET
H2
200
partnerpixels Show response
cm.g.doubleclick.net/ Frame 98C5
41 B
232 B
53ms
40ms
Document
text/html
142.251.24.154
Google LLC
General
Full URL
https://cm.g.doubleclick.net/partnerpixels?gdpr=0&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F41kkjh07tibblti%2FAINCRAD%2BFF%2BINJECTOR.apk%2Ffile%3Fdkey%3Drv5x6b8wlt0%26r%3D125
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202606090101/pubads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.24.154 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
rj-in-f154.1e100.net
Software
HTTP server (unknown) /
Resource Hash
a09179dd962df38a01440ce2e4748c37bd832fe1ac2f65ad974490a89d63d129
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.mediafire.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Linux"

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding
gzip
content-length
48
content-type
text/html; charset=UTF-8
date
Sat, 13 Jun 2026 12:38:50 GMT
referrer-policy
origin
server
HTTP server (unknown)
x-xss-protection
0
GET
H2
200
esp.js Show response
oa.openxcdn.net/
24 KB
8 KB
22ms
7ms
Script
application/javascript
34.102.146.192
Google LLC
General
Full URL
https://oa.openxcdn.net/esp.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202606090101/pubads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.102.146.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS
192.146.102.34.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-goog-metageneration
1
content-encoding
gzip
x-goog-hash
crc32c=f21hYg==, md5=31VCuIvA42jGmZdUpbniug==
etag
"df5542b88bc0e368c6999754a5b9e2ba"
age
4398
x-goog-stored-content-encoding
gzip
expires
Sun, 13 Jun 2027 11:25:32 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length
7927
date
Sat, 13 Jun 2026 11:25:32 GMT
last-modified
Thu, 27 May 2021 18:30:51 GMT
content-type
application/javascript
x-guploader-uploadid
AJ5rDhEHGoFxZFu7bjX7RM2TdHS9uZX4pXiMwiW5SZW65teGcfFvoirOGNJNU0gMrQ-M-enV
cache-control
no-transform
x-goog-storage-class
MULTI_REGIONAL
accept-ranges
bytes
x-goog-generation
1622140251693895
content-length
7927
server
UploadServer
GET
H2
200
sync.min.js Show response
tags.crwdcntrl.net/lt/c/16589/
45 KB
14 KB
19ms
5ms
Script
text/javascript
3.173.219.76
Amazon.com
General
Full URL
https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202606090101/pubads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.173.219.76 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-3-173-219-76.nrt20.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
59f4e0057c651cb962d4637e70ff0d239f2b9c2cf4b31345d0145e03320b5b5a

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

vary
Accept-Encoding
cache-control
public, max-age=86400
content-encoding
gzip
etag
W/"16a2c198855d5eacecb864b94a4e05ff"
age
64502
via
1.1 5b91740058de4472c524cbf1050d8d78.cloudfront.net (CloudFront)
alt-svc
h3=":443"; ma=86400
x-cache
Hit from cloudfront
x-amz-cf-id
ns5gTfoQ2O_pZlQ9N6ucBp9Epl3E5Mh-uf39oRRG-XOXwwPOY3IIsw==
date
Fri, 12 Jun 2026 18:43:49 GMT
content-type
text/javascript
last-modified
Tue, 21 Apr 2026 21:53:16 GMT
server
AmazonS3
x-amz-cf-pop
NRT20-P8
x-amz-server-side-encryption
AES256
GET
H3
200
pubcid.min.js Show response
cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/
382 B
617 B
7ms
2ms
Script
application/javascript
151.101.129.229
Fastly
General
Full URL
https://cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/pubcid.min.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202606090101/pubads_impl.js
Protocol
H3
Security
QUIC, , AES_256_GCM
Server
151.101.129.229 , United States, ASN54113 (FASTLY - Fastly, Inc., US),
Reverse DNS
Software
/
Resource Hash
6b9ae1fa0d1fc51ee0ad3feb565083bee200289c71bb346020f9b3d80cf73636
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

access-control-expose-headers
*
content-encoding
br
etag
W/"17e-goBKDsAq4SrgyL37A4bNh/aMb7I"
age
3723
x-content-type-options
nosniff
x-jsd-version-type
branch
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-cache
HIT, HIT
date
Sat, 13 Jun 2026 12:38:50 GMT
content-type
application/javascript; charset=utf-8
x-served-by
cache-fra-etou8220184-FRA, cache-nrt-rjaa8190058-NRT
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
public, max-age=604800, s-maxage=43200
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
content-length
237
x-jsd-version
master
GET
H2
200
publishertag.ids.js Show response
static.criteo.net/js/ld/
42 KB
15 KB
16ms
3ms
Script
text/javascript
2406:2600:4::2e
Criteo APAC
General
Full URL
https://static.criteo.net/js/ld/publishertag.ids.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202606090101/pubads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2406:2600:4::2e , Japan, ASN55569 (CRITEO-AS-AP - Criteo APAC, JP),
Reverse DNS
Software
Kestrel /
Resource Hash
896a5824d810b766c901dac3554d27015d9513ae24a75cccce5fb79393d4759f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=31536000; preload;
cache-control
public, max-age=86400
timing-allow-origin
*
content-encoding
br
x-criteo-endpoint-version
none
cross-origin-resource-policy
cross-origin
expires
Sun, 14 Jun 2026 12:38:50 GMT
x-criteo-endpoint-controller
DynamicPublisherTag
access-control-allow-origin
*
x-criteo-endpoint-action
GetPublisherTag
date
Sat, 13 Jun 2026 12:38:49 GMT
content-type
text/javascript
vary
x-geo-country, Accept-Encoding
server
Kestrel
GET
H2
200
encrypted-tag-g.js Show response
invstatic101.creativecdn.com/encrypted-signals/
3 KB
3 KB
291ms
276ms
Script
text/javascript
34.96.70.87
Google LLC
General
Full URL
https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202606090101/pubads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.96.70.87 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS
87.70.96.34.bc.googleusercontent.com
Software
Google Frontend /
Resource Hash
2e5f5cb912c0619933ea6c3ad8ac1466a005f792e3338d96a8432d144c63520f

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

etag
861bdaf24bda5c0db45c6ebe1c94a9eb
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
2729
date
Sat, 13 Jun 2026 12:38:50 GMT
content-type
text/javascript; charset=utf-8
last-modified
Wed, 05 Feb 2025 14:45:21 GMT
server
Google Frontend
x-cloud-trace-context
ca26ecaf5c4b5d046ec9148d1a872f05
GET
H2
200
connectId-gpt.js Show response
connectid.analytics.yahoo.com/
9 KB
9 KB
55ms
11ms
Script
application/javascript
2600:9000:26a6:1200:10:dd8:5e40:93a1
Amazon.com
General
Full URL
https://connectid.analytics.yahoo.com/connectId-gpt.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202606090101/pubads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:26a6:1200:10:dd8:5e40:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
56351c084d8d56437d41f1e58b7eb184b563871e88bab60f6b15486c39f13996
Security Headers
Name Value
Content-Security-Policy default-src 'self'

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

etag
"faa388a163b1b6d0377ee77a861591e5"
age
2543
x-cache
Hit from cloudfront
x-amz-cf-id
iJmATutqKWafyp5F6p9OKWcgjt2eS5_uc4aFbwjstAPw0pduhq09JA==
date
Sat, 13 Jun 2026 11:56:28 GMT
content-type
application/javascript
last-modified
Mon, 22 Apr 2024 18:18:45 GMT
x-amz-expiration
expiry-date="Mon, 23 Apr 2029 00:00:00 GMT", rule-id="webapp-standard-lifecycle"
content-security-policy
default-src 'self'
cache-control
max-age=3600
via
1.1 960fe7ece5325c975291dc9a414afb6e.cloudfront.net (CloudFront)
accept-ranges
bytes
content-length
8729
x-amz-cf-pop
NRT20-P1
server
AmazonS3
x-amz-server-side-encryption
AES256
GET
H3
200
ads Show response
securepubads.g.doubleclick.net/gampad/
1 KB
600 B
370ms
370ms
Fetch
text/plain
142.251.23.157
Google LLC
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1001161376096050&correlator=1253122288471046&eid=31098216%2C95393146&output=ldjh&gdfp_req=1&vrg=202606090101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-banner-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=1&didk=417644066&dids=div-gpt-ad-mediafire_com-banne&adfs=4128408292&sfv=1-0-45&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1781354330188&lmt=1781354330&adxs=436&adys=1410&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=1&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=540&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE0OS4wLjc4MjcuMTAyIixudWxsLDAsbnVsbCwiNjQiLFtbIkNocm9taXVtIiwiMTQ5LjAuMC4wIl0sWyJHb29nbGUgQ2hyb21lIiwiMTQ5LjAuMC4wIl0sWyJOb3QtQS5CcmFuZCIsIjI0LjAuMC4wIl1dLDBd&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F41kkjh07tibblti%2FAINCRAD%2BFF%2BINJECTOR.apk%2Ffile%3Fdkey%3Drv5x6b8wlt0%26r%3D125&vis=1&aee=0&a3p=EjQKCnB1YmNpZC5vcmcSJDNiZmJmN2JkLWI3NjQtNDZmYi05YjI0LWRkMjc5OWJlMmQ5MVgBEhwKDWNyd2RjbnRybC5uZXQYsPD3h-wzSABSAghkEhgKCXlhaG9vLmNvbRix8PeH7DNIAFICCGQSFAoFb3BlbngYsPD3h-wzSABSAghkEh0KDmVzcC5jcml0ZW8uY29tGLDw94fsM0gAUgIIZBIXCghydGJob3VzZRix8PeH7DNIAFICCGQ.&dlt=1781354328063&idt=1996&ppid=5594807e3b73660db22cc026894621f4&uule=a%20cm9sZToxIHByb2R1Y2VyOjEyIGxvYzoiMTQwLTAwMDEsSlAi&prev_scp=a%3D1%26iid1%3D386838486652581%26eid%3D386838486652581%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D1%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252F41kkjh07tibblti%252FAINCRAD%252BFF%252BINJECTOR.apk%252Ffile%253Fdkey%253Drv5x6b8wlt0%2526r%253D125%26path%3D%252Ffile%252F41kkjh07tibblti%252FAINCRAD%252BFF%252BINJECTOR.apk%252Ffile%26ap%3D1107%26sap%3D1107%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D9%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D30%26al%3D1030%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-banner-1%26tap%3Dmediafire_com-banner-1-386838486652581%26eb_br%3D1e913e99b80640fd5b86a539e5b97c94%26eba%3D0%26bv%3D11%26bvm%3D0%26bvr%3D1%26avc%3D21%26evc%3D27%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D22%26br2%3D12%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D32%2C193%2C0%2C0%2C0%2C131%2C132%2C0%2C0%2C0%2C187%2C0%2C901%2C182%2C901%2C902%2C903%26osb%3DLinux%252FChrome%26dbg%3Drc%253A1%26reqt%3D1781354330115&adks=3665333008&frm=20&eoidce=1&pbbce=1
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.23.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
rl-in-f157.1e100.net
Software
cafe /
Resource Hash
c97762a3080b01be49374c9835618573e957af81e9e5c6e73358bef6287c2b1e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
google-lineitem-id
-2
observe-browsing-topics
?1
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sat, 13 Jun 2026 12:38:50 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-2
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
569
x-xss-protection
0
server
cafe
GET
H3
200
ads Show response
securepubads.g.doubleclick.net/gampad/
863 B
443 B
329ms
327ms
Fetch
text/plain
142.251.23.157
Google LLC
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1001161376096050&correlator=4030360765573477&eid=31098216%2C95393146&output=ldjh&gdfp_req=1&vrg=202606090101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=2&didk=1697938527&dids=div-gpt-ad-mediafire_com-box-2&adfs=2211965457&sfv=1-0-45&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1781354330196&lmt=1781354330&adxs=552&adys=10&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=540&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE0OS4wLjc4MjcuMTAyIixudWxsLDAsbnVsbCwiNjQiLFtbIkNocm9taXVtIiwiMTQ5LjAuMC4wIl0sWyJHb29nbGUgQ2hyb21lIiwiMTQ5LjAuMC4wIl0sWyJOb3QtQS5CcmFuZCIsIjI0LjAuMC4wIl1dLDBd&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F41kkjh07tibblti%2FAINCRAD%2BFF%2BINJECTOR.apk%2Ffile%3Fdkey%3Drv5x6b8wlt0%26r%3D125&vis=1&aee=0&a3p=EjQKCnB1YmNpZC5vcmcSJDNiZmJmN2JkLWI3NjQtNDZmYi05YjI0LWRkMjc5OWJlMmQ5MVgBEhwKDWNyd2RjbnRybC5uZXQYsPD3h-wzSABSAghkEhgKCXlhaG9vLmNvbRix8PeH7DNIAFICCGQSFAoFb3BlbngYsPD3h-wzSABSAghkEh0KDmVzcC5jcml0ZW8uY29tGLDw94fsM0gAUgIIZBIXCghydGJob3VzZRix8PeH7DNIAFICCGQ.&dlt=1781354328063&idt=1996&ppid=5594807e3b73660db22cc026894621f4&uule=a%20cm9sZToxIHByb2R1Y2VyOjEyIGxvYzoiMTQwLTAwMDEsSlAi&prev_scp=a%3D1%26iid1%3D2274176620558%26eid%3D2274176620558%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D1%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252F41kkjh07tibblti%252FAINCRAD%252BFF%252BINJECTOR.apk%252Ffile%253Fdkey%253Drv5x6b8wlt0%2526r%253D125%26path%3D%252Ffile%252F41kkjh07tibblti%252FAINCRAD%252BFF%252BINJECTOR.apk%252Ffile%26ap%3D1103%26sap%3D1103%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-box-2%26tap%3Dmediafire_com-box-2-2274176620558%26eb_br%3D3ba982fc4238dd4197b1d51b345478dc%26eba%3D0%26bv%3D11%26bvm%3D0%26bvr%3D1%26avc%3D43%26evc%3D36%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D50%26br2%3D26%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D157%2C168%2C0%2C0%2C0%2C168%2C184%2C20%2C0%2C0%2C192%2C31%2C902%2C903%2C901%2C902%2C903%26osb%3DLinux%252FChrome%26dbg%3Drc%253A2%26reqt%3D1781354330123&adks=3106951849&frm=20&eoidce=1&pbbce=1
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.23.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
rl-in-f157.1e100.net
Software
cafe /
Resource Hash
925a247fa807fc6ebb96dee3a6114c4fe9267db22c430b69a431b8a4162ccc4c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
google-lineitem-id
-2
observe-browsing-topics
?1
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sat, 13 Jun 2026 12:38:50 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-2
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
412
x-xss-protection
0
server
cafe
GET
H3
200
ads Show response
securepubads.g.doubleclick.net/gampad/
865 B
443 B
276ms
274ms
Fetch
text/plain
142.251.23.157
Google LLC
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1001161376096050&correlator=3583210763977704&eid=31098216%2C95393146&output=ldjh&gdfp_req=1&vrg=202606090101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-edge-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=160x600&ifi=3&didk=2994273263&dids=div-gpt-ad-mediafire_com-edge-&adfs=580935078&sfv=1-0-45&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1781354330198&lmt=1781354330&adxs=0&adys=300&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=540&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE0OS4wLjc4MjcuMTAyIixudWxsLDAsbnVsbCwiNjQiLFtbIkNocm9taXVtIiwiMTQ5LjAuMC4wIl0sWyJHb29nbGUgQ2hyb21lIiwiMTQ5LjAuMC4wIl0sWyJOb3QtQS5CcmFuZCIsIjI0LjAuMC4wIl1dLDBd&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F41kkjh07tibblti%2FAINCRAD%2BFF%2BINJECTOR.apk%2Ffile%3Fdkey%3Drv5x6b8wlt0%26r%3D125&vis=1&aee=0&a3p=EjQKCnB1YmNpZC5vcmcSJDNiZmJmN2JkLWI3NjQtNDZmYi05YjI0LWRkMjc5OWJlMmQ5MVgBEhwKDWNyd2RjbnRybC5uZXQYsPD3h-wzSABSAghkEhgKCXlhaG9vLmNvbRix8PeH7DNIAFICCGQSFAoFb3BlbngYsPD3h-wzSABSAghkEh0KDmVzcC5jcml0ZW8uY29tGLDw94fsM0gAUgIIZBIXCghydGJob3VzZRix8PeH7DNIAFICCGQ.&dlt=1781354328063&idt=1996&ppid=5594807e3b73660db22cc026894621f4&uule=a%20cm9sZToxIHByb2R1Y2VyOjEyIGxvYzoiMTQwLTAwMDEsSlAi&prev_scp=a%3D1%26iid1%3D8913019870657068%26eid%3D8913019870657068%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D1%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252F41kkjh07tibblti%252FAINCRAD%252BFF%252BINJECTOR.apk%252Ffile%253Fdkey%253Drv5x6b8wlt0%2526r%253D125%26path%3D%252Ffile%252F41kkjh07tibblti%252FAINCRAD%252BFF%252BINJECTOR.apk%252Ffile%26ap%3D1101%26sap%3D1101%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D4%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D38%26al%3D1038%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-edge-1%26tap%3Dmediafire_com-edge-1-8913019870657068%26eb_br%3Dc352ba581bd3ffd8cea608cf2d55f519%26eba%3D0%26bv%3D23%26bvm%3D0%26bvr%3D3%26avc%3D20%26evc%3D25%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D60%26br2%3D28%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D157%2C131%2C0%2C0%2C0%2C168%2C184%2C20%2C0%2C0%2C192%2C31%2C902%2C903%2C901%2C902%2C903%26osb%3DLinux%252FChrome%26dbg%3Drc%253A3%26reqt%3D1781354330126&adks=966014519&frm=20&eoidce=1&pbbce=1
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.23.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
rl-in-f157.1e100.net
Software
cafe /
Resource Hash
1b414884f5f29c8dcf0613ec285a82e5b8cc6afcad28bf6d422a39b2d7e50c38
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
google-lineitem-id
-2
observe-browsing-topics
?1
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sat, 13 Jun 2026 12:38:50 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-2
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
412
x-xss-protection
0
server
cafe
GET
H3
200
ads Show response
securepubads.g.doubleclick.net/gampad/
865 B
445 B
266ms
264ms
Fetch
text/plain
142.251.23.157
Google LLC
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1001161376096050&correlator=4064590619305659&eid=31098216%2C95393146&output=ldjh&gdfp_req=1&vrg=202606090101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-edge-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=160x600&ifi=4&didk=2994425013&dids=div-gpt-ad-mediafire_com-edge-&adfs=982453029&sfv=1-0-45&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1781354330199&lmt=1781354330&adxs=1440&adys=300&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=540&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE0OS4wLjc4MjcuMTAyIixudWxsLDAsbnVsbCwiNjQiLFtbIkNocm9taXVtIiwiMTQ5LjAuMC4wIl0sWyJHb29nbGUgQ2hyb21lIiwiMTQ5LjAuMC4wIl0sWyJOb3QtQS5CcmFuZCIsIjI0LjAuMC4wIl1dLDBd&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F41kkjh07tibblti%2FAINCRAD%2BFF%2BINJECTOR.apk%2Ffile%3Fdkey%3Drv5x6b8wlt0%26r%3D125&vis=1&aee=0&a3p=EjQKCnB1YmNpZC5vcmcSJDNiZmJmN2JkLWI3NjQtNDZmYi05YjI0LWRkMjc5OWJlMmQ5MVgBEhwKDWNyd2RjbnRybC5uZXQYsPD3h-wzSABSAghkEhgKCXlhaG9vLmNvbRix8PeH7DNIAFICCGQSFAoFb3BlbngYsPD3h-wzSABSAghkEh0KDmVzcC5jcml0ZW8uY29tGLDw94fsM0gAUgIIZBIXCghydGJob3VzZRix8PeH7DNIAFICCGQ.&dlt=1781354328063&idt=1996&ppid=5594807e3b73660db22cc026894621f4&uule=a%20cm9sZToxIHByb2R1Y2VyOjEyIGxvYzoiMTQwLTAwMDEsSlAi&prev_scp=a%3D1%26iid1%3D8854121008628726%26eid%3D8854121008628726%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D1%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252F41kkjh07tibblti%252FAINCRAD%252BFF%252BINJECTOR.apk%252Ffile%253Fdkey%253Drv5x6b8wlt0%2526r%253D125%26path%3D%252Ffile%252F41kkjh07tibblti%252FAINCRAD%252BFF%252BINJECTOR.apk%252Ffile%26ap%3D1102%26sap%3D1102%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D3%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D39%26al%3D1039%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-edge-2%26tap%3Dmediafire_com-edge-2-8854121008628726%26eb_br%3De29f69dd468d31a5514dc9b5587ce757%26eba%3D0%26bv%3D54%26bvm%3D0%26bvr%3D15%26avc%3D25%26evc%3D27%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D16%26br2%3D8%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D157%2C131%2C0%2C0%2C0%2C168%2C184%2C20%2C0%2C0%2C192%2C31%2C902%2C903%2C901%2C902%2C903%26osb%3DLinux%252FChrome%26dbg%3Drc%253A4%26reqt%3D1781354330129&adks=697308627&frm=20&eoidce=1&pbbce=1
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.23.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
rl-in-f157.1e100.net
Software
cafe /
Resource Hash
1f9c27df3d36106a364d45b01ae4a5fb8c1b66d208b469bd27facbfbd3527411
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
google-lineitem-id
-2
observe-browsing-topics
?1
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sat, 13 Jun 2026 12:38:50 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-2
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
414
x-xss-protection
0
server
cafe
GET
H3
200
ads Show response
securepubads.g.doubleclick.net/gampad/
872 B
451 B
284ms
282ms
Fetch
text/plain
142.251.23.157
Google LLC
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1001161376096050&correlator=1738125064922083&eid=31098216%2C95393146&output=ldjh&gdfp_req=1&vrg=202606090101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=5&didk=46178465&dids=div-gpt-ad-mediafire_com-medre&adfs=1959198455&sfv=1-0-45&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1781354330200&lmt=1781354330&adxs=27&adys=1109&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=5&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=540&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE0OS4wLjc4MjcuMTAyIixudWxsLDAsbnVsbCwiNjQiLFtbIkNocm9taXVtIiwiMTQ5LjAuMC4wIl0sWyJHb29nbGUgQ2hyb21lIiwiMTQ5LjAuMC4wIl0sWyJOb3QtQS5CcmFuZCIsIjI0LjAuMC4wIl1dLDBd&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F41kkjh07tibblti%2FAINCRAD%2BFF%2BINJECTOR.apk%2Ffile%3Fdkey%3Drv5x6b8wlt0%26r%3D125&vis=1&aee=0&a3p=EjQKCnB1YmNpZC5vcmcSJDNiZmJmN2JkLWI3NjQtNDZmYi05YjI0LWRkMjc5OWJlMmQ5MVgBEhwKDWNyd2RjbnRybC5uZXQYsPD3h-wzSABSAghkEhgKCXlhaG9vLmNvbRix8PeH7DNIAFICCGQSFAoFb3BlbngYsPD3h-wzSABSAghkEh0KDmVzcC5jcml0ZW8uY29tGLDw94fsM0gAUgIIZBIXCghydGJob3VzZRix8PeH7DNIAFICCGQ.&dlt=1781354328063&idt=1996&ppid=5594807e3b73660db22cc026894621f4&uule=a%20cm9sZToxIHByb2R1Y2VyOjEyIGxvYzoiMTQwLTAwMDEsSlAi&prev_scp=a%3D1%26iid1%3D8074675296629805%26eid%3D8074675296629805%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D1%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252F41kkjh07tibblti%252FAINCRAD%252BFF%252BINJECTOR.apk%252Ffile%253Fdkey%253Drv5x6b8wlt0%2526r%253D125%26path%3D%252Ffile%252F41kkjh07tibblti%252FAINCRAD%252BFF%252BINJECTOR.apk%252Ffile%26ap%3D1100%26sap%3D1100%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D7%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-medrectangle-2%26tap%3Dmediafire_com-medrectangle-2-8074675296629805%26eb_br%3D33dd523f8e4dda158f0aa99686dda7f2%26eba%3D0%26bv%3D24%26bvm%3D0%26bvr%3D2%26avc%3D23%26evc%3D25%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D6%26br2%3D2%26ezoic%3D1%26nmau%3D2%26mau%3D0%26dac%3D0%26stl%3D32%2C131%2C0%2C0%2C0%2C131%2C132%2C0%2C0%2C0%2C187%2C0%2C901%2C182%2C901%2C902%2C903%26osb%3DLinux%252FChrome%26dbg%3Drc%253A5%26reqt%3D1781354330132&adks=1630800042&frm=20&eoidce=1&pbbce=1
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.23.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
rl-in-f157.1e100.net
Software
cafe /
Resource Hash
3d196968aa9a9415ba8e0408223a0dbe7a38b3c16702040df8ef3ce611f1eb3f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
google-lineitem-id
-2
observe-browsing-topics
?1
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sat, 13 Jun 2026 12:38:50 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-2
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
420
x-xss-protection
0
server
cafe
GET
H3
200
ads Show response
securepubads.g.doubleclick.net/gampad/
872 B
453 B
287ms
285ms
Fetch
text/plain
142.251.23.157
Google LLC
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1001161376096050&correlator=1690039492145370&eid=31098216%2C95393146&output=ldjh&gdfp_req=1&vrg=202606090101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=6&didk=219167732&dids=div-gpt-ad-mediafire_com-medre&adfs=2995551083&sfv=1-0-45&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1781354330202&lmt=1781354330&adxs=795&adys=1109&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=6&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=540&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE0OS4wLjc4MjcuMTAyIixudWxsLDAsbnVsbCwiNjQiLFtbIkNocm9taXVtIiwiMTQ5LjAuMC4wIl0sWyJHb29nbGUgQ2hyb21lIiwiMTQ5LjAuMC4wIl0sWyJOb3QtQS5CcmFuZCIsIjI0LjAuMC4wIl1dLDBd&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F41kkjh07tibblti%2FAINCRAD%2BFF%2BINJECTOR.apk%2Ffile%3Fdkey%3Drv5x6b8wlt0%26r%3D125&vis=1&aee=0&a3p=EjQKCnB1YmNpZC5vcmcSJDNiZmJmN2JkLWI3NjQtNDZmYi05YjI0LWRkMjc5OWJlMmQ5MVgBEhwKDWNyd2RjbnRybC5uZXQYsPD3h-wzSABSAghkEhgKCXlhaG9vLmNvbRix8PeH7DNIAFICCGQSFAoFb3BlbngYsPD3h-wzSABSAghkEh0KDmVzcC5jcml0ZW8uY29tGLDw94fsM0gAUgIIZBIXCghydGJob3VzZRix8PeH7DNIAFICCGQ.&dlt=1781354328063&idt=1996&ppid=5594807e3b73660db22cc026894621f4&uule=a%20cm9sZToxIHByb2R1Y2VyOjEyIGxvYzoiMTQwLTAwMDEsSlAi&prev_scp=a%3D1%26iid1%3D8074675296629805%26eid%3D8074675296629805%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D1%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252F41kkjh07tibblti%252FAINCRAD%252BFF%252BINJECTOR.apk%252Ffile%253Fdkey%253Drv5x6b8wlt0%2526r%253D125%26path%3D%252Ffile%252F41kkjh07tibblti%252FAINCRAD%252BFF%252BINJECTOR.apk%252Ffile%26ap%3D1100%26sap%3D1100%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D8%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-medrectangle-2%26tap%3Dmediafire_com-medrectangle-2-8074675296629805%26eb_br%3D33dd523f8e4dda158f0aa99686dda7f2%26eba%3D0%26bv%3D24%26bvm%3D0%26bvr%3D2%26avc%3D23%26evc%3D25%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D6%26br2%3D2%26ezoic%3D1%26nmau%3D2%26mau%3D1%26dac%3D1%26stl%3D32%2C131%2C0%2C0%2C0%2C131%2C132%2C0%2C0%2C0%2C187%2C0%2C901%2C182%2C901%2C902%2C903%26osb%3DLinux%252FChrome%26dbg%3Dadap%253A1%2Crc%253A6%26reqt%3D1781354330135&adks=1277576459&frm=20&eoidce=1&pbbce=1
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.23.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
rl-in-f157.1e100.net
Software
cafe /
Resource Hash
fa71e011d720fe2c49f414b4e47daa81c873bf8910adb3b1c51b1e18bc820b8f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
google-lineitem-id
-2
observe-browsing-topics
?1
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sat, 13 Jun 2026 12:38:50 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-2
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
422
x-xss-protection
0
server
cafe
GET
H3
200
ads Show response
securepubads.g.doubleclick.net/gampad/
62 KB
13 KB
445ms
444ms
Fetch
text/plain
142.251.23.157
Google LLC
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1001161376096050&correlator=1655959201555256&eid=31098216%2C95393146&output=ldjh&gdfp_req=1&vrg=202606090101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-medrectangle-3&enc_prev_ius=%2F0%2F1&prev_iu_szs=336x280&ifi=7&didk=46179496&dids=div-gpt-ad-mediafire_com-medre&adfs=1911771697&sfv=1-0-45&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1781354330203&lmt=1781354330&adxs=320&adys=120&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=7&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=540&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE0OS4wLjc4MjcuMTAyIixudWxsLDAsbnVsbCwiNjQiLFtbIkNocm9taXVtIiwiMTQ5LjAuMC4wIl0sWyJHb29nbGUgQ2hyb21lIiwiMTQ5LjAuMC4wIl0sWyJOb3QtQS5CcmFuZCIsIjI0LjAuMC4wIl1dLDBd&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F41kkjh07tibblti%2FAINCRAD%2BFF%2BINJECTOR.apk%2Ffile%3Fdkey%3Drv5x6b8wlt0%26r%3D125&vis=1&aee=0&a3p=EjQKCnB1YmNpZC5vcmcSJDNiZmJmN2JkLWI3NjQtNDZmYi05YjI0LWRkMjc5OWJlMmQ5MVgBEhwKDWNyd2RjbnRybC5uZXQYsPD3h-wzSABSAghkEhgKCXlhaG9vLmNvbRix8PeH7DNIAFICCGQSFAoFb3BlbngYsPD3h-wzSABSAghkEh0KDmVzcC5jcml0ZW8uY29tGLDw94fsM0gAUgIIZBIXCghydGJob3VzZRix8PeH7DNIAFICCGQ.&dlt=1781354328063&idt=1996&ppid=5594807e3b73660db22cc026894621f4&uule=a%20cm9sZToxIHByb2R1Y2VyOjEyIGxvYzoiMTQwLTAwMDEsSlAi&prev_scp=a%3D1%26iid1%3D4784697890653043%26eid%3D4784697890653043%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D1%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252F41kkjh07tibblti%252FAINCRAD%252BFF%252BINJECTOR.apk%252Ffile%253Fdkey%253Drv5x6b8wlt0%2526r%253D125%26path%3D%252Ffile%252F41kkjh07tibblti%252FAINCRAD%252BFF%252BINJECTOR.apk%252Ffile%26ap%3D1104%26sap%3D1104%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D5%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D21%26al%3D1021%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-medrectangle-3%26tap%3Dmediafire_com-medrectangle-3-4784697890653043%26eb_br%3Dee685f77592ce296910ee91457d66ba3%26eba%3D0%26bv%3D11%26bvm%3D0%26bvr%3D1%26avc%3D45%26evc%3D38%26shp%3D3%26ftsn%3D12%26ftsng%3D12%26br1%3D40%26br2%3D20%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D78%2C168%2C0%2C0%2C0%2C131%2C132%2C0%2C0%2C0%2C187%2C0%2C901%2C182%2C901%2C902%2C903%26osb%3DLinux%252FChrome%26dbg%3Drc%253A7%26reqt%3D1781354330139&adks=4079446691&frm=20&eoidce=1&pbbce=1
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.23.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
rl-in-f157.1e100.net
Software
cafe /
Resource Hash
da3b728baa75c96e29d60af2cfd03ca2bea0a302c62a225f7c92c326a7eed0ba
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

access-control-expose-headers
x-google-amp-ad-validated-version
content-encoding
br
google-lineitem-id
-1
observe-browsing-topics
?1
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sat, 13 Jun 2026 12:38:50 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-1
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
13425
x-xss-protection
0
server
cafe
GET
H3
200
ads Show response
securepubads.g.doubleclick.net/gampad/
873 B
453 B
279ms
278ms
Fetch
text/plain
142.251.23.157
Google LLC
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1001161376096050&correlator=204476930977470&eid=31098216%2C95393146&output=ldjh&gdfp_req=1&vrg=202606090101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-medrectangle-4&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250%7C336x280&ifi=8&didk=46192883&dids=div-gpt-ad-mediafire_com-medre&adfs=1749122204&sfv=1-0-45&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1781354330205&lmt=1781354330&adxs=320&adys=420&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=8&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=540&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE0OS4wLjc4MjcuMTAyIixudWxsLDAsbnVsbCwiNjQiLFtbIkNocm9taXVtIiwiMTQ5LjAuMC4wIl0sWyJHb29nbGUgQ2hyb21lIiwiMTQ5LjAuMC4wIl0sWyJOb3QtQS5CcmFuZCIsIjI0LjAuMC4wIl1dLDBd&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F41kkjh07tibblti%2FAINCRAD%2BFF%2BINJECTOR.apk%2Ffile%3Fdkey%3Drv5x6b8wlt0%26r%3D125&vis=1&aee=0&a3p=EjQKCnB1YmNpZC5vcmcSJDNiZmJmN2JkLWI3NjQtNDZmYi05YjI0LWRkMjc5OWJlMmQ5MVgBEhwKDWNyd2RjbnRybC5uZXQYsPD3h-wzSABSAghkEhgKCXlhaG9vLmNvbRix8PeH7DNIAFICCGQSFAoFb3BlbngYsPD3h-wzSABSAghkEh0KDmVzcC5jcml0ZW8uY29tGLDw94fsM0gAUgIIZBIXCghydGJob3VzZRix8PeH7DNIAFICCGQ.&dlt=1781354328063&idt=1996&ppid=5594807e3b73660db22cc026894621f4&uule=a%20cm9sZToxIHByb2R1Y2VyOjEyIGxvYzoiMTQwLTAwMDEsSlAi&prev_scp=a%3D1%26iid1%3D6879819124653894%26eid%3D6879819124653894%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D1%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252F41kkjh07tibblti%252FAINCRAD%252BFF%252BINJECTOR.apk%252Ffile%253Fdkey%253Drv5x6b8wlt0%2526r%253D125%26path%3D%252Ffile%252F41kkjh07tibblti%252FAINCRAD%252BFF%252BINJECTOR.apk%252Ffile%26ap%3D1105%26sap%3D1105%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D6%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D22%26al%3D1022%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-medrectangle-4%26tap%3Dmediafire_com-medrectangle-4-6879819124653894%26eb_br%3Dbf9a045b836005b6c23b7b0749249612%26eba%3D0%26bv%3D11%26bvm%3D0%26bvr%3D1%26avc%3D33%26evc%3D31%26shp%3D3%26ftsn%3D12%26ftsng%3D12%26br1%3D26%26br2%3D14%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D78%2C168%2C0%2C0%2C0%2C131%2C142%2C0%2C0%2C0%2C187%2C0%2C901%2C182%2C901%2C902%2C903%26osb%3DLinux%252FChrome%26dbg%3Drc%253A8%26reqt%3D1781354330141&adks=2877670411&frm=20&eoidce=1&pbbce=1
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.23.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
rl-in-f157.1e100.net
Software
cafe /
Resource Hash
7135a18ee90c92703cc114588a9402e52aad20f7525ec200af5250f1b2c20261
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
google-lineitem-id
-2
observe-browsing-topics
?1
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sat, 13 Jun 2026 12:38:50 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-2
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
422
x-xss-protection
0
server
cafe
GET
H3
200
container.html Show response
e9be73191e89464b00225c44fbcba626.safeframe.googlesyndication.com/safeframe/1-0-45/html/ Frame BC3B
7 KB
3 KB
50ms
39ms
Document
text/html
142.250.23.132
Google LLC
General
Full URL
https://e9be73191e89464b00225c44fbcba626.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202606090101/pubads_impl.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.23.132 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
zj-in-f132.1e100.net
Software
sffe /
Resource Hash
f1a68bf826c55985468304f4284a09cb8a68e82503d764166e611a7c58a85a4b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.mediafire.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Linux"

Response headers

accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=300
content-encoding
br
content-length
3121
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Sat, 13 Jun 2026 12:38:50 GMT
expires
Sat, 13 Jun 2026 12:38:50 GMT
last-modified
Thu, 08 May 2025 23:15:48 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
OPTIONS
H2
200
sid
mug.criteo.com/ Frame
0
0
16ms
3ms
Preflight
application/json
182.161.74.19
Criteo APAC
General
Full URL
https://mug.criteo.com/sid?cpp=e486NnwvTW84QUh2V3JsSTRUWEF4aTJtVEtjTmdVZjFiYVFJbHJ2YWI5ZS9XU3cwSDNXUGQrcndTTUhmeDhjN0orTGpqQ0RObGttaEZGVUhvZGVlSzR2VE8zN25PQU5FSFFkQ2tiOXptR0t5OWJpZWhNTXozRmdnbWxIcG9OTUFjQ0VxdzZIaGR6eFJmWjMvNnJOaVlyc1JQaGZBWnBEYmIvR1BySjh6SktXeTBCSHEvUmw2QlhueHF6UGFMTVU0QnR3dGE5OHBiMlBPKzZkZXFvNW9zNi9XZHA3MjZMUmFpMEgxTlF6bkcvQmRjeFJXalRIMlVTbnhid1JmaTdXRUc4NVRZfA&cppv=2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
182.161.74.19 , Singapore, ASN55569 (CRITEO-AS-AP - Criteo APAC, JP),
Reverse DNS
Software
Kestrel /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
GET
Origin
null
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
content-type
access-control-allow-methods
GET
access-control-allow-origin
null
cache-control
no-cache, no-store, must-revalidate
content-encoding
gzip
content-type
application/json; charset=utf-8
date
Sat, 13 Jun 2026 12:38:50 GMT
expires
0
pragma
no-cache
server
Kestrel
server-processing-duration-in-ticks
193834
strict-transport-security
max-age=31536000; preload;
vary
Accept-Encoding
GET
H2
200
bounce Show response
id5-sync.com/
29 B
526 B
451ms
223ms
Fetch
text/plain
135.125.170.104
OVH OVH SAS
General
Full URL
https://id5-sync.com/bounce
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
135.125.170.104 , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS
ns3270128.ip-135-125-170.eu
Software
/
Resource Hash
aca701811d62eb608d12b174231be1ceae3449fe0f4bc847469ff22aab8ca9a5
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
access-control-allow-credentials
true
expires
Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin
https://www.mediafire.com
p3p
CP="CAO PSA OUR"
date
Sat, 13 Jun 2026 12:38:50 GMT
content-type
text/plain;charset=utf-8
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
GET
H2
200
v1 Show response
lbs.eu-1-id5-sync.com/lbs/
54 B
162 B
683ms
223ms
Fetch
application/json
2001:41d0:72f:6100::
OVH OVH SAS
General
Full URL
https://lbs.eu-1-id5-sync.com/lbs/v1
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:41d0:72f:6100:: , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS
Software
/
Resource Hash
984b903229be986e646516844f0a36f2a7a3b5993874403674093ca2da9f8ad3

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

access-control-allow-origin
https://www.mediafire.com
content-length
54
date
Sat, 13 Jun 2026 12:38:50 GMT
content-type
application/json
vary
Origin
GET
H2
200
v1 Show response
lb.eu-1-id5-sync.com/lb/
45 B
336 B
672ms
222ms
Fetch
application/json
135.125.170.106
OVH OVH SAS
General
Full URL
https://lb.eu-1-id5-sync.com/lb/v1
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
135.125.170.106 , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS
ns3270107.ip-135-125-170.eu
Software
/
Resource Hash
ec295aced7429b6b7e407bfe5188b65e632a748495ef8be93ac9296778e15d46
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
access-control-allow-origin
https://www.mediafire.com
content-encoding
gzip
date
Sat, 13 Jun 2026 12:38:50 GMT
content-type
application/json;charset=UTF-8
vary
origin,access-control-request-method,access-control-request-headers,accept-encoding
POST
H2
200
imp.gif
g.ezoic.net/detroitchicago/
43 B
136 B
76ms
75ms
Ping
image/gif
2406:da18:9d0:143f:2124:4e9c:36a9:d9de
Amazon.com
General
Full URL
https://g.ezoic.net/detroitchicago/imp.gif
Requested by
Host:
URL: ez-standalone.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2406:da18:9d0:143f:2124:4e9c:36a9:d9de Singapore, Singapore, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
/
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
Content-Type
text/plain
sec-ch-ua-mobile
?0

Response headers

access-control-max-age
1728000, 1728000
cache-control
private, max-age=0, must-revalidate, no-cache, no-store
access-control-allow-credentials
true
access-control-allow-methods
GET, POST, PUT, OPTIONS, HEAD, PUT, POST, GET, OPTIONS
expires
Fri, 12 Jun 2026 12:38:50 GMT
access-control-allow-origin
https://www.mediafire.com, https://www.mediafire.com
content-length
43
date
Sat, 13 Jun 2026 12:38:50 GMT
x-middleton-display
imp_sol
content-type
image/gif
vary
Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
access-control-allow-headers
Content-Type, Content-Type
GET
H2
200
omaha.js Show response
g.ezoic.net/detroitchicago/
2 KB
649 B
72ms
72ms
Script
application/javascript
2406:da18:9d0:143f:2124:4e9c:36a9:d9de
Amazon.com
General
Full URL
https://g.ezoic.net/detroitchicago/omaha.js?gcb=195-16&cb=8f3688675f
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2406:da18:9d0:143f:2124:4e9c:36a9:d9de Singapore, Singapore, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
/
Resource Hash
8952b91af1705fc7fddb2a9bcc53534d55f136755e48e957711d85b038287542

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-robots-tag
noindex, follow
cache-control
max-age=31536000, public
content-encoding
br
content-length
595
date
Sat, 13 Jun 2026 12:38:50 GMT
x-middleton-display
sol-js
content-type
application/javascript
vary
Accept-Encoding
POST
H2
200
lgc Show response
d9.flashtalking.com/
103 B
539 B
18ms
16ms
XHR
application/json
35.74.31.108
Amazon.com
General
Full URL
https://d9.flashtalking.com/lgc
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.74.31.108 Tokyo, Japan, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-35-74-31-108.ap-northeast-1.compute.amazonaws.com
Software
Apache/2.4.66 (Amazon Linux) OpenSSL/3.5.5 /
Resource Hash
8d5b5f10f54ff6206d2ff9ec46ea10e38b0c52d83a83df6114037f3030f63519

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
Content-Type
application/x-www-form-urlencoded
sec-ch-ua-mobile
?0

Response headers

access-control-allow-credentials
true
access-control-allow-methods
GET,POST,SERVER
access-control-allow-origin
https://www.mediafire.com
content-length
103
p3p
policyref="localhost/w3c/D9_p3p_.xml", CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"
date
Sat, 13 Jun 2026 12:38:50 GMT
content-type
application/json;charset=UTF-8
server
Apache/2.4.66 (Amazon Linux) OpenSSL/3.5.5
GET
H2
200
syncframe Show response
gum.criteo.com/ Frame 4FAA
12 KB
5 KB
9ms
4ms
Document
text/html
2406:2600:4::13
Criteo APAC
General
Full URL
https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=www.mediafire.com&gdpr=0&gdpr_consent=
Requested by
Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.ids.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2406:2600:4::13 , Japan, ASN55569 (CRITEO-AS-AP - Criteo APAC, JP),
Reverse DNS
Software
Kestrel /
Resource Hash
033bd2b7f73cb447bf4ee25bdd45ce8a9639fd91fb7015c2bb49af94b7ff3cea
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://www.mediafire.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Linux"

Response headers

cache-control
private, max-age=3600
content-encoding
gzip
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Sat, 13 Jun 2026 12:38:50 GMT
server
Kestrel
server-processing-duration-in-ticks
1284286
strict-transport-security
max-age=31536000; preload;
vary
Accept-Encoding
x-robots-tag
noindex
POST
H2
200
map Show response
bcp.crwdcntrl.net/6/
231 B
691 B
293ms
80ms
XHR
application/json
52.76.86.147
Amazon.com
General
Full URL
https://bcp.crwdcntrl.net/6/map?xcid=16589
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.76.86.147 Singapore, Singapore, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-76-86-147.ap-southeast-1.compute.amazonaws.com
Software
/
Resource Hash
80f0686aefd05de787e5507e0dd657439b9bd9f1235a297227e9808f153637fa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000 ; includeSubDomains

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
Content-Type
text/plain;charset=UTF-8
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=31536000 ; includeSubDomains
cache-control
no-cache
pragma
no-cache
access-control-allow-credentials
true
expires
0
access-control-allow-origin
https://www.mediafire.com
p3p
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length
231
date
Sat, 13 Jun 2026 12:38:50 GMT
content-type
application/json;charset=utf-8
GET
H2
200
esp Show response
oajs.openx.net/
Redirect Chain
  • https://oajs.openx.net/esp?url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F41kkjh07tibblti%2FAINCRAD%2BFF%2BINJECTOR.apk%2Ffile%3Fdkey%3Drv5x6b8wlt0%26r%3D125&rid=esp
  • https://oajs.openx.net/esp?url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F41kkjh07tibblti%2FAINCRAD%2BFF%2BINJECTOR.apk%2Ffile%3Fdkey%3Drv5x6b8wlt0%26r%3D125&rid=esp&cc=1
85 B
195 B
182ms
181ms
Fetch
application/json
34.120.107.143
Google LLC
General
Full URL
https://oajs.openx.net/esp?url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F41kkjh07tibblti%2FAINCRAD%2BFF%2BINJECTOR.apk%2Ffile%3Fdkey%3Drv5x6b8wlt0%26r%3D125&rid=esp&cc=1
Protocol
H2
Server
34.120.107.143 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS
143.107.120.34.bc.googleusercontent.com
Software
/ Express
Resource Hash
c8a2767949c5430a767cbb9263b8c7114fcd027fd38d60a53fbcd613be219b7d

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

etag
W/"55-OBkLRZtjEmTUY6BQL35UafHCz+0"
access-control-allow-credentials
true
via
1.1 google
access-control-allow-origin
https://www.mediafire.com
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
85
date
Sat, 13 Jun 2026 12:38:51 GMT
content-type
application/json; charset=utf-8
x-powered-by
Express
vary
Origin

Redirect headers

location
/esp?url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F41kkjh07tibblti%2FAINCRAD%2BFF%2BINJECTOR.apk%2Ffile%3Fdkey%3Drv5x6b8wlt0%26r%3D125&rid=esp&cc=1
access-control-allow-credentials
true
via
1.1 google
access-control-allow-origin
https://www.mediafire.com
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
date
Sat, 13 Jun 2026 12:38:50 GMT
x-powered-by
Express
vary
Origin
GET
H2
400
fed Show response
ups.analytics.yahoo.com/ups/58813/
0
191 B
203ms
203ms
XHR
application/json
2406:2000:a4:807::
internet content ...
General
Full URL
https://ups.analytics.yahoo.com/ups/58813/fed?gpp_sid=-1&gdpr=false&gdpr_consent=&v=1&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F41kkjh07tibblti%2FAINCRAD%2BFF%2BINJECTOR.apk%2Ffile
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2406:2000:a4:807:: , Taiwan, ASN10230 (YAHOO-SG - internet content provider, SG),
Reverse DNS
Software
ATS /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=31536000
age
0
access-control-allow-credentials
true
x-content-type-options
nosniff
referrer-policy
no-referrer-when-downgrade
access-control-allow-origin
https://www.mediafire.com
content-length
0
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date
Sat, 13 Jun 2026 12:38:50 GMT
content-type
application/json
vary
Origin
server
ATS
GET
H2
200
sid Show response
mug.criteo.com/ Frame 4FAA
Redirect Chain
  • https://gum.criteo.com/sid/json?origin=publishertagids&domain=www.mediafire.com&sn=ChromeSyncframe&so=0&topUrl=www.mediafire.com
  • https://mug.criteo.com/sid?cpp=wrNh8Hw4dFdHZXJIL2FIY01rM1hnWXVLdVRhRG5VeUFFTHpaTGZETkg4ZXorVGpDaXVqYWNJWlZzOFBoUDF0b29wZDFSNFdiZ0M4aWxwbHM5bGJtMmcrQkVONllUZ0l6dWlDSkEvc1dlVDRvWVNMYlR5NGhYSTkydTdCbW...
435 B
1011 B
11ms
3ms
Fetch
application/json
182.161.74.19
Criteo APAC
General
Full URL
https://mug.criteo.com/sid?cpp=wrNh8Hw4dFdHZXJIL2FIY01rM1hnWXVLdVRhRG5VeUFFTHpaTGZETkg4ZXorVGpDaXVqYWNJWlZzOFBoUDF0b29wZDFSNFdiZ0M4aWxwbHM5bGJtMmcrQkVONllUZ0l6dWlDSkEvc1dlVDRvWVNMYlR5NGhYSTkydTdCbWxKUDltYndqSWJQQVBGS0puMjNmR2dlbHE3WXhJTERSMUlMNEFha0FsRlJVZ3k2aW8wTkhoRmVuK3Iybkg3cUpVempiMWtDYnNNT3Z0V29RVWg2WmdOd1RPL2lYcUxYS3dYdXJ3dUgydWVDWjNvdFgwcnRKV01vRUFvUG5ndG1QdlljQ3pGMFZYdlNXcGU5eEhtVWpsZUR1OE05S0ZPZ0JKVEhvNlNjRmZWblZRRVdXM1lFdHoyRG5OYXVwSVdld3k0ZVl6ZUlobXw&cppv=2
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H2
Server
182.161.74.19 , Singapore, ASN55569 (CRITEO-AS-AP - Criteo APAC, JP),
Reverse DNS
Software
Kestrel /
Resource Hash
2c059db5a9c8d8ab63540fb456a2bc6bac2d87a40a7b21582b8265a56441ad0b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Referer
https://gum.criteo.com/

Response headers

strict-transport-security
max-age=31536000; preload;
cache-control
no-cache, no-store, must-revalidate
content-encoding
gzip
pragma
no-cache
access-control-allow-credentials
true
access-control-allow-methods
GET
server-processing-duration-in-ticks
795504
expires
0
access-control-allow-origin
https://gum.criteo.com
date
Sat, 13 Jun 2026 12:38:49 GMT
content-type
application/json; charset=utf-8
vary
Accept-Encoding
server
Kestrel

Redirect headers

strict-transport-security
max-age=31536000; preload;
cache-control
no-cache, no-store, must-revalidate
location
https://mug.criteo.com/sid?cpp=wrNh8Hw4dFdHZXJIL2FIY01rM1hnWXVLdVRhRG5VeUFFTHpaTGZETkg4ZXorVGpDaXVqYWNJWlZzOFBoUDF0b29wZDFSNFdiZ0M4aWxwbHM5bGJtMmcrQkVONllUZ0l6dWlDSkEvc1dlVDRvWVNMYlR5NGhYSTkydTdCbWxKUDltYndqSWJQQVBGS0puMjNmR2dlbHE3WXhJTERSMUlMNEFha0FsRlJVZ3k2aW8wTkhoRmVuK3Iybkg3cUpVempiMWtDYnNNT3Z0V29RVWg2WmdOd1RPL2lYcUxYS3dYdXJ3dUgydWVDWjNvdFgwcnRKV01vRUFvUG5ndG1QdlljQ3pGMFZYdlNXcGU5eEhtVWpsZUR1OE05S0ZPZ0JKVEhvNlNjRmZWblZRRVdXM1lFdHoyRG5OYXVwSVdld3k0ZVl6ZUlobXw&cppv=2
pragma
no-cache
server-processing-duration-in-ticks
469602
expires
0
content-length
0
date
Sat, 13 Jun 2026 12:38:49 GMT
server
Kestrel
GET
H3
200
gpt
securepubads.g.doubleclick.net/pagead/managed/dict/m202606110101/
63 KB
23 KB
10ms
9ms
Other
text/plain
142.251.23.157
Google LLC
General
Full URL
https://securepubads.g.doubleclick.net/pagead/managed/dict/m202606110101/gpt
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.23.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
rl-in-f157.1e100.net
Software
cafe /
Resource Hash
128eb2ddabc22c456e73db5c95d723d0493dd69fb68dc59ab4ac2b295e3814ea
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
etag
14385589966446515411
age
50820
x-content-type-options
nosniff
expires
Fri, 19 Jun 2026 22:31:50 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Fri, 12 Jun 2026 22:31:50 GMT
content-type
text/plain; charset=UTF-8
vary
Accept-Encoding
cache-control
public, immutable, max-age=604800, stale-while-revalidate=7200
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
content-length
23605
x-xss-protection
0
server
cafe
use-as-dictionary
match="/gampad/ads", id="m202606110101"
GET
H2
200
px.gif Show response
ad-delivery.net/
43 B
135 B
8ms
7ms
Fetch
image/gif
2606:4700:10::ac42:948c
Cloudflare
General
Full URL
https://ad-delivery.net/px.gif?ch=2&e=0.7744485781732132
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac42:948c -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-goog-metageneration
5
access-control-expose-headers
*, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash
crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status
HIT
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3"
age
4
x-goog-stored-content-encoding
identity
expires
Fri, 12 Jun 2026 20:23:44 GMT
x-goog-stored-content-length
43
date
Sat, 13 Jun 2026 12:38:50 GMT
content-type
image/gif
last-modified
Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid
AAwnv3JMXkz3ZUQsLqzogVLXRUh4YB_2iVspb_DjiQ0uSiq9ZDNuQengWG2u3JEhwP_0kkXX
cache-control
public, max-age=86400
x-goog-storage-class
MULTI_REGIONAL
cf-ray
a0b12795396f9501-NRT
accept-ranges
bytes
access-control-allow-origin
*
x-goog-generation
1620242732037093
content-length
43
server
cloudflare
GET
H3
200
favicon.ico Show response
ad.doubleclick.net/
1 KB
129 B
39ms
39ms
Fetch
image/x-icon
142.251.24.149
Google LLC
General
Full URL
https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.4494261499525408
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.24.149 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
rj-in-f149.1e100.net
Software
sffe /
Resource Hash
d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options
nosniff
expires
Sun, 14 Jun 2026 12:38:50 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 13 Jun 2026 12:38:50 GMT
content-type
image/x-icon
vary
Accept-Encoding
last-modified
Tue, 08 May 2012 13:08:06 GMT
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
content-length
104
x-xss-protection
0
server
sffe
GET
H2
200
px.gif Show response
ad-delivery.net/
43 B
110 B
8ms
6ms
Fetch
image/gif
2606:4700:10::ac42:948c
Cloudflare
General
Full URL
https://ad-delivery.net/px.gif?ch=1&e=0.6382920707624309
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac42:948c -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-goog-metageneration
5
access-control-expose-headers
*, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash
crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status
HIT
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3"
age
4
x-goog-stored-content-encoding
identity
expires
Fri, 12 Jun 2026 20:23:44 GMT
x-goog-stored-content-length
43
date
Sat, 13 Jun 2026 12:38:50 GMT
content-type
image/gif
last-modified
Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid
AAwnv3JMXkz3ZUQsLqzogVLXRUh4YB_2iVspb_DjiQ0uSiq9ZDNuQengWG2u3JEhwP_0kkXX
cache-control
public, max-age=86400
x-goog-storage-class
MULTI_REGIONAL
cf-ray
a0b12795497e9501-NRT
accept-ranges
bytes
access-control-allow-origin
*
x-goog-generation
1620242732037093
content-length
43
server
cloudflare
GET
H2
200
dns Show response
ab.dns-finder.com/meta/
2 B
0
1ms
1ms
Fetch
text/plain
34.36.200.111
Google LLC
General
Full URL
https://ab.dns-finder.com/meta/dns
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.36.200.111 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS
111.200.36.34.bc.googleusercontent.com
Software
/
Resource Hash
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
private, max-age=180, stale-if-error=180, stale-while-revalidate=180
access-control-expose-headers
X-Resolver
x-resolver
default
via
1.1 google
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
2
date
Sat, 13 Jun 2026 12:38:48 GMT
content-type
text/plain; charset=utf-8
vary
Origin
POST
H2
200
encrypt Show response
esp.rtbhouse.com/
329 B
594 B
770ms
273ms
Fetch
application/json
35.190.39.111
Google LLC
General
Full URL
https://esp.rtbhouse.com/encrypt
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.190.39.111 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS
111.39.190.35.bc.googleusercontent.com
Software
Google Frontend /
Resource Hash
2779077c7b2d5740b5a7eac2c5e5bdca293e99343a1d7db03ba196d17b710f06

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
Content-Type
text/plain
sec-ch-ua-mobile
?0

Response headers

access-control-allow-credentials
true
access-control-allow-methods
POST
via
1.1 google
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
329
date
Sat, 13 Jun 2026 12:38:51 GMT
content-type
application/json
x-cloud-trace-context
cc80c27a6291834db5383af635569cfa
server
Google Frontend
access-control-allow-headers
X-Requested-With
GET
H2
200
px.gif Show response
ad-delivery.net/
43 B
110 B
6ms
6ms
Fetch
image/gif
2606:4700:10::ac42:948c
Cloudflare
General
Full URL
https://ad-delivery.net/px.gif?ch=1&e=0.852272889239645
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac42:948c -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-goog-metageneration
5
access-control-expose-headers
*, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash
crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status
HIT
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3"
age
4
x-goog-stored-content-encoding
identity
expires
Fri, 12 Jun 2026 20:23:44 GMT
x-goog-stored-content-length
43
date
Sat, 13 Jun 2026 12:38:50 GMT
content-type
image/gif
last-modified
Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid
AAwnv3JMXkz3ZUQsLqzogVLXRUh4YB_2iVspb_DjiQ0uSiq9ZDNuQengWG2u3JEhwP_0kkXX
cache-control
public, max-age=86400
x-goog-storage-class
MULTI_REGIONAL
cf-ray
a0b127969d4b9501-NRT
accept-ranges
bytes
access-control-allow-origin
*
x-goog-generation
1620242732037093
content-length
43
server
cloudflare
GET
H2
200
amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012605071401000/ Frame 7FE7
196 KB
55 KB
30ms
4ms
Script
text/javascript
2404:6800:400b:c005::84
Google LLC
General
Full URL
https://cdn.ampproject.org/rtv/012605071401000/amp4ads-v0.mjs
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202606090101/pubads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:400b:c005::84 , Japan, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
19e6bf3356536c59e3a9aa5791665905d004766bda6b46fcf8e8457958020e28
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
etag
"9eade6bfff02340f"
age
349177
report-to
{"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
x-content-type-options
nosniff
expires
Wed, 09 Jun 2027 11:39:13 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 09 Jun 2026 11:39:13 GMT
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="amphtml-china-available"
content-length
56125
x-xss-protection
0
server
sffe
GET
H2
200
amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012605071401000/v0/ Frame 7FE7
15 KB
5 KB
35ms
9ms
Script
text/javascript
2404:6800:400b:c005::84
Google LLC
General
Full URL
https://cdn.ampproject.org/rtv/012605071401000/v0/amp-ad-exit-0.1.mjs
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202606090101/pubads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:400b:c005::84 , Japan, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
f4b0148628292afd7b50bd67548ba6d3e97d564ee9ef938c963b4657747ac60b
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
etag
"88c4cbda6719bc74"
age
468038
report-to
{"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
x-content-type-options
nosniff
expires
Tue, 08 Jun 2027 02:38:12 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 08 Jun 2026 02:38:12 GMT
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="amphtml-china-available"
content-length
5221
x-xss-protection
0
server
sffe
GET
H2
200
amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012605071401000/v0/ Frame 7FE7
95 KB
28 KB
32ms
7ms
Script
text/javascript
2404:6800:400b:c005::84
Google LLC
General
Full URL
https://cdn.ampproject.org/rtv/012605071401000/v0/amp-analytics-0.1.mjs
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202606090101/pubads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:400b:c005::84 , Japan, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
91171ed1478c24131b918c94dbc8bcc3cbc3a55dca8bb00f21cd64387b2ea8a6
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
etag
"97215e1667de42f6"
age
335010
report-to
{"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
x-content-type-options
nosniff
expires
Wed, 09 Jun 2027 15:35:20 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 09 Jun 2026 15:35:20 GMT
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="amphtml-china-available"
content-length
29021
x-xss-protection
0
server
sffe
GET
H2
200
amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012605071401000/v0/ Frame 7FE7
5 KB
2 KB
36ms
10ms
Script
text/javascript
2404:6800:400b:c005::84
Google LLC
General
Full URL
https://cdn.ampproject.org/rtv/012605071401000/v0/amp-fit-text-0.1.mjs
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202606090101/pubads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:400b:c005::84 , Japan, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
dce1ce383bed84a4ed739e972b11f44c4c45a1339a1bdf75c3598b88d46cc69d
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
etag
"4871326834a6f544"
age
463868
report-to
{"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
x-content-type-options
nosniff
expires
Tue, 08 Jun 2027 03:47:42 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 08 Jun 2026 03:47:42 GMT
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="amphtml-china-available"
content-length
1920
x-xss-protection
0
server
sffe
GET
H2
200
amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012605071401000/v0/ Frame 7FE7
40 KB
14 KB
28ms
3ms
Script
text/javascript
2404:6800:400b:c005::84
Google LLC
General
Full URL
https://cdn.ampproject.org/rtv/012605071401000/v0/amp-form-0.1.mjs
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202606090101/pubads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:400b:c005::84 , Japan, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
513bcb26bd9e258e314f0fa39e4f8d57be3305e65101ccbeb63ae1617073547f
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
etag
"ce7dfc1b22abf1b0"
age
304362
report-to
{"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
x-content-type-options
nosniff
expires
Thu, 10 Jun 2027 00:06:08 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 10 Jun 2026 00:06:08 GMT
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="amphtml-china-available"
content-length
12959
x-xss-protection
0
server
sffe
GET
H2
200
58197005096228806
tpc.googlesyndication.com/daca_images/simgad/ Frame 7FE7
95 KB
95 KB
23ms
8ms
Image
image/jpeg
2404:6800:400b:c006::84
Google LLC
General
Full URL
https://tpc.googlesyndication.com/daca_images/simgad/58197005096228806
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:400b:c006::84 , Japan, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
64dc6955dce4fee4070b12c20684745a49317312b4083b4a58f93efc3b303391
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

age
190329
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
x-content-type-options
nosniff
expires
Fri, 11 Jun 2027 07:46:41 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons
true
date
Thu, 11 Jun 2026 07:46:41 GMT
last-modified
Fri, 05 Jun 2026 07:53:06 GMT
content-type
image/jpeg
cache-control
public, max-age=31536000
timing-allow-origin
*
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
content-length
97134
x-xss-protection
0
server
sffe
GET
H2
200
en.png
tpc.googlesyndication.com/pagead/images/abg/ Frame 7FE7
3 KB
3 KB
21ms
6ms
Image
image/png
2404:6800:400b:c006::84
Google LLC
General
Full URL
https://tpc.googlesyndication.com/pagead/images/abg/en.png
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:400b:c006::84 , Japan, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
85a64faec356c3a72f249a98a037317adc730ec6d38e47653cd53be5485d80a1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=86400
timing-allow-origin
*
etag
15880770647744369592
age
16266
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Sun, 14 Jun 2026 08:07:44 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
2982
x-xss-protection
0
date
Sat, 13 Jun 2026 08:07:44 GMT
content-type
image/png
vary
Accept-Encoding
server
cafe
GET
H2
200
adchoices_blue_wb.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 7FE7
209 B
313 B
21ms
7ms
Image
image/png
2404:6800:400b:c006::84
Google LLC
General
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/adchoices_blue_wb.png
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:400b:c006::84 , Japan, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
135fe1822959b8811afafc20effec079f339c96788df6e47e933a7d0c267921b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=86400
timing-allow-origin
*
etag
2799713854418114702
age
69389
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Sat, 13 Jun 2026 17:22:21 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
209
x-xss-protection
0
date
Fri, 12 Jun 2026 17:22:21 GMT
content-type
image/png
vary
Accept-Encoding
server
cafe
GET

adview
securepubads.g.doubleclick.net/pagead/ Frame 7FE7
0
0


POST
H2
204
collect
analytics.google.com/g/
0
0
41ms
37ms
Fetch
text/plain
2001:4860:4802:34::181
Google LLC
General
Full URL
https://analytics.google.com/g/collect?v=2&tid=G-K68XP6D85D&gtm=45je66a1v887485693za20gzb6304663zd6304663&_p=1781354328508&_gaz=1&gcs=G111&gcd=13n3n3n3n5l1&npa=0&dma=0&tcfd=10000&_eu=AEIAAGQC&are=1&cid=56541922.1781354330&frm=0&pscdl=noapi&rcb=19&sr=1600x1200&uaa=x86&uab=64&uafvl=Chromium%3B149.0.0.0%7CGoogle%2520Chrome%3B149.0.0.0%7CNot-A.Brand%3B24.0.0.0&uam=&uamb=0&uap=Linux&uapv=&uaw=0&ul=ja-jp&gaf=2&_s=2&tag_exp=115616985~115938465~115938469~118012008~119392696~119392704~119456239~119456247&sid=1781354329&sct=1&seg=0&dl=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F41kkjh07tibblti%2FAINCRAD%2BFF%2BINJECTOR.apk%2Ffile%3Fdkey%3Drv5x6b8wlt0%26r%3D125&dt=%F0%9F%94%A5%20%F0%9D%97%94%F0%9D%97%9C%F0%9D%97%A1%F0%9D%97%96%F0%9D%97%A5%F0%9D%97%94%F0%9D%97%97%20%F0%9D%97%A0%F0%9D%97%A2%F0%9D%97%97%F0%9D%97%A6%20%F0%9D%97%99%F0%9D%97%99%20%F0%9D%97%A0%F0%9D%97%94%F0%9D%97%AB%20%F0%9F%98%B2%20%F0%9D%97%A1%F0%9D%97%A2%20%F0%9D%97%95%F0%9D%97%94%F0%9D%97%A1%20%F0%9F%9B%A1%EF%B8%8F&en=ad_impression&ep.query_id=CNPGzICehJUDFUNvwwYduw0sOw&_et=1024&tfd=3205
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:34::181 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:196:0
report-to
{"group":"ascnsrsggc:196:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:196:0"}],}
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
https://www.mediafire.com
cross-origin-opener-policy-report-only
same-origin; report-to=ascnsrsggc:196:0
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 13 Jun 2026 12:38:50 GMT
content-type
text/plain
server
Golfe2
GET
H3
200
ga-audiences
www.google.co.jp/ads/
42 B
63 B
11ms
9ms
Image
image/gif
142.251.24.94
Google LLC
General
Full URL
https://www.google.co.jp/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-K68XP6D85D&cid=56541922.1781354330&gtm=45je66a1v887485693za20gzb6304663zd6304663&rcb=19&aip=1&dma=0&gcs=G111&gcd=13n3n3n3n5l1&npa=0&frm=0&tag_exp=115616985~115938465~115938469~118012008~119392696~119392704~119456239~119456247&z=1890991018
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.24.94 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
rj-in-f94.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
42
date
Sat, 13 Jun 2026 12:38:50 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
GET
DATA
200
OK
truncated
/ Frame 7FE7
212 B
0
Image
image/png

General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b044342cfff5fe7697723acdb5d665bfb7d3c5c2bf98bc8931d9156f5dbf2e02

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/png
GET

si
googleads.g.doubleclick.net/pagead/drt/ Frame 7FE7
Redirect Chain
  • https://www.google.com/pagead/drt/ui
  • https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
0
0


GET

view
securepubads.g.doubleclick.net/btr/ Frame 7FE7
0
0


GET
H2
200
location Show response
privacy-location-edge.ccgateway.net/privacy/
5 B
191 B
514ms
166ms
XHR
text/plain
18.212.140.196
Amazon.com
General
Full URL
https://privacy-location-edge.ccgateway.net/privacy/location
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.212.140.196 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-18-212-140-196.compute-1.amazonaws.com
Software
/
Resource Hash
1c55d9b826e8dfa994370e306ae8dc2e849f3e003381dc848a0b95f782c0c0e3

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

access-control-allow-origin
*
content-encoding
gzip
date
Sat, 13 Jun 2026 12:38:51 GMT
content-type
text/plain; charset=utf-8
vary
Accept-Encoding
access-control-allow-credentials
true
GET
H3
200
sodar Show response
ep1.adtrafficquality.google/getconfig/
18 KB
13 KB
27ms
18ms
XHR
application/json
142.251.24.157
Google LLC
General
Full URL
https://ep1.adtrafficquality.google/getconfig/sodar?sv=200&tid=gpt&tv=m202606090101&st=env&sjk=1001161376096050
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.24.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
rj-in-f157.1e100.net
Software
cafe /
Resource Hash
ff5146e7e0ea898c04e214789d592a741cb08d803315f0d64e1c22069ea0dd76
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

timing-allow-origin
*
content-encoding
br
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
13711
date
Sat, 13 Jun 2026 12:38:50 GMT
x-xss-protection
0
content-type
application/json; charset=UTF-8
content-disposition
attachment; filename="f.txt"
server
cafe
POST
H3
204
rum Show response
www.mediafire.com/cdn-cgi/
0
197 B
6ms
5ms
XHR
text/plain
104.17.147.83
Cloudflare
General
Full URL
https://www.mediafire.com/cdn-cgi/rum?
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.147.83 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
content-type
application/json
sec-ch-ua-mobile
?0

Response headers

access-control-max-age
86400
access-control-allow-credentials
true
access-control-allow-methods
POST,OPTIONS
cf-ray
a0b127979e5ef277-NRT
access-control-allow-origin
https://www.mediafire.com
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sat, 13 Jun 2026 12:38:50 GMT
content-type
text/plain
vary
Origin, accept-encoding
server
cloudflare
priority
u=1,i
GET
H3
200
favicon.ico
www.mediafire.com/
11 KB
2 KB
27ms
27ms
Other
image/x-icon
104.17.147.83
Cloudflare
General
Full URL
https://www.mediafire.com/favicon.ico
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.147.83 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
cdc78cc8b2994712a041a2a4cb02f488afbab00981771bdd3a8036c2dddf540f

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
cf-cache-status
HIT
etag
W/"62deda56-2a46"
age
13787
access-control-allow-methods
OPTIONS, POST, GET
expires
Mon, 13 Jul 2026 08:49:03 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
x-mf-env
liveApi
date
Sat, 13 Jun 2026 12:38:50 GMT
content-type
image/x-icon
last-modified
Mon, 25 Jul 2022 18:00:54 GMT
vary
Accept-Encoding
priority
u=1,i
cache-control
max-age=2592000
cf-ray
a0b127979e6af277-NRT
x-mf-fe
mf2
access-control-allow-origin
*
server
cloudflare
GET
H2
200
sodar2.js Show response
ep2.adtrafficquality.google/sodar/
21 KB
8 KB
51ms
40ms
Script
text/javascript
2404:6800:400b:c006::84
Google LLC
General
Full URL
https://ep2.adtrafficquality.google/sodar/sodar2.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202606090101/pubads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:400b:c006::84 , Japan, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
cb8d603426932f2666666f4bd32b3dde726161c7f7413e385d2e124e6e03039c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
etag
"1775059593017171"
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
x-content-type-options
nosniff
expires
Sat, 13 Jun 2026 12:38:50 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 13 Jun 2026 12:38:50 GMT
content-type
text/javascript
vary
Accept-Encoding
cache-control
private, max-age=3000
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
content-length
7628
x-xss-protection
0
server
sffe
GET
H2
200
px.gif Show response
ad-delivery.net/
43 B
110 B
11ms
10ms
Fetch
image/gif
2606:4700:10::ac42:948c
Cloudflare
General
Full URL
https://ad-delivery.net/px.gif?ch=2&e=0.39063982286536925
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac42:948c -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-goog-metageneration
5
access-control-expose-headers
*, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash
crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status
HIT
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3"
age
4
x-goog-stored-content-encoding
identity
expires
Fri, 12 Jun 2026 20:23:44 GMT
x-goog-stored-content-length
43
date
Sat, 13 Jun 2026 12:38:50 GMT
content-type
image/gif
last-modified
Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid
AAwnv3JMXkz3ZUQsLqzogVLXRUh4YB_2iVspb_DjiQ0uSiq9ZDNuQengWG2u3JEhwP_0kkXX
cache-control
public, max-age=86400
x-goog-storage-class
MULTI_REGIONAL
cf-ray
a0b12797d8b49501-NRT
accept-ranges
bytes
access-control-allow-origin
*
x-goog-generation
1620242732037093
content-length
43
server
cloudflare
GET
H3
200
favicon.ico Show response
ad.doubleclick.net/
1 KB
129 B
38ms
37ms
Fetch
image/x-icon
142.251.24.149
Google LLC
General
Full URL
https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.45062384193007365
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.24.149 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
rj-in-f149.1e100.net
Software
sffe /
Resource Hash
d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options
nosniff
expires
Sun, 14 Jun 2026 12:38:50 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 13 Jun 2026 12:38:50 GMT
content-type
image/x-icon
vary
Accept-Encoding
last-modified
Tue, 08 May 2012 13:08:06 GMT
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
content-length
104
x-xss-protection
0
server
sffe
GET
H2
200
runner.html Show response
ep2.adtrafficquality.google/sodar/sodar2/254/ Frame 523B
14 KB
6 KB
19ms
3ms
Document
text/html
2404:6800:400b:c006::84
Google LLC
General
Full URL
https://ep2.adtrafficquality.google/sodar/sodar2/254/runner.html
Requested by
Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/sodar2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:400b:c006::84 , Japan, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
fe2eddeaa8adad53d570fdeeb04412a07ec65ad99b25fe5beb092dfe4fb78cc9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.mediafire.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Linux"

Response headers

accept-ranges
bytes
age
2197
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=3000
content-encoding
gzip
content-length
5457
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
date
Sat, 13 Jun 2026 12:02:13 GMT
expires
Sat, 13 Jun 2026 12:52:13 GMT
last-modified
Wed, 01 Apr 2026 16:06:33 GMT
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server
sffe
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
GET
H3
200
aframe Show response
www.google.com/recaptcha/api2/ Frame 2D02
829 B
571 B
54ms
40ms
Document
text/html
142.251.155.119
Google LLC
General
Full URL
https://www.google.com/recaptcha/api2/aframe
Requested by
Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/sodar2.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.155.119 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
57d0f4cce3986f9b84224fcece55e57c32efa46b9078721c89fdb471fff689be
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-NB6wFvWtzHB48JjNFIqY5Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.mediafire.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Linux"

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=300
content-encoding
gzip
content-security-policy
script-src 'report-sample' 'nonce-NB6wFvWtzHB48JjNFIqY5Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-opener-policy-report-only
same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
cross-origin-resource-policy
cross-origin
date
Sat, 13 Jun 2026 12:38:50 GMT
expires
Sat, 13 Jun 2026 12:38:50 GMT
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
server
ESF
x-content-type-options
nosniff
x-xss-protection
0
POST
H2
200
v3 Show response
id5-sync.com/gm/
2 KB
2 KB
227ms
226ms
XHR
application/json
135.125.170.104
OVH OVH SAS
General
Full URL
https://id5-sync.com/gm/v3
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
135.125.170.104 , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS
ns3270128.ip-135-125-170.eu
Software
/
Resource Hash
58db8c4b619b75568a74a190ae75fd53397fc70f028f3e86b1cbe35a67593b7e
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
Content-Type
text/plain
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
access-control-allow-credentials
true
expires
Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin
https://www.mediafire.com
p3p
CP="CAO PSA OUR"
date
Sat, 13 Jun 2026 12:38:51 GMT
content-type
application/json
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
GET
H3
200
5qcCL5_oaynoDfE5WSt7CMdwNnn_mIPiRFdxDfBbpZQ.js Show response
pagead2.googlesyndication.com/bg/ Frame 523B
57 KB
22 KB
14ms
5ms
Script
text/javascript
142.251.24.155
Google LLC
General
Full URL
https://pagead2.googlesyndication.com/bg/5qcCL5_oaynoDfE5WSt7CMdwNnn_mIPiRFdxDfBbpZQ.js
Requested by
Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/sodar2/254/runner.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.24.155 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
rj-in-f155.1e100.net
Software
sffe /
Resource Hash
e6a7022f9fe86b29e80df139592b7b08c7703679ff9883e24457710df05ba594
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://ep2.adtrafficquality.google/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
age
251367
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
x-content-type-options
nosniff
expires
Thu, 10 Jun 2027 14:49:23 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 10 Jun 2026 14:49:23 GMT
last-modified
Mon, 08 Jun 2026 12:48:00 GMT
content-type
text/javascript
vary
Accept-Encoding
cache-control
public, max-age=31536000
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
accept-ranges
bytes
content-length
22437
x-xss-protection
0
server
sffe
GET
H3
204
sodar
pagead2.googlesyndication.com/pagead/ Frame 2D02
0
17 B
10ms
9ms
Image
image/
142.251.24.155
Google LLC
General
Full URL
https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=254&li=gpt_m202606090101&jk=1001161376096050&rc=
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.24.155 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
rj-in-f155.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

timing-allow-origin
*
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Sat, 13 Jun 2026 12:38:51 GMT
x-xss-protection
0
content-type
image/
server
cafe
GET
H2
204
generate_204
ep2.adtrafficquality.google/ Frame 523B
0
40 B
3ms
2ms
Image
text/plain
2404:6800:400b:c006::84
Google LLC
General
Full URL
https://ep2.adtrafficquality.google/generate_204?QemWzg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:400b:c006::84 , Japan, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://ep2.adtrafficquality.google/sodar/sodar2/254/runner.html
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
date
Sat, 13 Jun 2026 12:38:51 GMT
cross-origin-resource-policy
cross-origin
GET
H3
200
ads Show response
securepubads.g.doubleclick.net/gampad/
520 B
253 B
329ms
327ms
Fetch
text/plain
142.251.23.157
Google LLC
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1001161376096050&correlator=517119737388104&eid=31098216%2C95393146&output=ldjh&gdfp_req=1&vrg=202606090101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=9&didk=1697938527&dids=div-gpt-ad-mediafire_com-box-2&adfs=2211965457&sfv=1-0-45&rcs=1&eri=1&sc=1&cookie=ID%3Da72da8f8dac4dbe8%3AT%3D1781354330%3ART%3D1781354330%3AS%3DALNI_MZCBh_ptzlSFjn4mKG_I6_ZJqzdog&gpic=UID%3D0000146865d5f26d%3AT%3D1781354330%3ART%3D1781354330%3AS%3DALNI_MY7xi4RFbTEF4Q5wPKl_IsjF120uA&abxe=1&dt=1781354331160&lmt=1781354331&adxs=552&adys=10&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=2&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=540&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE0OS4wLjc4MjcuMTAyIixudWxsLDAsbnVsbCwiNjQiLFtbIkNocm9taXVtIiwiMTQ5LjAuMC4wIl0sWyJHb29nbGUgQ2hyb21lIiwiMTQ5LjAuMC4wIl0sWyJOb3QtQS5CcmFuZCIsIjI0LjAuMC4wIl1dLDBd&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F41kkjh07tibblti%2FAINCRAD%2BFF%2BINJECTOR.apk%2Ffile%3Fdkey%3Drv5x6b8wlt0%26r%3D125&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&a3p=EjYKDGFkc2VydmVyLm9yZxIkMGY1MTcxMjAtNjgzYy00Y2U5LTkyYWQtY2QxOTI2NmQ2ZGVkWAESmwEKCmNyaXRlby5jb20SigFOWGd6eTE5b2QxSnFTbko0VVc5TWNuaERkRmxyZDNOU2FFSnFTVUZ1Tm1Wek5URnJlVXQxV0RreU5IUWxNa0pzYVRoMU5IVnNOR2xtZHlVeVJuRnRaVWRNVm5WVGFXVTFTa1V6ZGxOb1ZFMTRlVGg0ZUd0T01GSjBRMDhsTWtZd1FTVXpSQ1V6UkFYARI0CgpwdWJjaWQub3JnEiQzYmZiZjdiZC1iNzY0LTQ2ZmItOWIyNC1kZDI3OTliZTJkOTFYARJaCg1jcndkY250cmwubmV0EkBmYjdlYzU1ZDI5ZGZjMjVkYWQzNWRjNGRlNDY3MTg1Y2EwMmM1MjBkZmNlZTk3OGUyZWMzMjIyZTc2ZDYzZmYwGPnz94fsM0gAEh0KDmVzcC5jcml0ZW8uY29tGLDw94fsM0gAUgIIZBIYCgl5YWhvby5jb20Y2_H3h-wzSABSAghvEhQKBW9wZW54GLDw94fsM0gAUgIIZBIXCghydGJob3VzZRix8PeH7DNIAFICCGQ.&dlt=1781354328063&idt=1996&ppid=5594807e3b73660db22cc026894621f4&uule=a%20cm9sZToxIHByb2R1Y2VyOjEyIGxvYzoiMTQwLTAwMDEsSlAi&prev_scp=a%3D1%26iid1%3D2274176620558%26eid%3D2274176620558%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D1%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252F41kkjh07tibblti%252FAINCRAD%252BFF%252BINJECTOR.apk%252Ffile%253Fdkey%253Drv5x6b8wlt0%2526r%253D125%26path%3D%252Ffile%252F41kkjh07tibblti%252FAINCRAD%252BFF%252BINJECTOR.apk%252Ffile%26ap%3D1103%26sap%3D1103%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-box-2%26tap%3Dmediafire_com-box-2-2274176620558%26eb_br%3Dbf9a045b836005b6c23b7b0749249612%26eba%3D0%26bv%3D11%26bvm%3D0%26bvr%3D1%26avc%3D43%26evc%3D36%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D26%26br2%3D26%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D157%2C168%2C0%2C0%2C0%2C168%2C184%2C20%2C0%2C0%2C192%2C31%2C902%2C903%2C901%2C902%2C903%26deal1%3D18%2C1428%2C2693%2C3052%2C3053%2C3856%2C7331%2C8229%2C8333%2C8334%2C8335%26osb%3DLinux%252FChrome%26dbg%3Drc%253A2%26reqt%3D1781354330593&adks=3106951849&frm=20&eo_id_str=ID%3Dc9df7b54bcd371a2%3AT%3D1781354330%3ART%3D1781354330%3AS%3DAA-Afja4gVi1oGpU66Pr7KR0wygQ&pbbce=1
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.23.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
rl-in-f157.1e100.net
Software
cafe /
Resource Hash
ed1e8e91099715b5b8c29748f9bfcd11d9696ca83c34dad258179ec55ba84b75
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
dcb
google-lineitem-id
-2
observe-browsing-topics
?1
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sat, 13 Jun 2026 12:38:51 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-2
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
223
x-xss-protection
0
server
cafe
GET
H3
200
ads Show response
securepubads.g.doubleclick.net/gampad/
60 KB
9 KB
354ms
354ms
Fetch
text/plain
142.251.23.157
Google LLC
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1001161376096050&correlator=2518078752565741&eid=31098216%2C95393146&output=ldjh&gdfp_req=1&vrg=202606090101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-edge-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=160x600&ifi=10&didk=2994273263&dids=div-gpt-ad-mediafire_com-edge-&adfs=580935078&sfv=1-0-45&rcs=1&eri=1&sc=1&cookie=ID%3Da72da8f8dac4dbe8%3AT%3D1781354330%3ART%3D1781354330%3AS%3DALNI_MZCBh_ptzlSFjn4mKG_I6_ZJqzdog&gpic=UID%3D0000146865d5f26d%3AT%3D1781354330%3ART%3D1781354330%3AS%3DALNI_MY7xi4RFbTEF4Q5wPKl_IsjF120uA&abxe=1&dt=1781354331176&lmt=1781354331&adxs=0&adys=300&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=3&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=540&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE0OS4wLjc4MjcuMTAyIixudWxsLDAsbnVsbCwiNjQiLFtbIkNocm9taXVtIiwiMTQ5LjAuMC4wIl0sWyJHb29nbGUgQ2hyb21lIiwiMTQ5LjAuMC4wIl0sWyJOb3QtQS5CcmFuZCIsIjI0LjAuMC4wIl1dLDBd&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F41kkjh07tibblti%2FAINCRAD%2BFF%2BINJECTOR.apk%2Ffile%3Fdkey%3Drv5x6b8wlt0%26r%3D125&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&a3p=EjYKDGFkc2VydmVyLm9yZxIkMGY1MTcxMjAtNjgzYy00Y2U5LTkyYWQtY2QxOTI2NmQ2ZGVkWAESmwEKCmNyaXRlby5jb20SigFOWGd6eTE5b2QxSnFTbko0VVc5TWNuaERkRmxyZDNOU2FFSnFTVUZ1Tm1Wek5URnJlVXQxV0RreU5IUWxNa0pzYVRoMU5IVnNOR2xtZHlVeVJuRnRaVWRNVm5WVGFXVTFTa1V6ZGxOb1ZFMTRlVGg0ZUd0T01GSjBRMDhsTWtZd1FTVXpSQ1V6UkFYARI0CgpwdWJjaWQub3JnEiQzYmZiZjdiZC1iNzY0LTQ2ZmItOWIyNC1kZDI3OTliZTJkOTFYARJaCg1jcndkY250cmwubmV0EkBmYjdlYzU1ZDI5ZGZjMjVkYWQzNWRjNGRlNDY3MTg1Y2EwMmM1MjBkZmNlZTk3OGUyZWMzMjIyZTc2ZDYzZmYwGPnz94fsM0gAEh0KDmVzcC5jcml0ZW8uY29tGLDw94fsM0gAUgIIZBIYCgl5YWhvby5jb20Y2_H3h-wzSABSAghvEhQKBW9wZW54GLDw94fsM0gAUgIIZBIXCghydGJob3VzZRix8PeH7DNIAFICCGQ.&dlt=1781354328063&idt=1996&ppid=5594807e3b73660db22cc026894621f4&uule=a%20cm9sZToxIHByb2R1Y2VyOjEyIGxvYzoiMTQwLTAwMDEsSlAi&prev_scp=a%3D1%26iid1%3D8913019870657068%26eid%3D8913019870657068%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D1%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252F41kkjh07tibblti%252FAINCRAD%252BFF%252BINJECTOR.apk%252Ffile%253Fdkey%253Drv5x6b8wlt0%2526r%253D125%26path%3D%252Ffile%252F41kkjh07tibblti%252FAINCRAD%252BFF%252BINJECTOR.apk%252Ffile%26ap%3D1101%26sap%3D1101%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D4%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D38%26al%3D1038%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-edge-1%26tap%3Dmediafire_com-edge-1-8913019870657068%26eb_br%3D54d0fa6d5f6aabe7623cb24faa42a441%26eba%3D0%26bv%3D23%26bvm%3D0%26bvr%3D3%26avc%3D20%26evc%3D25%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D30%26br2%3D28%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D157%2C131%2C0%2C0%2C0%2C168%2C184%2C20%2C0%2C0%2C192%2C31%2C902%2C903%2C901%2C902%2C903%26deal1%3D2693%2C3053%2C7331%2C8290%2C8299%2C8335%26osb%3DLinux%252FChrome%26dbg%3Drc%253A3%26reqt%3D1781354330544&adks=966014519&frm=20&eo_id_str=ID%3Dc9df7b54bcd371a2%3AT%3D1781354330%3ART%3D1781354330%3AS%3DAA-Afja4gVi1oGpU66Pr7KR0wygQ&pbbce=1
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.23.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
rl-in-f157.1e100.net
Software
cafe /
Resource Hash
39593d60b1858399a28bd01a6f53cb9916e4d90e9bd3667425c63b511da1d0d9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

access-control-expose-headers
x-google-amp-ad-validated-version
content-encoding
dcb
google-lineitem-id
-1
observe-browsing-topics
?1
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sat, 13 Jun 2026 12:38:51 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-1
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
8840
x-xss-protection
0
server
cafe
GET
H3
200
ads Show response
securepubads.g.doubleclick.net/gampad/
523 B
253 B
353ms
352ms
Fetch
text/plain
142.251.23.157
Google LLC
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1001161376096050&correlator=2936350619072760&eid=31098216%2C95393146&output=ldjh&gdfp_req=1&vrg=202606090101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-banner-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=11&didk=417644066&dids=div-gpt-ad-mediafire_com-banne&adfs=4128408292&sfv=1-0-45&rcs=1&eri=1&sc=1&cookie=ID%3Da72da8f8dac4dbe8%3AT%3D1781354330%3ART%3D1781354330%3AS%3DALNI_MZCBh_ptzlSFjn4mKG_I6_ZJqzdog&gpic=UID%3D0000146865d5f26d%3AT%3D1781354330%3ART%3D1781354330%3AS%3DALNI_MY7xi4RFbTEF4Q5wPKl_IsjF120uA&abxe=1&dt=1781354331184&lmt=1781354331&adxs=436&adys=1410&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=2&ucis=1&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=540&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE0OS4wLjc4MjcuMTAyIixudWxsLDAsbnVsbCwiNjQiLFtbIkNocm9taXVtIiwiMTQ5LjAuMC4wIl0sWyJHb29nbGUgQ2hyb21lIiwiMTQ5LjAuMC4wIl0sWyJOb3QtQS5CcmFuZCIsIjI0LjAuMC4wIl1dLDBd&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F41kkjh07tibblti%2FAINCRAD%2BFF%2BINJECTOR.apk%2Ffile%3Fdkey%3Drv5x6b8wlt0%26r%3D125&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&a3p=EjYKDGFkc2VydmVyLm9yZxIkMGY1MTcxMjAtNjgzYy00Y2U5LTkyYWQtY2QxOTI2NmQ2ZGVkWAESmwEKCmNyaXRlby5jb20SigFOWGd6eTE5b2QxSnFTbko0VVc5TWNuaERkRmxyZDNOU2FFSnFTVUZ1Tm1Wek5URnJlVXQxV0RreU5IUWxNa0pzYVRoMU5IVnNOR2xtZHlVeVJuRnRaVWRNVm5WVGFXVTFTa1V6ZGxOb1ZFMTRlVGg0ZUd0T01GSjBRMDhsTWtZd1FTVXpSQ1V6UkFYARI0CgpwdWJjaWQub3JnEiQzYmZiZjdiZC1iNzY0LTQ2ZmItOWIyNC1kZDI3OTliZTJkOTFYARJaCg1jcndkY250cmwubmV0EkBmYjdlYzU1ZDI5ZGZjMjVkYWQzNWRjNGRlNDY3MTg1Y2EwMmM1MjBkZmNlZTk3OGUyZWMzMjIyZTc2ZDYzZmYwGPnz94fsM0gAEh0KDmVzcC5jcml0ZW8uY29tGLDw94fsM0gAUgIIZBIYCgl5YWhvby5jb20Y2_H3h-wzSABSAghvEhQKBW9wZW54GLDw94fsM0gAUgIIZBIXCghydGJob3VzZRix8PeH7DNIAFICCGQ.&dlt=1781354328063&idt=1996&ppid=5594807e3b73660db22cc026894621f4&uule=a%20cm9sZToxIHByb2R1Y2VyOjEyIGxvYzoiMTQwLTAwMDEsSlAi&prev_scp=a%3D1%26iid1%3D386838486652581%26eid%3D386838486652581%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D1%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252F41kkjh07tibblti%252FAINCRAD%252BFF%252BINJECTOR.apk%252Ffile%253Fdkey%253Drv5x6b8wlt0%2526r%253D125%26path%3D%252Ffile%252F41kkjh07tibblti%252FAINCRAD%252BFF%252BINJECTOR.apk%252Ffile%26ap%3D1107%26sap%3D1107%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D9%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D30%26al%3D1030%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-banner-1%26tap%3Dmediafire_com-banner-1-386838486652581%26eb_br%3D14e8a85d4c42ff1db8790cbef9e33493%26eba%3D0%26bv%3D11%26bvm%3D0%26bvr%3D1%26avc%3D21%26evc%3D27%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D12%26br2%3D12%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D32%2C193%2C0%2C0%2C0%2C131%2C132%2C0%2C0%2C0%2C187%2C0%2C901%2C182%2C901%2C902%2C903%26deal1%3D3052%2C3856%2C8229%26osb%3DLinux%252FChrome%26dbg%3Drc%253A1%26reqt%3D1781354330633&adks=3665333008&frm=20&eo_id_str=ID%3Dc9df7b54bcd371a2%3AT%3D1781354330%3ART%3D1781354330%3AS%3DAA-Afja4gVi1oGpU66Pr7KR0wygQ&pbbce=1
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.23.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
rl-in-f157.1e100.net
Software
cafe /
Resource Hash
76382cf74ce4ab45eb4bcd033c2d89b991f7a29a08a173dcfdde8f03573ee006
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
dcb
google-lineitem-id
-2
observe-browsing-topics
?1
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sat, 13 Jun 2026 12:38:51 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-2
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
223
x-xss-protection
0
server
cafe
GET
H3
200
ads Show response
securepubads.g.doubleclick.net/gampad/
530 B
262 B
308ms
308ms
Fetch
text/plain
142.251.23.157
Google LLC
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1001161376096050&correlator=3038180864037434&eid=31098216%2C95393146&output=ldjh&gdfp_req=1&vrg=202606090101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-medrectangle-3&enc_prev_ius=%2F0%2F1&prev_iu_szs=336x280&ifi=12&didk=46179496&dids=div-gpt-ad-mediafire_com-medre&adfs=1911771697&sfv=1-0-45&rcs=1&eri=1&sc=1&cookie=ID%3Da72da8f8dac4dbe8%3AT%3D1781354330%3ART%3D1781354330%3AS%3DALNI_MZCBh_ptzlSFjn4mKG_I6_ZJqzdog&gpic=UID%3D0000146865d5f26d%3AT%3D1781354330%3ART%3D1781354330%3AS%3DALNI_MY7xi4RFbTEF4Q5wPKl_IsjF120uA&abxe=1&dt=1781354331189&lmt=1781354331&adxs=320&adys=120&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=7&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=540&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE0OS4wLjc4MjcuMTAyIixudWxsLDAsbnVsbCwiNjQiLFtbIkNocm9taXVtIiwiMTQ5LjAuMC4wIl0sWyJHb29nbGUgQ2hyb21lIiwiMTQ5LjAuMC4wIl0sWyJOb3QtQS5CcmFuZCIsIjI0LjAuMC4wIl1dLDBd&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F41kkjh07tibblti%2FAINCRAD%2BFF%2BINJECTOR.apk%2Ffile%3Fdkey%3Drv5x6b8wlt0%26r%3D125&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&a3p=EjYKDGFkc2VydmVyLm9yZxIkMGY1MTcxMjAtNjgzYy00Y2U5LTkyYWQtY2QxOTI2NmQ2ZGVkWAESmwEKCmNyaXRlby5jb20SigFOWGd6eTE5b2QxSnFTbko0VVc5TWNuaERkRmxyZDNOU2FFSnFTVUZ1Tm1Wek5URnJlVXQxV0RreU5IUWxNa0pzYVRoMU5IVnNOR2xtZHlVeVJuRnRaVWRNVm5WVGFXVTFTa1V6ZGxOb1ZFMTRlVGg0ZUd0T01GSjBRMDhsTWtZd1FTVXpSQ1V6UkFYARI0CgpwdWJjaWQub3JnEiQzYmZiZjdiZC1iNzY0LTQ2ZmItOWIyNC1kZDI3OTliZTJkOTFYARJaCg1jcndkY250cmwubmV0EkBmYjdlYzU1ZDI5ZGZjMjVkYWQzNWRjNGRlNDY3MTg1Y2EwMmM1MjBkZmNlZTk3OGUyZWMzMjIyZTc2ZDYzZmYwGPnz94fsM0gAEh0KDmVzcC5jcml0ZW8uY29tGLDw94fsM0gAUgIIZBIYCgl5YWhvby5jb20Y2_H3h-wzSABSAghvEhQKBW9wZW54GLDw94fsM0gAUgIIZBIXCghydGJob3VzZRix8PeH7DNIAFICCGQ.&dlt=1781354328063&idt=1996&ppid=5594807e3b73660db22cc026894621f4&uule=a%20cm9sZToxIHByb2R1Y2VyOjEyIGxvYzoiMTQwLTAwMDEsSlAi&prev_scp=a%3D1%26iid1%3D4784697890653043%26eid%3D4784697890653043%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D1%26adnum%3D2%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252F41kkjh07tibblti%252FAINCRAD%252BFF%252BINJECTOR.apk%252Ffile%253Fdkey%253Drv5x6b8wlt0%2526r%253D125%26path%3D%252Ffile%252F41kkjh07tibblti%252FAINCRAD%252BFF%252BINJECTOR.apk%252Ffile%26ap%3D1104%26sap%3D1104%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D5%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D21%26al%3D1021%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-medrectangle-3%26tap%3Dmediafire_com-medrectangle-3-4784697890653043%26eb_br%3Dee685f77592ce296910ee91457d66ba3%26eba%3D0%26bv%3D11%26bvm%3D0%26bvr%3D1%26avc%3D45%26evc%3D38%26shp%3D3%26ftsn%3D12%26ftsng%3D12%26br1%3D40%26br2%3D20%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D78%2C168%2C0%2C0%2C0%2C131%2C132%2C0%2C0%2C0%2C187%2C0%2C901%2C182%2C901%2C902%2C903%26osb%3DLinux%252FChrome%26dbg%3Drc%253A7%26reqt%3D1781354330718&adks=4079446691&frm=20&eo_id_str=ID%3Dc9df7b54bcd371a2%3AT%3D1781354330%3ART%3D1781354330%3AS%3DAA-Afja4gVi1oGpU66Pr7KR0wygQ&pbbce=1
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.23.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
rl-in-f157.1e100.net
Software
cafe /
Resource Hash
b0e1c971e01bd6e96d4cfee0ed2beee1a883728b9315176070ef9edae3df2af7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
dcb
google-lineitem-id
-2
observe-browsing-topics
?1
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sat, 13 Jun 2026 12:38:51 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-2
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
232
x-xss-protection
0
server
cafe
GET
H3
200
ads Show response
securepubads.g.doubleclick.net/gampad/
529 B
264 B
304ms
304ms
Fetch
text/plain
142.251.23.157
Google LLC
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1001161376096050&correlator=3141026648679646&eid=31098216%2C95393146&output=ldjh&gdfp_req=1&vrg=202606090101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=13&didk=219167732&dids=div-gpt-ad-mediafire_com-medre&adfs=2995551083&sfv=1-0-45&rcs=1&eri=1&sc=1&cookie=ID%3Da72da8f8dac4dbe8%3AT%3D1781354330%3ART%3D1781354330%3AS%3DALNI_MZCBh_ptzlSFjn4mKG_I6_ZJqzdog&gpic=UID%3D0000146865d5f26d%3AT%3D1781354330%3ART%3D1781354330%3AS%3DALNI_MY7xi4RFbTEF4Q5wPKl_IsjF120uA&abxe=1&dt=1781354331194&lmt=1781354331&adxs=795&adys=1109&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=6&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=540&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE0OS4wLjc4MjcuMTAyIixudWxsLDAsbnVsbCwiNjQiLFtbIkNocm9taXVtIiwiMTQ5LjAuMC4wIl0sWyJHb29nbGUgQ2hyb21lIiwiMTQ5LjAuMC4wIl0sWyJOb3QtQS5CcmFuZCIsIjI0LjAuMC4wIl1dLDBd&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F41kkjh07tibblti%2FAINCRAD%2BFF%2BINJECTOR.apk%2Ffile%3Fdkey%3Drv5x6b8wlt0%26r%3D125&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&a3p=EjYKDGFkc2VydmVyLm9yZxIkMGY1MTcxMjAtNjgzYy00Y2U5LTkyYWQtY2QxOTI2NmQ2ZGVkWAESmwEKCmNyaXRlby5jb20SigFOWGd6eTE5b2QxSnFTbko0VVc5TWNuaERkRmxyZDNOU2FFSnFTVUZ1Tm1Wek5URnJlVXQxV0RreU5IUWxNa0pzYVRoMU5IVnNOR2xtZHlVeVJuRnRaVWRNVm5WVGFXVTFTa1V6ZGxOb1ZFMTRlVGg0ZUd0T01GSjBRMDhsTWtZd1FTVXpSQ1V6UkFYARI0CgpwdWJjaWQub3JnEiQzYmZiZjdiZC1iNzY0LTQ2ZmItOWIyNC1kZDI3OTliZTJkOTFYARJaCg1jcndkY250cmwubmV0EkBmYjdlYzU1ZDI5ZGZjMjVkYWQzNWRjNGRlNDY3MTg1Y2EwMmM1MjBkZmNlZTk3OGUyZWMzMjIyZTc2ZDYzZmYwGPnz94fsM0gAEh0KDmVzcC5jcml0ZW8uY29tGLDw94fsM0gAUgIIZBIYCgl5YWhvby5jb20Y2_H3h-wzSABSAghvEhQKBW9wZW54GLDw94fsM0gAUgIIZBIXCghydGJob3VzZRix8PeH7DNIAFICCGQ.&dlt=1781354328063&idt=1996&ppid=5594807e3b73660db22cc026894621f4&uule=a%20cm9sZToxIHByb2R1Y2VyOjEyIGxvYzoiMTQwLTAwMDEsSlAi&prev_scp=a%3D1%26iid1%3D8074675296629805%26eid%3D8074675296629805%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D1%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252F41kkjh07tibblti%252FAINCRAD%252BFF%252BINJECTOR.apk%252Ffile%253Fdkey%253Drv5x6b8wlt0%2526r%253D125%26path%3D%252Ffile%252F41kkjh07tibblti%252FAINCRAD%252BFF%252BINJECTOR.apk%252Ffile%26ap%3D1100%26sap%3D1100%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D8%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-medrectangle-2%26tap%3Dmediafire_com-medrectangle-2-8074675296629805%26eb_br%3D9c3e4ee8eae7f1433cb2fe69b1326605%26eba%3D0%26bv%3D24%26bvm%3D0%26bvr%3D2%26avc%3D23%26evc%3D25%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D4%26br2%3D2%26ezoic%3D1%26nmau%3D2%26mau%3D1%26dac%3D1%26stl%3D32%2C131%2C0%2C0%2C0%2C131%2C132%2C0%2C0%2C0%2C187%2C0%2C901%2C182%2C901%2C902%2C903%26osb%3DLinux%252FChrome%26dbg%3Dadap%253A1%2Crc%253A6%26reqt%3D1781354330554&adks=1277576459&frm=20&eo_id_str=ID%3Dc9df7b54bcd371a2%3AT%3D1781354330%3ART%3D1781354330%3AS%3DAA-Afja4gVi1oGpU66Pr7KR0wygQ&pbbce=1
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.23.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
rl-in-f157.1e100.net
Software
cafe /
Resource Hash
59377c67e4abd19dc6fee9800b0b9383958655bb52dec02e4d700a373cd337a7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
dcb
google-lineitem-id
-2
observe-browsing-topics
?1
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sat, 13 Jun 2026 12:38:51 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-2
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
234
x-xss-protection
0
server
cafe
GET
H3
200
ads Show response
securepubads.g.doubleclick.net/gampad/
522 B
255 B
258ms
258ms
Fetch
text/plain
142.251.23.157
Google LLC
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1001161376096050&correlator=1671896586908675&eid=31098216%2C95393146&output=ldjh&gdfp_req=1&vrg=202606090101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-edge-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=160x600&ifi=14&didk=2994425013&dids=div-gpt-ad-mediafire_com-edge-&adfs=982453029&sfv=1-0-45&rcs=1&eri=1&sc=1&cookie=ID%3Da72da8f8dac4dbe8%3AT%3D1781354330%3ART%3D1781354330%3AS%3DALNI_MZCBh_ptzlSFjn4mKG_I6_ZJqzdog&gpic=UID%3D0000146865d5f26d%3AT%3D1781354330%3ART%3D1781354330%3AS%3DALNI_MY7xi4RFbTEF4Q5wPKl_IsjF120uA&abxe=1&dt=1781354331199&lmt=1781354331&adxs=1440&adys=300&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=4&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=540&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE0OS4wLjc4MjcuMTAyIixudWxsLDAsbnVsbCwiNjQiLFtbIkNocm9taXVtIiwiMTQ5LjAuMC4wIl0sWyJHb29nbGUgQ2hyb21lIiwiMTQ5LjAuMC4wIl0sWyJOb3QtQS5CcmFuZCIsIjI0LjAuMC4wIl1dLDBd&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F41kkjh07tibblti%2FAINCRAD%2BFF%2BINJECTOR.apk%2Ffile%3Fdkey%3Drv5x6b8wlt0%26r%3D125&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&a3p=EjYKDGFkc2VydmVyLm9yZxIkMGY1MTcxMjAtNjgzYy00Y2U5LTkyYWQtY2QxOTI2NmQ2ZGVkWAESmwEKCmNyaXRlby5jb20SigFOWGd6eTE5b2QxSnFTbko0VVc5TWNuaERkRmxyZDNOU2FFSnFTVUZ1Tm1Wek5URnJlVXQxV0RreU5IUWxNa0pzYVRoMU5IVnNOR2xtZHlVeVJuRnRaVWRNVm5WVGFXVTFTa1V6ZGxOb1ZFMTRlVGg0ZUd0T01GSjBRMDhsTWtZd1FTVXpSQ1V6UkFYARI0CgpwdWJjaWQub3JnEiQzYmZiZjdiZC1iNzY0LTQ2ZmItOWIyNC1kZDI3OTliZTJkOTFYARJaCg1jcndkY250cmwubmV0EkBmYjdlYzU1ZDI5ZGZjMjVkYWQzNWRjNGRlNDY3MTg1Y2EwMmM1MjBkZmNlZTk3OGUyZWMzMjIyZTc2ZDYzZmYwGPnz94fsM0gAEh0KDmVzcC5jcml0ZW8uY29tGLDw94fsM0gAUgIIZBIYCgl5YWhvby5jb20Y2_H3h-wzSABSAghvEhQKBW9wZW54GLDw94fsM0gAUgIIZBIXCghydGJob3VzZRix8PeH7DNIAFICCGQ.&dlt=1781354328063&idt=1996&ppid=5594807e3b73660db22cc026894621f4&uule=a%20cm9sZToxIHByb2R1Y2VyOjEyIGxvYzoiMTQwLTAwMDEsSlAi&prev_scp=a%3D1%26iid1%3D8854121008628726%26eid%3D8854121008628726%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D1%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252F41kkjh07tibblti%252FAINCRAD%252BFF%252BINJECTOR.apk%252Ffile%253Fdkey%253Drv5x6b8wlt0%2526r%253D125%26path%3D%252Ffile%252F41kkjh07tibblti%252FAINCRAD%252BFF%252BINJECTOR.apk%252Ffile%26ap%3D1102%26sap%3D1102%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D3%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D39%26al%3D1039%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-edge-2%26tap%3Dmediafire_com-edge-2-8854121008628726%26eb_br%3D2e8b8c60843e52e5aaa1e3a52287a2bb%26eba%3D0%26bv%3D54%26bvm%3D0%26bvr%3D15%26avc%3D25%26evc%3D27%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D8%26br2%3D8%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D157%2C131%2C0%2C0%2C0%2C168%2C184%2C20%2C0%2C0%2C192%2C31%2C902%2C903%2C901%2C902%2C903%26deal1%3D3856%26osb%3DLinux%252FChrome%26dbg%3Drc%253A4%26reqt%3D1781354330539&adks=697308627&frm=20&eo_id_str=ID%3Dc9df7b54bcd371a2%3AT%3D1781354330%3ART%3D1781354330%3AS%3DAA-Afja4gVi1oGpU66Pr7KR0wygQ&pbbce=1
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.23.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
rl-in-f157.1e100.net
Software
cafe /
Resource Hash
5ad32e1ddfb68ed8df6e2b675b777a6e71238dd0ac6fedb136342734e2d37f82
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
dcb
google-lineitem-id
-2
observe-browsing-topics
?1
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sat, 13 Jun 2026 12:38:51 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-2
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
225
x-xss-protection
0
server
cafe
GET

match
ps.eyeota.net/
Redirect Chain
  • https://id5-sync.com/i/457/8.gif?o=api&id5id=ID5*2BKGCmvglNTKHQFTn07tHCcEg6i_BVEa5P-F05APPgn__2otT1taAAEBCmotT1oAuKdvnv_krGSQhoNFtPbzhQ&gdpr_consent=&gdpr=false
  • https://eb2.3lift.com/getuid?redir=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F170%2F7%2F2.gif%3Fpuid%3D%24UID%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&cmp_cs=
  • https://eb2.3lift.com/getuid?ld=1&gdpr=0&cmp_cs=&us_privacy=&redir=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F170%2F7%2F2.gif%3Fpuid%3D%24UID%26gdpr%3D0%26gdpr_consent%3D
  • https://id5-sync.com/c/457/170/7/2.gif?puid=1442466936165105232497&gdpr=0&gdpr_consent=
  • https://pixel.tapad.com/idsync/ex/push?partner_id=2922&partner_url=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F108%2F6%2F3.gif%3Fpuid%3D%24%7BTA_DEVICE_ID%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_con...
  • https://id5-sync.com/c/457/108/6/3.gif?puid=1a939850-f88b-4746-a81a-76f7cf5f305d&gdpr=0&gdpr_consent=
  • https://ib.adnxs.com/getuid?https://id5-sync.com/c/457/2/5/4.gif?puid=$UID&gdpr=0&gdpr_consent=
  • https://id5-sync.com/c/457/2/5/4.gif?puid=1314968767185625243&gdpr=0&gdpr_consent=
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=8h9u11h&ttd_tpi=1&gdpr=0&gdpr_consent=
  • https://id5-sync.com/k/264.gif?puid=0f517120-683c-4ce9-92ad-cd19266d6ded&ttl=%%TTL%%
  • https://rtb.gumgum.com/getuid/id5?r=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F441%2F3%2F6.gif%3Fpuid%3D%5BUID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=
  • https://id5-sync.com/c/457/441/3/6.gif?puid=a_b01e4b5c-f5af-49cf-92e1-8a10bc11d763&gdpr=0&gdpr_consent=
  • https://sync.crwdcntrl.net/map/c=13953/tp=IDFI/gdpr=0/gdpr_consent=?https://id5-sync.com/c/457/19/2/7.gif?puid=${profile_id}&gdpr=0&gdpr_consent=
  • https://id5-sync.com/c/457/19/2/7.gif?puid=522f503f52da3f25f1c2a54198675e&gdpr=0&gdpr_consent=
  • https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&bid=1mpr7m0&r=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F123%2F1%2F8.gif%3Fpuid%3D%7BUUID%7D%26gdpr%3D0%26gdpr_consent%3D
0
0


POST
H2
200
v3 Show response
id5-sync.com/gm/
2 KB
3 KB
242ms
241ms
XHR
application/json
135.125.170.104
OVH OVH SAS
General
Full URL
https://id5-sync.com/gm/v3
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
135.125.170.104 , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS
ns3270128.ip-135-125-170.eu
Software
/
Resource Hash
c289b9aaa1c8a69478679cb4a1f9ee046b4d6a303448cc67d0babcca102cff16
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
Content-Type
text/plain
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
access-control-allow-credentials
true
expires
Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin
https://www.mediafire.com
p3p
CP="CAO PSA OUR"
date
Sat, 13 Jun 2026 12:38:51 GMT
content-type
application/json
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
GET
H3
200
ads Show response
securepubads.g.doubleclick.net/gampad/
530 B
253 B
330ms
329ms
Fetch
text/plain
142.251.23.157
Google LLC
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1001161376096050&correlator=1752911806818277&eid=31098216%2C95393146&output=ldjh&gdfp_req=1&vrg=202606090101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-medrectangle-4&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250%7C336x280&ifi=15&didk=46192883&dids=div-gpt-ad-mediafire_com-medre&adfs=1749122204&sfv=1-0-45&rcs=1&eri=1&sc=1&cookie=ID%3Da72da8f8dac4dbe8%3AT%3D1781354330%3ART%3D1781354330%3AS%3DALNI_MZCBh_ptzlSFjn4mKG_I6_ZJqzdog&gpic=UID%3D0000146865d5f26d%3AT%3D1781354330%3ART%3D1781354330%3AS%3DALNI_MY7xi4RFbTEF4Q5wPKl_IsjF120uA&abxe=1&dt=1781354331206&lmt=1781354331&adxs=320&adys=420&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=8&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=540&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE0OS4wLjc4MjcuMTAyIixudWxsLDAsbnVsbCwiNjQiLFtbIkNocm9taXVtIiwiMTQ5LjAuMC4wIl0sWyJHb29nbGUgQ2hyb21lIiwiMTQ5LjAuMC4wIl0sWyJOb3QtQS5CcmFuZCIsIjI0LjAuMC4wIl1dLDBd&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F41kkjh07tibblti%2FAINCRAD%2BFF%2BINJECTOR.apk%2Ffile%3Fdkey%3Drv5x6b8wlt0%26r%3D125&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&a3p=EjYKDGFkc2VydmVyLm9yZxIkMGY1MTcxMjAtNjgzYy00Y2U5LTkyYWQtY2QxOTI2NmQ2ZGVkWAESmwEKCmNyaXRlby5jb20SigFOWGd6eTE5b2QxSnFTbko0VVc5TWNuaERkRmxyZDNOU2FFSnFTVUZ1Tm1Wek5URnJlVXQxV0RreU5IUWxNa0pzYVRoMU5IVnNOR2xtZHlVeVJuRnRaVWRNVm5WVGFXVTFTa1V6ZGxOb1ZFMTRlVGg0ZUd0T01GSjBRMDhsTWtZd1FTVXpSQ1V6UkFYARI0CgpwdWJjaWQub3JnEiQzYmZiZjdiZC1iNzY0LTQ2ZmItOWIyNC1kZDI3OTliZTJkOTFYARJaCg1jcndkY250cmwubmV0EkBmYjdlYzU1ZDI5ZGZjMjVkYWQzNWRjNGRlNDY3MTg1Y2EwMmM1MjBkZmNlZTk3OGUyZWMzMjIyZTc2ZDYzZmYwGPnz94fsM0gAEh0KDmVzcC5jcml0ZW8uY29tGLDw94fsM0gAUgIIZBIYCgl5YWhvby5jb20Y2_H3h-wzSABSAghvEhQKBW9wZW54GLDw94fsM0gAUgIIZBIXCghydGJob3VzZRix8PeH7DNIAFICCGQ.&dlt=1781354328063&idt=1996&ppid=5594807e3b73660db22cc026894621f4&uule=a%20cm9sZToxIHByb2R1Y2VyOjEyIGxvYzoiMTQwLTAwMDEsSlAi&prev_scp=a%3D1%26iid1%3D6879819124653894%26eid%3D6879819124653894%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D1%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252F41kkjh07tibblti%252FAINCRAD%252BFF%252BINJECTOR.apk%252Ffile%253Fdkey%253Drv5x6b8wlt0%2526r%253D125%26path%3D%252Ffile%252F41kkjh07tibblti%252FAINCRAD%252BFF%252BINJECTOR.apk%252Ffile%26ap%3D1105%26sap%3D1105%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D6%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D22%26al%3D1022%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-medrectangle-4%26tap%3Dmediafire_com-medrectangle-4-6879819124653894%26eb_br%3Dad0061a38dd7c6f7bcb692aee88dfda4%26eba%3D0%26bv%3D11%26bvm%3D0%26bvr%3D1%26avc%3D33%26evc%3D31%26shp%3D3%26ftsn%3D12%26ftsng%3D12%26br1%3D14%26br2%3D14%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D78%2C168%2C0%2C0%2C0%2C131%2C142%2C0%2C0%2C0%2C187%2C0%2C901%2C182%2C901%2C902%2C903%26deal1%3D18%2C1428%2C3052%2C3856%2C8229%2C8333%26osb%3DLinux%252FChrome%26dbg%3Drc%253A8%26reqt%3D1781354330548&adks=2877670411&frm=20&eo_id_str=ID%3Dc9df7b54bcd371a2%3AT%3D1781354330%3ART%3D1781354330%3AS%3DAA-Afja4gVi1oGpU66Pr7KR0wygQ&pbbce=1
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.23.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
rl-in-f157.1e100.net
Software
cafe /
Resource Hash
904431e8567e9c3d82cd397fc851a83079e07453c6be22f39db889532abec1d7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
dcb
google-lineitem-id
-2
observe-browsing-topics
?1
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sat, 13 Jun 2026 12:38:51 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-2
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
223
x-xss-protection
0
server
cafe
GET
H3
200
ads Show response
securepubads.g.doubleclick.net/gampad/
529 B
263 B
256ms
255ms
Fetch
text/plain
142.251.23.157
Google LLC
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1001161376096050&correlator=196812701584885&eid=31098216%2C95393146&output=ldjh&gdfp_req=1&vrg=202606090101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=16&didk=46178465&dids=div-gpt-ad-mediafire_com-medre&adfs=1959198455&sfv=1-0-45&rcs=1&eri=1&sc=1&cookie=ID%3Da72da8f8dac4dbe8%3AT%3D1781354330%3ART%3D1781354330%3AS%3DALNI_MZCBh_ptzlSFjn4mKG_I6_ZJqzdog&gpic=UID%3D0000146865d5f26d%3AT%3D1781354330%3ART%3D1781354330%3AS%3DALNI_MY7xi4RFbTEF4Q5wPKl_IsjF120uA&abxe=1&dt=1781354331209&lmt=1781354331&adxs=27&adys=1109&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=5&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=540&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE0OS4wLjc4MjcuMTAyIixudWxsLDAsbnVsbCwiNjQiLFtbIkNocm9taXVtIiwiMTQ5LjAuMC4wIl0sWyJHb29nbGUgQ2hyb21lIiwiMTQ5LjAuMC4wIl0sWyJOb3QtQS5CcmFuZCIsIjI0LjAuMC4wIl1dLDBd&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F41kkjh07tibblti%2FAINCRAD%2BFF%2BINJECTOR.apk%2Ffile%3Fdkey%3Drv5x6b8wlt0%26r%3D125&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&a3p=EjYKDGFkc2VydmVyLm9yZxIkMGY1MTcxMjAtNjgzYy00Y2U5LTkyYWQtY2QxOTI2NmQ2ZGVkWAESmwEKCmNyaXRlby5jb20SigFOWGd6eTE5b2QxSnFTbko0VVc5TWNuaERkRmxyZDNOU2FFSnFTVUZ1Tm1Wek5URnJlVXQxV0RreU5IUWxNa0pzYVRoMU5IVnNOR2xtZHlVeVJuRnRaVWRNVm5WVGFXVTFTa1V6ZGxOb1ZFMTRlVGg0ZUd0T01GSjBRMDhsTWtZd1FTVXpSQ1V6UkFYARI0CgpwdWJjaWQub3JnEiQzYmZiZjdiZC1iNzY0LTQ2ZmItOWIyNC1kZDI3OTliZTJkOTFYARJaCg1jcndkY250cmwubmV0EkBmYjdlYzU1ZDI5ZGZjMjVkYWQzNWRjNGRlNDY3MTg1Y2EwMmM1MjBkZmNlZTk3OGUyZWMzMjIyZTc2ZDYzZmYwGPnz94fsM0gAEh0KDmVzcC5jcml0ZW8uY29tGLDw94fsM0gAUgIIZBIYCgl5YWhvby5jb20Y2_H3h-wzSABSAghvEhQKBW9wZW54GLDw94fsM0gAUgIIZBIXCghydGJob3VzZRix8PeH7DNIAFICCGQ.&dlt=1781354328063&idt=1996&ppid=5594807e3b73660db22cc026894621f4&uule=a%20cm9sZToxIHByb2R1Y2VyOjEyIGxvYzoiMTQwLTAwMDEsSlAi&prev_scp=a%3D1%26iid1%3D8074675296629805%26eid%3D8074675296629805%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D1%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252F41kkjh07tibblti%252FAINCRAD%252BFF%252BINJECTOR.apk%252Ffile%253Fdkey%253Drv5x6b8wlt0%2526r%253D125%26path%3D%252Ffile%252F41kkjh07tibblti%252FAINCRAD%252BFF%252BINJECTOR.apk%252Ffile%26ap%3D1100%26sap%3D1100%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D7%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-medrectangle-2%26tap%3Dmediafire_com-medrectangle-2-8074675296629805%26eb_br%3D9c3e4ee8eae7f1433cb2fe69b1326605%26eba%3D0%26bv%3D24%26bvm%3D0%26bvr%3D2%26avc%3D23%26evc%3D25%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D4%26br2%3D2%26ezoic%3D1%26nmau%3D2%26mau%3D0%26dac%3D0%26stl%3D32%2C131%2C0%2C0%2C0%2C131%2C132%2C0%2C0%2C0%2C187%2C0%2C901%2C182%2C901%2C902%2C903%26osb%3DLinux%252FChrome%26dbg%3Drc%253A5%26reqt%3D1781354330551&adks=1630800042&frm=20&eo_id_str=ID%3Dc9df7b54bcd371a2%3AT%3D1781354330%3ART%3D1781354330%3AS%3DAA-Afja4gVi1oGpU66Pr7KR0wygQ&pbbce=1
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.23.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
rl-in-f157.1e100.net
Software
cafe /
Resource Hash
309499ed1b15193a35bcf698ecdf7f5f9cb454b165e06f3169787595bc75d033
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
dcb
google-lineitem-id
-2
observe-browsing-topics
?1
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sat, 13 Jun 2026 12:38:51 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-2
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
233
x-xss-protection
0
server
cafe
POST
H3
204
ping
pagead2.googlesyndication.com/pagead/
0
0
49ms
38ms
Fetch
image/gif
142.251.24.157
Google LLC
General
Full URL
https://pagead2.googlesyndication.com/pagead/ping?e=1
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.24.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
rj-in-f157.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
Content-Type
text/plain;charset=UTF-8
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Sat, 13 Jun 2026 12:38:51 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
GET
H2
200
pd Show response
google-bidout-d.openx.net/w/1.0/ Frame 29A8
491 B
741 B
58ms
43ms
Document
text/html
35.244.159.8
Google LLC
General
Full URL
https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Requested by
Host: oa.openxcdn.net
URL: https://oa.openxcdn.net/esp.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
/
Resource Hash
b13e94c675a8d34d359a94002285b33ee0241412a678a14a7fe1d99db32b2092

Request headers

Referer
https://www.mediafire.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Linux"

Response headers

alt-svc
h3=":443"; ma=2592000
cache-control
private, max-age=0, no-cache
content-encoding
br
content-length
371
content-type
text/html
date
Sat, 13 Jun 2026 12:38:50 GMT
p3p
CP="CUR ADM OUR NOR STA NID"
pragma
no-cache
vary
Accept, Accept-Encoding
via
1.1 google
x-forwarded-for
146.70.201.96
GET
H2
200
px.gif Show response
ad-delivery.net/
43 B
135 B
6ms
6ms
Fetch
image/gif
2606:4700:10::ac42:948c
Cloudflare
General
Full URL
https://ad-delivery.net/px.gif?ch=2&e=0.679631338412309
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac42:948c -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-goog-metageneration
5
access-control-expose-headers
*, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash
crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status
HIT
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3"
age
5
x-goog-stored-content-encoding
identity
expires
Fri, 12 Jun 2026 20:23:44 GMT
x-goog-stored-content-length
43
date
Sat, 13 Jun 2026 12:38:51 GMT
content-type
image/gif
last-modified
Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid
AAwnv3JMXkz3ZUQsLqzogVLXRUh4YB_2iVspb_DjiQ0uSiq9ZDNuQengWG2u3JEhwP_0kkXX
cache-control
public, max-age=86400
x-goog-storage-class
MULTI_REGIONAL
cf-ray
a0b1279a6f509501-NRT
accept-ranges
bytes
access-control-allow-origin
*
x-goog-generation
1620242732037093
content-length
43
server
cloudflare
GET
H2
200
sd
us-u.openx.net/w/1.0/ Frame 29A8
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEGlm34Y5ApLFiNBAukIbsnE&google_cver=1
43 B
97 B
40ms
39ms
Image
image/gif
35.244.159.8
Google LLC
General
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEGlm34Y5ApLFiNBAukIbsnE&google_cver=1
Requested by
Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Protocol
H2
Server
35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
/
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Referer
https://google-bidout-d.openx.net/

Response headers

cache-control
private, max-age=0, no-cache
pragma
no-cache
x-forwarded-for
146.70.201.96
via
1.1 google
expires
Mon, 26 Jul 1997 05:00:00 GMT
alt-svc
h3=":443"; ma=2592000
content-length
43
p3p
CP="CUR ADM OUR NOR STA NID"
date
Sat, 13 Jun 2026 12:38:50 GMT
content-type
image/gif
vary
Accept

Redirect headers

cache-control
no-cache, must-revalidate
location
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEGlm34Y5ApLFiNBAukIbsnE&google_cver=1
pragma
no-cache
cross-origin-resource-policy
cross-origin
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length
295
date
Sat, 13 Jun 2026 12:38:51 GMT
x-xss-protection
0
content-type
text/html; charset=UTF-8
server
HTTP server (unknown)
GET
H2
200
pixel
cm.g.doubleclick.net/ Frame 29A8
170 B
243 B
43ms
42ms
Image
image/png
142.251.24.154
Google LLC
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=OTNlMTAyN2YtYzU0Ni0yNWE4LWYzMzYtNDdlOTEwMGUzNmFi
Requested by
Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.24.154 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
rj-in-f154.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://google-bidout-d.openx.net/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
date
Sat, 13 Jun 2026 12:38:51 GMT
x-xss-protection
0
content-type
image/png
server
HTTP server (unknown)
GET
H2
200
sd
jp-u.openx.net/w/1.0/ Frame 29A8
Redirect Chain
  • https://cr-p3.ladsp.com/cookiesender/3
  • https://cr-p3.ladsp.com/cookiesender/3?cr=true
  • https://jp-u.openx.net/w/1.0/sd?id=537072451&val=AZEi0ZY5q8Ynks8AKW9v0-cKEs8AAAGewP38tA
43 B
97 B
47ms
40ms
Image
image/gif
35.244.159.8
Google LLC
General
Full URL
https://jp-u.openx.net/w/1.0/sd?id=537072451&val=AZEi0ZY5q8Ynks8AKW9v0-cKEs8AAAGewP38tA
Requested by
Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Protocol
H2
Server
35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
/
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Referer
https://google-bidout-d.openx.net/

Response headers

cache-control
private, max-age=0, no-cache
pragma
no-cache
x-forwarded-for
146.70.201.96
via
1.1 google
expires
Mon, 26 Jul 1997 05:00:00 GMT
alt-svc
h3=":443"; ma=2592000
content-length
43
p3p
CP="CUR ADM OUR NOR STA NID"
date
Sat, 13 Jun 2026 12:38:50 GMT
content-type
image/gif
vary
Accept

Redirect headers

cache-control
no-cache
location
https://jp-u.openx.net/w/1.0/sd?id=537072451&val=AZEi0ZY5q8Ynks8AKW9v0-cKEs8AAAGewP38tA
pragma
no-cache
via
1.1 b31d3fc2fbf5c9a115bdf4daacd1f236.cloudfront.net (CloudFront)
expires
-1
x-cache
Miss from cloudfront
content-length
0
x-amz-cf-id
7xTIKTdpQlIiCrpi3ojYtEqTQat4iK3fIXJjpMT0S8dm-ySjTNjsYA==
date
Sat, 13 Jun 2026 12:38:51 GMT
x-amz-cf-pop
NRT20-P9
GET
H2
200
sd
us-u.openx.net/w/1.0/ Frame 29A8
Redirect Chain
  • https://match.adsrvr.org/track/cmf/openx?oxid=bf8ed1b5-0c31-7b0c-e6d6-1d50daecf8cb&gdpr=0
  • https://us-u.openx.net/w/1.0/sd?id=537072971&val=0f517120-683c-4ce9-92ad-cd19266d6ded&ttd_puid=bf8ed1b5-0c31-7b0c-e6d6-1d50daecf8cb&gdpr=0&gdpr_consent=
43 B
136 B
48ms
40ms
Image
image/gif
35.244.159.8
Google LLC
General
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072971&val=0f517120-683c-4ce9-92ad-cd19266d6ded&ttd_puid=bf8ed1b5-0c31-7b0c-e6d6-1d50daecf8cb&gdpr=0&gdpr_consent=
Requested by
Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Protocol
H2
Server
35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
/
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Referer
https://google-bidout-d.openx.net/

Response headers

cache-control
private, max-age=0, no-cache
pragma
no-cache
x-forwarded-for
146.70.201.96
via
1.1 google
expires
Mon, 26 Jul 1997 05:00:00 GMT
alt-svc
h3=":443"; ma=2592000
content-length
43
p3p
CP="CUR ADM OUR NOR STA NID"
date
Sat, 13 Jun 2026 12:38:51 GMT
content-type
image/gif
vary
Accept

Redirect headers

location
https://us-u.openx.net/w/1.0/sd?id=537072971&val=0f517120-683c-4ce9-92ad-cd19266d6ded&ttd_puid=bf8ed1b5-0c31-7b0c-e6d6-1d50daecf8cb&gdpr=0&gdpr_consent=
content-length
335
date
Sat, 13 Jun 2026 12:38:51 GMT
server
Kestrel
GET
H2
200
sd
u.openx.net/w/1.0/ Frame 29A8
Redirect Chain
  • https://t.adx.opera.com/pub/sync?pubid=pub9322105895424
  • https://www.temu.com/api/adx/cm/pixel-opera?adx_uid=64b12eda3b3567f6&gdpr=&gdpr_consent=&us_privacy=&redir=https%3A%2F%2Ft.oa.opera.com%2Fsync%3Fvendor%3D60369%26pubid%3Dpub9322105895424%26gdpr%3D%...
  • https://t.oa.opera.com/sync?vendor=60369&pubid=pub9322105895424&gdpr=&consent=&us_privacy=&custom_data=
  • https://u.openx.net/w/1.0/sd?gdpr=&gdpr_consent=&id=559546607&val=OPU641eaebb53714bc7a8270d3a66a5d1f0
43 B
97 B
48ms
41ms
Image
image/gif
35.244.159.8
Google LLC
General
Full URL
https://u.openx.net/w/1.0/sd?gdpr=&gdpr_consent=&id=559546607&val=OPU641eaebb53714bc7a8270d3a66a5d1f0
Requested by
Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Protocol
H2
Server
35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
/
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Referer
https://google-bidout-d.openx.net/

Response headers

cache-control
private, max-age=0, no-cache
pragma
no-cache
x-forwarded-for
146.70.201.96
via
1.1 google
expires
Mon, 26 Jul 1997 05:00:00 GMT
alt-svc
h3=":443"; ma=2592000
content-length
43
p3p
CP="CUR ADM OUR NOR STA NID"
date
Sat, 13 Jun 2026 12:38:52 GMT
content-type
image/gif
vary
Accept

Redirect headers

Cache-Control
no-cache, no-store, must-revalidate
Location
https://u.openx.net/w/1.0/sd?gdpr=&gdpr_consent=&id=559546607&val=OPU641eaebb53714bc7a8270d3a66a5d1f0
Pragma
no-cache
Connection
keep-alive
Access-Control-Allow-Credentials
true
Access-Control-Allow-Methods
POST, GET, OPTIONS
Expires
Mon, 01 Jan 1990 00:00:00 GMT
Access-Control-Allow-Origin
*
Content-Length
136
Date
Sat, 13 Jun 2026 12:38:53 GMT
Content-Type
text/html; charset=utf-8
Access-Control-Allow-Headers
Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With
GET
H3
200
favicon.ico Show response
ad.doubleclick.net/
1 KB
129 B
39ms
38ms
Fetch
image/x-icon
142.251.24.149
Google LLC
General
Full URL
https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.6512965810999441
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.24.149 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
rj-in-f149.1e100.net
Software
sffe /
Resource Hash
d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options
nosniff
expires
Sun, 14 Jun 2026 12:38:51 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 13 Jun 2026 12:38:51 GMT
content-type
image/x-icon
vary
Accept-Encoding
last-modified
Tue, 08 May 2012 13:08:06 GMT
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
content-length
104
x-xss-protection
0
server
sffe
GET
H2
200
userId Show response
script-api.ccgateway.net/1/
446 B
789 B
294ms
164ms
Script
text/javascript
34.224.42.28
Amazon.com
General
Full URL
https://script-api.ccgateway.net/1/userId
Requested by
Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=www.mediafire.com&parentId=0dae949f4b
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.224.42.28 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-224-42-28.compute-1.amazonaws.com
Software
/
Resource Hash
6d794178f6d2cd9368bcf750c6dc4f558f50f7222e34fdc239e6e5008760beb7

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
private,max-age=3156000
content-length
446
date
Sat, 13 Jun 2026 12:38:51 GMT
content-type
text/javascript; charset=utf-8
GET
H2
200
user.js Show response
script-api.ccgateway.net/script/launcher/2/
2 KB
2 KB
293ms
164ms
Script
text/javascript
34.224.42.28
Amazon.com
General
Full URL
https://script-api.ccgateway.net/script/launcher/2/user.js
Requested by
Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=www.mediafire.com&parentId=0dae949f4b
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.224.42.28 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-224-42-28.compute-1.amazonaws.com
Software
/
Resource Hash
a11d3b4b6f2902037c365146ff80b5bf95923f3176f1a827355e45177314d423

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
private,max-age=604800
content-length
1611
date
Sat, 13 Jun 2026 12:38:51 GMT
content-type
text/javascript; charset=utf-8
GET
H2
200
customevents.js Show response
script-api.ccgateway.net/script/launcher/1/
5 KB
5 KB
292ms
163ms
Script
text/javascript
34.224.42.28
Amazon.com
General
Full URL
https://script-api.ccgateway.net/script/launcher/1/customevents.js
Requested by
Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=www.mediafire.com&parentId=0dae949f4b
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.224.42.28 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-224-42-28.compute-1.amazonaws.com
Software
/
Resource Hash
04c94ecaae50f713607dd45d40c5756d0e6a9e58c6398433ac098bc9bee89f5d

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
private,max-age=604800
content-length
5130
date
Sat, 13 Jun 2026 12:38:51 GMT
content-type
text/javascript; charset=utf-8
GET
H2
200
api.js Show response
script-api.ccgateway.net/script/launcher/6/
4 KB
5 KB
292ms
163ms
Script
text/javascript
34.224.42.28
Amazon.com
General
Full URL
https://script-api.ccgateway.net/script/launcher/6/api.js
Requested by
Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=www.mediafire.com&parentId=0dae949f4b
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.224.42.28 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-224-42-28.compute-1.amazonaws.com
Software
/
Resource Hash
880444af8f79aca9fdb01d819bb615c7d8ce8fb9327df856784f7027819de58b

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
private,max-age=604800
content-length
4602
date
Sat, 13 Jun 2026 12:38:51 GMT
content-type
text/javascript; charset=utf-8
GET
H2
200
9.gif
id5-sync.com/c/457/826/0/
Redirect Chain
  • https://id5-sync.com/i/457/8.gif?o=api&id5id=ID5*_3ym8UyOtC_tcyGouCDN5wBqo1OYa3Hhw5GlKLdhHvL__2otT1taAAEBCmotT1oAuKfyieyJTjJg7VG1V7EDdw&gdpr_consent=&gdpr=false
  • https://pixel.tapad.com/idsync/ex/push?partner_id=2922&partner_url=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F108%2F7%2F2.gif%3Fpuid%3D%24%7BTA_DEVICE_ID%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_con...
  • https://pixel.tapad.com/idsync/ex/push/check?partner_id=2922&partner_url=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F108%2F7%2F2.gif%3Fpuid%3D%24%7BTA_DEVICE_ID%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gd...
  • https://id5-sync.com/c/457/108/7/2.gif?puid=1a939850-f88b-4746-a81a-76f7cf5f305d&gdpr=0&gdpr_consent=
  • https://ib.adnxs.com/getuid?https://id5-sync.com/c/457/2/6/3.gif?puid=$UID&gdpr=0&gdpr_consent=
  • https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fid5-sync.com%2Fc%2F457%2F2%2F6%2F3.gif%3Fpuid%3D%24UID%26gdpr%3D0%26gdpr_consent%3D
  • https://id5-sync.com/c/457/2/6/3.gif?puid=1314968767185625243&gdpr=0&gdpr_consent=
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=8h9u11h&ttd_tpi=1&gdpr=0&gdpr_consent=
  • https://id5-sync.com/k/264.gif?puid=0f517120-683c-4ce9-92ad-cd19266d6ded&ttl=%%TTL%%
  • https://rtb.gumgum.com/getuid/id5?r=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F441%2F3%2F6.gif%3Fpuid%3D%5BUID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=
  • https://id5-sync.com/c/457/441/3/6.gif?puid=a_f0fcce9b-945f-4ed3-8943-9f61262313ef&gdpr=0&gdpr_consent=
  • https://sync.crwdcntrl.net/map/c=13953/tp=IDFI/gdpr=0/gdpr_consent=?https://id5-sync.com/c/457/19/2/7.gif?puid=${profile_id}&gdpr=0&gdpr_consent=
  • https://id5-sync.com/c/457/19/2/7.gif?puid=522f503f52da3f25f1c2a54198675e&gdpr=0&gdpr_consent=
  • https://sync.mathtag.com/sync/img?mt_exid=10089&mt_exuid=ID5-1b83gpAq7SNtv2p2PlMlznQ9kVZ17yMNjzvqeX-AMA&redir=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F3%2F1%2F8.gif%3Fpuid%3D%5BUUID%5D%26gdpr%3D0%26g...
  • https://id5-sync.com/c/457/3/1/8.gif?puid=255b6a2d-4f5d-4000-99ab-c292ff5b11b2&gdpr=0&gdpr_consent=
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=108&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F826%2F0%2F9.gif%3Fpuid%3D%7BuserId%7D%26gdpr%3D0%26gdpr_consent%3D
  • https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=108&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F826%2F0%2F9.gif%3Fpuid%3D%7BuserId%7D%26gdpr%3D0%26gdpr_consent%3D
  • https://pixel.tapad.com/idsync/ex/push?partner_id=2499&partner_device_id=dedddd13-148e-41df-ab45-c0a1f4c23902-6a2d4f5e-4a50&partner_url=https%3A%2F%2Fsync.crwdcntrl.net%2Fqmap%3Fc%3D1389%26tp%3DSTS...
  • https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=dedddd13-148e-41df-ab45-c0a1f4c23902-6a2d4f5e-4a50&gdpr=0&gdpr_consent=&d=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F826%2F0%2F9.gif%3Fpuid%3Ddedddd1...
  • https://id5-sync.com/c/457/826/0/9.gif?puid=dedddd13-148e-41df-ab45-c0a1f4c23902-6a2d4f5e-4a50&gdpr=0&gdpr_consent=
43 B
1 KB
225ms
225ms
Image
image/gif
135.125.170.104
OVH OVH SAS
General
Full URL
https://id5-sync.com/c/457/826/0/9.gif?puid=dedddd13-148e-41df-ab45-c0a1f4c23902-6a2d4f5e-4a50&gdpr=0&gdpr_consent=
Protocol
H2
Server
135.125.170.104 , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS
ns3270128.ip-135-125-170.eu
Software
/
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
p3p
CP="CAO PSA OUR"
date
Sat, 13 Jun 2026 12:38:54 GMT
content-type
image/gif;charset=UTF-8
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers

Redirect headers

strict-transport-security
max-age=31536000 ; includeSubDomains
cache-control
no-cache
location
https://id5-sync.com/c/457/826/0/9.gif?puid=dedddd13-148e-41df-ab45-c0a1f4c23902-6a2d4f5e-4a50&gdpr=0&gdpr_consent=
pragma
no-cache
expires
0
p3p
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length
0
date
Sat, 13 Jun 2026 12:38:54 GMT
GET
H2
200
amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012605071401000/ Frame 1C40
196 KB
0
30ms
4ms
Script
text/javascript
2404:6800:400b:c005::84
Google LLC
General
Full URL
https://cdn.ampproject.org/rtv/012605071401000/amp4ads-v0.mjs
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202606090101/pubads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:400b:c005::84 , Japan, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
19e6bf3356536c59e3a9aa5791665905d004766bda6b46fcf8e8457958020e28
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
etag
"9eade6bfff02340f"
age
349177
report-to
{"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
x-content-type-options
nosniff
expires
Wed, 09 Jun 2027 11:39:13 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 09 Jun 2026 11:39:13 GMT
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="amphtml-china-available"
content-length
56125
x-xss-protection
0
server
sffe
GET
H2
200
amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012605071401000/v0/ Frame 1C40
15 KB
0
35ms
9ms
Script
text/javascript
2404:6800:400b:c005::84
Google LLC
General
Full URL
https://cdn.ampproject.org/rtv/012605071401000/v0/amp-ad-exit-0.1.mjs
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202606090101/pubads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:400b:c005::84 , Japan, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
f4b0148628292afd7b50bd67548ba6d3e97d564ee9ef938c963b4657747ac60b
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
etag
"88c4cbda6719bc74"
age
468038
report-to
{"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
x-content-type-options
nosniff
expires
Tue, 08 Jun 2027 02:38:12 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 08 Jun 2026 02:38:12 GMT
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="amphtml-china-available"
content-length
5221
x-xss-protection
0
server
sffe
GET
H2
200
amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012605071401000/v0/ Frame 1C40
95 KB
0
32ms
7ms
Script
text/javascript
2404:6800:400b:c005::84
Google LLC
General
Full URL
https://cdn.ampproject.org/rtv/012605071401000/v0/amp-analytics-0.1.mjs
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202606090101/pubads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:400b:c005::84 , Japan, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
91171ed1478c24131b918c94dbc8bcc3cbc3a55dca8bb00f21cd64387b2ea8a6
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
etag
"97215e1667de42f6"
age
335010
report-to
{"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
x-content-type-options
nosniff
expires
Wed, 09 Jun 2027 15:35:20 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 09 Jun 2026 15:35:20 GMT
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="amphtml-china-available"
content-length
29021
x-xss-protection
0
server
sffe
GET
H2
200
amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012605071401000/v0/ Frame 1C40
5 KB
0
36ms
10ms
Script
text/javascript
2404:6800:400b:c005::84
Google LLC
General
Full URL
https://cdn.ampproject.org/rtv/012605071401000/v0/amp-fit-text-0.1.mjs
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202606090101/pubads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:400b:c005::84 , Japan, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
dce1ce383bed84a4ed739e972b11f44c4c45a1339a1bdf75c3598b88d46cc69d
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
etag
"4871326834a6f544"
age
463868
report-to
{"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
x-content-type-options
nosniff
expires
Tue, 08 Jun 2027 03:47:42 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 08 Jun 2026 03:47:42 GMT
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="amphtml-china-available"
content-length
1920
x-xss-protection
0
server
sffe
GET
H2
200
amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012605071401000/v0/ Frame 1C40
40 KB
0
28ms
3ms
Script
text/javascript
2404:6800:400b:c005::84
Google LLC
General
Full URL
https://cdn.ampproject.org/rtv/012605071401000/v0/amp-form-0.1.mjs
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202606090101/pubads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:400b:c005::84 , Japan, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
513bcb26bd9e258e314f0fa39e4f8d57be3305e65101ccbeb63ae1617073547f
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
etag
"ce7dfc1b22abf1b0"
age
304362
report-to
{"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
x-content-type-options
nosniff
expires
Thu, 10 Jun 2027 00:06:08 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 10 Jun 2026 00:06:08 GMT
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="amphtml-china-available"
content-length
12959
x-xss-protection
0
server
sffe
GET
H2
200
en.png
tpc.googlesyndication.com/pagead/images/abg/ Frame 1C40
3 KB
0
21ms
6ms
Image
image/png
2404:6800:400b:c006::84
Google LLC
General
Full URL
https://tpc.googlesyndication.com/pagead/images/abg/en.png
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202606090101/pubads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:400b:c006::84 , Japan, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
85a64faec356c3a72f249a98a037317adc730ec6d38e47653cd53be5485d80a1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=86400
timing-allow-origin
*
etag
15880770647744369592
age
16266
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Sun, 14 Jun 2026 08:07:44 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
2982
x-xss-protection
0
date
Sat, 13 Jun 2026 08:07:44 GMT
content-type
image/png
vary
Accept-Encoding
server
cafe
GET
H2
200
adchoices_blue_wb.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 1C40
209 B
0
21ms
7ms
Image
image/png
2404:6800:400b:c006::84
Google LLC
General
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/adchoices_blue_wb.png
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202606090101/pubads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:400b:c006::84 , Japan, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
135fe1822959b8811afafc20effec079f339c96788df6e47e933a7d0c267921b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=86400
timing-allow-origin
*
etag
2799713854418114702
age
69389
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Sat, 13 Jun 2026 17:22:21 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
209
x-xss-protection
0
date
Fri, 12 Jun 2026 17:22:21 GMT
content-type
image/png
vary
Accept-Encoding
server
cafe
GET
H2
200
15223551526234006467
tpc.googlesyndication.com/daca_images/simgad/ Frame 1C40
128 KB
128 KB
6ms
4ms
Image
image/webp
2404:6800:400b:c006::84
Google LLC
General
Full URL
https://tpc.googlesyndication.com/daca_images/simgad/15223551526234006467
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:400b:c006::84 , Japan, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
f04474a1439c9579744b26351ace051c3a9740e7af5f214c7231c75b8dd1e3ba
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

age
193045
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
x-content-type-options
nosniff
expires
Fri, 11 Jun 2027 07:01:26 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons
true
date
Thu, 11 Jun 2026 07:01:26 GMT
last-modified
Tue, 26 May 2026 06:56:08 GMT
content-type
image/webp
cache-control
public, max-age=31536000
timing-allow-origin
*
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
content-length
131154
x-xss-protection
0
server
sffe
GET

l
www.google.com/ads/measurement/ Frame 1C40
0
0


GET

adview
securepubads.g.doubleclick.net/pagead/ Frame 1C40
0
0


GET
DATA
200
OK
truncated
/ Frame 1C40
216 B
0
Image
image/png

General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c1143c5335c119c5e774eb8a1979677d4107922d3751323c29346439bd9c59a8

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/png
GET
H3
204
sodar
ep1.adtrafficquality.google/pagead/
0
17 B
44ms
43ms
Image
image/
142.251.24.157
Google LLC
General
Full URL
https://ep1.adtrafficquality.google/pagead/sodar?id=sodar2&v=254&t=2&li=gpt_m202606090101&jk=1001161376096050&bg=!WVqlWjjNAAYUzILKNMw7AEcBe5WfOH2aCIe2WDik_ba5_oosXM-ZyMHzxyPZc3yKIWpxwB1Ni9Gm0Wu5IcafIaYa7Wwxn0Efu6pzozHO5b04w5SQJcRNbAIAAABfUgAAAAZoAQd-ADf39XhCJQK5AC6DOgDJ3k_Zh0Xw5Ba-COEeZP8-PIX29disypqBaAHUM_nfXZfAdGiSAD8VwNf3CgAy7v1tKZZhiVPNj-K6MJ_vInb9VCLGWWsF6JEJ-kQsvQd35S4NyW-y1G_VOsUHNOcEoZCZAk1P4jqJ4gE5nfGzgPsXzlCkpKCQC7lsHbKEC10AW-GK1Oy4z5PaSbiylrBpBmBJ3v5gG-7vWiE84I0p9f0ZhDxbLbuXtYzRM-Fh8c8b4oTyAB0mVgxrGfAu0J12Vkocjos_Vi9sdJ2ZBHkL4INaSk1Z8U6xUmoOMM_QeNYLzX5TLCon9_jO_bR9E6YYqI9cZsr5-uD1kbg5WDPPHo-x8R67YSAtZ3SvITofV6l9jG92XtbIN9kKfWiZ_kGXF3IGjt7tu02elrule_NpKN8CIb5canGY63QU69QmpiP7sQBNakJsf8hK-S5ckMGBFsjkWEBJhSh15bRAfHJ83CewnPPQipsNVRZlmCLY9RcbexMmDHwyiOOYEXeOs0jDM59szpsoxSelv_E4LVYC6QnHECOekN03lnopmj5ts57dmjwAhzuUz4E-X2rawY62zF5T3pgc-9BublREpCiOjNypvUCOrrLEk2bBi6lPP9FI9_70tFcHbu0WjLDWjsgvcUeQDvT2hfJEzSktiBs_0sRupm2bbCvXIS1RgBiOCEPp4IE7EmVy427hE0tTQ_I5rd14TEJ5hnCjdrwbzDXMUzWda6_PI1MlPOj1TjdioH1llLPTG46-gqZ-dyvG8pvudMne9AEKLoj758eJHK9-Gmn5Uyajm6yqk3ta9iipsNQeooF1btk9sAJA7pPlgBv9o-WEn6nIcI-Lj17k7tJ1YZO526EQgGakDxpJb-M2rIwO5icJNTXnKtBueFuxUl9YwF2CeRFKAVE9w6sfYBAQxWBJ
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.24.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
rj-in-f157.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

timing-allow-origin
*
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Sat, 13 Jun 2026 12:38:51 GMT
x-xss-protection
0
content-type
image/
server
cafe
GET
H2
200
setUser Show response
script-api.ccgateway.net/
0
309 B
169ms
168ms
Script
text/javascript
34.224.42.28
Amazon.com
General
Full URL
https://script-api.ccgateway.net/setUser?parent=0dae949f4b&site=www.mediafire.com&ccuid=9b68d783-d333-44c9-b65b-8e99d95257a9&ccsid=4823239f-dab8-43f2-afac-812a4b24d12d
Requested by
Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=www.mediafire.com&parentId=0dae949f4b
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.224.42.28 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-224-42-28.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
private,max-age=300
content-length
0
date
Sat, 13 Jun 2026 12:38:51 GMT
content-type
text/javascript
GET
H2
200
bundle Show response
script-api.ccgateway.net/script/
16 KB
16 KB
168ms
167ms
Script
text/javascript
34.224.42.28
Amazon.com
General
Full URL
https://script-api.ccgateway.net/script/bundle?id=www.mediafire.com&parentId=0dae949f4b
Requested by
Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=www.mediafire.com&parentId=0dae949f4b
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.224.42.28 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-224-42-28.compute-1.amazonaws.com
Software
/
Resource Hash
c879e20b7fd8e872a394d588a3363a46561ca1bd1bdaabee0d213d4f429a4ed9

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
public,max-age=1200
content-length
16478
date
Sat, 13 Jun 2026 12:38:51 GMT
content-type
text/javascript; charset=utf-8
GET

view
securepubads.g.doubleclick.net/btr/ Frame 1C40
0
0


GET
H2
200
px.gif Show response
ad-delivery.net/
43 B
110 B
5ms
5ms
Fetch
image/gif
2606:4700:10::ac42:948c
Cloudflare
General
Full URL
https://ad-delivery.net/px.gif?ch=2&e=0.3293093715156771
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac42:948c -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-goog-metageneration
5
access-control-expose-headers
*, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash
crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status
HIT
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3"
age
5
x-goog-stored-content-encoding
identity
expires
Fri, 12 Jun 2026 20:23:44 GMT
x-goog-stored-content-length
43
date
Sat, 13 Jun 2026 12:38:51 GMT
content-type
image/gif
last-modified
Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid
AAwnv3JMXkz3ZUQsLqzogVLXRUh4YB_2iVspb_DjiQ0uSiq9ZDNuQengWG2u3JEhwP_0kkXX
cache-control
public, max-age=86400
x-goog-storage-class
MULTI_REGIONAL
cf-ray
a0b1279ced579501-NRT
accept-ranges
bytes
access-control-allow-origin
*
x-goog-generation
1620242732037093
content-length
43
server
cloudflare
GET
H3
200
favicon.ico Show response
ad.doubleclick.net/
1 KB
129 B
39ms
39ms
Fetch
image/x-icon
142.251.24.149
Google LLC
General
Full URL
https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.8410701343364523
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.24.149 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
rj-in-f149.1e100.net
Software
sffe /
Resource Hash
d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options
nosniff
expires
Sun, 14 Jun 2026 12:38:51 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 13 Jun 2026 12:38:51 GMT
content-type
image/x-icon
vary
Accept-Encoding
last-modified
Tue, 08 May 2012 13:08:06 GMT
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
content-length
104
x-xss-protection
0
server
sffe
GET
H3
200
activeview
pagead2.googlesyndication.com/pcs/ Frame 7FE7
42 B
65 B
50ms
43ms
Image
image/gif
142.251.24.157
Google LLC
General
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsteHBlZHSjIx75irzRNMP_KNqZnwM8r1FR-K1MlK0moWNx6-ERVliDD-GdPZHGNLhtdooO_fiK_3WGTYISdLWJxPGVXwZsJMeObyQC1fUYL8X4v5Stir8i9B9ZnbN5r8vWvZYQP4wGzL3jPimeCXUt2HR63H9bpLdgGeDvDzY6gBlDPrH6h1ghVKY9PEu53IEItPCL7-gJ8XtZ0Q8sQvQ&sai=AMfl-YSXAUCFymmXjP1fSQQehiNef2DallUql7-oQBstUFY3eM0hQx_ak9Jbnoq6bVgxZh4xbhfjFlA6hZiFsAChl6dzzJnbYmjh0bR_e8IUOA0HsQvLA_fuqv_G7_OQgHE9GkKLuVcdOXhiK1XxIoUNdYoIdcM6DlGNiXzBZeeR3_NA4E5rwNVqAgad5vuKARD2Mg9HjlovVnyhoFBtmFZDLFyoUfrPiBWrZ-uOm705Z07BBjvFNSQpKJf4HrwqiYfE4wlGFAbT6zlbUAwh_GPZZwV8-Knyj_v-LrvX3UIjIhop8IelnTz8UsRxxlFQ17I2Z0jcAbiR6727mSoKwQ881f95qfpwhUCt_icVmcBMNnTdOFLhEk6_mN09uRRe5dLHSjrqR2S7FZ32QVhcxmWCgSzY0VW-cmVypXdVA3dB&sig=Cg0ArKJSzDgvtSjfv1u0EAE&cid=CAQSmQIAEQoqgcsDN8q9GKkqph7aLk_HHpjOscPA47zSg2OmqU3nxvJSgfdIr4kZoAKVMmUCADUoOFDLH9nN3A8FZtuAKvlUKHoBJER61vw6cEH0aM_naWTWweoVtBYN9EsAy9ErSACkJ13emXE56W_1qjk17tuvxEuFr4x7DT0E2-Fa1I2uepudwDwUslJalsmDIEIVi3g-ovO6OznXSnUjtT9sxDnhPAasWhujrbz6DbyzOMTVKerCVJnXMnaiNTyywhkLpkFikjdcxn-x3fC143gc1Qp9MQi7rvCbgdHAdYpiJqfz5u0sexsNUK0-CLrNOuPb0DjcwLIqhMVWp30XnEoLu6G2QAU-U3QTqNeA_xaKfOytWLdyx28dMhgB&id=ampim&o=320,120&d=336,280&ss=1600,1200&bs=1600,1200&mcvt=1000&mtos=0,0,1000,1000,1000&tos=0,0,1000,0,0&tfs=130&tls=1130&g=100&h=100&tt=1130&r=v&avms=ampa&uap=Linux&uapv=&uaa=x86&uam=&uafv=149.0.7827.102&uab=64&uafvl=%5B%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22149.0.0.0%22%7D%2C%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22149.0.0.0%22%7D%2C%7B%22brand%22%3A%22Not-A.Brand%22%2C%22version%22%3A%2224.0.0.0%22%7D%5D&uaw=false&adk=0
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.24.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
rj-in-f157.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
42
date
Sat, 13 Jun 2026 12:38:51 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
OPTIONS
H2
204
page_visit
pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ Frame
0
0
411ms
129ms
Preflight
44.227.112.76
Amazon.com
General
Full URL
https://pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/page_visit
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
44.227.112.76 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-44-227-112-76.us-west-2.compute.amazonaws.com
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.mediafire.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Content-Type,Content-Length,Accept-Encoding,Authorization,X-Forwarded-For
access-control-allow-methods
GET,POST
access-control-allow-origin
https://www.mediafire.com
access-control-max-age
86400
date
Sat, 13 Jun 2026 12:38:52 GMT
vary
Origin Access-Control-Request-Method Access-Control-Request-Headers
OPTIONS
H2
204
ad_impression
pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ Frame
0
0
409ms
129ms
Preflight
44.227.112.76
Amazon.com
General
Full URL
https://pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ad_impression
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
44.227.112.76 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-44-227-112-76.us-west-2.compute.amazonaws.com
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.mediafire.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Content-Type,Content-Length,Accept-Encoding,Authorization,X-Forwarded-For
access-control-allow-methods
GET,POST
access-control-allow-origin
https://www.mediafire.com
access-control-max-age
86400
date
Sat, 13 Jun 2026 12:38:52 GMT
vary
Origin Access-Control-Request-Method Access-Control-Request-Headers
POST
H2
200
page_visit Show response
pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/
60 B
337 B
131ms
129ms
Fetch
application/json
44.227.112.76
Amazon.com
General
Full URL
https://pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/page_visit
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
44.227.112.76 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-44-227-112-76.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
ee63979b621d070be7f6aee315971acb7959ff766758fda88f01c822fd24a7b0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
Content-Type
application/json
sec-ch-ua-mobile
?0

Response headers

access-control-allow-origin
https://www.mediafire.com
content-length
60
date
Sat, 13 Jun 2026 12:38:52 GMT
content-type
application/json; charset=utf-8
vary
Origin
access-control-allow-credentials
true
POST
H2
200
ad_impression Show response
pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/
60 B
337 B
133ms
132ms
Fetch
application/json
44.227.112.76
Amazon.com
General
Full URL
https://pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ad_impression
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
44.227.112.76 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-44-227-112-76.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
ee63979b621d070be7f6aee315971acb7959ff766758fda88f01c822fd24a7b0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
Content-Type
application/json
sec-ch-ua-mobile
?0

Response headers

access-control-allow-origin
https://www.mediafire.com
content-length
60
date
Sat, 13 Jun 2026 12:38:52 GMT
content-type
application/json; charset=utf-8
vary
Origin
access-control-allow-credentials
true
GET
H2
200
user_sync
pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/
Redirect Chain
  • https://sync.crwdcntrl.net/qmap?c=18513&tp=MGNI&tpid=9b68d783-d333-44c9-b65b-8e99d95257a9&d=https%3A%2F%2Fpb-ing-02.ccgateway.net%2Fv1.0%2Fparent%2F0dae949f4b%2Fengagement%2Ftrigger%2Fuser_sync%3Fs...
  • https://pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/user_sync?src=lotame&puid=522f503f52da3f25f1c2a54198675e&id=www.mediafire.com&parentId=0dae949f4b&ccsid=4823239f-dab8-43f2-...
0
38 B
396ms
132ms
Image
text/plain
44.227.112.76
Amazon.com
General
Full URL
https://pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/user_sync?src=lotame&puid=522f503f52da3f25f1c2a54198675e&id=www.mediafire.com&parentId=0dae949f4b&ccsid=4823239f-dab8-43f2-afac-812a4b24d12d&ccuid=9b68d783-d333-44c9-b65b-8e99d95257a9&ccpt=0&pvid=e0627e70-d7ff-483d-af85-d9da43e3c1a7&engid=c367127e-5bf8-4990-82e0-e4c596340357&engcount=0&engttl=60
Protocol
H2
Server
44.227.112.76 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-44-227-112-76.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

date
Sat, 13 Jun 2026 12:38:52 GMT
content-length
0

Redirect headers

strict-transport-security
max-age=31536000 ; includeSubDomains
cache-control
no-cache
location
https://pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/user_sync?src=lotame&puid=522f503f52da3f25f1c2a54198675e&id=www.mediafire.com&parentId=0dae949f4b&ccsid=4823239f-dab8-43f2-afac-812a4b24d12d&ccuid=9b68d783-d333-44c9-b65b-8e99d95257a9&ccpt=0&pvid=e0627e70-d7ff-483d-af85-d9da43e3c1a7&engid=c367127e-5bf8-4990-82e0-e4c596340357&engcount=0&engttl=60
pragma
no-cache
expires
0
p3p
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length
0
date
Sat, 13 Jun 2026 12:38:51 GMT
GET
H2
200
px.gif Show response
ad-delivery.net/
43 B
135 B
12ms
11ms
Fetch
image/gif
2606:4700:10::ac42:948c
Cloudflare
General
Full URL
https://ad-delivery.net/px.gif?ch=2&e=0.8685499072502276
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac42:948c -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-goog-metageneration
5
access-control-expose-headers
*, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash
crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status
HIT
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3"
age
6
x-goog-stored-content-encoding
identity
expires
Fri, 12 Jun 2026 20:23:44 GMT
x-goog-stored-content-length
43
date
Sat, 13 Jun 2026 12:38:52 GMT
content-type
image/gif
last-modified
Wed, 05 May 2021 19:25:32 GMT
x-guploader-uploadid
AAwnv3JMXkz3ZUQsLqzogVLXRUh4YB_2iVspb_DjiQ0uSiq9ZDNuQengWG2u3JEhwP_0kkXX
cache-control
public, max-age=86400
x-goog-storage-class
MULTI_REGIONAL
cf-ray
a0b1279f8bfa9501-NRT
accept-ranges
bytes
access-control-allow-origin
*
x-goog-generation
1620242732037093
content-length
43
server
cloudflare
OPTIONS
H2
200
json
gum.criteo.com/sid/ Frame
0
0
4ms
1ms
Preflight
application/json
2406:2600:4::13
Criteo APAC
General
Full URL
https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.mediafire.com%2F&domain=www.mediafire.com&bundle=sFbEPF9oaW9XS2olMkZ5SEhIa2tmSU9MbGpPOGVyWGE3NCUyRnRzd2luYnIxJTJGa3JBR1ZIamZSdU1JWkxnV2pZTkpjWnhGMlNyT1puVlBjQkhnZ3F5NnprMmNlZ2glMkZ1ejVJUnlqUyUyRjFQNUVwTUswaXFFUlF2emVQTFBQUElkVXlJdGo2c3VvNzQ&cw=1&pbt=1&lsw=1&gdpr=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2406:2600:4::13 , Japan, ASN55569 (CRITEO-AS-AP - Criteo APAC, JP),
Reverse DNS
Software
Kestrel /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
GET
Origin
https://www.mediafire.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
content-type
access-control-allow-methods
GET
access-control-allow-origin
https://www.mediafire.com
cache-control
no-cache, no-store, must-revalidate
content-encoding
gzip
content-type
application/json; charset=utf-8
date
Sat, 13 Jun 2026 12:38:51 GMT
expires
0
pragma
no-cache
server
Kestrel
server-processing-duration-in-ticks
288872
strict-transport-security
max-age=31536000; preload;
vary
Accept-Encoding
GET
H2
200
envelope Show response
lexicon.33across.com/v1/
1 KB
2 KB
170ms
169ms
Fetch
application/json
37.19.206.163
CDN77 Datacamp Li...
General
Full URL
https://lexicon.33across.com/v1/envelope?pid=0010b00002MpnPqAAJ&gdpr=0&src=pbjs&ver=10.23.0&coppa=0&tp=jD9xVCyk%2FlGetk0hI6rhl7bp0A0Qg0ig3y4VnauK%2BJA%3D
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-16-179
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
37.19.206.163 Ashburn, United States, ASN60068 (CDN77 Datacamp Limited, GB),
Reverse DNS
unn-37-19-206-163.datapacket.com
Software
/
Resource Hash
1dd32b12fc30d36cacdb563ae9a8189e226c0342333a03b552c3a3d472c0b285

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
content-type
text/plain
sec-ch-ua-mobile
?0

Response headers

access-control-allow-origin
https://www.mediafire.com
content-length
1528
content-type
application/json
vary
origin
access-control-allow-credentials
true
GET
H2
200
set Show response
id.a-mx.com/
Redirect Chain
  • https://id.a-mx.com/sync/?tagId=&ref=null&u=https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125&tl=https://www.mediafire.com/file/41kkjh07tibblti/AINC...
  • https://c3.a-mo.net/b?uid=f3595a37%2D4a9d%2D4b24%2D9cd9%2D94bf18e66c2c&sh=id%2Ea%2Dmx%2Ecom&gdpr=0&
  • https://id.a-mx.com/set?oid=f3595a37-4a9d-4b24-9cd9-94bf18e66c2c&uid=f3595a37-4a9d-4b24-9cd9-94bf18e66c2c&
99 B
870 B
214ms
213ms
Fetch
application/json
2400:52e0:1500::1180:1
BunnyCDN BUNNYWAY
General
Full URL
https://id.a-mx.com/set?oid=f3595a37-4a9d-4b24-9cd9-94bf18e66c2c&uid=f3595a37-4a9d-4b24-9cd9-94bf18e66c2c&
Protocol
H2
Server
2400:52e0:1500::1180:1 , Singapore, ASN200325 (BunnyCDN BUNNYWAY, informacijske storitve d.o.o., SI),
Reverse DNS
Software
BunnyCDN-SG1-1180 /
Resource Hash
789a0b260659565f639a7079d607c835feac8fde7413014ed6255a81e989cee4

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

cdn-status
200
date
Sat, 13 Jun 2026 12:38:52 GMT
cdn-cache
BYPASS
content-type
application/json
cdn-cachedat
06/13/2026 12:38:52
cdn-requestpullcode
200
cache-control
public, max-age=0
cdn-requestpullsuccess
True
cdn-requesttime
0
cdn-requestid
c2684eeab57ff5917fe30442328a7b01
access-control-allow-credentials
true
cdn-pullzone
5497800
cdn-proxyver
1.57
access-control-allow-origin
null
content-length
99
cdn-edgestorageid
782
server
BunnyCDN-SG1-1180
cdn-requestcountrycode
JP

Redirect headers

cdn-status
302
date
Sat, 13 Jun 2026 12:38:52 GMT
cdn-cache
BYPASS
cdn-cachedat
06/13/2026 12:38:52
cdn-requestpullcode
302
cache-control
public, max-age=0
location
https://id.a-mx.com/set?oid=f3595a37-4a9d-4b24-9cd9-94bf18e66c2c&uid=f3595a37-4a9d-4b24-9cd9-94bf18e66c2c&
cdn-requestpullsuccess
True
cdn-requestid
522fbd05efca6e1f3758f9919a49049f
access-control-allow-credentials
true
cdn-pullzone
5497800
cdn-proxyver
1.57
cdn-requesttime
0
access-control-allow-origin
null
content-length
0
cdn-edgestorageid
988
server
BunnyCDN-SG1-869
cdn-requestcountrycode
JP
GET
H2
200
sid Show response
mug.criteo.com/
Redirect Chain
  • https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.mediafire.com%2F&domain=www.mediafire.com&bundle=sFbEPF9oaW9XS2olMkZ5SEhIa2tmSU9MbGpPOGVyWGE3NCUyRnRzd2luYnIxJTJGa3JBR1ZIamZSd...
  • https://mug.criteo.com/sid?cpp=eQUcWHw2a1AwcmFhb2daOFQrOURFc2tWNE1DUCs0cm1tbzZBcVR4dkZmanR5aVlKMGg3enh3S2xTMVE4bStKYmdIa3ZZTWlEOTFjeUw1VHVjVHNwQjN6N1E2L2QwbW1rYXhGNHJYcFVsdTZuaTBvM3hrRzd4aXY1dVo2Yk...
440 B
1 KB
4ms
4ms
Fetch
application/json
182.161.74.19
Criteo APAC
General
Full URL
https://mug.criteo.com/sid?cpp=eQUcWHw2a1AwcmFhb2daOFQrOURFc2tWNE1DUCs0cm1tbzZBcVR4dkZmanR5aVlKMGg3enh3S2xTMVE4bStKYmdIa3ZZTWlEOTFjeUw1VHVjVHNwQjN6N1E2L2QwbW1rYXhGNHJYcFVsdTZuaTBvM3hrRzd4aXY1dVo2YkFXelZkSXB6TzFBWDhvMnJFVUZSamNoNFpyb2NuZFJ1OUQvNU8rbldoTTVvYWpwY1NRZzdSUlRkOHZqcUFQREZRNFRWK0ZBdHo5bm1IY1ZKUENlZ3I0Z1lITURoY1JDUW4wRHZZZ1VhT2lJMkxwazZzdHVLRXBZTzhFcEJKcTBxR3cvUE53MlZxQjdwQ1AvYlpNdWkrZDJYaXFEajVobng2K1gwWXJmYm5GbkJGZXFMdlBid3RmVDF0UXRnTm5rSXc3ZUpSK01JTVdNNy9uNHAvdmVjRTYvSDU3UWZoS1E9PXw&cppv=2
Protocol
H2
Server
182.161.74.19 , Singapore, ASN55569 (CRITEO-AS-AP - Criteo APAC, JP),
Reverse DNS
Software
Kestrel /
Resource Hash
d204aa686be22209ad9666af1336f4e46dd3d3b05c4f6f5e7c88001f4dc95af0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

strict-transport-security
max-age=31536000; preload;
cache-control
no-cache, no-store, must-revalidate
content-encoding
gzip
pragma
no-cache
access-control-allow-credentials
true
access-control-allow-methods
GET
server-processing-duration-in-ticks
1014059
expires
0
access-control-allow-origin
null
date
Sat, 13 Jun 2026 12:38:51 GMT
content-type
application/json; charset=utf-8
vary
Accept-Encoding
server
Kestrel

Redirect headers

strict-transport-security
max-age=31536000; preload;
cache-control
no-cache, no-store, must-revalidate
location
https://mug.criteo.com/sid?cpp=eQUcWHw2a1AwcmFhb2daOFQrOURFc2tWNE1DUCs0cm1tbzZBcVR4dkZmanR5aVlKMGg3enh3S2xTMVE4bStKYmdIa3ZZTWlEOTFjeUw1VHVjVHNwQjN6N1E2L2QwbW1rYXhGNHJYcFVsdTZuaTBvM3hrRzd4aXY1dVo2YkFXelZkSXB6TzFBWDhvMnJFVUZSamNoNFpyb2NuZFJ1OUQvNU8rbldoTTVvYWpwY1NRZzdSUlRkOHZqcUFQREZRNFRWK0ZBdHo5bm1IY1ZKUENlZ3I0Z1lITURoY1JDUW4wRHZZZ1VhT2lJMkxwazZzdHVLRXBZTzhFcEJKcTBxR3cvUE53MlZxQjdwQ1AvYlpNdWkrZDJYaXFEajVobng2K1gwWXJmYm5GbkJGZXFMdlBid3RmVDF0UXRnTm5rSXc3ZUpSK01JTVdNNy9uNHAvdmVjRTYvSDU3UWZoS1E9PXw&cppv=2
pragma
no-cache
access-control-allow-credentials
true
access-control-allow-methods
GET
server-processing-duration-in-ticks
452183
expires
0
access-control-allow-origin
https://www.mediafire.com
content-length
0
date
Sat, 13 Jun 2026 12:38:51 GMT
server
Kestrel
GET
H2
200
pbhid Show response
id.hadron.ad.gt/api/v1/
2 B
0
1ms
1ms
Fetch
application/json
2606:4700:10::ac42:949f
Cloudflare
General
Full URL
https://id.hadron.ad.gt/api/v1/pbhid?partner_id=524&_it=prebid&t=1&src=id&domain=www.mediafire.com&gdpr=0
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-16-179
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac42:949f -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
content-type
text/plain
sec-ch-ua-mobile
?0

Response headers

cache-control
max-age=604800
cf-cache-status
DYNAMIC
access-control-allow-credentials
true
access-control-allow-methods
HEAD,GET,POST,PUT,DELETE,OPTIONS
cf-ray
a0b12792cd01817d-NRT
access-control-allow-origin
*
content-length
2
date
Sat, 13 Jun 2026 12:38:50 GMT
content-type
application/json; charset=utf8
server
cloudflare
access-control-allow-headers
authorization,content-type
POST
H2
200
prebid Show response
id5-sync.com/api/config/
195 B
457 B
230ms
224ms
Fetch
application/json
135.125.170.104
OVH OVH SAS
General
Full URL
https://id5-sync.com/api/config/prebid
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-16-179
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
135.125.170.104 , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS
ns3270128.ip-135-125-170.eu
Software
/
Resource Hash
aa8a5c4a92b78ce2c775274d190dafb720a44b4facce02c94e63f63c90c60a57
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
Content-Type
text/plain;charset=UTF-8
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
access-control-allow-origin
https://www.mediafire.com
content-encoding
gzip
date
Sat, 13 Jun 2026 12:38:52 GMT
content-type
application/json;charset=UTF-8
vary
origin,access-control-request-method,access-control-request-headers,accept-encoding
access-control-allow-credentials
true
GET
H2
200
UCookieSetPug Show response
image6.pubmatic.com/AdServer/
0
65 B
11ms
7ms
Fetch
text/html
207.65.34.81
PubMatic
General
Full URL
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=5&p=156983&publisherId=156983&gdpr=0&gdpr_consent=&src=pbjs_uid&ver=1&coppa=0&us_privacy=&gpp=&gpp_sid=
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-16-179
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
207.65.34.81 , United States, ASN62713 (AS-PUBMATIC - PubMatic, Inc., US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=16070400; includeSubDomains

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
content-type
text/plain
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=16070400; includeSubDomains
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
0
date
Sat, 13 Jun 2026 12:38:52 GMT
content-type
text/html; charset=UTF-8
GET
H2
200
fpc Show response
at.teads.tv/
56 B
273 B
13ms
12ms
Fetch
text/plain
151.101.130.132
Fastly
General
Full URL
https://at.teads.tv/fpc?analytics_tag_id=PUB_13877&tfpvi=ZDQyYTM1MDctNThkZi00MzQ5LTliOWItN2YxY2UwMzBhOWU2Iy0xMA%3D%3D&gdpr_consent=&gdpr_status=0&gdpr_reason=0&ccpa_consent=&sv=prebid-v1
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-16-179
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.130.132 , United States, ASN54113 (FASTLY - Fastly, Inc., US),
Reverse DNS
Software
/
Resource Hash
5340fb84bcdfe8399820fc1d8d480e8161a83308075d7e66a322ab751026d53d
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
content-type
text/plain
sec-ch-ua-mobile
?0

Response headers

x-check-cacheable
NO
x-cache
MISS
date
Sat, 13 Jun 2026 12:38:52 GMT
content-type
text/plain; charset=UTF-8
x-served-by
cache-nrt-rjaa8190049-NRT
x-cache-hits
0
x-u
/fpc?analytics_tag_id=PUB_13877&tfpvi=ZDQyYTM1MDctNThkZi00MzQ5LTliOWItN2YxY2UwMzBhOWU2Iy0xMA%3D%3D&gdpr_consent=&gdpr_status=0&gdpr_reason=0&ccpa_consent=&sv=prebid-v1
x-b
ylOjgn7Xd9Ovs8YIkDlH51--F_at_apne1_teads_tv
strict-transport-security
max-age=300
vary
Accept-Encoding
cache-control
max-age=0, no-cache, no-store
x-timer
S1781354332.124324,VS0,VE9
access-control-allow-credentials
true
via
1.1 varnish
x-ff
146.70.201.96
accept-ranges
bytes
access-control-allow-origin
https://www.mediafire.com
content-length
56
traffic-path
TKDC2
GET
H2
200
rid Show response
match.adsrvr.org/track/
109 B
0
0ms
0ms
Fetch
application/json
3.33.220.150
Amazon.com
General
Full URL
https://match.adsrvr.org/track/rid?ttd_pid=muno13d&fmt=json
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-16-179
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.33.220.150 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
a12b7a488abeaa9e4.awsglobalaccelerator.com
Software
Kestrel /
Resource Hash
b2e52ac1d50555583c8124e598f510f48a937f7427b5161bfcce214ba687645d

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
content-type
text/plain
sec-ch-ua-mobile
?0

Response headers

cache-control
private
content-encoding
gzip
access-control-allow-credentials
true
expires
Mon, 13 Jul 2026 12:38:50 GMT
access-control-allow-origin
https://www.mediafire.com
date
Sat, 13 Jun 2026 12:38:50 GMT
content-type
application/json
vary
Origin,Accept-Encoding
server
Kestrel
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept, x-integration-type
OPTIONS
H2
200
sid
mug.criteo.com/ Frame
0
0
3ms
2ms
Preflight
application/json
182.161.74.19
Criteo APAC
General
Full URL
https://mug.criteo.com/sid?cpp=eQUcWHw2a1AwcmFhb2daOFQrOURFc2tWNE1DUCs0cm1tbzZBcVR4dkZmanR5aVlKMGg3enh3S2xTMVE4bStKYmdIa3ZZTWlEOTFjeUw1VHVjVHNwQjN6N1E2L2QwbW1rYXhGNHJYcFVsdTZuaTBvM3hrRzd4aXY1dVo2YkFXelZkSXB6TzFBWDhvMnJFVUZSamNoNFpyb2NuZFJ1OUQvNU8rbldoTTVvYWpwY1NRZzdSUlRkOHZqcUFQREZRNFRWK0ZBdHo5bm1IY1ZKUENlZ3I0Z1lITURoY1JDUW4wRHZZZ1VhT2lJMkxwazZzdHVLRXBZTzhFcEJKcTBxR3cvUE53MlZxQjdwQ1AvYlpNdWkrZDJYaXFEajVobng2K1gwWXJmYm5GbkJGZXFMdlBid3RmVDF0UXRnTm5rSXc3ZUpSK01JTVdNNy9uNHAvdmVjRTYvSDU3UWZoS1E9PXw&cppv=2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
182.161.74.19 , Singapore, ASN55569 (CRITEO-AS-AP - Criteo APAC, JP),
Reverse DNS
Software
Kestrel /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
GET
Origin
null
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
content-type
access-control-allow-methods
GET
access-control-allow-origin
null
cache-control
no-cache, no-store, must-revalidate
content-encoding
gzip
content-type
application/json; charset=utf-8
date
Sat, 13 Jun 2026 12:38:51 GMT
expires
0
pragma
no-cache
server
Kestrel
server-processing-duration-in-ticks
197440
strict-transport-security
max-age=31536000; preload;
vary
Accept-Encoding
GET
H3
200
ads Show response
securepubads.g.doubleclick.net/gampad/
520 B
255 B
254ms
253ms
Fetch
text/plain
142.251.23.157
Google LLC
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1001161376096050&correlator=1983084363695259&eid=31098216%2C95393146&output=ldjh&gdfp_req=1&vrg=202606090101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=17&didk=1697938527&dids=div-gpt-ad-mediafire_com-box-2&adfs=2211965457&sfv=1-0-45&rcs=2&eri=1&sc=1&cookie=ID%3Da72da8f8dac4dbe8%3AT%3D1781354330%3ART%3D1781354330%3AS%3DALNI_MZCBh_ptzlSFjn4mKG_I6_ZJqzdog&gpic=UID%3D0000146865d5f26d%3AT%3D1781354330%3ART%3D1781354330%3AS%3DALNI_MY7xi4RFbTEF4Q5wPKl_IsjF120uA&abxe=1&dt=1781354332149&lmt=1781354332&adxs=552&adys=10&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=2&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=540&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE0OS4wLjc4MjcuMTAyIixudWxsLDAsbnVsbCwiNjQiLFtbIkNocm9taXVtIiwiMTQ5LjAuMC4wIl0sWyJHb29nbGUgQ2hyb21lIiwiMTQ5LjAuMC4wIl0sWyJOb3QtQS5CcmFuZCIsIjI0LjAuMC4wIl1dLDBd&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F41kkjh07tibblti%2FAINCRAD%2BFF%2BINJECTOR.apk%2Ffile%3Fdkey%3Drv5x6b8wlt0%26r%3D125&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&a3p=EmwKDGlkNS1zeW5jLmNvbRJaSUQ1KmlQVFhWenNHeFltYS0xQU96Nmk4UVhmaTB2WHY0d0JIdEJuVWpzRHBiMVRfXzJvdFQxdGFBQUVCQ21vdFQxb0F1S2ZKaktlZDd4TEtNVkF1MXRtTHdBWAESNgoMYWRzZXJ2ZXIub3JnEiQwZjUxNzEyMC02ODNjLTRjZTktOTJhZC1jZDE5MjY2ZDZkZWRYARK7AQoKY3JpdGVvLmNvbRKqAVNaYU16bDlvZDFKcVNuSjRVVzlNY25oRGRGbHJkM05TYUVKcVNVRnVObVZ6TlRGcmVVdDFXRGt5TkhRbE1rSnNhVGgxTkhWc05HbG1keVV5Um5GdFpVZE1WblZUYVdVMVNtNDBXR1ZhSlRKQ1RuaERlWEJYTlcxMU16RkpkbWR2YmtGeVJIQnliVlowSlRKQ1QxRnNKVEpHVFdwWVNYZ2xNa1pEWXlVelJBWAESNAoKcHViY2lkLm9yZxIkM2JmYmY3YmQtYjc2NC00NmZiLTliMjQtZGQyNzk5YmUyZDkxWAESWgoNY3J3ZGNudHJsLm5ldBJAZmI3ZWM1NWQyOWRmYzI1ZGFkMzVkYzRkZTQ2NzE4NWNhMDJjNTIwZGZjZWU5NzhlMmVjMzIyMmU3NmQ2M2ZmMBj58_eH7DNIABIdCg5lc3AuY3JpdGVvLmNvbRiw8PeH7DNIAFICCGQSGAoJeWFob28uY29tGNvx94fsM0gAUgIIbxI-CgVvcGVueBIsZXlKcElqb2lZa05NZFRkTFZ6SlNVSFU0UVU1WE5IWnpka3hPWnowOUluMD0Y0Pj3h-wzSAASrgIKCHJ0YmhvdXNlEpgCb2o0TWU4T0xkckdQbksyTUUyUmY3ODl0aU04V2RvNUt5ZzBwSzM2NU9iZmRUdFExcUdubTZCckF3V0tGaFdhRWJEQ3F0SXpSMlkzRVlkRGM5dmF5U1JsU24wcGE3cFR0cm14WHBHclpJZWhIQkd3V1cwMXVtZTZvZElZS0J5OE5FUitoWjdkaSsvaVdQSzBjYXB4eFVVZzRTMGlVUTJKQXVNbTdSWjV5aDBaN1k4aWtvUTV1RG1CY2ZsTDFUZ1c0RjJ6ZXo2QzI1eEIxWnFFR0pHeGI0UVd2OWJwd3Y3MnhDU291djNWUllyN0IwQUJuMmtqZ1lRckVjRHFOREtJQlduRGx2QStaZDdJRGkrenNOUzB0dWc9PRjn-PeH7DNIAA..&dlt=1781354328063&idt=1996&ppid=5594807e3b73660db22cc026894621f4&uule=a%20cm9sZToxIHByb2R1Y2VyOjEyIGxvYzoiMTQwLTAwMDEsSlAi&prev_scp=a%3D1%26iid1%3D2274176620558%26eid%3D2274176620558%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D1%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252F41kkjh07tibblti%252FAINCRAD%252BFF%252BINJECTOR.apk%252Ffile%253Fdkey%253Drv5x6b8wlt0%2526r%253D125%26path%3D%252Ffile%252F41kkjh07tibblti%252FAINCRAD%252BFF%252BINJECTOR.apk%252Ffile%26ap%3D1103%26sap%3D1103%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-box-2%26tap%3Dmediafire_com-box-2-2274176620558%26eb_br%3Dzero%26eba%3D0%26bv%3D11%26bvm%3D0%26bvr%3D1%26avc%3D43%26evc%3D36%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D0%26br2%3D26%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D157%2C168%2C0%2C0%2C0%2C168%2C184%2C20%2C0%2C0%2C192%2C31%2C902%2C903%2C901%2C902%2C903%26deal1%3D18%2C1428%2C2693%2C3052%2C3053%2C3856%2C7331%2C8229%2C8333%2C8334%2C8335%26osb%3DLinux%252FChrome%26dbg%3Drc%253A2%26reqt%3D1781354331611&adks=3106951849&frm=20&eo_id_str=ID%3Dc9df7b54bcd371a2%3AT%3D1781354330%3ART%3D1781354330%3AS%3DAA-Afja4gVi1oGpU66Pr7KR0wygQ&pbbce=1
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.23.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
rl-in-f157.1e100.net
Software
cafe /
Resource Hash
6013e3da151047bfcdddc1d3a2ade401538d489eff88ad1782a87c0d1ae9cd6a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
dcb
google-lineitem-id
-2
observe-browsing-topics
?1
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sat, 13 Jun 2026 12:38:52 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-2
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
225
x-xss-protection
0
server
cafe
GET
H3
200
ads Show response
securepubads.g.doubleclick.net/gampad/
523 B
252 B
261ms
260ms
Fetch
text/plain
142.251.23.157
Google LLC
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1001161376096050&correlator=3681982847018971&eid=31098216%2C95393146&output=ldjh&gdfp_req=1&vrg=202606090101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-banner-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=18&didk=417644066&dids=div-gpt-ad-mediafire_com-banne&adfs=4128408292&sfv=1-0-45&rcs=2&eri=1&sc=1&cookie=ID%3Da72da8f8dac4dbe8%3AT%3D1781354330%3ART%3D1781354330%3AS%3DALNI_MZCBh_ptzlSFjn4mKG_I6_ZJqzdog&gpic=UID%3D0000146865d5f26d%3AT%3D1781354330%3ART%3D1781354330%3AS%3DALNI_MY7xi4RFbTEF4Q5wPKl_IsjF120uA&abxe=1&dt=1781354332182&lmt=1781354332&adxs=436&adys=1410&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=3&ucis=1&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=540&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE0OS4wLjc4MjcuMTAyIixudWxsLDAsbnVsbCwiNjQiLFtbIkNocm9taXVtIiwiMTQ5LjAuMC4wIl0sWyJHb29nbGUgQ2hyb21lIiwiMTQ5LjAuMC4wIl0sWyJOb3QtQS5CcmFuZCIsIjI0LjAuMC4wIl1dLDBd&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F41kkjh07tibblti%2FAINCRAD%2BFF%2BINJECTOR.apk%2Ffile%3Fdkey%3Drv5x6b8wlt0%26r%3D125&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&a3p=EmwKDGlkNS1zeW5jLmNvbRJaSUQ1KmlQVFhWenNHeFltYS0xQU96Nmk4UVhmaTB2WHY0d0JIdEJuVWpzRHBiMVRfXzJvdFQxdGFBQUVCQ21vdFQxb0F1S2ZKaktlZDd4TEtNVkF1MXRtTHdBWAESNgoMYWRzZXJ2ZXIub3JnEiQwZjUxNzEyMC02ODNjLTRjZTktOTJhZC1jZDE5MjY2ZDZkZWRYARK7AQoKY3JpdGVvLmNvbRKqAVNaYU16bDlvZDFKcVNuSjRVVzlNY25oRGRGbHJkM05TYUVKcVNVRnVObVZ6TlRGcmVVdDFXRGt5TkhRbE1rSnNhVGgxTkhWc05HbG1keVV5Um5GdFpVZE1WblZUYVdVMVNtNDBXR1ZhSlRKQ1RuaERlWEJYTlcxMU16RkpkbWR2YmtGeVJIQnliVlowSlRKQ1QxRnNKVEpHVFdwWVNYZ2xNa1pEWXlVelJBWAESNAoKcHViY2lkLm9yZxIkM2JmYmY3YmQtYjc2NC00NmZiLTliMjQtZGQyNzk5YmUyZDkxWAESWgoNY3J3ZGNudHJsLm5ldBJAZmI3ZWM1NWQyOWRmYzI1ZGFkMzVkYzRkZTQ2NzE4NWNhMDJjNTIwZGZjZWU5NzhlMmVjMzIyMmU3NmQ2M2ZmMBj58_eH7DNIABIdCg5lc3AuY3JpdGVvLmNvbRiw8PeH7DNIAFICCGQSGAoJeWFob28uY29tGNvx94fsM0gAUgIIbxI-CgVvcGVueBIsZXlKcElqb2lZa05NZFRkTFZ6SlNVSFU0UVU1WE5IWnpka3hPWnowOUluMD0Y0Pj3h-wzSAASrgIKCHJ0YmhvdXNlEpgCb2o0TWU4T0xkckdQbksyTUUyUmY3ODl0aU04V2RvNUt5ZzBwSzM2NU9iZmRUdFExcUdubTZCckF3V0tGaFdhRWJEQ3F0SXpSMlkzRVlkRGM5dmF5U1JsU24wcGE3cFR0cm14WHBHclpJZWhIQkd3V1cwMXVtZTZvZElZS0J5OE5FUitoWjdkaSsvaVdQSzBjYXB4eFVVZzRTMGlVUTJKQXVNbTdSWjV5aDBaN1k4aWtvUTV1RG1CY2ZsTDFUZ1c0RjJ6ZXo2QzI1eEIxWnFFR0pHeGI0UVd2OWJwd3Y3MnhDU291djNWUllyN0IwQUJuMmtqZ1lRckVjRHFOREtJQlduRGx2QStaZDdJRGkrenNOUzB0dWc9PRjn-PeH7DNIAA..&dlt=1781354328063&idt=1996&ppid=5594807e3b73660db22cc026894621f4&uule=a%20cm9sZToxIHByb2R1Y2VyOjEyIGxvYzoiMTQwLTAwMDEsSlAi&prev_scp=a%3D1%26iid1%3D386838486652581%26eid%3D386838486652581%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D1%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252F41kkjh07tibblti%252FAINCRAD%252BFF%252BINJECTOR.apk%252Ffile%253Fdkey%253Drv5x6b8wlt0%2526r%253D125%26path%3D%252Ffile%252F41kkjh07tibblti%252FAINCRAD%252BFF%252BINJECTOR.apk%252Ffile%26ap%3D1107%26sap%3D1107%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D9%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D30%26al%3D1030%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-banner-1%26tap%3Dmediafire_com-banner-1-386838486652581%26eb_br%3Dzero%26eba%3D0%26bv%3D11%26bvm%3D0%26bvr%3D1%26avc%3D21%26evc%3D27%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D0%26br2%3D12%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D32%2C193%2C0%2C0%2C0%2C131%2C132%2C0%2C0%2C0%2C187%2C0%2C901%2C182%2C901%2C902%2C903%26deal1%3D3052%2C3856%2C8229%26osb%3DLinux%252FChrome%26dbg%3Drc%253A1%26reqt%3D1781354331636&adks=3665333008&frm=20&eo_id_str=ID%3Dc9df7b54bcd371a2%3AT%3D1781354330%3ART%3D1781354330%3AS%3DAA-Afja4gVi1oGpU66Pr7KR0wygQ&pbbce=1
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.23.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
rl-in-f157.1e100.net
Software
cafe /
Resource Hash
30efb77cc288905ea319e4607f6043db2e034cf9582acd97dc1cafbf9abc6380
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
dcb
google-lineitem-id
-2
observe-browsing-topics
?1
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sat, 13 Jun 2026 12:38:52 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-2
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
222
x-xss-protection
0
server
cafe
GET
H3
200
ads Show response
securepubads.g.doubleclick.net/gampad/
530 B
260 B
303ms
302ms
Fetch
text/plain
142.251.23.157
Google LLC
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1001161376096050&correlator=520960800882492&eid=31098216%2C95393146&output=ldjh&gdfp_req=1&vrg=202606090101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-medrectangle-3&enc_prev_ius=%2F0%2F1&prev_iu_szs=336x280&ifi=19&didk=46179496&dids=div-gpt-ad-mediafire_com-medre&adfs=1911771697&sfv=1-0-45&rcs=2&eri=1&sc=1&cookie=ID%3Da72da8f8dac4dbe8%3AT%3D1781354330%3ART%3D1781354330%3AS%3DALNI_MZCBh_ptzlSFjn4mKG_I6_ZJqzdog&gpic=UID%3D0000146865d5f26d%3AT%3D1781354330%3ART%3D1781354330%3AS%3DALNI_MY7xi4RFbTEF4Q5wPKl_IsjF120uA&abxe=1&dt=1781354332188&lmt=1781354332&adxs=320&adys=120&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=7&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=540&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE0OS4wLjc4MjcuMTAyIixudWxsLDAsbnVsbCwiNjQiLFtbIkNocm9taXVtIiwiMTQ5LjAuMC4wIl0sWyJHb29nbGUgQ2hyb21lIiwiMTQ5LjAuMC4wIl0sWyJOb3QtQS5CcmFuZCIsIjI0LjAuMC4wIl1dLDBd&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F41kkjh07tibblti%2FAINCRAD%2BFF%2BINJECTOR.apk%2Ffile%3Fdkey%3Drv5x6b8wlt0%26r%3D125&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&a3p=EmwKDGlkNS1zeW5jLmNvbRJaSUQ1KmlQVFhWenNHeFltYS0xQU96Nmk4UVhmaTB2WHY0d0JIdEJuVWpzRHBiMVRfXzJvdFQxdGFBQUVCQ21vdFQxb0F1S2ZKaktlZDd4TEtNVkF1MXRtTHdBWAESNgoMYWRzZXJ2ZXIub3JnEiQwZjUxNzEyMC02ODNjLTRjZTktOTJhZC1jZDE5MjY2ZDZkZWRYARK7AQoKY3JpdGVvLmNvbRKqAVNaYU16bDlvZDFKcVNuSjRVVzlNY25oRGRGbHJkM05TYUVKcVNVRnVObVZ6TlRGcmVVdDFXRGt5TkhRbE1rSnNhVGgxTkhWc05HbG1keVV5Um5GdFpVZE1WblZUYVdVMVNtNDBXR1ZhSlRKQ1RuaERlWEJYTlcxMU16RkpkbWR2YmtGeVJIQnliVlowSlRKQ1QxRnNKVEpHVFdwWVNYZ2xNa1pEWXlVelJBWAESNAoKcHViY2lkLm9yZxIkM2JmYmY3YmQtYjc2NC00NmZiLTliMjQtZGQyNzk5YmUyZDkxWAESWgoNY3J3ZGNudHJsLm5ldBJAZmI3ZWM1NWQyOWRmYzI1ZGFkMzVkYzRkZTQ2NzE4NWNhMDJjNTIwZGZjZWU5NzhlMmVjMzIyMmU3NmQ2M2ZmMBj58_eH7DNIABIdCg5lc3AuY3JpdGVvLmNvbRiw8PeH7DNIAFICCGQSGAoJeWFob28uY29tGNvx94fsM0gAUgIIbxI-CgVvcGVueBIsZXlKcElqb2lZa05NZFRkTFZ6SlNVSFU0UVU1WE5IWnpka3hPWnowOUluMD0Y0Pj3h-wzSAASrgIKCHJ0YmhvdXNlEpgCb2o0TWU4T0xkckdQbksyTUUyUmY3ODl0aU04V2RvNUt5ZzBwSzM2NU9iZmRUdFExcUdubTZCckF3V0tGaFdhRWJEQ3F0SXpSMlkzRVlkRGM5dmF5U1JsU24wcGE3cFR0cm14WHBHclpJZWhIQkd3V1cwMXVtZTZvZElZS0J5OE5FUitoWjdkaSsvaVdQSzBjYXB4eFVVZzRTMGlVUTJKQXVNbTdSWjV5aDBaN1k4aWtvUTV1RG1CY2ZsTDFUZ1c0RjJ6ZXo2QzI1eEIxWnFFR0pHeGI0UVd2OWJwd3Y3MnhDU291djNWUllyN0IwQUJuMmtqZ1lRckVjRHFOREtJQlduRGx2QStaZDdJRGkrenNOUzB0dWc9PRjn-PeH7DNIAA..&dlt=1781354328063&idt=1996&ppid=5594807e3b73660db22cc026894621f4&uule=a%20cm9sZToxIHByb2R1Y2VyOjEyIGxvYzoiMTQwLTAwMDEsSlAi&prev_scp=a%3D1%26iid1%3D4784697890653043%26eid%3D4784697890653043%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D1%26adnum%3D2%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252F41kkjh07tibblti%252FAINCRAD%252BFF%252BINJECTOR.apk%252Ffile%253Fdkey%253Drv5x6b8wlt0%2526r%253D125%26path%3D%252Ffile%252F41kkjh07tibblti%252FAINCRAD%252BFF%252BINJECTOR.apk%252Ffile%26ap%3D1104%26sap%3D1104%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D5%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D21%26al%3D1021%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-medrectangle-3%26tap%3Dmediafire_com-medrectangle-3-4784697890653043%26eb_br%3D7432360301409ae695ba255f16fbcf06%26eba%3D0%26bv%3D11%26bvm%3D0%26bvr%3D1%26avc%3D45%26evc%3D38%26shp%3D3%26ftsn%3D12%26ftsng%3D12%26br1%3D20%26br2%3D20%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D78%2C168%2C0%2C0%2C0%2C131%2C132%2C0%2C0%2C0%2C187%2C0%2C901%2C182%2C901%2C902%2C903%26deal1%3D18%2C1428%2C3052%2C3053%2C3856%2C7331%2C8229%2C8333%2C8334%26osb%3DLinux%252FChrome%26dbg%3Drc%253A7%26reqt%3D1781354331613&adks=4079446691&frm=20&eo_id_str=ID%3Dc9df7b54bcd371a2%3AT%3D1781354330%3ART%3D1781354330%3AS%3DAA-Afja4gVi1oGpU66Pr7KR0wygQ&pbbce=1
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.23.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
rl-in-f157.1e100.net
Software
cafe /
Resource Hash
cc9fc34cc8204f5f55da2b50bc51524db4e28807a34cab1ff36b8a7d87fd6fe9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
dcb
google-lineitem-id
-2
observe-browsing-topics
?1
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sat, 13 Jun 2026 12:38:52 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-2
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
230
x-xss-protection
0
server
cafe
GET
H3
200
ads Show response
securepubads.g.doubleclick.net/gampad/
529 B
261 B
253ms
253ms
Fetch
text/plain
142.251.23.157
Google LLC
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1001161376096050&correlator=383225618272117&eid=31098216%2C95393146&output=ldjh&gdfp_req=1&vrg=202606090101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=20&didk=219167732&dids=div-gpt-ad-mediafire_com-medre&adfs=2995551083&sfv=1-0-45&rcs=2&eri=1&sc=1&cookie=ID%3Da72da8f8dac4dbe8%3AT%3D1781354330%3ART%3D1781354330%3AS%3DALNI_MZCBh_ptzlSFjn4mKG_I6_ZJqzdog&gpic=UID%3D0000146865d5f26d%3AT%3D1781354330%3ART%3D1781354330%3AS%3DALNI_MY7xi4RFbTEF4Q5wPKl_IsjF120uA&abxe=1&dt=1781354332193&lmt=1781354332&adxs=795&adys=1109&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=6&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=540&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE0OS4wLjc4MjcuMTAyIixudWxsLDAsbnVsbCwiNjQiLFtbIkNocm9taXVtIiwiMTQ5LjAuMC4wIl0sWyJHb29nbGUgQ2hyb21lIiwiMTQ5LjAuMC4wIl0sWyJOb3QtQS5CcmFuZCIsIjI0LjAuMC4wIl1dLDBd&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F41kkjh07tibblti%2FAINCRAD%2BFF%2BINJECTOR.apk%2Ffile%3Fdkey%3Drv5x6b8wlt0%26r%3D125&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&a3p=EmwKDGlkNS1zeW5jLmNvbRJaSUQ1KmlQVFhWenNHeFltYS0xQU96Nmk4UVhmaTB2WHY0d0JIdEJuVWpzRHBiMVRfXzJvdFQxdGFBQUVCQ21vdFQxb0F1S2ZKaktlZDd4TEtNVkF1MXRtTHdBWAESNgoMYWRzZXJ2ZXIub3JnEiQwZjUxNzEyMC02ODNjLTRjZTktOTJhZC1jZDE5MjY2ZDZkZWRYARK7AQoKY3JpdGVvLmNvbRKqAVNaYU16bDlvZDFKcVNuSjRVVzlNY25oRGRGbHJkM05TYUVKcVNVRnVObVZ6TlRGcmVVdDFXRGt5TkhRbE1rSnNhVGgxTkhWc05HbG1keVV5Um5GdFpVZE1WblZUYVdVMVNtNDBXR1ZhSlRKQ1RuaERlWEJYTlcxMU16RkpkbWR2YmtGeVJIQnliVlowSlRKQ1QxRnNKVEpHVFdwWVNYZ2xNa1pEWXlVelJBWAESNAoKcHViY2lkLm9yZxIkM2JmYmY3YmQtYjc2NC00NmZiLTliMjQtZGQyNzk5YmUyZDkxWAESWgoNY3J3ZGNudHJsLm5ldBJAZmI3ZWM1NWQyOWRmYzI1ZGFkMzVkYzRkZTQ2NzE4NWNhMDJjNTIwZGZjZWU5NzhlMmVjMzIyMmU3NmQ2M2ZmMBj58_eH7DNIABIdCg5lc3AuY3JpdGVvLmNvbRiw8PeH7DNIAFICCGQSGAoJeWFob28uY29tGNvx94fsM0gAUgIIbxI-CgVvcGVueBIsZXlKcElqb2lZa05NZFRkTFZ6SlNVSFU0UVU1WE5IWnpka3hPWnowOUluMD0Y0Pj3h-wzSAASrgIKCHJ0YmhvdXNlEpgCb2o0TWU4T0xkckdQbksyTUUyUmY3ODl0aU04V2RvNUt5ZzBwSzM2NU9iZmRUdFExcUdubTZCckF3V0tGaFdhRWJEQ3F0SXpSMlkzRVlkRGM5dmF5U1JsU24wcGE3cFR0cm14WHBHclpJZWhIQkd3V1cwMXVtZTZvZElZS0J5OE5FUitoWjdkaSsvaVdQSzBjYXB4eFVVZzRTMGlVUTJKQXVNbTdSWjV5aDBaN1k4aWtvUTV1RG1CY2ZsTDFUZ1c0RjJ6ZXo2QzI1eEIxWnFFR0pHeGI0UVd2OWJwd3Y3MnhDU291djNWUllyN0IwQUJuMmtqZ1lRckVjRHFOREtJQlduRGx2QStaZDdJRGkrenNOUzB0dWc9PRjn-PeH7DNIAA..&dlt=1781354328063&idt=1996&ppid=5594807e3b73660db22cc026894621f4&uule=a%20cm9sZToxIHByb2R1Y2VyOjEyIGxvYzoiMTQwLTAwMDEsSlAi&prev_scp=a%3D1%26iid1%3D8074675296629805%26eid%3D8074675296629805%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D1%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252F41kkjh07tibblti%252FAINCRAD%252BFF%252BINJECTOR.apk%252Ffile%253Fdkey%253Drv5x6b8wlt0%2526r%253D125%26path%3D%252Ffile%252F41kkjh07tibblti%252FAINCRAD%252BFF%252BINJECTOR.apk%252Ffile%26ap%3D1100%26sap%3D1100%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D8%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-medrectangle-2%26tap%3Dmediafire_com-medrectangle-2-8074675296629805%26eb_br%3Dzero%26eba%3D0%26bv%3D24%26bvm%3D0%26bvr%3D2%26avc%3D23%26evc%3D25%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D0%26br2%3D2%26ezoic%3D1%26nmau%3D2%26mau%3D1%26dac%3D1%26stl%3D32%2C131%2C0%2C0%2C0%2C131%2C132%2C0%2C0%2C0%2C187%2C0%2C901%2C182%2C901%2C902%2C903%26deal1%3D8229%26osb%3DLinux%252FChrome%26dbg%3Dadap%253A1%2Crc%253A6%26reqt%3D1781354331616&adks=1277576459&frm=20&eo_id_str=ID%3Dc9df7b54bcd371a2%3AT%3D1781354330%3ART%3D1781354330%3AS%3DAA-Afja4gVi1oGpU66Pr7KR0wygQ&pbbce=1
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.23.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
rl-in-f157.1e100.net
Software
cafe /
Resource Hash
a2140778f429118df810b50336d49b28830a0e988210fa7a6a2925477c65c212
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
dcb
google-lineitem-id
-2
observe-browsing-topics
?1
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sat, 13 Jun 2026 12:38:52 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-2
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
231
x-xss-protection
0
server
cafe
GET
H3
200
ads Show response
securepubads.g.doubleclick.net/gampad/
522 B
255 B
259ms
258ms
Fetch
text/plain
142.251.23.157
Google LLC
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1001161376096050&correlator=881804150316041&eid=31098216%2C95393146&output=ldjh&gdfp_req=1&vrg=202606090101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-edge-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=160x600&ifi=21&didk=2994425013&dids=div-gpt-ad-mediafire_com-edge-&adfs=982453029&sfv=1-0-45&rcs=2&eri=1&sc=1&cookie=ID%3Da72da8f8dac4dbe8%3AT%3D1781354330%3ART%3D1781354330%3AS%3DALNI_MZCBh_ptzlSFjn4mKG_I6_ZJqzdog&gpic=UID%3D0000146865d5f26d%3AT%3D1781354330%3ART%3D1781354330%3AS%3DALNI_MY7xi4RFbTEF4Q5wPKl_IsjF120uA&abxe=1&dt=1781354332197&lmt=1781354332&adxs=1440&adys=300&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=4&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=540&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE0OS4wLjc4MjcuMTAyIixudWxsLDAsbnVsbCwiNjQiLFtbIkNocm9taXVtIiwiMTQ5LjAuMC4wIl0sWyJHb29nbGUgQ2hyb21lIiwiMTQ5LjAuMC4wIl0sWyJOb3QtQS5CcmFuZCIsIjI0LjAuMC4wIl1dLDBd&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F41kkjh07tibblti%2FAINCRAD%2BFF%2BINJECTOR.apk%2Ffile%3Fdkey%3Drv5x6b8wlt0%26r%3D125&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&a3p=EmwKDGlkNS1zeW5jLmNvbRJaSUQ1KmlQVFhWenNHeFltYS0xQU96Nmk4UVhmaTB2WHY0d0JIdEJuVWpzRHBiMVRfXzJvdFQxdGFBQUVCQ21vdFQxb0F1S2ZKaktlZDd4TEtNVkF1MXRtTHdBWAESNgoMYWRzZXJ2ZXIub3JnEiQwZjUxNzEyMC02ODNjLTRjZTktOTJhZC1jZDE5MjY2ZDZkZWRYARK7AQoKY3JpdGVvLmNvbRKqAVNaYU16bDlvZDFKcVNuSjRVVzlNY25oRGRGbHJkM05TYUVKcVNVRnVObVZ6TlRGcmVVdDFXRGt5TkhRbE1rSnNhVGgxTkhWc05HbG1keVV5Um5GdFpVZE1WblZUYVdVMVNtNDBXR1ZhSlRKQ1RuaERlWEJYTlcxMU16RkpkbWR2YmtGeVJIQnliVlowSlRKQ1QxRnNKVEpHVFdwWVNYZ2xNa1pEWXlVelJBWAESNAoKcHViY2lkLm9yZxIkM2JmYmY3YmQtYjc2NC00NmZiLTliMjQtZGQyNzk5YmUyZDkxWAESWgoNY3J3ZGNudHJsLm5ldBJAZmI3ZWM1NWQyOWRmYzI1ZGFkMzVkYzRkZTQ2NzE4NWNhMDJjNTIwZGZjZWU5NzhlMmVjMzIyMmU3NmQ2M2ZmMBj58_eH7DNIABIdCg5lc3AuY3JpdGVvLmNvbRiw8PeH7DNIAFICCGQSGAoJeWFob28uY29tGNvx94fsM0gAUgIIbxI-CgVvcGVueBIsZXlKcElqb2lZa05NZFRkTFZ6SlNVSFU0UVU1WE5IWnpka3hPWnowOUluMD0Y0Pj3h-wzSAASrgIKCHJ0YmhvdXNlEpgCb2o0TWU4T0xkckdQbksyTUUyUmY3ODl0aU04V2RvNUt5ZzBwSzM2NU9iZmRUdFExcUdubTZCckF3V0tGaFdhRWJEQ3F0SXpSMlkzRVlkRGM5dmF5U1JsU24wcGE3cFR0cm14WHBHclpJZWhIQkd3V1cwMXVtZTZvZElZS0J5OE5FUitoWjdkaSsvaVdQSzBjYXB4eFVVZzRTMGlVUTJKQXVNbTdSWjV5aDBaN1k4aWtvUTV1RG1CY2ZsTDFUZ1c0RjJ6ZXo2QzI1eEIxWnFFR0pHeGI0UVd2OWJwd3Y3MnhDU291djNWUllyN0IwQUJuMmtqZ1lRckVjRHFOREtJQlduRGx2QStaZDdJRGkrenNOUzB0dWc9PRjn-PeH7DNIAA..&dlt=1781354328063&idt=1996&ppid=5594807e3b73660db22cc026894621f4&uule=a%20cm9sZToxIHByb2R1Y2VyOjEyIGxvYzoiMTQwLTAwMDEsSlAi&prev_scp=a%3D1%26iid1%3D8854121008628726%26eid%3D8854121008628726%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D1%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252F41kkjh07tibblti%252FAINCRAD%252BFF%252BINJECTOR.apk%252Ffile%253Fdkey%253Drv5x6b8wlt0%2526r%253D125%26path%3D%252Ffile%252F41kkjh07tibblti%252FAINCRAD%252BFF%252BINJECTOR.apk%252Ffile%26ap%3D1102%26sap%3D1102%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D3%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D39%26al%3D1039%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-edge-2%26tap%3Dmediafire_com-edge-2-8854121008628726%26eb_br%3D33dd523f8e4dda158f0aa99686dda7f2%26eba%3D0%26bv%3D54%26bvm%3D0%26bvr%3D15%26avc%3D25%26evc%3D27%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D6%26br2%3D8%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D157%2C131%2C0%2C0%2C0%2C168%2C184%2C20%2C0%2C0%2C192%2C31%2C902%2C903%2C901%2C902%2C903%26deal1%3D3856%26osb%3DLinux%252FChrome%26dbg%3Drc%253A4%26reqt%3D1781354331526&adks=697308627&frm=20&eo_id_str=ID%3Dc9df7b54bcd371a2%3AT%3D1781354330%3ART%3D1781354330%3AS%3DAA-Afja4gVi1oGpU66Pr7KR0wygQ&pbbce=1
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.23.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
rl-in-f157.1e100.net
Software
cafe /
Resource Hash
b6e7602b7a190d77f2ceb56a9f8a1f668ab0efeb75a82c6cc9aef5a7f101341e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
dcb
google-lineitem-id
-2
observe-browsing-topics
?1
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sat, 13 Jun 2026 12:38:52 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-2
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
225
x-xss-protection
0
server
cafe
GET
H3
200
ads Show response
securepubads.g.doubleclick.net/gampad/
530 B
256 B
297ms
297ms
Fetch
text/plain
142.251.23.157
Google LLC
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1001161376096050&correlator=1855402402676611&eid=31098216%2C95393146&output=ldjh&gdfp_req=1&vrg=202606090101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-medrectangle-4&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250%7C336x280&ifi=22&didk=46192883&dids=div-gpt-ad-mediafire_com-medre&adfs=1749122204&sfv=1-0-45&rcs=2&eri=1&sc=1&cookie=ID%3Da72da8f8dac4dbe8%3AT%3D1781354330%3ART%3D1781354330%3AS%3DALNI_MZCBh_ptzlSFjn4mKG_I6_ZJqzdog&gpic=UID%3D0000146865d5f26d%3AT%3D1781354330%3ART%3D1781354330%3AS%3DALNI_MY7xi4RFbTEF4Q5wPKl_IsjF120uA&abxe=1&dt=1781354332206&lmt=1781354332&adxs=320&adys=420&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=8&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=540&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE0OS4wLjc4MjcuMTAyIixudWxsLDAsbnVsbCwiNjQiLFtbIkNocm9taXVtIiwiMTQ5LjAuMC4wIl0sWyJHb29nbGUgQ2hyb21lIiwiMTQ5LjAuMC4wIl0sWyJOb3QtQS5CcmFuZCIsIjI0LjAuMC4wIl1dLDBd&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F41kkjh07tibblti%2FAINCRAD%2BFF%2BINJECTOR.apk%2Ffile%3Fdkey%3Drv5x6b8wlt0%26r%3D125&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&a3p=EmwKDGlkNS1zeW5jLmNvbRJaSUQ1KmlQVFhWenNHeFltYS0xQU96Nmk4UVhmaTB2WHY0d0JIdEJuVWpzRHBiMVRfXzJvdFQxdGFBQUVCQ21vdFQxb0F1S2ZKaktlZDd4TEtNVkF1MXRtTHdBWAESNgoMYWRzZXJ2ZXIub3JnEiQwZjUxNzEyMC02ODNjLTRjZTktOTJhZC1jZDE5MjY2ZDZkZWRYARK7AQoKY3JpdGVvLmNvbRKqAVNaYU16bDlvZDFKcVNuSjRVVzlNY25oRGRGbHJkM05TYUVKcVNVRnVObVZ6TlRGcmVVdDFXRGt5TkhRbE1rSnNhVGgxTkhWc05HbG1keVV5Um5GdFpVZE1WblZUYVdVMVNtNDBXR1ZhSlRKQ1RuaERlWEJYTlcxMU16RkpkbWR2YmtGeVJIQnliVlowSlRKQ1QxRnNKVEpHVFdwWVNYZ2xNa1pEWXlVelJBWAESNAoKcHViY2lkLm9yZxIkM2JmYmY3YmQtYjc2NC00NmZiLTliMjQtZGQyNzk5YmUyZDkxWAESWgoNY3J3ZGNudHJsLm5ldBJAZmI3ZWM1NWQyOWRmYzI1ZGFkMzVkYzRkZTQ2NzE4NWNhMDJjNTIwZGZjZWU5NzhlMmVjMzIyMmU3NmQ2M2ZmMBj58_eH7DNIABIdCg5lc3AuY3JpdGVvLmNvbRiw8PeH7DNIAFICCGQSGAoJeWFob28uY29tGNvx94fsM0gAUgIIbxI-CgVvcGVueBIsZXlKcElqb2lZa05NZFRkTFZ6SlNVSFU0UVU1WE5IWnpka3hPWnowOUluMD0Y0Pj3h-wzSAASrgIKCHJ0YmhvdXNlEpgCb2o0TWU4T0xkckdQbksyTUUyUmY3ODl0aU04V2RvNUt5ZzBwSzM2NU9iZmRUdFExcUdubTZCckF3V0tGaFdhRWJEQ3F0SXpSMlkzRVlkRGM5dmF5U1JsU24wcGE3cFR0cm14WHBHclpJZWhIQkd3V1cwMXVtZTZvZElZS0J5OE5FUitoWjdkaSsvaVdQSzBjYXB4eFVVZzRTMGlVUTJKQXVNbTdSWjV5aDBaN1k4aWtvUTV1RG1CY2ZsTDFUZ1c0RjJ6ZXo2QzI1eEIxWnFFR0pHeGI0UVd2OWJwd3Y3MnhDU291djNWUllyN0IwQUJuMmtqZ1lRckVjRHFOREtJQlduRGx2QStaZDdJRGkrenNOUzB0dWc9PRjn-PeH7DNIAA..&dlt=1781354328063&idt=1996&ppid=5594807e3b73660db22cc026894621f4&uule=a%20cm9sZToxIHByb2R1Y2VyOjEyIGxvYzoiMTQwLTAwMDEsSlAi&prev_scp=a%3D1%26iid1%3D6879819124653894%26eid%3D6879819124653894%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D1%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252F41kkjh07tibblti%252FAINCRAD%252BFF%252BINJECTOR.apk%252Ffile%253Fdkey%253Drv5x6b8wlt0%2526r%253D125%26path%3D%252Ffile%252F41kkjh07tibblti%252FAINCRAD%252BFF%252BINJECTOR.apk%252Ffile%26ap%3D1105%26sap%3D1105%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D6%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D22%26al%3D1022%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-medrectangle-4%26tap%3Dmediafire_com-medrectangle-4-6879819124653894%26eb_br%3Dzero%26eba%3D0%26bv%3D11%26bvm%3D0%26bvr%3D1%26avc%3D33%26evc%3D31%26shp%3D3%26ftsn%3D12%26ftsng%3D12%26br1%3D0%26br2%3D14%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D78%2C168%2C0%2C0%2C0%2C131%2C142%2C0%2C0%2C0%2C187%2C0%2C901%2C182%2C901%2C902%2C903%26deal1%3D18%2C1428%2C3052%2C3856%2C8229%2C8333%26osb%3DLinux%252FChrome%26dbg%3Drc%253A8%26reqt%3D1781354331632&adks=2877670411&frm=20&eo_id_str=ID%3Dc9df7b54bcd371a2%3AT%3D1781354330%3ART%3D1781354330%3AS%3DAA-Afja4gVi1oGpU66Pr7KR0wygQ&pbbce=1
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.23.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
rl-in-f157.1e100.net
Software
cafe /
Resource Hash
d5029954faac1e200614108f193af4345c878d1d84250e009914bf391502c778
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
dcb
google-lineitem-id
-2
observe-browsing-topics
?1
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sat, 13 Jun 2026 12:38:52 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-2
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
226
x-xss-protection
0
server
cafe
GET
H3
200
favicon.ico Show response
ad.doubleclick.net/
1 KB
129 B
50ms
49ms
Fetch
image/x-icon
142.251.24.149
Google LLC
General
Full URL
https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250&e=0.08664934936651336
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.24.149 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
rj-in-f149.1e100.net
Software
sffe /
Resource Hash
d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options
nosniff
expires
Sun, 14 Jun 2026 12:38:52 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 13 Jun 2026 12:38:52 GMT
content-type
image/x-icon
vary
Accept-Encoding
last-modified
Tue, 08 May 2012 13:08:06 GMT
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
content-length
104
x-xss-protection
0
server
sffe
GET
H3
200
ads Show response
securepubads.g.doubleclick.net/gampad/
529 B
263 B
253ms
253ms
Fetch
text/plain
142.251.23.157
Google LLC
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1001161376096050&correlator=197735193830612&eid=31098216%2C95393146&output=ldjh&gdfp_req=1&vrg=202606090101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=23&didk=46178465&dids=div-gpt-ad-mediafire_com-medre&adfs=1959198455&sfv=1-0-45&rcs=2&eri=1&sc=1&cookie=ID%3Da72da8f8dac4dbe8%3AT%3D1781354330%3ART%3D1781354330%3AS%3DALNI_MZCBh_ptzlSFjn4mKG_I6_ZJqzdog&gpic=UID%3D0000146865d5f26d%3AT%3D1781354330%3ART%3D1781354330%3AS%3DALNI_MY7xi4RFbTEF4Q5wPKl_IsjF120uA&abxe=1&dt=1781354332210&lmt=1781354332&adxs=27&adys=1109&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=5&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=540&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE0OS4wLjc4MjcuMTAyIixudWxsLDAsbnVsbCwiNjQiLFtbIkNocm9taXVtIiwiMTQ5LjAuMC4wIl0sWyJHb29nbGUgQ2hyb21lIiwiMTQ5LjAuMC4wIl0sWyJOb3QtQS5CcmFuZCIsIjI0LjAuMC4wIl1dLDBd&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F41kkjh07tibblti%2FAINCRAD%2BFF%2BINJECTOR.apk%2Ffile%3Fdkey%3Drv5x6b8wlt0%26r%3D125&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&a3p=EmwKDGlkNS1zeW5jLmNvbRJaSUQ1KmlQVFhWenNHeFltYS0xQU96Nmk4UVhmaTB2WHY0d0JIdEJuVWpzRHBiMVRfXzJvdFQxdGFBQUVCQ21vdFQxb0F1S2ZKaktlZDd4TEtNVkF1MXRtTHdBWAESNgoMYWRzZXJ2ZXIub3JnEiQwZjUxNzEyMC02ODNjLTRjZTktOTJhZC1jZDE5MjY2ZDZkZWRYARK7AQoKY3JpdGVvLmNvbRKqAVNaYU16bDlvZDFKcVNuSjRVVzlNY25oRGRGbHJkM05TYUVKcVNVRnVObVZ6TlRGcmVVdDFXRGt5TkhRbE1rSnNhVGgxTkhWc05HbG1keVV5Um5GdFpVZE1WblZUYVdVMVNtNDBXR1ZhSlRKQ1RuaERlWEJYTlcxMU16RkpkbWR2YmtGeVJIQnliVlowSlRKQ1QxRnNKVEpHVFdwWVNYZ2xNa1pEWXlVelJBWAESNAoKcHViY2lkLm9yZxIkM2JmYmY3YmQtYjc2NC00NmZiLTliMjQtZGQyNzk5YmUyZDkxWAESWgoNY3J3ZGNudHJsLm5ldBJAZmI3ZWM1NWQyOWRmYzI1ZGFkMzVkYzRkZTQ2NzE4NWNhMDJjNTIwZGZjZWU5NzhlMmVjMzIyMmU3NmQ2M2ZmMBj58_eH7DNIABIdCg5lc3AuY3JpdGVvLmNvbRiw8PeH7DNIAFICCGQSGAoJeWFob28uY29tGNvx94fsM0gAUgIIbxI-CgVvcGVueBIsZXlKcElqb2lZa05NZFRkTFZ6SlNVSFU0UVU1WE5IWnpka3hPWnowOUluMD0Y0Pj3h-wzSAASrgIKCHJ0YmhvdXNlEpgCb2o0TWU4T0xkckdQbksyTUUyUmY3ODl0aU04V2RvNUt5ZzBwSzM2NU9iZmRUdFExcUdubTZCckF3V0tGaFdhRWJEQ3F0SXpSMlkzRVlkRGM5dmF5U1JsU24wcGE3cFR0cm14WHBHclpJZWhIQkd3V1cwMXVtZTZvZElZS0J5OE5FUitoWjdkaSsvaVdQSzBjYXB4eFVVZzRTMGlVUTJKQXVNbTdSWjV5aDBaN1k4aWtvUTV1RG1CY2ZsTDFUZ1c0RjJ6ZXo2QzI1eEIxWnFFR0pHeGI0UVd2OWJwd3Y3MnhDU291djNWUllyN0IwQUJuMmtqZ1lRckVjRHFOREtJQlduRGx2QStaZDdJRGkrenNOUzB0dWc9PRjn-PeH7DNIAA..&dlt=1781354328063&idt=1996&ppid=5594807e3b73660db22cc026894621f4&uule=a%20cm9sZToxIHByb2R1Y2VyOjEyIGxvYzoiMTQwLTAwMDEsSlAi&prev_scp=a%3D1%26iid1%3D8074675296629805%26eid%3D8074675296629805%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D1%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252F41kkjh07tibblti%252FAINCRAD%252BFF%252BINJECTOR.apk%252Ffile%253Fdkey%253Drv5x6b8wlt0%2526r%253D125%26path%3D%252Ffile%252F41kkjh07tibblti%252FAINCRAD%252BFF%252BINJECTOR.apk%252Ffile%26ap%3D1100%26sap%3D1100%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D7%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-medrectangle-2%26tap%3Dmediafire_com-medrectangle-2-8074675296629805%26eb_br%3Dzero%26eba%3D0%26bv%3D24%26bvm%3D0%26bvr%3D2%26avc%3D23%26evc%3D25%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D0%26br2%3D2%26ezoic%3D1%26nmau%3D2%26mau%3D0%26dac%3D0%26stl%3D32%2C131%2C0%2C0%2C0%2C131%2C132%2C0%2C0%2C0%2C187%2C0%2C901%2C182%2C901%2C902%2C903%26deal1%3D8229%26osb%3DLinux%252FChrome%26dbg%3Drc%253A5%26reqt%3D1781354331537&adks=1630800042&frm=20&eo_id_str=ID%3Dc9df7b54bcd371a2%3AT%3D1781354330%3ART%3D1781354330%3AS%3DAA-Afja4gVi1oGpU66Pr7KR0wygQ&pbbce=1
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.23.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
rl-in-f157.1e100.net
Software
cafe /
Resource Hash
42ac4b37770b42c56312aeb1f888ddae261ade1b9ca92f871fbfe616648a057f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
dcb
google-lineitem-id
-2
observe-browsing-topics
?1
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sat, 13 Jun 2026 12:38:52 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-2
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
233
x-xss-protection
0
server
cafe
POST
H2
200
ad_impression Show response
pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/
60 B
337 B
132ms
130ms
Fetch
application/json
44.227.112.76
Amazon.com
General
Full URL
https://pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ad_impression
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
44.227.112.76 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-44-227-112-76.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
ee63979b621d070be7f6aee315971acb7959ff766758fda88f01c822fd24a7b0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
Content-Type
application/json
sec-ch-ua-mobile
?0

Response headers

access-control-allow-origin
https://www.mediafire.com
content-length
60
date
Sat, 13 Jun 2026 12:38:52 GMT
content-type
application/json; charset=utf-8
vary
Origin
access-control-allow-credentials
true
POST
H2
200
ad_impression Show response
pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/
60 B
337 B
134ms
132ms
Fetch
application/json
44.227.112.76
Amazon.com
General
Full URL
https://pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ad_impression
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
44.227.112.76 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-44-227-112-76.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
ee63979b621d070be7f6aee315971acb7959ff766758fda88f01c822fd24a7b0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
Content-Type
application/json
sec-ch-ua-mobile
?0

Response headers

access-control-allow-origin
https://www.mediafire.com
content-length
60
date
Sat, 13 Jun 2026 12:38:52 GMT
content-type
application/json; charset=utf-8
vary
Origin
access-control-allow-credentials
true
POST
H2
200
ad_impression Show response
pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/
60 B
337 B
132ms
130ms
Fetch
application/json
44.227.112.76
Amazon.com
General
Full URL
https://pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ad_impression
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
44.227.112.76 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-44-227-112-76.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
ee63979b621d070be7f6aee315971acb7959ff766758fda88f01c822fd24a7b0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
Content-Type
application/json
sec-ch-ua-mobile
?0

Response headers

access-control-allow-origin
https://www.mediafire.com
content-length
60
date
Sat, 13 Jun 2026 12:38:52 GMT
content-type
application/json; charset=utf-8
vary
Origin
access-control-allow-credentials
true
POST
H2
200
ad_impression Show response
pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/
60 B
337 B
131ms
130ms
Fetch
application/json
44.227.112.76
Amazon.com
General
Full URL
https://pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ad_impression
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
44.227.112.76 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-44-227-112-76.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
ee63979b621d070be7f6aee315971acb7959ff766758fda88f01c822fd24a7b0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
Content-Type
application/json
sec-ch-ua-mobile
?0

Response headers

access-control-allow-origin
https://www.mediafire.com
content-length
60
date
Sat, 13 Jun 2026 12:38:52 GMT
content-type
application/json; charset=utf-8
vary
Origin
access-control-allow-credentials
true
POST
H2
200
ad_impression Show response
pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/
60 B
337 B
131ms
129ms
Fetch
application/json
44.227.112.76
Amazon.com
General
Full URL
https://pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ad_impression
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
44.227.112.76 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-44-227-112-76.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
ee63979b621d070be7f6aee315971acb7959ff766758fda88f01c822fd24a7b0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
Content-Type
application/json
sec-ch-ua-mobile
?0

Response headers

access-control-allow-origin
https://www.mediafire.com
content-length
60
date
Sat, 13 Jun 2026 12:38:52 GMT
content-type
application/json; charset=utf-8
vary
Origin
access-control-allow-credentials
true
POST
H2
200
ad_impression Show response
pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/
60 B
337 B
180ms
179ms
Fetch
application/json
44.227.112.76
Amazon.com
General
Full URL
https://pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ad_impression
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
44.227.112.76 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-44-227-112-76.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
ee63979b621d070be7f6aee315971acb7959ff766758fda88f01c822fd24a7b0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
Content-Type
application/json
sec-ch-ua-mobile
?0

Response headers

access-control-allow-origin
https://www.mediafire.com
content-length
60
date
Sat, 13 Jun 2026 12:38:52 GMT
content-type
application/json; charset=utf-8
vary
Origin
access-control-allow-credentials
true
POST
H2
200
ad_impression Show response
pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/
60 B
337 B
168ms
166ms
Fetch
application/json
44.227.112.76
Amazon.com
General
Full URL
https://pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ad_impression
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
44.227.112.76 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-44-227-112-76.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
ee63979b621d070be7f6aee315971acb7959ff766758fda88f01c822fd24a7b0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
Content-Type
application/json
sec-ch-ua-mobile
?0

Response headers

access-control-allow-origin
https://www.mediafire.com
content-length
60
date
Sat, 13 Jun 2026 12:38:52 GMT
content-type
application/json; charset=utf-8
vary
Origin
access-control-allow-credentials
true
GET
H3
200
activeview
pagead2.googlesyndication.com/pcs/ Frame 1C40
42 B
65 B
47ms
46ms
Image
image/gif
142.251.24.157
Google LLC
General
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsveVyqsjjTnTb5_dcX3DNzvllCWYA2O1AYiFuY6IqmJk6-Td9Ji1NRT9C8HT-7gd55hK6F83KaNGj4RJS25BzbiXPxv5DzHmiLc2fU5JM3gBgec9PLojlGLZ1kffvGBIp5ngZYoSmYWW4-sf2IJGqwOAlizVLtcAYvg2qIM2P_j_UmSDL6BQJzieFKirhcGaY_vBO8kObfmr7g4VVmxvQ&sai=AMfl-YQlAcMooPn-YJViy1xSZBd5v-bvub5MHVQwJE_ag2hsta7wc7lPDkXxs_ny-FCzFbkbJrjndgsXgBK0mrXW-vRz9wTl6GGWcwwrNSDP6lqfbBxcN0dE2PWqGV50q01-bGjResWNyNwQceTldaUsd_LqSruEFeCXPm8ktf-ILX7WlcESpp_g0etXaUW-uCwzshi-gJVd4bQedA081eaMLyonMolOSnrQoNoLr3JcJGHiE9ADRqbuJo2PO7jp8MAEjappf_CczqhpqjpDdL2GXXwpmYLncLnicaBUtJSWb8FvYallwGzLRTeg0PMcPWocDHaPVCJ4MvN_6joR4i12Zpl8gMQ6eDnuQ6s4fNr3Q5S_PrPzp_mstsgQvggeerXzFq3WutGA6pS5qSY&sig=Cg0ArKJSzPN4-XfG_cskEAE&cid=CAQShgIAEQoqgXoZDjiwdmAR3lLp8alT61ZPEE4phptS_GL4pOSpMyvKF_Gf3fUC-RmhCw3eSwiHWTYkCdKoWyqMryDZLpATpQqehux2qQhbzQ9L1qahcPc7DJRtzpZENK7OGG1LDSKWqkea5Eq2g-Egc4RlU2kw_Q_oo9s3Vp8PAmI2DGojgKemmCO020hBLzT0SJRHYK5gYtwyzaGU4RlMrnYR6allZH4ZwZOkAit3rW3RyEbWjZjfyXDYLCi8K7uCfX31t9rkoI0H4MmyYm9douYy4lALsHpDtR0HuO_GzTFugUi3-_b4Bl0POyq_yZdC0pYac8S5-cLmmDZA5fMtbt6xEJNBqOFyGAE&id=ampim&o=0,300&d=160,600&ss=1600,1200&bs=1600,1200&mcvt=1001&mtos=0,0,1001,1001,1001&tos=0,0,1001,0,0&tfs=96&tls=1097&g=100&h=100&tt=1097&r=v&avms=ampa&uap=Linux&uapv=&uaa=x86&uam=&uafv=149.0.7827.102&uab=64&uafvl=%5B%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22149.0.0.0%22%7D%2C%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22149.0.0.0%22%7D%2C%7B%22brand%22%3A%22Not-A.Brand%22%2C%22version%22%3A%2224.0.0.0%22%7D%5D&uaw=false&adk=0
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.24.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
rj-in-f157.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
42
date
Sat, 13 Jun 2026 12:38:52 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
GET
H2
200
country Show response
api.btloader.com/
37 B
153 B
152ms
150ms
Fetch
application/json
130.211.23.194
Google LLC
General
Full URL
https://api.btloader.com/country?o=5678961798414336
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
130.211.23.194 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS
194.23.211.130.bc.googleusercontent.com
Software
/
Resource Hash
2fc364844767afcfcadb2bd75ae41d008d1ac70351d355f03d3d4814c09bc09d

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
private, max-age=300, stale-while-revalidate=600, stale-if-error=600
via
1.1 google
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000
content-length
37
date
Sat, 13 Jun 2026 12:38:52 GMT
content-type
application/json
vary
Origin
POST
H3
204
pv
api.btloader.com/
0
0
152ms
151ms
Fetch
130.211.23.194
Google LLC
General
Full URL
https://api.btloader.com/pv?nlf=false&tid=3cx3J3ev-wmzF7dOhX-9ec0fdf239&sid=bqPjyzVFSR-jo4xQCMD-9ec0fdf239&cv=2.1.189-1-gf2b7278&upapi=true
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
130.211.23.194 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS
194.23.211.130.bc.googleusercontent.com
Software
/
Resource Hash

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

via
1.1 google
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
alt-svc
h3=":443"; ma=2592000
date
Sat, 13 Jun 2026 12:38:52 GMT
vary
Origin
GET
H3
200
ads Show response
securepubads.g.doubleclick.net/gampad/
529 B
264 B
251ms
249ms
Fetch
text/plain
142.251.23.157
Google LLC
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1001161376096050&correlator=1621938614515556&eid=31098216%2C95393146&output=ldjh&gdfp_req=1&vrg=202606090101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=24&didk=219167732&dids=div-gpt-ad-mediafire_com-medre&adfs=2995551083&sfv=1-0-45&rcs=3&eri=1&sc=1&cookie=ID%3Da72da8f8dac4dbe8%3AT%3D1781354330%3ART%3D1781354330%3AS%3DALNI_MZCBh_ptzlSFjn4mKG_I6_ZJqzdog&gpic=UID%3D0000146865d5f26d%3AT%3D1781354330%3ART%3D1781354330%3AS%3DALNI_MY7xi4RFbTEF4Q5wPKl_IsjF120uA&abxe=1&dt=1781354333199&lmt=1781354333&adxs=795&adys=1109&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=6&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=540&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE0OS4wLjc4MjcuMTAyIixudWxsLDAsbnVsbCwiNjQiLFtbIkNocm9taXVtIiwiMTQ5LjAuMC4wIl0sWyJHb29nbGUgQ2hyb21lIiwiMTQ5LjAuMC4wIl0sWyJOb3QtQS5CcmFuZCIsIjI0LjAuMC4wIl1dLDBd&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F41kkjh07tibblti%2FAINCRAD%2BFF%2BINJECTOR.apk%2Ffile%3Fdkey%3Drv5x6b8wlt0%26r%3D125&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&a3p=EmwKDGlkNS1zeW5jLmNvbRJaSUQ1KmlQVFhWenNHeFltYS0xQU96Nmk4UVhmaTB2WHY0d0JIdEJuVWpzRHBiMVRfXzJvdFQxdGFBQUVCQ21vdFQxb0F1S2ZKaktlZDd4TEtNVkF1MXRtTHdBWAESNgoMYWRzZXJ2ZXIub3JnEiQwZjUxNzEyMC02ODNjLTRjZTktOTJhZC1jZDE5MjY2ZDZkZWRYARK7AQoKY3JpdGVvLmNvbRKqAVNaYU16bDlvZDFKcVNuSjRVVzlNY25oRGRGbHJkM05TYUVKcVNVRnVObVZ6TlRGcmVVdDFXRGt5TkhRbE1rSnNhVGgxTkhWc05HbG1keVV5Um5GdFpVZE1WblZUYVdVMVNtNDBXR1ZhSlRKQ1RuaERlWEJYTlcxMU16RkpkbWR2YmtGeVJIQnliVlowSlRKQ1QxRnNKVEpHVFdwWVNYZ2xNa1pEWXlVelJBWAESNAoKcHViY2lkLm9yZxIkM2JmYmY3YmQtYjc2NC00NmZiLTliMjQtZGQyNzk5YmUyZDkxWAESWgoNY3J3ZGNudHJsLm5ldBJAZmI3ZWM1NWQyOWRmYzI1ZGFkMzVkYzRkZTQ2NzE4NWNhMDJjNTIwZGZjZWU5NzhlMmVjMzIyMmU3NmQ2M2ZmMBj58_eH7DNIABIdCg5lc3AuY3JpdGVvLmNvbRiw8PeH7DNIAFICCGQSGAoJeWFob28uY29tGNvx94fsM0gAUgIIbxI-CgVvcGVueBIsZXlKcElqb2lZa05NZFRkTFZ6SlNVSFU0UVU1WE5IWnpka3hPWnowOUluMD0Y0Pj3h-wzSAASrgIKCHJ0YmhvdXNlEpgCb2o0TWU4T0xkckdQbksyTUUyUmY3ODl0aU04V2RvNUt5ZzBwSzM2NU9iZmRUdFExcUdubTZCckF3V0tGaFdhRWJEQ3F0SXpSMlkzRVlkRGM5dmF5U1JsU24wcGE3cFR0cm14WHBHclpJZWhIQkd3V1cwMXVtZTZvZElZS0J5OE5FUitoWjdkaSsvaVdQSzBjYXB4eFVVZzRTMGlVUTJKQXVNbTdSWjV5aDBaN1k4aWtvUTV1RG1CY2ZsTDFUZ1c0RjJ6ZXo2QzI1eEIxWnFFR0pHeGI0UVd2OWJwd3Y3MnhDU291djNWUllyN0IwQUJuMmtqZ1lRckVjRHFOREtJQlduRGx2QStaZDdJRGkrenNOUzB0dWc9PRjn-PeH7DNIAA..&dlt=1781354328063&idt=1996&ppid=5594807e3b73660db22cc026894621f4&uule=a%20cm9sZToxIHByb2R1Y2VyOjEyIGxvYzoiMTQwLTAwMDEsSlAi&prev_scp=a%3D1%26iid1%3D8074675296629805%26eid%3D8074675296629805%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D1%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252F41kkjh07tibblti%252FAINCRAD%252BFF%252BINJECTOR.apk%252Ffile%253Fdkey%253Drv5x6b8wlt0%2526r%253D125%26path%3D%252Ffile%252F41kkjh07tibblti%252FAINCRAD%252BFF%252BINJECTOR.apk%252Ffile%26ap%3D1100%26sap%3D1100%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D4%26at%3Dmbf%26adr%3D399%26ezosn%3D8%26reft%3Dn%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-medrectangle-2%26tap%3Dmediafire_com-medrectangle-2-8074675296629805%26eb_br%3Dzero%26eba%3D0%26bv%3D24%26bvm%3D0%26bvr%3D2%26avc%3D23%26evc%3D25%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D0%26br2%3D2%26ezoic%3D1%26nmau%3D2%26mau%3D1%26dac%3D1%26stl%3D32%2C131%2C0%2C0%2C0%2C131%2C132%2C0%2C0%2C0%2C187%2C0%2C901%2C182%2C901%2C902%2C903%26deal1%3D8229%26osb%3DLinux%252FChrome%26dbg%3Dadap%253A1%2Crc%253A6%26reqt%3D1781354332513&adks=1277576459&frm=20&eo_id_str=ID%3Dc9df7b54bcd371a2%3AT%3D1781354330%3ART%3D1781354330%3AS%3DAA-Afja4gVi1oGpU66Pr7KR0wygQ&pbbce=1
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.23.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
rl-in-f157.1e100.net
Software
cafe /
Resource Hash
34d74ebadd5a665de4e719f81f48ad5644a4e2ba4dfd4483fbcd2cc5639a7515
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
dcb
google-lineitem-id
-2
observe-browsing-topics
?1
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sat, 13 Jun 2026 12:38:53 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-2
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
234
x-xss-protection
0
server
cafe
GET
H3
200
ads Show response
securepubads.g.doubleclick.net/gampad/
522 B
254 B
263ms
262ms
Fetch
text/plain
142.251.23.157
Google LLC
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1001161376096050&correlator=1418890108721337&eid=31098216%2C95393146&output=ldjh&gdfp_req=1&vrg=202606090101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-edge-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=160x600&ifi=25&didk=2994425013&dids=div-gpt-ad-mediafire_com-edge-&adfs=982453029&sfv=1-0-45&rcs=3&eri=1&sc=1&cookie=ID%3Da72da8f8dac4dbe8%3AT%3D1781354330%3ART%3D1781354330%3AS%3DALNI_MZCBh_ptzlSFjn4mKG_I6_ZJqzdog&gpic=UID%3D0000146865d5f26d%3AT%3D1781354330%3ART%3D1781354330%3AS%3DALNI_MY7xi4RFbTEF4Q5wPKl_IsjF120uA&abxe=1&dt=1781354333217&lmt=1781354333&adxs=1440&adys=300&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=4&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=540&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE0OS4wLjc4MjcuMTAyIixudWxsLDAsbnVsbCwiNjQiLFtbIkNocm9taXVtIiwiMTQ5LjAuMC4wIl0sWyJHb29nbGUgQ2hyb21lIiwiMTQ5LjAuMC4wIl0sWyJOb3QtQS5CcmFuZCIsIjI0LjAuMC4wIl1dLDBd&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F41kkjh07tibblti%2FAINCRAD%2BFF%2BINJECTOR.apk%2Ffile%3Fdkey%3Drv5x6b8wlt0%26r%3D125&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&a3p=EmwKDGlkNS1zeW5jLmNvbRJaSUQ1KmlQVFhWenNHeFltYS0xQU96Nmk4UVhmaTB2WHY0d0JIdEJuVWpzRHBiMVRfXzJvdFQxdGFBQUVCQ21vdFQxb0F1S2ZKaktlZDd4TEtNVkF1MXRtTHdBWAESNgoMYWRzZXJ2ZXIub3JnEiQwZjUxNzEyMC02ODNjLTRjZTktOTJhZC1jZDE5MjY2ZDZkZWRYARK7AQoKY3JpdGVvLmNvbRKqAVNaYU16bDlvZDFKcVNuSjRVVzlNY25oRGRGbHJkM05TYUVKcVNVRnVObVZ6TlRGcmVVdDFXRGt5TkhRbE1rSnNhVGgxTkhWc05HbG1keVV5Um5GdFpVZE1WblZUYVdVMVNtNDBXR1ZhSlRKQ1RuaERlWEJYTlcxMU16RkpkbWR2YmtGeVJIQnliVlowSlRKQ1QxRnNKVEpHVFdwWVNYZ2xNa1pEWXlVelJBWAESNAoKcHViY2lkLm9yZxIkM2JmYmY3YmQtYjc2NC00NmZiLTliMjQtZGQyNzk5YmUyZDkxWAESWgoNY3J3ZGNudHJsLm5ldBJAZmI3ZWM1NWQyOWRmYzI1ZGFkMzVkYzRkZTQ2NzE4NWNhMDJjNTIwZGZjZWU5NzhlMmVjMzIyMmU3NmQ2M2ZmMBj58_eH7DNIABIdCg5lc3AuY3JpdGVvLmNvbRiw8PeH7DNIAFICCGQSGAoJeWFob28uY29tGNvx94fsM0gAUgIIbxI-CgVvcGVueBIsZXlKcElqb2lZa05NZFRkTFZ6SlNVSFU0UVU1WE5IWnpka3hPWnowOUluMD0Y0Pj3h-wzSAASrgIKCHJ0YmhvdXNlEpgCb2o0TWU4T0xkckdQbksyTUUyUmY3ODl0aU04V2RvNUt5ZzBwSzM2NU9iZmRUdFExcUdubTZCckF3V0tGaFdhRWJEQ3F0SXpSMlkzRVlkRGM5dmF5U1JsU24wcGE3cFR0cm14WHBHclpJZWhIQkd3V1cwMXVtZTZvZElZS0J5OE5FUitoWjdkaSsvaVdQSzBjYXB4eFVVZzRTMGlVUTJKQXVNbTdSWjV5aDBaN1k4aWtvUTV1RG1CY2ZsTDFUZ1c0RjJ6ZXo2QzI1eEIxWnFFR0pHeGI0UVd2OWJwd3Y3MnhDU291djNWUllyN0IwQUJuMmtqZ1lRckVjRHFOREtJQlduRGx2QStaZDdJRGkrenNOUzB0dWc9PRjn-PeH7DNIAA..&dlt=1781354328063&idt=1996&ppid=5594807e3b73660db22cc026894621f4&uule=a%20cm9sZToxIHByb2R1Y2VyOjEyIGxvYzoiMTQwLTAwMDEsSlAi&prev_scp=a%3D1%26iid1%3D8854121008628726%26eid%3D8854121008628726%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D1%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252F41kkjh07tibblti%252FAINCRAD%252BFF%252BINJECTOR.apk%252Ffile%253Fdkey%253Drv5x6b8wlt0%2526r%253D125%26path%3D%252Ffile%252F41kkjh07tibblti%252FAINCRAD%252BFF%252BINJECTOR.apk%252Ffile%26ap%3D1102%26sap%3D1102%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D4%26at%3Dmbf%26adr%3D399%26ezosn%3D3%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D39%26al%3D1039%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-edge-2%26tap%3Dmediafire_com-edge-2-8854121008628726%26eb_br%3D9c3e4ee8eae7f1433cb2fe69b1326605%26eba%3D0%26bv%3D54%26bvm%3D0%26bvr%3D15%26avc%3D25%26evc%3D27%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D4%26br2%3D8%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D157%2C131%2C0%2C0%2C0%2C168%2C184%2C20%2C0%2C0%2C192%2C31%2C902%2C903%2C901%2C902%2C903%26deal1%3D3856%26osb%3DLinux%252FChrome%26dbg%3Drc%253A4%26reqt%3D1781354332520&adks=697308627&frm=20&eo_id_str=ID%3Dc9df7b54bcd371a2%3AT%3D1781354330%3ART%3D1781354330%3AS%3DAA-Afja4gVi1oGpU66Pr7KR0wygQ&pbbce=1
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.23.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
rl-in-f157.1e100.net
Software
cafe /
Resource Hash
ef1cb6fe965a9b02f8a04a03f93897884ac7df8c0d898a80f13b53af709d8e7c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
dcb
google-lineitem-id
-2
observe-browsing-topics
?1
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sat, 13 Jun 2026 12:38:53 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-2
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
224
x-xss-protection
0
server
cafe
GET
H3
200
ads Show response
securepubads.g.doubleclick.net/gampad/
529 B
263 B
259ms
259ms
Fetch
text/plain
142.251.23.157
Google LLC
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1001161376096050&correlator=2445769345449229&eid=31098216%2C95393146&output=ldjh&gdfp_req=1&vrg=202606090101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=26&didk=46178465&dids=div-gpt-ad-mediafire_com-medre&adfs=1959198455&sfv=1-0-45&rcs=3&eri=1&sc=1&cookie=ID%3Da72da8f8dac4dbe8%3AT%3D1781354330%3ART%3D1781354330%3AS%3DALNI_MZCBh_ptzlSFjn4mKG_I6_ZJqzdog&gpic=UID%3D0000146865d5f26d%3AT%3D1781354330%3ART%3D1781354330%3AS%3DALNI_MY7xi4RFbTEF4Q5wPKl_IsjF120uA&abxe=1&dt=1781354333228&lmt=1781354333&adxs=27&adys=1109&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=5&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=540&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE0OS4wLjc4MjcuMTAyIixudWxsLDAsbnVsbCwiNjQiLFtbIkNocm9taXVtIiwiMTQ5LjAuMC4wIl0sWyJHb29nbGUgQ2hyb21lIiwiMTQ5LjAuMC4wIl0sWyJOb3QtQS5CcmFuZCIsIjI0LjAuMC4wIl1dLDBd&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F41kkjh07tibblti%2FAINCRAD%2BFF%2BINJECTOR.apk%2Ffile%3Fdkey%3Drv5x6b8wlt0%26r%3D125&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&a3p=EmwKDGlkNS1zeW5jLmNvbRJaSUQ1KmlQVFhWenNHeFltYS0xQU96Nmk4UVhmaTB2WHY0d0JIdEJuVWpzRHBiMVRfXzJvdFQxdGFBQUVCQ21vdFQxb0F1S2ZKaktlZDd4TEtNVkF1MXRtTHdBWAESNgoMYWRzZXJ2ZXIub3JnEiQwZjUxNzEyMC02ODNjLTRjZTktOTJhZC1jZDE5MjY2ZDZkZWRYARK7AQoKY3JpdGVvLmNvbRKqAVNaYU16bDlvZDFKcVNuSjRVVzlNY25oRGRGbHJkM05TYUVKcVNVRnVObVZ6TlRGcmVVdDFXRGt5TkhRbE1rSnNhVGgxTkhWc05HbG1keVV5Um5GdFpVZE1WblZUYVdVMVNtNDBXR1ZhSlRKQ1RuaERlWEJYTlcxMU16RkpkbWR2YmtGeVJIQnliVlowSlRKQ1QxRnNKVEpHVFdwWVNYZ2xNa1pEWXlVelJBWAESNAoKcHViY2lkLm9yZxIkM2JmYmY3YmQtYjc2NC00NmZiLTliMjQtZGQyNzk5YmUyZDkxWAESWgoNY3J3ZGNudHJsLm5ldBJAZmI3ZWM1NWQyOWRmYzI1ZGFkMzVkYzRkZTQ2NzE4NWNhMDJjNTIwZGZjZWU5NzhlMmVjMzIyMmU3NmQ2M2ZmMBj58_eH7DNIABIdCg5lc3AuY3JpdGVvLmNvbRiw8PeH7DNIAFICCGQSGAoJeWFob28uY29tGNvx94fsM0gAUgIIbxI-CgVvcGVueBIsZXlKcElqb2lZa05NZFRkTFZ6SlNVSFU0UVU1WE5IWnpka3hPWnowOUluMD0Y0Pj3h-wzSAASrgIKCHJ0YmhvdXNlEpgCb2o0TWU4T0xkckdQbksyTUUyUmY3ODl0aU04V2RvNUt5ZzBwSzM2NU9iZmRUdFExcUdubTZCckF3V0tGaFdhRWJEQ3F0SXpSMlkzRVlkRGM5dmF5U1JsU24wcGE3cFR0cm14WHBHclpJZWhIQkd3V1cwMXVtZTZvZElZS0J5OE5FUitoWjdkaSsvaVdQSzBjYXB4eFVVZzRTMGlVUTJKQXVNbTdSWjV5aDBaN1k4aWtvUTV1RG1CY2ZsTDFUZ1c0RjJ6ZXo2QzI1eEIxWnFFR0pHeGI0UVd2OWJwd3Y3MnhDU291djNWUllyN0IwQUJuMmtqZ1lRckVjRHFOREtJQlduRGx2QStaZDdJRGkrenNOUzB0dWc9PRjn-PeH7DNIAA..&dlt=1781354328063&idt=1996&ppid=5594807e3b73660db22cc026894621f4&uule=a%20cm9sZToxIHByb2R1Y2VyOjEyIGxvYzoiMTQwLTAwMDEsSlAi&prev_scp=a%3D1%26iid1%3D8074675296629805%26eid%3D8074675296629805%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D1%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252F41kkjh07tibblti%252FAINCRAD%252BFF%252BINJECTOR.apk%252Ffile%253Fdkey%253Drv5x6b8wlt0%2526r%253D125%26path%3D%252Ffile%252F41kkjh07tibblti%252FAINCRAD%252BFF%252BINJECTOR.apk%252Ffile%26ap%3D1100%26sap%3D1100%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D4%26at%3Dmbf%26adr%3D399%26ezosn%3D7%26reft%3Dn%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-medrectangle-2%26tap%3Dmediafire_com-medrectangle-2-8074675296629805%26eb_br%3Dzero%26eba%3D0%26bv%3D24%26bvm%3D0%26bvr%3D2%26avc%3D23%26evc%3D25%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D0%26br2%3D2%26ezoic%3D1%26nmau%3D2%26mau%3D0%26dac%3D0%26stl%3D32%2C131%2C0%2C0%2C0%2C131%2C132%2C0%2C0%2C0%2C187%2C0%2C901%2C182%2C901%2C902%2C903%26deal1%3D8229%26osb%3DLinux%252FChrome%26dbg%3Drc%253A5%26reqt%3D1781354332525&adks=1630800042&frm=20&eo_id_str=ID%3Dc9df7b54bcd371a2%3AT%3D1781354330%3ART%3D1781354330%3AS%3DAA-Afja4gVi1oGpU66Pr7KR0wygQ&pbbce=1
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.23.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
rl-in-f157.1e100.net
Software
cafe /
Resource Hash
1c3c94a31ffd750ef9ab669b67d499e9a1e1df647d849c377f39c7501f5951bf
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
dcb
google-lineitem-id
-2
observe-browsing-topics
?1
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sat, 13 Jun 2026 12:38:53 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-2
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
233
x-xss-protection
0
server
cafe
POST
H2
200
ad_impression Show response
pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/
60 B
337 B
133ms
130ms
Fetch
application/json
44.227.112.76
Amazon.com
General
Full URL
https://pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ad_impression
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
44.227.112.76 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-44-227-112-76.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
ee63979b621d070be7f6aee315971acb7959ff766758fda88f01c822fd24a7b0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
Content-Type
application/json
sec-ch-ua-mobile
?0

Response headers

access-control-allow-origin
https://www.mediafire.com
content-length
60
date
Sat, 13 Jun 2026 12:38:53 GMT
content-type
application/json; charset=utf-8
vary
Origin
access-control-allow-credentials
true
POST
H2
200
ad_impression Show response
pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/
60 B
337 B
132ms
130ms
Fetch
application/json
44.227.112.76
Amazon.com
General
Full URL
https://pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ad_impression
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
44.227.112.76 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-44-227-112-76.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
ee63979b621d070be7f6aee315971acb7959ff766758fda88f01c822fd24a7b0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
Content-Type
application/json
sec-ch-ua-mobile
?0

Response headers

access-control-allow-origin
https://www.mediafire.com
content-length
60
date
Sat, 13 Jun 2026 12:38:53 GMT
content-type
application/json; charset=utf-8
vary
Origin
access-control-allow-credentials
true
POST
H2
200
ad_impression Show response
pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/
60 B
337 B
134ms
132ms
Fetch
application/json
44.227.112.76
Amazon.com
General
Full URL
https://pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ad_impression
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
44.227.112.76 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-44-227-112-76.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
ee63979b621d070be7f6aee315971acb7959ff766758fda88f01c822fd24a7b0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
Content-Type
application/json
sec-ch-ua-mobile
?0

Response headers

access-control-allow-origin
https://www.mediafire.com
content-length
60
date
Sat, 13 Jun 2026 12:38:53 GMT
content-type
application/json; charset=utf-8
vary
Origin
access-control-allow-credentials
true
GET
H3
200
ads Show response
securepubads.g.doubleclick.net/gampad/
522 B
256 B
267ms
264ms
Fetch
text/plain
142.251.23.157
Google LLC
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1001161376096050&correlator=1359370853088965&eid=31098216%2C95393146&output=ldjh&gdfp_req=1&vrg=202606090101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-edge-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=160x600&ifi=27&didk=2994425013&dids=div-gpt-ad-mediafire_com-edge-&adfs=982453029&sfv=1-0-45&rcs=4&eri=1&sc=1&cookie=ID%3Da72da8f8dac4dbe8%3AT%3D1781354330%3ART%3D1781354330%3AS%3DALNI_MZCBh_ptzlSFjn4mKG_I6_ZJqzdog&gpic=UID%3D0000146865d5f26d%3AT%3D1781354330%3ART%3D1781354330%3AS%3DALNI_MY7xi4RFbTEF4Q5wPKl_IsjF120uA&abxe=1&dt=1781354334216&lmt=1781354334&adxs=1440&adys=300&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=4&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=540&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE0OS4wLjc4MjcuMTAyIixudWxsLDAsbnVsbCwiNjQiLFtbIkNocm9taXVtIiwiMTQ5LjAuMC4wIl0sWyJHb29nbGUgQ2hyb21lIiwiMTQ5LjAuMC4wIl0sWyJOb3QtQS5CcmFuZCIsIjI0LjAuMC4wIl1dLDBd&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F41kkjh07tibblti%2FAINCRAD%2BFF%2BINJECTOR.apk%2Ffile%3Fdkey%3Drv5x6b8wlt0%26r%3D125&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&a3p=EmwKDGlkNS1zeW5jLmNvbRJaSUQ1KmlQVFhWenNHeFltYS0xQU96Nmk4UVhmaTB2WHY0d0JIdEJuVWpzRHBiMVRfXzJvdFQxdGFBQUVCQ21vdFQxb0F1S2ZKaktlZDd4TEtNVkF1MXRtTHdBWAESNgoMYWRzZXJ2ZXIub3JnEiQwZjUxNzEyMC02ODNjLTRjZTktOTJhZC1jZDE5MjY2ZDZkZWRYARK7AQoKY3JpdGVvLmNvbRKqAVNaYU16bDlvZDFKcVNuSjRVVzlNY25oRGRGbHJkM05TYUVKcVNVRnVObVZ6TlRGcmVVdDFXRGt5TkhRbE1rSnNhVGgxTkhWc05HbG1keVV5Um5GdFpVZE1WblZUYVdVMVNtNDBXR1ZhSlRKQ1RuaERlWEJYTlcxMU16RkpkbWR2YmtGeVJIQnliVlowSlRKQ1QxRnNKVEpHVFdwWVNYZ2xNa1pEWXlVelJBWAESNAoKcHViY2lkLm9yZxIkM2JmYmY3YmQtYjc2NC00NmZiLTliMjQtZGQyNzk5YmUyZDkxWAESWgoNY3J3ZGNudHJsLm5ldBJAZmI3ZWM1NWQyOWRmYzI1ZGFkMzVkYzRkZTQ2NzE4NWNhMDJjNTIwZGZjZWU5NzhlMmVjMzIyMmU3NmQ2M2ZmMBj58_eH7DNIABIdCg5lc3AuY3JpdGVvLmNvbRiw8PeH7DNIAFICCGQSGAoJeWFob28uY29tGNvx94fsM0gAUgIIbxI-CgVvcGVueBIsZXlKcElqb2lZa05NZFRkTFZ6SlNVSFU0UVU1WE5IWnpka3hPWnowOUluMD0Y0Pj3h-wzSAASrgIKCHJ0YmhvdXNlEpgCb2o0TWU4T0xkckdQbksyTUUyUmY3ODl0aU04V2RvNUt5ZzBwSzM2NU9iZmRUdFExcUdubTZCckF3V0tGaFdhRWJEQ3F0SXpSMlkzRVlkRGM5dmF5U1JsU24wcGE3cFR0cm14WHBHclpJZWhIQkd3V1cwMXVtZTZvZElZS0J5OE5FUitoWjdkaSsvaVdQSzBjYXB4eFVVZzRTMGlVUTJKQXVNbTdSWjV5aDBaN1k4aWtvUTV1RG1CY2ZsTDFUZ1c0RjJ6ZXo2QzI1eEIxWnFFR0pHeGI0UVd2OWJwd3Y3MnhDU291djNWUllyN0IwQUJuMmtqZ1lRckVjRHFOREtJQlduRGx2QStaZDdJRGkrenNOUzB0dWc9PRjn-PeH7DNIAA..&dlt=1781354328063&idt=1996&ppid=5594807e3b73660db22cc026894621f4&uule=a%20cm9sZToxIHByb2R1Y2VyOjEyIGxvYzoiMTQwLTAwMDEsSlAi&prev_scp=a%3D1%26iid1%3D8854121008628726%26eid%3D8854121008628726%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D1%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252F41kkjh07tibblti%252FAINCRAD%252BFF%252BINJECTOR.apk%252Ffile%253Fdkey%253Drv5x6b8wlt0%2526r%253D125%26path%3D%252Ffile%252F41kkjh07tibblti%252FAINCRAD%252BFF%252BINJECTOR.apk%252Ffile%26ap%3D1102%26sap%3D1102%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D5%26at%3Dmbf%26adr%3D399%26ezosn%3D3%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D39%26al%3D1039%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-edge-2%26tap%3Dmediafire_com-edge-2-8854121008628726%26eb_br%3Db6c98a8bb15764f1c4ee331dcb724178%26eba%3D0%26bv%3D54%26bvm%3D0%26bvr%3D15%26avc%3D25%26evc%3D27%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D2%26br2%3D8%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D157%2C131%2C0%2C0%2C0%2C168%2C184%2C20%2C0%2C0%2C192%2C31%2C902%2C903%2C901%2C902%2C903%26deal1%3D3856%2C8229%26osb%3DLinux%252FChrome%26dbg%3Drc%253A4%26reqt%3D1781354333547&adks=697308627&frm=20&eo_id_str=ID%3Dc9df7b54bcd371a2%3AT%3D1781354330%3ART%3D1781354330%3AS%3DAA-Afja4gVi1oGpU66Pr7KR0wygQ&pbbce=1
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.23.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
rl-in-f157.1e100.net
Software
cafe /
Resource Hash
e9124c970d7475f4471197cbf13bc226200f81bba0a34a562a1c87a8f97a68d6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
dcb
google-lineitem-id
-2
observe-browsing-topics
?1
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sat, 13 Jun 2026 12:38:54 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-2
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
226
x-xss-protection
0
server
cafe
POST
H2
200
ad_impression Show response
pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/
60 B
337 B
132ms
131ms
Fetch
application/json
44.227.112.76
Amazon.com
General
Full URL
https://pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ad_impression
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
44.227.112.76 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-44-227-112-76.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
ee63979b621d070be7f6aee315971acb7959ff766758fda88f01c822fd24a7b0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
Content-Type
application/json
sec-ch-ua-mobile
?0

Response headers

access-control-allow-origin
https://www.mediafire.com
content-length
60
date
Sat, 13 Jun 2026 12:38:54 GMT
content-type
application/json; charset=utf-8
vary
Origin
access-control-allow-credentials
true
POST
H2
200
adop.gif
g.ezoic.net/porpoiseant/
43 B
119 B
88ms
76ms
Ping
image/gif
2406:da18:9d0:143f:2124:4e9c:36a9:d9de
Amazon.com
General
Full URL
https://g.ezoic.net/porpoiseant/adop.gif?orig=0&sts=W3siZ3JvdXBfaWQiOiJtZWRpYWZpcmVfY29tLWJhbm5lci0xLzIwMjYtMDYtMTMvMzg2ODM4NDg2NjUyNTgxIiwiYWRfc2xvdF9pbmRleCI6MCwicGFnZXZpZXdfaWQiOiI0MmUyZTRjMS05OGYxLTRhYmItOWJlMC0wMzY4NDJjYzlkZmQiLCJkb21haW5faWQiOjQ4NDQ3MCwiYWRfdW5pdCI6Im1lZGlhZmlyZV9jb20tYmFubmVyLTEiLCJhZF9wb3NpdGlvbiI6MTEwNywiYWRfdHlwZSI6ImRpc3BsYXkiLCJhZF9zb3VyY2UiOiJnYW0iLCJyZXF1ZXN0ZWRfc2l6ZXMiOiI3Mjh4OTAiLCJiaWRfZmxvb3IiOjAuMjIsImlkIjoiN2Q5MDBiYzEtOTBiYS00ZjBiLThlZDUtYjRhZmM2ZGQzMDNkIiwiaGFuZGxlX2lkIjoiN2Q5MDBiYzEtOTBiYS00ZjBiLThlZDUtYjRhZmM2ZGQzMDNkIiwia2V5IjoibWVkaWFmaXJlX2NvbS1iYW5uZXItMS8yMDI2LTA2LTEzLzM4NjgzODQ4NjY1MjU4MXwwfDEiLCJhdHRlbXB0X251bWJlciI6MSwidF90aW1lIjoiMjAyNi0wNi0xMyAwNzozODo0OCIsImZldGNoX2Vwb2NoIjoxNzgxMzU0MzMwLCJ2ZXJzaW9uIjoyLCJzdGF0dXMiOiJmZXRjaGVkIiwibGFzdF9ldmVudCI6ImZldGNoZWQiLCJsYXN0X3VwZGF0ZWRfbXMiOjE3ODEzNTQzMzAxMTksInJlY29yZF90eXBlIjoib3Bwb3J0dW5pdHkifSx7Imdyb3VwX2lkIjoibWVkaWFmaXJlX2NvbS1ib3gtMi8yMDI2LTA2LTEzLzIyNzQxNzY2MjA1NTgiLCJhZF9zbG90X2luZGV4IjowLCJwYWdldmlld19pZCI6IjQyZTJlNGMxLTk4ZjEtNGFiYi05YmUwLTAzNjg0MmNjOWRmZCIsImRvbWFpbl9pZCI6NDg0NDcwLCJhZF91bml0IjoibWVkaWFmaXJlX2NvbS1ib3gtMiIsImFkX3Bvc2l0aW9uIjoxMTAzLCJhZF90eXBlIjoiZGlzcGxheSIsImFkX3NvdXJjZSI6ImdhbSIsInJlcXVlc3RlZF9zaXplcyI6IjcyOHg5MCIsImJpZF9mbG9vciI6MC41LCJpZCI6ImMxZTFjZDM4LTMxZjEtNDRhMi1hOGY2LWMwNzNhYjE5OWZlZCIsImhhbmRsZV9pZCI6ImMxZTFjZDM4LTMxZjEtNDRhMi1hOGY2LWMwNzNhYjE5OWZlZCIsImtleSI6Im1lZGlhZmlyZV9jb20tYm94LTIvMjAyNi0wNi0xMy8yMjc0MTc2NjIwNTU4fDB8MSIsImF0dGVtcHRfbnVtYmVyIjoxLCJ0X3RpbWUiOiIyMDI2LTA2LTEzIDA3OjM4OjQ4IiwiZmV0Y2hfZXBvY2giOjE3ODEzNTQzMzAsInZlcnNpb24iOjIsInN0YXR1cyI6ImZldGNoZWQiLCJsYXN0X2V2ZW50IjoiZmV0Y2hlZCIsImxhc3RfdXBkYXRlZF9tcyI6MTc4MTM1NDMzMDEyNCwicmVjb3JkX3R5cGUiOiJvcHBvcnR1bml0eSJ9LHsiZ3JvdXBfaWQiOiJtZWRpYWZpcmVfY29tLWVkZ2UtMS8yMDI2LTA2LTEzLzg5MTMwMTk4NzA2NTcwNjgiLCJhZF9zbG90X2luZGV4IjowLCJwYWdldmlld19pZCI6IjQyZTJlNGMxLTk4ZjEtNGFiYi05YmUwLTAzNjg0MmNjOWRmZCIsImRvbWFpbl9pZCI6NDg0NDcwLCJhZF91bml0IjoibWVkaWFmaXJlX2NvbS1lZGdlLTEiLCJhZF9wb3NpdGlvbiI6MTEwMSwiYWRfdHlwZSI6ImRpc3BsYXkiLCJhZF9zb3VyY2UiOiJnYW0iLCJyZXF1ZXN0ZWRfc2l6ZXMiOiIxNjB4NjAwIiwiYmlkX2Zsb29yIjowLjYsImlkIjoiNDNiOTkxMzMtMGVhOS00ODIxLThjNTEtMzcwMDQ5NDBhN2E0IiwiaGFuZGxlX2lkIjoiNDNiOTkxMzMtMGVhOS00ODIxLThjNTEtMzcwMDQ5NDBhN2E0Iiwia2V5IjoibWVkaWFmaXJlX2NvbS1lZGdlLTEvMjAyNi0wNi0xMy84OTEzMDE5ODcwNjU3MDY4fDB8MSIsImF0dGVtcHRfbnVtYmVyIjoxLCJ0X3RpbWUiOiIyMDI2LTA2LTEzIDA3OjM4OjQ4IiwiZmV0Y2hfZXBvY2giOjE3ODEzNTQzMzAsInZlcnNpb24iOjIsInN0YXR1cyI6ImZldGNoZWQiLCJsYXN0X2V2ZW50IjoiZmV0Y2hlZCIsImxhc3RfdXBkYXRlZF9tcyI6MTc4MTM1NDMzMDEyNywicmVjb3JkX3R5cGUiOiJvcHBvcnR1bml0eSJ9LHsiZ3JvdXBfaWQiOiJtZWRpYWZpcmVfY29tLWVkZ2UtMi8yMDI2LTA2LTEzLzg4NTQxMjEwMDg2Mjg3MjYiLCJhZF9zbG90X2luZGV4IjowLCJwYWdldmlld19pZCI6IjQyZTJlNGMxLTk4ZjEtNGFiYi05YmUwLTAzNjg0MmNjOWRmZCIsImRvbWFpbl9pZCI6NDg0NDcwLCJhZF91bml0IjoibWVkaWFmaXJlX2NvbS1lZGdlLTIiLCJhZF9wb3NpdGlvbiI6MTEwMiwiYWRfdHlwZSI6ImRpc3BsYXkiLCJhZF9zb3VyY2UiOiJnYW0iLCJyZXF1ZXN0ZWRfc2l6ZXMiOiIxNjB4NjAwIiwiYmlkX2Zsb29yIjowLjE2LCJpZCI6IjcxZjM4ZmE1LTRiM2UtNGEyMC04NDdmLTZlZDJlMzRlMWYxNCIsImhhbmRsZV9pZCI6IjcxZjM4ZmE1LTRiM2UtNGEyMC04NDdmLTZlZDJlMzRlMWYxNCIsImtleSI6Im1lZGlhZmlyZV9jb20tZWRnZS0yLzIwMjYtMDYtMTMvODg1NDEyMTAwODYyODcyNnwwfDEiLCJhdHRlbXB0X251bWJlciI6MSwidF90aW1lIjoiMjAyNi0wNi0xMyAwNzozODo0OCIsImZldGNoX2Vwb2NoIjoxNzgxMzU0MzMwLCJ2ZXJzaW9uIjoyLCJzdGF0dXMiOiJmZXRjaGVkIiwibGFzdF9ldmVudCI6ImZldGNoZWQiLCJsYXN0X3VwZGF0ZWRfbXMiOjE3ODEzNTQzMzAxMzAsInJlY29yZF90eXBlIjoib3Bwb3J0dW5pdHkifSx7Imdyb3VwX2lkIjoibWVkaWFmaXJlX2NvbS1tZWRyZWN0YW5nbGUtMi8yMDI2LTA2LTEzLzgwNzQ2NzUyOTY2Mjk4MDUiLCJhZF9zbG90X2luZGV4IjowLCJwYWdldmlld19pZCI6IjQyZTJlNGMxLTk4ZjEtNGFiYi05YmUwLTAzNjg0MmNjOWRmZCIsImRvbWFpbl9pZCI6NDg0NDcwLCJhZF91bml0IjoibWVkaWFmaXJlX2NvbS1tZWRyZWN0YW5nbGUtMiIsImFkX3Bvc2l0aW9uIjoxMTAwLCJhZF90eXBlIjoiZmxvYXRpbmciLCJhZF9zb3VyY2UiOiJnYW0iLCJyZXF1ZXN0ZWRfc2l6ZXMiOiI3Mjh4OTAiLCJiaWRfZmxvb3IiOjAuMDYsImlkIjoiYjU3MmQ3NjUtMDA5Yy00NGIzLTg0OTYtZDgwZDI5YjdmNzg0IiwiaGFuZGxlX2lkIjoiYjU3MmQ3NjUtMDA5Yy00NGIzLTg0OTYtZDgwZDI5YjdmNzg0Iiwia2V5IjoibWVkaWFmaXJlX2NvbS1tZWRyZWN0YW5nbGUtMi8yMDI2LTA2LTEzLzgwNzQ2NzUyOTY2Mjk4MDV8MHwxIiwiYXR0ZW1wdF9udW1iZXIiOjEsInRfdGltZSI6IjIwMjYtMDYtMTMgMDc6Mzg6NDgiLCJmZXRjaF9lcG9jaCI6MTc4MTM1NDMzMCwidmVyc2lvbiI6Miwic3RhdHVzIjoiZmV0Y2hlZCIsImxhc3RfZXZlbnQiOiJmZXRjaGVkIiwibGFzdF91cGRhdGVkX21zIjoxNzgxMzU0MzMwMTMzLCJyZWNvcmRfdHlwZSI6Im9wcG9ydHVuaXR5In0seyJncm91cF9pZCI6Im1lZGlhZmlyZV9jb20tbWVkcmVjdGFuZ2xlLTIvMjAyNi0wNi0xMy84MDc0Njc1Mjk2NjI5ODA1IiwiYWRfc2xvdF9pbmRleCI6MSwicGFnZXZpZXdfaWQiOiI0MmUyZTRjMS05OGYxLTRhYmItOWJlMC0wMzY4NDJjYzlkZmQiLCJkb21haW5faWQiOjQ4NDQ3MCwiYWRfdW5pdCI6Im1lZGlhZmlyZV9jb20tbWVkcmVjdGFuZ2xlLTIiLCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfdHlwZSI6ImZsb2F0aW5nIiwiYWRfc291cmNlIjoiZ2FtIiwicmVxdWVzdGVkX3NpemVzIjoiNzI4eDkwIiwiYmlkX2Zsb29yIjowLjA2LCJpZCI6ImU2NjE5ZWIwLTMzNmItNDI0Yi05MDg5LWY3ZGVjZTE3MzEzNSIsImhhbmRsZV9pZCI6ImU2NjE5ZWIwLTMzNmItNDI0Yi05MDg5LWY3ZGVjZTE3MzEzNSIsImtleSI6Im1lZGlhZmlyZV9jb20tbWVkcmVjdGFuZ2xlLTIvMjAyNi0wNi0xMy84MDc0Njc1Mjk2NjI5ODA1fDF8MSIsImF0dGVtcHRfbnVtYmVyIjoxLCJ0X3RpbWUiOiIyMDI2LTA2LTEzIDA3OjM4OjQ4IiwiZmV0Y2hfZXBvY2giOjE3ODEzNTQzMzAsInZlcnNpb24iOjIsInN0YXR1cyI6ImZldGNoZWQiLCJsYXN0X2V2ZW50IjoiZmV0Y2hlZCIsImxhc3RfdXBkYXRlZF9tcyI6MTc4MTM1NDMzMDEzNywicmVjb3JkX3R5cGUiOiJvcHBvcnR1bml0eSJ9LHsiZ3JvdXBfaWQiOiJtZWRpYWZpcmVfY29tLW1lZHJlY3RhbmdsZS0zLzIwMjYtMDYtMTMvNDc4NDY5Nzg5MDY1MzA0MyIsImFkX3Nsb3RfaW5kZXgiOjAsInBhZ2V2aWV3X2lkIjoiNDJlMmU0YzEtOThmMS00YWJiLTliZTAtMDM2ODQyY2M5ZGZkIiwiZG9tYWluX2lkIjo0ODQ0NzAsImFkX3VuaXQiOiJtZWRpYWZpcmVfY29tLW1lZHJlY3RhbmdsZS0zIiwiYWRfcG9zaXRpb24iOjExMDQsImFkX3R5cGUiOiJkaXNwbGF5IiwiYWRfc291cmNlIjoiZ2FtIiwicmVxdWVzdGVkX3NpemVzIjoiMzM2eDI4MCIsImJpZF9mbG9vciI6MC40LCJpZCI6IjNiODcxZjg2LTg2MWMtNGI3ZS04YzIyLTBmNTlmMDZiN2M4ZSIsImhhbmRsZV9pZCI6IjNiODcxZjg2LTg2MWMtNGI3ZS04YzIyLTBmNTlmMDZiN2M4ZSIsImtleSI6Im1lZGlhZmlyZV9jb20tbWVkcmVjdGFuZ2xlLTMvMjAyNi0wNi0xMy80Nzg0Njk3ODkwNjUzMDQzfDB8MSIsImF0dGVtcHRfbnVtYmVyIjoxLCJ0X3RpbWUiOiIyMDI2LTA2LTEzIDA3OjM4OjQ4IiwiZmV0Y2hfZXBvY2giOjE3ODEzNTQzMzAsInZlcnNpb24iOjIsInN0YXR1cyI6ImZldGNoZWQiLCJsYXN0X2V2ZW50IjoiZmV0Y2hlZCIsImxhc3RfdXBkYXRlZF9tcyI6MTc4MTM1NDMzMDE0MCwicmVjb3JkX3R5cGUiOiJvcHBvcnR1bml0eSJ9LHsiZ3JvdXBfaWQiOiJtZWRpYWZpcmVfY29tLW1lZHJlY3RhbmdsZS00LzIwMjYtMDYtMTMvNjg3OTgxOTEyNDY1Mzg5NCIsImFkX3Nsb3RfaW5kZXgiOjAsInBhZ2V2aWV3X2lkIjoiNDJlMmU0YzEtOThmMS00YWJiLTliZTAtMDM2ODQyY2M5ZGZkIiwiZG9tYWluX2lkIjo0ODQ0NzAsImFkX3VuaXQiOiJtZWRpYWZpcmVfY29tLW1lZHJlY3RhbmdsZS00IiwiYWRfcG9zaXRpb24iOjExMDUsImFkX3R5cGUiOiJkaXNwbGF5IiwiYWRfc291cmNlIjoiZ2FtIiwicmVxdWVzdGVkX3NpemVzIjoiMzAweDI1MCwzMzZ4MjgwIiwiYmlkX2Zsb29yIjowLjI2LCJpZCI6ImUzZDEzNjVmLTZlNjEtNDMxZC04ZTc1LTY3YjBjYzhjZjgyZiIsImhhbmRsZV9pZCI6ImUzZDEzNjVmLTZlNjEtNDMxZC04ZTc1LTY3YjBjYzhjZjgyZiIsImtleSI6Im1lZGlhZmlyZV9jb20tbWVkcmVjdGFuZ2xlLTQvMjAyNi0wNi0xMy82ODc5ODE5MTI0NjUzODk0fDB8MSIsImF0dGVtcHRfbnVtYmVyIjoxLCJ0X3RpbWUiOiIyMDI2LTA2LTEzIDA3OjM4OjQ4IiwiZmV0Y2hfZXBvY2giOjE3ODEzNTQzMzAsInZlcnNpb24iOjIsInN0YXR1cyI6ImZldGNoZWQiLCJsYXN0X2V2ZW50IjoiZmV0Y2hlZCIsImxhc3RfdXBkYXRlZF9tcyI6MTc4MTM1NDMzMDE0MiwicmVjb3JkX3R5cGUiOiJvcHBvcnR1bml0eSJ9LHsiZ3JvdXBfaWQiOiJtZWRpYWZpcmVfY29tLWVkZ2UtMi8yMDI2LTA2LTEzLzg4NTQxMjEwMDg2Mjg3MjYiLCJhdHRlbXB0X251bWJlciI6MSwiYWRfc2xvdF9pbmRleCI6MCwicGFnZXZpZXdfaWQiOiI0MmUyZTRjMS05OGYxLTRhYmItOWJlMC0wMzY4NDJjYzlkZmQiLCJkb21haW5faWQiOjQ4NDQ3MCwiYWRfdW5pdCI6Im1lZGlhZmlyZV9jb20tZWRnZS0yIiwidF90aW1lIjoiMjAyNi0wNi0xMyAwNzozODo0OCIsInJlY29yZF90eXBlIjoiY3VzdG9tX2V2ZW50IiwiZXZlbnRfaWQiOiI0NjgwNzU4MC03ZDk1LTQ5MTctYmMwMy0yZmQ5NjEwYTZjZmQiLCJldmVudF9uYW1lIjoibm9fZmlsbF9yZWFzb24iLCJldmVudF92YWwiOiJyZXRyeV9lbXB0eSIsImV2ZW50X2Vwb2NoIjoxNzgxMzU0MzMwLCJpc192aXNpYmxlIjpmYWxzZX0seyJncm91cF9pZCI6Im1lZGlhZmlyZV9jb20tZWRnZS0xLzIwMjYtMDYtMTMvODkxMzAxOTg3MDY1NzA2OCIsImF0dGVtcHRfbnVtYmVyIjoxLCJhZF9zbG90X2luZGV4IjowLCJwYWdldmlld19pZCI6IjQyZTJlNGMxLTk4ZjEtNGFiYi05YmUwLTAzNjg0MmNjOWRmZCIsImRvbWFpbl9pZCI6NDg0NDcwLCJhZF91bml0IjoibWVkaWFmaXJlX2NvbS1lZGdlLTEiLCJ0X3RpbWUiOiIyMDI2LTA2LTEzIDA3OjM4OjQ4IiwicmVjb3JkX3R5cGUiOiJjdXN0b21fZXZlbnQiLCJldmVudF9pZCI6IjNkODdhZTFiLWU5ZTgtNGM1OS1iYzQ3LWQ0YjY5NzNhMDU0YiIsImV2ZW50X25hbWUiOiJub19maWxsX3JlYXNvbiIsImV2ZW50X3ZhbCI6InJldHJ5X2VtcHR5IiwiZXZlbnRfZXBvY2giOjE3ODEzNTQzMzAsImlzX3Zpc2libGUiOmZhbHNlfV0=
Requested by
Host:
URL: ez-standalone.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2406:da18:9d0:143f:2124:4e9c:36a9:d9de Singapore, Singapore, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
/
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

access-control-max-age
1728000
cache-control
private, max-age=0, must-revalidate, no-cache, no-store
access-control-allow-methods
HEAD, PUT, POST, GET, OPTIONS
expires
Fri, 12 Jun 2026 12:38:54 GMT
access-control-allow-origin
https://www.mediafire.com
content-length
43
date
Sat, 13 Jun 2026 12:38:54 GMT
x-middleton-display
imp_sol
content-type
image/gif
vary
Accept-Encoding
access-control-allow-headers
Content-Type
POST
H2
200
adop.gif
g.ezoic.net/porpoiseant/
43 B
73 B
99ms
88ms
Ping
image/gif
2406:da18:9d0:143f:2124:4e9c:36a9:d9de
Amazon.com
General
Full URL
https://g.ezoic.net/porpoiseant/adop.gif?orig=0&sts=W3siZ3JvdXBfaWQiOiJtZWRpYWZpcmVfY29tLW1lZHJlY3RhbmdsZS00LzIwMjYtMDYtMTMvNjg3OTgxOTEyNDY1Mzg5NCIsImF0dGVtcHRfbnVtYmVyIjoxLCJhZF9zbG90X2luZGV4IjowLCJwYWdldmlld19pZCI6IjQyZTJlNGMxLTk4ZjEtNGFiYi05YmUwLTAzNjg0MmNjOWRmZCIsImRvbWFpbl9pZCI6NDg0NDcwLCJhZF91bml0IjoibWVkaWFmaXJlX2NvbS1tZWRyZWN0YW5nbGUtNCIsInRfdGltZSI6IjIwMjYtMDYtMTMgMDc6Mzg6NDgiLCJyZWNvcmRfdHlwZSI6ImN1c3RvbV9ldmVudCIsImV2ZW50X2lkIjoiN2Y4MGRiYTMtMzVjNi00YzdmLWIzNTEtMWNmOTc3MDdhMDk2IiwiZXZlbnRfbmFtZSI6Im5vX2ZpbGxfcmVhc29uIiwiZXZlbnRfdmFsIjoicmV0cnlfZW1wdHkiLCJldmVudF9lcG9jaCI6MTc4MTM1NDMzMCwiaXNfdmlzaWJsZSI6ZmFsc2V9LHsiZ3JvdXBfaWQiOiJtZWRpYWZpcmVfY29tLW1lZHJlY3RhbmdsZS0yLzIwMjYtMDYtMTMvODA3NDY3NTI5NjYyOTgwNSIsImF0dGVtcHRfbnVtYmVyIjoxLCJhZF9zbG90X2luZGV4IjowLCJwYWdldmlld19pZCI6IjQyZTJlNGMxLTk4ZjEtNGFiYi05YmUwLTAzNjg0MmNjOWRmZCIsImRvbWFpbl9pZCI6NDg0NDcwLCJhZF91bml0IjoibWVkaWFmaXJlX2NvbS1tZWRyZWN0YW5nbGUtMiIsInRfdGltZSI6IjIwMjYtMDYtMTMgMDc6Mzg6NDgiLCJyZWNvcmRfdHlwZSI6ImN1c3RvbV9ldmVudCIsImV2ZW50X2lkIjoiMGFiOWU1ZDUtYWE0MC00ZDExLTljOWEtNjc1MDMwZTMxMGY4IiwiZXZlbnRfbmFtZSI6Im5vX2ZpbGxfcmVhc29uIiwiZXZlbnRfdmFsIjoicmV0cnlfZW1wdHkiLCJldmVudF9lcG9jaCI6MTc4MTM1NDMzMCwiaXNfdmlzaWJsZSI6ZmFsc2V9LHsiZ3JvdXBfaWQiOiJtZWRpYWZpcmVfY29tLW1lZHJlY3RhbmdsZS0yLzIwMjYtMDYtMTMvODA3NDY3NTI5NjYyOTgwNSIsImF0dGVtcHRfbnVtYmVyIjoxLCJhZF9zbG90X2luZGV4IjoxLCJwYWdldmlld19pZCI6IjQyZTJlNGMxLTk4ZjEtNGFiYi05YmUwLTAzNjg0MmNjOWRmZCIsImRvbWFpbl9pZCI6NDg0NDcwLCJhZF91bml0IjoibWVkaWFmaXJlX2NvbS1tZWRyZWN0YW5nbGUtMiIsInRfdGltZSI6IjIwMjYtMDYtMTMgMDc6Mzg6NDgiLCJyZWNvcmRfdHlwZSI6ImN1c3RvbV9ldmVudCIsImV2ZW50X2lkIjoiYmFiMWNiNzktN2ZiYS00ZjY0LWFlOTItODMyN2M4NGI4YjZmIiwiZXZlbnRfbmFtZSI6Im5vX2ZpbGxfcmVhc29uIiwiZXZlbnRfdmFsIjoicmV0cnlfZW1wdHkiLCJldmVudF9lcG9jaCI6MTc4MTM1NDMzMCwiaXNfdmlzaWJsZSI6ZmFsc2V9LHsiZ3JvdXBfaWQiOiJtZWRpYWZpcmVfY29tLWVkZ2UtMi8yMDI2LTA2LTEzLzg4NTQxMjEwMDg2Mjg3MjYiLCJhZF9zbG90X2luZGV4IjowLCJwYWdldmlld19pZCI6IjQyZTJlNGMxLTk4ZjEtNGFiYi05YmUwLTAzNjg0MmNjOWRmZCIsImRvbWFpbl9pZCI6NDg0NDcwLCJhZF91bml0IjoibWVkaWFmaXJlX2NvbS1lZGdlLTIiLCJhZF9wb3NpdGlvbiI6MTEwMiwiYWRfdHlwZSI6ImRpc3BsYXkiLCJhZF9zb3VyY2UiOiJnYW0iLCJyZXF1ZXN0ZWRfc2l6ZXMiOiIxNjB4NjAwIiwiYmlkX2Zsb29yIjowLjA4LCJpZCI6ImZlNDNkZDRhLTlmOGItNDE2NC05YTkzLWUyNTQ4YmQ3YmJiNCIsImhhbmRsZV9pZCI6ImZlNDNkZDRhLTlmOGItNDE2NC05YTkzLWUyNTQ4YmQ3YmJiNCIsImtleSI6Im1lZGlhZmlyZV9jb20tZWRnZS0yLzIwMjYtMDYtMTMvODg1NDEyMTAwODYyODcyNnwwfDIiLCJhdHRlbXB0X251bWJlciI6MiwidF90aW1lIjoiMjAyNi0wNi0xMyAwNzozODo0OCIsImZldGNoX2Vwb2NoIjoxNzgxMzU0MzMwLCJ2ZXJzaW9uIjoyLCJzdGF0dXMiOiJmZXRjaGVkIiwibGFzdF9ldmVudCI6ImZldGNoZWQiLCJsYXN0X3VwZGF0ZWRfbXMiOjE3ODEzNTQzMzA1MzksInJlY29yZF90eXBlIjoib3Bwb3J0dW5pdHkifSx7Imdyb3VwX2lkIjoibWVkaWFmaXJlX2NvbS1ib3gtMi8yMDI2LTA2LTEzLzIyNzQxNzY2MjA1NTgiLCJhdHRlbXB0X251bWJlciI6MSwiYWRfc2xvdF9pbmRleCI6MCwicGFnZXZpZXdfaWQiOiI0MmUyZTRjMS05OGYxLTRhYmItOWJlMC0wMzY4NDJjYzlkZmQiLCJkb21haW5faWQiOjQ4NDQ3MCwiYWRfdW5pdCI6Im1lZGlhZmlyZV9jb20tYm94LTIiLCJ0X3RpbWUiOiIyMDI2LTA2LTEzIDA3OjM4OjQ4IiwicmVjb3JkX3R5cGUiOiJjdXN0b21fZXZlbnQiLCJldmVudF9pZCI6ImU2ZTcyN2E5LWQxNGItNDY0Yi1hNTIxLTY4NGI3OGZmYWM4MiIsImV2ZW50X25hbWUiOiJub19maWxsX3JlYXNvbiIsImV2ZW50X3ZhbCI6InJldHJ5X2VtcHR5IiwiZXZlbnRfZXBvY2giOjE3ODEzNTQzMzAsImlzX3Zpc2libGUiOmZhbHNlfSx7Imdyb3VwX2lkIjoibWVkaWFmaXJlX2NvbS1lZGdlLTEvMjAyNi0wNi0xMy84OTEzMDE5ODcwNjU3MDY4IiwiYWRfc2xvdF9pbmRleCI6MCwicGFnZXZpZXdfaWQiOiI0MmUyZTRjMS05OGYxLTRhYmItOWJlMC0wMzY4NDJjYzlkZmQiLCJkb21haW5faWQiOjQ4NDQ3MCwiYWRfdW5pdCI6Im1lZGlhZmlyZV9jb20tZWRnZS0xIiwiYWRfcG9zaXRpb24iOjExMDEsImFkX3R5cGUiOiJkaXNwbGF5IiwiYWRfc291cmNlIjoiZ2FtIiwicmVxdWVzdGVkX3NpemVzIjoiMTYweDYwMCIsImJpZF9mbG9vciI6MC4zLCJpZCI6ImJmMDk5NmQyLWEzYzgtNDQ3OC1iOGRkLTU3M2E2YmFkYzZjYyIsImhhbmRsZV9pZCI6ImJmMDk5NmQyLWEzYzgtNDQ3OC1iOGRkLTU3M2E2YmFkYzZjYyIsImtleSI6Im1lZGlhZmlyZV9jb20tZWRnZS0xLzIwMjYtMDYtMTMvODkxMzAxOTg3MDY1NzA2OHwwfDIiLCJhdHRlbXB0X251bWJlciI6MiwidF90aW1lIjoiMjAyNi0wNi0xMyAwNzozODo0OCIsImZldGNoX2Vwb2NoIjoxNzgxMzU0MzMwLCJ2ZXJzaW9uIjoyLCJzdGF0dXMiOiJmZXRjaGVkIiwibGFzdF9ldmVudCI6ImZldGNoZWQiLCJsYXN0X3VwZGF0ZWRfbXMiOjE3ODEzNTQzMzA1NDQsInJlY29yZF90eXBlIjoib3Bwb3J0dW5pdHkifSx7Imdyb3VwX2lkIjoibWVkaWFmaXJlX2NvbS1tZWRyZWN0YW5nbGUtNC8yMDI2LTA2LTEzLzY4Nzk4MTkxMjQ2NTM4OTQiLCJhZF9zbG90X2luZGV4IjowLCJwYWdldmlld19pZCI6IjQyZTJlNGMxLTk4ZjEtNGFiYi05YmUwLTAzNjg0MmNjOWRmZCIsImRvbWFpbl9pZCI6NDg0NDcwLCJhZF91bml0IjoibWVkaWFmaXJlX2NvbS1tZWRyZWN0YW5nbGUtNCIsImFkX3Bvc2l0aW9uIjoxMTA1LCJhZF90eXBlIjoiZGlzcGxheSIsImFkX3NvdXJjZSI6ImdhbSIsInJlcXVlc3RlZF9zaXplcyI6IjMwMHgyNTAsMzM2eDI4MCIsImJpZF9mbG9vciI6MC4xNCwiaWQiOiI0MTM5YmUzZC0wODQzLTRiNzEtYjUzZC1iYmY4ZmQzYjAwY2MiLCJoYW5kbGVfaWQiOiI0MTM5YmUzZC0wODQzLTRiNzEtYjUzZC1iYmY4ZmQzYjAwY2MiLCJrZXkiOiJtZWRpYWZpcmVfY29tLW1lZHJlY3RhbmdsZS00LzIwMjYtMDYtMTMvNjg3OTgxOTEyNDY1Mzg5NHwwfDIiLCJhdHRlbXB0X251bWJlciI6MiwidF90aW1lIjoiMjAyNi0wNi0xMyAwNzozODo0OCIsImZldGNoX2Vwb2NoIjoxNzgxMzU0MzMwLCJ2ZXJzaW9uIjoyLCJzdGF0dXMiOiJmZXRjaGVkIiwibGFzdF9ldmVudCI6ImZldGNoZWQiLCJsYXN0X3VwZGF0ZWRfbXMiOjE3ODEzNTQzMzA1NDksInJlY29yZF90eXBlIjoib3Bwb3J0dW5pdHkifSx7Imdyb3VwX2lkIjoibWVkaWFmaXJlX2NvbS1tZWRyZWN0YW5nbGUtMi8yMDI2LTA2LTEzLzgwNzQ2NzUyOTY2Mjk4MDUiLCJhZF9zbG90X2luZGV4IjowLCJwYWdldmlld19pZCI6IjQyZTJlNGMxLTk4ZjEtNGFiYi05YmUwLTAzNjg0MmNjOWRmZCIsImRvbWFpbl9pZCI6NDg0NDcwLCJhZF91bml0IjoibWVkaWFmaXJlX2NvbS1tZWRyZWN0YW5nbGUtMiIsImFkX3Bvc2l0aW9uIjoxMTAwLCJhZF90eXBlIjoiZmxvYXRpbmciLCJhZF9zb3VyY2UiOiJnYW0iLCJyZXF1ZXN0ZWRfc2l6ZXMiOiI3Mjh4OTAiLCJiaWRfZmxvb3IiOjAuMDQsImlkIjoiYjJiYWEzNmUtZGU3Ni00ODIyLWFiZTUtMDhkZTUxNDc5YTYxIiwiaGFuZGxlX2lkIjoiYjJiYWEzNmUtZGU3Ni00ODIyLWFiZTUtMDhkZTUxNDc5YTYxIiwia2V5IjoibWVkaWFmaXJlX2NvbS1tZWRyZWN0YW5nbGUtMi8yMDI2LTA2LTEzLzgwNzQ2NzUyOTY2Mjk4MDV8MHwyIiwiYXR0ZW1wdF9udW1iZXIiOjIsInRfdGltZSI6IjIwMjYtMDYtMTMgMDc6Mzg6NDgiLCJmZXRjaF9lcG9jaCI6MTc4MTM1NDMzMCwidmVyc2lvbiI6Miwic3RhdHVzIjoiZmV0Y2hlZCIsImxhc3RfZXZlbnQiOiJmZXRjaGVkIiwibGFzdF91cGRhdGVkX21zIjoxNzgxMzU0MzMwNTUyLCJyZWNvcmRfdHlwZSI6Im9wcG9ydHVuaXR5In0seyJncm91cF9pZCI6Im1lZGlhZmlyZV9jb20tbWVkcmVjdGFuZ2xlLTIvMjAyNi0wNi0xMy84MDc0Njc1Mjk2NjI5ODA1IiwiYWRfc2xvdF9pbmRleCI6MSwicGFnZXZpZXdfaWQiOiI0MmUyZTRjMS05OGYxLTRhYmItOWJlMC0wMzY4NDJjYzlkZmQiLCJkb21haW5faWQiOjQ4NDQ3MCwiYWRfdW5pdCI6Im1lZGlhZmlyZV9jb20tbWVkcmVjdGFuZ2xlLTIiLCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfdHlwZSI6ImZsb2F0aW5nIiwiYWRfc291cmNlIjoiZ2FtIiwicmVxdWVzdGVkX3NpemVzIjoiNzI4eDkwIiwiYmlkX2Zsb29yIjowLjA0LCJpZCI6IjkxYjNmMjA5LTM1MmItNDczMi1hNmRlLTk0MzBjYTYxNGEzYyIsImhhbmRsZV9pZCI6IjkxYjNmMjA5LTM1MmItNDczMi1hNmRlLTk0MzBjYTYxNGEzYyIsImtleSI6Im1lZGlhZmlyZV9jb20tbWVkcmVjdGFuZ2xlLTIvMjAyNi0wNi0xMy84MDc0Njc1Mjk2NjI5ODA1fDF8MiIsImF0dGVtcHRfbnVtYmVyIjoyLCJ0X3RpbWUiOiIyMDI2LTA2LTEzIDA3OjM4OjQ4IiwiZmV0Y2hfZXBvY2giOjE3ODEzNTQzMzAsInZlcnNpb24iOjIsInN0YXR1cyI6ImZldGNoZWQiLCJsYXN0X2V2ZW50IjoiZmV0Y2hlZCIsImxhc3RfdXBkYXRlZF9tcyI6MTc4MTM1NDMzMDU1NCwicmVjb3JkX3R5cGUiOiJvcHBvcnR1bml0eSJ9LHsiZ3JvdXBfaWQiOiJtZWRpYWZpcmVfY29tLWJhbm5lci0xLzIwMjYtMDYtMTMvMzg2ODM4NDg2NjUyNTgxIiwiYXR0ZW1wdF9udW1iZXIiOjEsImFkX3Nsb3RfaW5kZXgiOjAsInBhZ2V2aWV3X2lkIjoiNDJlMmU0YzEtOThmMS00YWJiLTliZTAtMDM2ODQyY2M5ZGZkIiwiZG9tYWluX2lkIjo0ODQ0NzAsImFkX3VuaXQiOiJtZWRpYWZpcmVfY29tLWJhbm5lci0xIiwidF90aW1lIjoiMjAyNi0wNi0xMyAwNzozODo0OCIsInJlY29yZF90eXBlIjoiY3VzdG9tX2V2ZW50IiwiZXZlbnRfaWQiOiJiNzM3ZGQ1Mi05N2ViLTRhZDQtODI5Mi0xODhkZTNmODcyYzkiLCJldmVudF9uYW1lIjoibm9fZmlsbF9yZWFzb24iLCJldmVudF92YWwiOiJyZXRyeV9lbXB0eSIsImV2ZW50X2Vwb2NoIjoxNzgxMzU0MzMwLCJpc192aXNpYmxlIjpmYWxzZX1d
Requested by
Host:
URL: ez-standalone.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2406:da18:9d0:143f:2124:4e9c:36a9:d9de Singapore, Singapore, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
/
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

access-control-max-age
1728000
cache-control
private, max-age=0, must-revalidate, no-cache, no-store
access-control-allow-methods
HEAD, PUT, POST, GET, OPTIONS
expires
Fri, 12 Jun 2026 12:38:54 GMT
access-control-allow-origin
https://www.mediafire.com
content-length
43
date
Sat, 13 Jun 2026 12:38:54 GMT
x-middleton-display
imp_sol
content-type
image/gif
vary
Accept-Encoding
access-control-allow-headers
Content-Type
POST
H2
200
adop.gif
g.ezoic.net/porpoiseant/
43 B
73 B
105ms
96ms
Ping
image/gif
2406:da18:9d0:143f:2124:4e9c:36a9:d9de
Amazon.com
General
Full URL
https://g.ezoic.net/porpoiseant/adop.gif?orig=0&sts=W3siZ3JvdXBfaWQiOiJtZWRpYWZpcmVfY29tLWJveC0yLzIwMjYtMDYtMTMvMjI3NDE3NjYyMDU1OCIsImFkX3Nsb3RfaW5kZXgiOjAsInBhZ2V2aWV3X2lkIjoiNDJlMmU0YzEtOThmMS00YWJiLTliZTAtMDM2ODQyY2M5ZGZkIiwiZG9tYWluX2lkIjo0ODQ0NzAsImFkX3VuaXQiOiJtZWRpYWZpcmVfY29tLWJveC0yIiwiYWRfcG9zaXRpb24iOjExMDMsImFkX3R5cGUiOiJkaXNwbGF5IiwiYWRfc291cmNlIjoiZ2FtIiwicmVxdWVzdGVkX3NpemVzIjoiNzI4eDkwIiwiYmlkX2Zsb29yIjowLjI2LCJpZCI6IjM2ZWY4MzViLTQ0MzItNDE5ZC05ZWIzLTgwZGQwYjczMTA5NSIsImhhbmRsZV9pZCI6IjM2ZWY4MzViLTQ0MzItNDE5ZC05ZWIzLTgwZGQwYjczMTA5NSIsImtleSI6Im1lZGlhZmlyZV9jb20tYm94LTIvMjAyNi0wNi0xMy8yMjc0MTc2NjIwNTU4fDB8MiIsImF0dGVtcHRfbnVtYmVyIjoyLCJ0X3RpbWUiOiIyMDI2LTA2LTEzIDA3OjM4OjQ4IiwiZmV0Y2hfZXBvY2giOjE3ODEzNTQzMzAsInZlcnNpb24iOjIsInN0YXR1cyI6ImZldGNoZWQiLCJsYXN0X2V2ZW50IjoiZmV0Y2hlZCIsImxhc3RfdXBkYXRlZF9tcyI6MTc4MTM1NDMzMDU5NCwicmVjb3JkX3R5cGUiOiJvcHBvcnR1bml0eSJ9LHsiZ3JvdXBfaWQiOiJtZWRpYWZpcmVfY29tLWJhbm5lci0xLzIwMjYtMDYtMTMvMzg2ODM4NDg2NjUyNTgxIiwiYWRfc2xvdF9pbmRleCI6MCwicGFnZXZpZXdfaWQiOiI0MmUyZTRjMS05OGYxLTRhYmItOWJlMC0wMzY4NDJjYzlkZmQiLCJkb21haW5faWQiOjQ4NDQ3MCwiYWRfdW5pdCI6Im1lZGlhZmlyZV9jb20tYmFubmVyLTEiLCJhZF9wb3NpdGlvbiI6MTEwNywiYWRfdHlwZSI6ImRpc3BsYXkiLCJhZF9zb3VyY2UiOiJnYW0iLCJyZXF1ZXN0ZWRfc2l6ZXMiOiI3Mjh4OTAiLCJiaWRfZmxvb3IiOjAuMTIsImlkIjoiNmQyY2ZlZWEtOWQ4ZS00ZWI3LWI2NTMtZGMzY2I5YTBmM2E0IiwiaGFuZGxlX2lkIjoiNmQyY2ZlZWEtOWQ4ZS00ZWI3LWI2NTMtZGMzY2I5YTBmM2E0Iiwia2V5IjoibWVkaWFmaXJlX2NvbS1iYW5uZXItMS8yMDI2LTA2LTEzLzM4NjgzODQ4NjY1MjU4MXwwfDIiLCJhdHRlbXB0X251bWJlciI6MiwidF90aW1lIjoiMjAyNi0wNi0xMyAwNzozODo0OCIsImZldGNoX2Vwb2NoIjoxNzgxMzU0MzMwLCJ2ZXJzaW9uIjoyLCJzdGF0dXMiOiJmZXRjaGVkIiwibGFzdF9ldmVudCI6ImZldGNoZWQiLCJsYXN0X3VwZGF0ZWRfbXMiOjE3ODEzNTQzMzA2MzQsInJlY29yZF90eXBlIjoib3Bwb3J0dW5pdHkifSx7Imdyb3VwX2lkIjoibWVkaWFmaXJlX2NvbS1tZWRyZWN0YW5nbGUtMy8yMDI2LTA2LTEzLzQ3ODQ2OTc4OTA2NTMwNDMiLCJhdHRlbXB0X251bWJlciI6MSwiYWRfc2xvdF9pbmRleCI6MCwicGFnZXZpZXdfaWQiOiI0MmUyZTRjMS05OGYxLTRhYmItOWJlMC0wMzY4NDJjYzlkZmQiLCJkb21haW5faWQiOjQ4NDQ3MCwiYWRfdW5pdCI6Im1lZGlhZmlyZV9jb20tbWVkcmVjdGFuZ2xlLTMiLCJ0X3RpbWUiOiIyMDI2LTA2LTEzIDA3OjM4OjQ4IiwicmVjb3JkX3R5cGUiOiJjdXN0b21fZXZlbnQiLCJldmVudF9pZCI6Ijk3OTU2MjJkLWQ5ZWQtNDZmYi05NzA0LTkzZmFjNDVjZTc5ZCIsImV2ZW50X25hbWUiOiJsb2FkZWQiLCJldmVudF92YWwiOiJ0cnVlIiwiZXZlbnRfZXBvY2giOjE3ODEzNTQzMzAsImlzX3Zpc2libGUiOmZhbHNlfSx7Imdyb3VwX2lkIjoibWVkaWFmaXJlX2NvbS1tZWRyZWN0YW5nbGUtMy8yMDI2LTA2LTEzLzQ3ODQ2OTc4OTA2NTMwNDMiLCJhdHRlbXB0X251bWJlciI6MSwiYWRfc2xvdF9pbmRleCI6MCwicGFnZXZpZXdfaWQiOiI0MmUyZTRjMS05OGYxLTRhYmItOWJlMC0wMzY4NDJjYzlkZmQiLCJkb21haW5faWQiOjQ4NDQ3MCwiYWRfdW5pdCI6Im1lZGlhZmlyZV9jb20tbWVkcmVjdGFuZ2xlLTMiLCJ0X3RpbWUiOiIyMDI2LTA2LTEzIDA3OjM4OjQ4IiwicmVjb3JkX3R5cGUiOiJjdXN0b21fZXZlbnQiLCJldmVudF9pZCI6IjU1OWQ5ZDI0LTZmYTgtNDJmMC04ZTUxLTAyN2ExNzliZTg1ZiIsImV2ZW50X25hbWUiOiJzdGF0X3NvdXJjZV9pZCIsImV2ZW50X3ZhbCI6IjM1IiwiZXZlbnRfZXBvY2giOjE3ODEzNTQzMzAsImlzX3Zpc2libGUiOmZhbHNlfSx7Imdyb3VwX2lkIjoibWVkaWFmaXJlX2NvbS1tZWRyZWN0YW5nbGUtMy8yMDI2LTA2LTEzLzQ3ODQ2OTc4OTA2NTMwNDMiLCJhdHRlbXB0X251bWJlciI6MSwiYWRfc2xvdF9pbmRleCI6MCwicGFnZXZpZXdfaWQiOiI0MmUyZTRjMS05OGYxLTRhYmItOWJlMC0wMzY4NDJjYzlkZmQiLCJkb21haW5faWQiOjQ4NDQ3MCwiYWRfdW5pdCI6Im1lZGlhZmlyZV9jb20tbWVkcmVjdGFuZ2xlLTMiLCJ0X3RpbWUiOiIyMDI2LTA2LTEzIDA3OjM4OjQ4IiwicmVjb3JkX3R5cGUiOiJjdXN0b21fZXZlbnQiLCJldmVudF9pZCI6IjM4MTM3NjBiLThjN2EtNGQ5My04MmQxLWJmZTFmM2Y3NzE5OCIsImV2ZW50X25hbWUiOiJjcmVhdGl2ZV9pZCIsImV2ZW50X3ZhbCI6IjEzODQ4NjE0ODc0NCIsImV2ZW50X2Vwb2NoIjoxNzgxMzU0MzMwLCJpc192aXNpYmxlIjpmYWxzZX0seyJncm91cF9pZCI6Im1lZGlhZmlyZV9jb20tbWVkcmVjdGFuZ2xlLTMvMjAyNi0wNi0xMy80Nzg0Njk3ODkwNjUzMDQzIiwiYXR0ZW1wdF9udW1iZXIiOjEsImFkX3Nsb3RfaW5kZXgiOjAsInBhZ2V2aWV3X2lkIjoiNDJlMmU0YzEtOThmMS00YWJiLTliZTAtMDM2ODQyY2M5ZGZkIiwiZG9tYWluX2lkIjo0ODQ0NzAsImFkX3VuaXQiOiJtZWRpYWZpcmVfY29tLW1lZHJlY3RhbmdsZS0zIiwidF90aW1lIjoiMjAyNi0wNi0xMyAwNzozODo0OCIsInJlY29yZF90eXBlIjoiY3VzdG9tX2V2ZW50IiwiZXZlbnRfaWQiOiJkZTAyNWE5My1lZDA4LTQ0YzQtYmM1Yy1lZTkyNDNjZTAzZDMiLCJldmVudF9uYW1lIjoibGluZWl0ZW1faWQiLCJldmVudF92YWwiOiIyODY4NzI3NCIsImV2ZW50X2Vwb2NoIjoxNzgxMzU0MzMwLCJpc192aXNpYmxlIjpmYWxzZX0seyJncm91cF9pZCI6Im1lZGlhZmlyZV9jb20tbWVkcmVjdGFuZ2xlLTMvMjAyNi0wNi0xMy80Nzg0Njk3ODkwNjUzMDQzIiwiYXR0ZW1wdF9udW1iZXIiOjEsImFkX3Nsb3RfaW5kZXgiOjAsInBhZ2V2aWV3X2lkIjoiNDJlMmU0YzEtOThmMS00YWJiLTliZTAtMDM2ODQyY2M5ZGZkIiwiZG9tYWluX2lkIjo0ODQ0NzAsImFkX3VuaXQiOiJtZWRpYWZpcmVfY29tLW1lZHJlY3RhbmdsZS0zIiwidF90aW1lIjoiMjAyNi0wNi0xMyAwNzozODo0OCIsInJlY29yZF90eXBlIjoiY3VzdG9tX2V2ZW50IiwiZXZlbnRfaWQiOiI5YmNjM2ViMi0xYzg4LTQ0YjctYjdhOS00ODk5NjI1NWNlZWYiLCJldmVudF9uYW1lIjoiZmlsbGVkX3NpemUiLCJldmVudF92YWwiOiIzMzZ4MjgwIiwiZXZlbnRfZXBvY2giOjE3ODEzNTQzMzAsImlzX3Zpc2libGUiOmZhbHNlfSx7Imdyb3VwX2lkIjoibWVkaWFmaXJlX2NvbS1tZWRyZWN0YW5nbGUtMy8yMDI2LTA2LTEzLzQ3ODQ2OTc4OTA2NTMwNDMiLCJhdHRlbXB0X251bWJlciI6MSwiYWRfc2xvdF9pbmRleCI6MCwicGFnZXZpZXdfaWQiOiI0MmUyZTRjMS05OGYxLTRhYmItOWJlMC0wMzY4NDJjYzlkZmQiLCJkb21haW5faWQiOjQ4NDQ3MCwiYWRfdW5pdCI6Im1lZGlhZmlyZV9jb20tbWVkcmVjdGFuZ2xlLTMiLCJ0X3RpbWUiOiIyMDI2LTA2LTEzIDA3OjM4OjQ4IiwicmVjb3JkX3R5cGUiOiJjdXN0b21fZXZlbnQiLCJldmVudF9pZCI6ImJkZWYzMjhiLTU2ODgtNDdjOC1hNDY2LTAwMTMzNTk2NDMxOSIsImV2ZW50X25hbWUiOiJnYW1faXNfZW1wdHkiLCJldmVudF92YWwiOiJmYWxzZSIsImV2ZW50X2Vwb2NoIjoxNzgxMzU0MzMwLCJpc192aXNpYmxlIjpmYWxzZX0seyJncm91cF9pZCI6Im1lZGlhZmlyZV9jb20tbWVkcmVjdGFuZ2xlLTMvMjAyNi0wNi0xMy80Nzg0Njk3ODkwNjUzMDQzIiwiYXR0ZW1wdF9udW1iZXIiOjEsImFkX3Nsb3RfaW5kZXgiOjAsInBhZ2V2aWV3X2lkIjoiNDJlMmU0YzEtOThmMS00YWJiLTliZTAtMDM2ODQyY2M5ZGZkIiwiZG9tYWluX2lkIjo0ODQ0NzAsImFkX3VuaXQiOiJtZWRpYWZpcmVfY29tLW1lZHJlY3RhbmdsZS0zIiwidF90aW1lIjoiMjAyNi0wNi0xMyAwNzozODo0OCIsInJlY29yZF90eXBlIjoiY3VzdG9tX2V2ZW50IiwiZXZlbnRfaWQiOiIwMDA1ZDUyNC1jMjBkLTQ1NzQtOWQ2Mi05ZGNjMDE2MjJjODEiLCJldmVudF9uYW1lIjoiZ2FtX2dvb2dsZV9xdWVyeV9pZCIsImV2ZW50X3ZhbCI6IkNOUEd6SUNlaEpVREZVTnZ3d1lkdXcwc093IiwiZXZlbnRfZXBvY2giOjE3ODEzNTQzMzAsImlzX3Zpc2libGUiOmZhbHNlfSx7Imdyb3VwX2lkIjoibWVkaWFmaXJlX2NvbS1tZWRyZWN0YW5nbGUtMy8yMDI2LTA2LTEzLzQ3ODQ2OTc4OTA2NTMwNDMiLCJhdHRlbXB0X251bWJlciI6MSwiYWRfc2xvdF9pbmRleCI6MCwicGFnZXZpZXdfaWQiOiI0MmUyZTRjMS05OGYxLTRhYmItOWJlMC0wMzY4NDJjYzlkZmQiLCJkb21haW5faWQiOjQ4NDQ3MCwiYWRfdW5pdCI6Im1lZGlhZmlyZV9jb20tbWVkcmVjdGFuZ2xlLTMiLCJ0X3RpbWUiOiIyMDI2LTA2LTEzIDA3OjM4OjQ4IiwicmVjb3JkX3R5cGUiOiJjdXN0b21fZXZlbnQiLCJldmVudF9pZCI6IjlkN2ViZDM2LWVlNTctNDFkZi04MGI5LTg3ODVkN2E4MDkzMCIsImV2ZW50X25hbWUiOiJzdG9yZV9maWxsZWRfc291cmNlIiwiZXZlbnRfdmFsIjoiZ2FtX3Nsb3RfcmVuZGVyZWQiLCJldmVudF9lcG9jaCI6MTc4MTM1NDMzMCwiaXNfdmlzaWJsZSI6ZmFsc2V9XQ==
Requested by
Host:
URL: ez-standalone.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2406:da18:9d0:143f:2124:4e9c:36a9:d9de Singapore, Singapore, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
/
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

access-control-max-age
1728000
cache-control
private, max-age=0, must-revalidate, no-cache, no-store
access-control-allow-methods
HEAD, PUT, POST, GET, OPTIONS
expires
Fri, 12 Jun 2026 12:38:54 GMT
access-control-allow-origin
https://www.mediafire.com
content-length
43
date
Sat, 13 Jun 2026 12:38:54 GMT
x-middleton-display
imp_sol
content-type
image/gif
vary
Accept-Encoding
access-control-allow-headers
Content-Type
POST
H2
200
adop.gif
g.ezoic.net/porpoiseant/
43 B
73 B
114ms
105ms
Ping
image/gif
2406:da18:9d0:143f:2124:4e9c:36a9:d9de
Amazon.com
General
Full URL
https://g.ezoic.net/porpoiseant/adop.gif?orig=0&sts=W3siZ3JvdXBfaWQiOiJtZWRpYWZpcmVfY29tLW1lZHJlY3RhbmdsZS0zLzIwMjYtMDYtMTMvNDc4NDY5Nzg5MDY1MzA0MyIsImF0dGVtcHRfbnVtYmVyIjoxLCJhZF9zbG90X2luZGV4IjowLCJwYWdldmlld19pZCI6IjQyZTJlNGMxLTk4ZjEtNGFiYi05YmUwLTAzNjg0MmNjOWRmZCIsImRvbWFpbl9pZCI6NDg0NDcwLCJhZF91bml0IjoibWVkaWFmaXJlX2NvbS1tZWRyZWN0YW5nbGUtMyIsInRfdGltZSI6IjIwMjYtMDYtMTMgMDc6Mzg6NDgiLCJyZWNvcmRfdHlwZSI6ImN1c3RvbV9ldmVudCIsImV2ZW50X2lkIjoiYzBiZTBjZjItMmRhNC00NWMyLWJhY2UtY2VmMGRmYzRlYmU3IiwiZXZlbnRfbmFtZSI6InJldmVudWVfdXNkIiwiZXZlbnRfdmFsIjoiMC4wMDA0IiwiZXZlbnRfZXBvY2giOjE3ODEzNTQzMzAsImlzX3Zpc2libGUiOmZhbHNlfSx7Imdyb3VwX2lkIjoibWVkaWFmaXJlX2NvbS1tZWRyZWN0YW5nbGUtMy8yMDI2LTA2LTEzLzQ3ODQ2OTc4OTA2NTMwNDMiLCJhdHRlbXB0X251bWJlciI6MSwiYWRfc2xvdF9pbmRleCI6MCwicGFnZXZpZXdfaWQiOiI0MmUyZTRjMS05OGYxLTRhYmItOWJlMC0wMzY4NDJjYzlkZmQiLCJkb21haW5faWQiOjQ4NDQ3MCwiYWRfdW5pdCI6Im1lZGlhZmlyZV9jb20tbWVkcmVjdGFuZ2xlLTMiLCJ0X3RpbWUiOiIyMDI2LTA2LTEzIDA3OjM4OjQ4IiwicmVjb3JkX3R5cGUiOiJjdXN0b21fZXZlbnQiLCJldmVudF9pZCI6IjQ4ZjliMzU4LTYzMmItNDRlMi1hZTkyLTJkMWY3MmUyMTlkNyIsImV2ZW50X25hbWUiOiJlc3RfcmV2ZW51ZV91c2QiLCJldmVudF92YWwiOiIwLjAwMDQiLCJldmVudF9lcG9jaCI6MTc4MTM1NDMzMCwiaXNfdmlzaWJsZSI6ZmFsc2V9LHsiZ3JvdXBfaWQiOiJtZWRpYWZpcmVfY29tLW1lZHJlY3RhbmdsZS0zLzIwMjYtMDYtMTMvNDc4NDY5Nzg5MDY1MzA0MyIsImF0dGVtcHRfbnVtYmVyIjoxLCJhZF9zbG90X2luZGV4IjowLCJwYWdldmlld19pZCI6IjQyZTJlNGMxLTk4ZjEtNGFiYi05YmUwLTAzNjg0MmNjOWRmZCIsImRvbWFpbl9pZCI6NDg0NDcwLCJhZF91bml0IjoibWVkaWFmaXJlX2NvbS1tZWRyZWN0YW5nbGUtMyIsInRfdGltZSI6IjIwMjYtMDYtMTMgMDc6Mzg6NDgiLCJyZWNvcmRfdHlwZSI6ImN1c3RvbV9ldmVudCIsImV2ZW50X2lkIjoiMGRmNWU4ZGEtYmY1Mi00ZmI1LWI0ZTQtYjYwOThjMDg1MzFkIiwiZXZlbnRfbmFtZSI6ImFkX3NvdXJjZSIsImV2ZW50X3ZhbCI6ImdhbSIsImV2ZW50X2Vwb2NoIjoxNzgxMzU0MzMwLCJpc192aXNpYmxlIjpmYWxzZX0seyJncm91cF9pZCI6Im1lZGlhZmlyZV9jb20tbWVkcmVjdGFuZ2xlLTMvMjAyNi0wNi0xMy80Nzg0Njk3ODkwNjUzMDQzIiwiYWRfc2xvdF9pbmRleCI6MCwicGFnZXZpZXdfaWQiOiI0MmUyZTRjMS05OGYxLTRhYmItOWJlMC0wMzY4NDJjYzlkZmQiLCJkb21haW5faWQiOjQ4NDQ3MCwiYWRfdW5pdCI6Im1lZGlhZmlyZV9jb20tbWVkcmVjdGFuZ2xlLTMiLCJhZF9wb3NpdGlvbiI6MTEwNCwiYWRfdHlwZSI6ImRpc3BsYXkiLCJhZF9zb3VyY2UiOiJnYW0iLCJyZXF1ZXN0ZWRfc2l6ZXMiOiIzMzZ4MjgwIiwiYmlkX2Zsb29yIjowLjQsImlkIjoiOWIyNmU0NmYtNjk0ZC00ZGMxLWIzOWUtNTk5NWQ0ODA3MTdiIiwiaGFuZGxlX2lkIjoiOWIyNmU0NmYtNjk0ZC00ZGMxLWIzOWUtNTk5NWQ0ODA3MTdiIiwia2V5IjoibWVkaWFmaXJlX2NvbS1tZWRyZWN0YW5nbGUtMy8yMDI2LTA2LTEzLzQ3ODQ2OTc4OTA2NTMwNDN8MHwyIiwiYXR0ZW1wdF9udW1iZXIiOjIsInRfdGltZSI6IjIwMjYtMDYtMTMgMDc6Mzg6NDgiLCJmZXRjaF9lcG9jaCI6MTc4MTM1NDMzMCwidmVyc2lvbiI6Miwic3RhdHVzIjoiZmV0Y2hlZCIsImxhc3RfZXZlbnQiOiJmZXRjaGVkIiwibGFzdF91cGRhdGVkX21zIjoxNzgxMzU0MzMwNzE5LCJyZWNvcmRfdHlwZSI6Im9wcG9ydHVuaXR5In0seyJncm91cF9pZCI6Im1lZGlhZmlyZV9jb20tZWRnZS0yLzIwMjYtMDYtMTMvODg1NDEyMTAwODYyODcyNiIsImF0dGVtcHRfbnVtYmVyIjoyLCJhZF9zbG90X2luZGV4IjowLCJwYWdldmlld19pZCI6IjQyZTJlNGMxLTk4ZjEtNGFiYi05YmUwLTAzNjg0MmNjOWRmZCIsImRvbWFpbl9pZCI6NDg0NDcwLCJhZF91bml0IjoibWVkaWFmaXJlX2NvbS1lZGdlLTIiLCJ0X3RpbWUiOiIyMDI2LTA2LTEzIDA3OjM4OjQ4IiwicmVjb3JkX3R5cGUiOiJjdXN0b21fZXZlbnQiLCJldmVudF9pZCI6IjIwNjNiYjhkLTRlMjUtNGY1YS1hOTRhLTlmM2MyYTIyYjUxNiIsImV2ZW50X25hbWUiOiJub19maWxsX3JlYXNvbiIsImV2ZW50X3ZhbCI6InJldHJ5X2VtcHR5IiwiZXZlbnRfZXBvY2giOjE3ODEzNTQzMzEsImlzX3Zpc2libGUiOmZhbHNlfSx7Imdyb3VwX2lkIjoibWVkaWFmaXJlX2NvbS1tZWRyZWN0YW5nbGUtMi8yMDI2LTA2LTEzLzgwNzQ2NzUyOTY2Mjk4MDUiLCJhdHRlbXB0X251bWJlciI6MiwiYWRfc2xvdF9pbmRleCI6MCwicGFnZXZpZXdfaWQiOiI0MmUyZTRjMS05OGYxLTRhYmItOWJlMC0wMzY4NDJjYzlkZmQiLCJkb21haW5faWQiOjQ4NDQ3MCwiYWRfdW5pdCI6Im1lZGlhZmlyZV9jb20tbWVkcmVjdGFuZ2xlLTIiLCJ0X3RpbWUiOiIyMDI2LTA2LTEzIDA3OjM4OjQ4IiwicmVjb3JkX3R5cGUiOiJjdXN0b21fZXZlbnQiLCJldmVudF9pZCI6IjZkNmNiNDMwLTFjYzUtNDU1OC04OWExLTljNDIyNTc5Yjc5NSIsImV2ZW50X25hbWUiOiJub19maWxsX3JlYXNvbiIsImV2ZW50X3ZhbCI6InJldHJ5X2VtcHR5IiwiZXZlbnRfZXBvY2giOjE3ODEzNTQzMzEsImlzX3Zpc2libGUiOmZhbHNlfSx7Imdyb3VwX2lkIjoibWVkaWFmaXJlX2NvbS1ib3gtMi8yMDI2LTA2LTEzLzIyNzQxNzY2MjA1NTgiLCJhdHRlbXB0X251bWJlciI6MiwiYWRfc2xvdF9pbmRleCI6MCwicGFnZXZpZXdfaWQiOiI0MmUyZTRjMS05OGYxLTRhYmItOWJlMC0wMzY4NDJjYzlkZmQiLCJkb21haW5faWQiOjQ4NDQ3MCwiYWRfdW5pdCI6Im1lZGlhZmlyZV9jb20tYm94LTIiLCJ0X3RpbWUiOiIyMDI2LTA2LTEzIDA3OjM4OjQ4IiwicmVjb3JkX3R5cGUiOiJjdXN0b21fZXZlbnQiLCJldmVudF9pZCI6ImNjYzQwMjJlLTY4NzItNDYyMi1hMTA3LWMwYjRlYzg3ZGVmNSIsImV2ZW50X25hbWUiOiJub19maWxsX3JlYXNvbiIsImV2ZW50X3ZhbCI6InJldHJ5X2VtcHR5IiwiZXZlbnRfZXBvY2giOjE3ODEzNTQzMzEsImlzX3Zpc2libGUiOmZhbHNlfSx7Imdyb3VwX2lkIjoibWVkaWFmaXJlX2NvbS1tZWRyZWN0YW5nbGUtMy8yMDI2LTA2LTEzLzQ3ODQ2OTc4OTA2NTMwNDMiLCJhdHRlbXB0X251bWJlciI6MiwiYWRfc2xvdF9pbmRleCI6MCwicGFnZXZpZXdfaWQiOiI0MmUyZTRjMS05OGYxLTRhYmItOWJlMC0wMzY4NDJjYzlkZmQiLCJkb21haW5faWQiOjQ4NDQ3MCwiYWRfdW5pdCI6Im1lZGlhZmlyZV9jb20tbWVkcmVjdGFuZ2xlLTMiLCJ0X3RpbWUiOiIyMDI2LTA2LTEzIDA3OjM4OjQ4IiwicmVjb3JkX3R5cGUiOiJjdXN0b21fZXZlbnQiLCJldmVudF9pZCI6IjI2Mzk4Zjk3LTMxMDAtNDUzNy04ZDM0LWIxODlhOWEzODU0OCIsImV2ZW50X25hbWUiOiJub19maWxsX3JlYXNvbiIsImV2ZW50X3ZhbCI6InJldHJ5X2VtcHR5IiwiZXZlbnRfZXBvY2giOjE3ODEzNTQzMzEsImlzX3Zpc2libGUiOmZhbHNlfSx7Imdyb3VwX2lkIjoibWVkaWFmaXJlX2NvbS1tZWRyZWN0YW5nbGUtMi8yMDI2LTA2LTEzLzgwNzQ2NzUyOTY2Mjk4MDUiLCJhdHRlbXB0X251bWJlciI6MiwiYWRfc2xvdF9pbmRleCI6MSwicGFnZXZpZXdfaWQiOiI0MmUyZTRjMS05OGYxLTRhYmItOWJlMC0wMzY4NDJjYzlkZmQiLCJkb21haW5faWQiOjQ4NDQ3MCwiYWRfdW5pdCI6Im1lZGlhZmlyZV9jb20tbWVkcmVjdGFuZ2xlLTIiLCJ0X3RpbWUiOiIyMDI2LTA2LTEzIDA3OjM4OjQ4IiwicmVjb3JkX3R5cGUiOiJjdXN0b21fZXZlbnQiLCJldmVudF9pZCI6ImNkZmE0MDMxLWMyOTItNDkwNy04NGJjLWVmNTc2MDY2YjM5ZSIsImV2ZW50X25hbWUiOiJub19maWxsX3JlYXNvbiIsImV2ZW50X3ZhbCI6InJldHJ5X2VtcHR5IiwiZXZlbnRfZXBvY2giOjE3ODEzNTQzMzEsImlzX3Zpc2libGUiOmZhbHNlfSx7Imdyb3VwX2lkIjoibWVkaWFmaXJlX2NvbS1lZGdlLTIvMjAyNi0wNi0xMy84ODU0MTIxMDA4NjI4NzI2IiwiYWRfc2xvdF9pbmRleCI6MCwicGFnZXZpZXdfaWQiOiI0MmUyZTRjMS05OGYxLTRhYmItOWJlMC0wMzY4NDJjYzlkZmQiLCJkb21haW5faWQiOjQ4NDQ3MCwiYWRfdW5pdCI6Im1lZGlhZmlyZV9jb20tZWRnZS0yIiwiYWRfcG9zaXRpb24iOjExMDIsImFkX3R5cGUiOiJkaXNwbGF5IiwiYWRfc291cmNlIjoiZ2FtIiwicmVxdWVzdGVkX3NpemVzIjoiMTYweDYwMCIsImJpZF9mbG9vciI6MC4wNiwiaWQiOiJhZmE2MjgyNS02ZDliLTQyYjAtYWY2Ni00NWM4ZTM5YWQ4M2QiLCJoYW5kbGVfaWQiOiJhZmE2MjgyNS02ZDliLTQyYjAtYWY2Ni00NWM4ZTM5YWQ4M2QiLCJrZXkiOiJtZWRpYWZpcmVfY29tLWVkZ2UtMi8yMDI2LTA2LTEzLzg4NTQxMjEwMDg2Mjg3MjZ8MHwzIiwiYXR0ZW1wdF9udW1iZXIiOjMsInRfdGltZSI6IjIwMjYtMDYtMTMgMDc6Mzg6NDgiLCJmZXRjaF9lcG9jaCI6MTc4MTM1NDMzMSwidmVyc2lvbiI6Miwic3RhdHVzIjoiZmV0Y2hlZCIsImxhc3RfZXZlbnQiOiJmZXRjaGVkIiwibGFzdF91cGRhdGVkX21zIjoxNzgxMzU0MzMxNTI5LCJyZWNvcmRfdHlwZSI6Im9wcG9ydHVuaXR5In1d
Requested by
Host:
URL: ez-standalone.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2406:da18:9d0:143f:2124:4e9c:36a9:d9de Singapore, Singapore, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
/
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

access-control-max-age
1728000
cache-control
private, max-age=0, must-revalidate, no-cache, no-store
access-control-allow-methods
HEAD, PUT, POST, GET, OPTIONS
expires
Fri, 12 Jun 2026 12:38:54 GMT
access-control-allow-origin
https://www.mediafire.com
content-length
43
date
Sat, 13 Jun 2026 12:38:54 GMT
x-middleton-display
imp_sol
content-type
image/gif
vary
Accept-Encoding
access-control-allow-headers
Content-Type
POST
H2
200
adop.gif
g.ezoic.net/porpoiseant/
43 B
73 B
121ms
113ms
Ping
image/gif
2406:da18:9d0:143f:2124:4e9c:36a9:d9de
Amazon.com
General
Full URL
https://g.ezoic.net/porpoiseant/adop.gif?orig=0&sts=W3siZ3JvdXBfaWQiOiJtZWRpYWZpcmVfY29tLW1lZHJlY3RhbmdsZS0yLzIwMjYtMDYtMTMvODA3NDY3NTI5NjYyOTgwNSIsImFkX3Nsb3RfaW5kZXgiOjAsInBhZ2V2aWV3X2lkIjoiNDJlMmU0YzEtOThmMS00YWJiLTliZTAtMDM2ODQyY2M5ZGZkIiwiZG9tYWluX2lkIjo0ODQ0NzAsImFkX3VuaXQiOiJtZWRpYWZpcmVfY29tLW1lZHJlY3RhbmdsZS0yIiwiYWRfcG9zaXRpb24iOjExMDAsImFkX3R5cGUiOiJmbG9hdGluZyIsImFkX3NvdXJjZSI6ImdhbSIsInJlcXVlc3RlZF9zaXplcyI6IjcyOHg5MCIsImJpZF9mbG9vciI6MCwiaWQiOiI4Y2QxNTZiYy0zNzhkLTQ3NTMtOGQ5Yy1mNDkwODllOWY0ODkiLCJoYW5kbGVfaWQiOiI4Y2QxNTZiYy0zNzhkLTQ3NTMtOGQ5Yy1mNDkwODllOWY0ODkiLCJrZXkiOiJtZWRpYWZpcmVfY29tLW1lZHJlY3RhbmdsZS0yLzIwMjYtMDYtMTMvODA3NDY3NTI5NjYyOTgwNXwwfDMiLCJhdHRlbXB0X251bWJlciI6MywidF90aW1lIjoiMjAyNi0wNi0xMyAwNzozODo0OCIsImZldGNoX2Vwb2NoIjoxNzgxMzU0MzMxLCJ2ZXJzaW9uIjoyLCJzdGF0dXMiOiJmZXRjaGVkIiwibGFzdF9ldmVudCI6ImZldGNoZWQiLCJsYXN0X3VwZGF0ZWRfbXMiOjE3ODEzNTQzMzE1MzksInJlY29yZF90eXBlIjoib3Bwb3J0dW5pdHkifSx7Imdyb3VwX2lkIjoibWVkaWFmaXJlX2NvbS1lZGdlLTEvMjAyNi0wNi0xMy84OTEzMDE5ODcwNjU3MDY4IiwiYXR0ZW1wdF9udW1iZXIiOjIsImFkX3Nsb3RfaW5kZXgiOjAsInBhZ2V2aWV3X2lkIjoiNDJlMmU0YzEtOThmMS00YWJiLTliZTAtMDM2ODQyY2M5ZGZkIiwiZG9tYWluX2lkIjo0ODQ0NzAsImFkX3VuaXQiOiJtZWRpYWZpcmVfY29tLWVkZ2UtMSIsInRfdGltZSI6IjIwMjYtMDYtMTMgMDc6Mzg6NDgiLCJyZWNvcmRfdHlwZSI6ImN1c3RvbV9ldmVudCIsImV2ZW50X2lkIjoiM2QzM2MzOWItZjhhMi00NTY3LTg0MGItZmI4NmU2MzAyMDBiIiwiZXZlbnRfbmFtZSI6ImxvYWRlZCIsImV2ZW50X3ZhbCI6InRydWUiLCJldmVudF9lcG9jaCI6MTc4MTM1NDMzMSwiaXNfdmlzaWJsZSI6ZmFsc2V9LHsiZ3JvdXBfaWQiOiJtZWRpYWZpcmVfY29tLWVkZ2UtMS8yMDI2LTA2LTEzLzg5MTMwMTk4NzA2NTcwNjgiLCJhdHRlbXB0X251bWJlciI6MiwiYWRfc2xvdF9pbmRleCI6MCwicGFnZXZpZXdfaWQiOiI0MmUyZTRjMS05OGYxLTRhYmItOWJlMC0wMzY4NDJjYzlkZmQiLCJkb21haW5faWQiOjQ4NDQ3MCwiYWRfdW5pdCI6Im1lZGlhZmlyZV9jb20tZWRnZS0xIiwidF90aW1lIjoiMjAyNi0wNi0xMyAwNzozODo0OCIsInJlY29yZF90eXBlIjoiY3VzdG9tX2V2ZW50IiwiZXZlbnRfaWQiOiI0ZmM2OTkwZS1lNTUxLTQ5MDQtODhhNS03MWM1ODM5ZTllNDUiLCJldmVudF9uYW1lIjoic3RhdF9zb3VyY2VfaWQiLCJldmVudF92YWwiOiIzNSIsImV2ZW50X2Vwb2NoIjoxNzgxMzU0MzMxLCJpc192aXNpYmxlIjpmYWxzZX0seyJncm91cF9pZCI6Im1lZGlhZmlyZV9jb20tZWRnZS0xLzIwMjYtMDYtMTMvODkxMzAxOTg3MDY1NzA2OCIsImF0dGVtcHRfbnVtYmVyIjoyLCJhZF9zbG90X2luZGV4IjowLCJwYWdldmlld19pZCI6IjQyZTJlNGMxLTk4ZjEtNGFiYi05YmUwLTAzNjg0MmNjOWRmZCIsImRvbWFpbl9pZCI6NDg0NDcwLCJhZF91bml0IjoibWVkaWFmaXJlX2NvbS1lZGdlLTEiLCJ0X3RpbWUiOiIyMDI2LTA2LTEzIDA3OjM4OjQ4IiwicmVjb3JkX3R5cGUiOiJjdXN0b21fZXZlbnQiLCJldmVudF9pZCI6ImNjMWY0YjQ0LTdjM2EtNDg5MC05MTdhLWQyOTE4ZDNiMzI0YSIsImV2ZW50X25hbWUiOiJjcmVhdGl2ZV9pZCIsImV2ZW50X3ZhbCI6IjEzODQ4NjE0ODc0NCIsImV2ZW50X2Vwb2NoIjoxNzgxMzU0MzMxLCJpc192aXNpYmxlIjpmYWxzZX0seyJncm91cF9pZCI6Im1lZGlhZmlyZV9jb20tZWRnZS0xLzIwMjYtMDYtMTMvODkxMzAxOTg3MDY1NzA2OCIsImF0dGVtcHRfbnVtYmVyIjoyLCJhZF9zbG90X2luZGV4IjowLCJwYWdldmlld19pZCI6IjQyZTJlNGMxLTk4ZjEtNGFiYi05YmUwLTAzNjg0MmNjOWRmZCIsImRvbWFpbl9pZCI6NDg0NDcwLCJhZF91bml0IjoibWVkaWFmaXJlX2NvbS1lZGdlLTEiLCJ0X3RpbWUiOiIyMDI2LTA2LTEzIDA3OjM4OjQ4IiwicmVjb3JkX3R5cGUiOiJjdXN0b21fZXZlbnQiLCJldmVudF9pZCI6ImQ4NDQ0M2E4LWNmYWQtNGU2Zi1hNDFhLTU3YzA0OGRhNDJmNCIsImV2ZW50X25hbWUiOiJsaW5laXRlbV9pZCIsImV2ZW50X3ZhbCI6IjI4Njg3Mjc0IiwiZXZlbnRfZXBvY2giOjE3ODEzNTQzMzEsImlzX3Zpc2libGUiOmZhbHNlfSx7Imdyb3VwX2lkIjoibWVkaWFmaXJlX2NvbS1lZGdlLTEvMjAyNi0wNi0xMy84OTEzMDE5ODcwNjU3MDY4IiwiYXR0ZW1wdF9udW1iZXIiOjIsImFkX3Nsb3RfaW5kZXgiOjAsInBhZ2V2aWV3X2lkIjoiNDJlMmU0YzEtOThmMS00YWJiLTliZTAtMDM2ODQyY2M5ZGZkIiwiZG9tYWluX2lkIjo0ODQ0NzAsImFkX3VuaXQiOiJtZWRpYWZpcmVfY29tLWVkZ2UtMSIsInRfdGltZSI6IjIwMjYtMDYtMTMgMDc6Mzg6NDgiLCJyZWNvcmRfdHlwZSI6ImN1c3RvbV9ldmVudCIsImV2ZW50X2lkIjoiZTA5ZWI0ODQtMzdjNC00MWQ5LThhNjQtZmFkOWI4YmJmNTg0IiwiZXZlbnRfbmFtZSI6ImZpbGxlZF9zaXplIiwiZXZlbnRfdmFsIjoiMTYweDYwMCIsImV2ZW50X2Vwb2NoIjoxNzgxMzU0MzMxLCJpc192aXNpYmxlIjpmYWxzZX0seyJncm91cF9pZCI6Im1lZGlhZmlyZV9jb20tZWRnZS0xLzIwMjYtMDYtMTMvODkxMzAxOTg3MDY1NzA2OCIsImF0dGVtcHRfbnVtYmVyIjoyLCJhZF9zbG90X2luZGV4IjowLCJwYWdldmlld19pZCI6IjQyZTJlNGMxLTk4ZjEtNGFiYi05YmUwLTAzNjg0MmNjOWRmZCIsImRvbWFpbl9pZCI6NDg0NDcwLCJhZF91bml0IjoibWVkaWFmaXJlX2NvbS1lZGdlLTEiLCJ0X3RpbWUiOiIyMDI2LTA2LTEzIDA3OjM4OjQ4IiwicmVjb3JkX3R5cGUiOiJjdXN0b21fZXZlbnQiLCJldmVudF9pZCI6IjU1NjE1YmUyLWQyNWMtNDgyZi05ZDYwLTUxNjVhOTA4MTA4NyIsImV2ZW50X25hbWUiOiJnYW1faXNfZW1wdHkiLCJldmVudF92YWwiOiJmYWxzZSIsImV2ZW50X2Vwb2NoIjoxNzgxMzU0MzMxLCJpc192aXNpYmxlIjpmYWxzZX0seyJncm91cF9pZCI6Im1lZGlhZmlyZV9jb20tZWRnZS0xLzIwMjYtMDYtMTMvODkxMzAxOTg3MDY1NzA2OCIsImF0dGVtcHRfbnVtYmVyIjoyLCJhZF9zbG90X2luZGV4IjowLCJwYWdldmlld19pZCI6IjQyZTJlNGMxLTk4ZjEtNGFiYi05YmUwLTAzNjg0MmNjOWRmZCIsImRvbWFpbl9pZCI6NDg0NDcwLCJhZF91bml0IjoibWVkaWFmaXJlX2NvbS1lZGdlLTEiLCJ0X3RpbWUiOiIyMDI2LTA2LTEzIDA3OjM4OjQ4IiwicmVjb3JkX3R5cGUiOiJjdXN0b21fZXZlbnQiLCJldmVudF9pZCI6ImEyZmZiM2M2LTEwMmMtNGEyMi04NDdkLWUyNzZlMzQ0YzIxMiIsImV2ZW50X25hbWUiOiJnYW1fZ29vZ2xlX3F1ZXJ5X2lkIiwiZXZlbnRfdmFsIjoiQ09QbmhvR2VoSlVERlFKTHd3WWRmNTgwc2ciLCJldmVudF9lcG9jaCI6MTc4MTM1NDMzMSwiaXNfdmlzaWJsZSI6ZmFsc2V9LHsiZ3JvdXBfaWQiOiJtZWRpYWZpcmVfY29tLWVkZ2UtMS8yMDI2LTA2LTEzLzg5MTMwMTk4NzA2NTcwNjgiLCJhdHRlbXB0X251bWJlciI6MiwiYWRfc2xvdF9pbmRleCI6MCwicGFnZXZpZXdfaWQiOiI0MmUyZTRjMS05OGYxLTRhYmItOWJlMC0wMzY4NDJjYzlkZmQiLCJkb21haW5faWQiOjQ4NDQ3MCwiYWRfdW5pdCI6Im1lZGlhZmlyZV9jb20tZWRnZS0xIiwidF90aW1lIjoiMjAyNi0wNi0xMyAwNzozODo0OCIsInJlY29yZF90eXBlIjoiY3VzdG9tX2V2ZW50IiwiZXZlbnRfaWQiOiJiOWNmODRiYy05YmJmLTQ4NWQtODM0MC1lMmZmN2VhMGJkNTYiLCJldmVudF9uYW1lIjoic3RvcmVfZmlsbGVkX3NvdXJjZSIsImV2ZW50X3ZhbCI6ImdhbV9zbG90X3JlbmRlcmVkIiwiZXZlbnRfZXBvY2giOjE3ODEzNTQzMzEsImlzX3Zpc2libGUiOmZhbHNlfSx7Imdyb3VwX2lkIjoibWVkaWFmaXJlX2NvbS1lZGdlLTEvMjAyNi0wNi0xMy84OTEzMDE5ODcwNjU3MDY4IiwiYXR0ZW1wdF9udW1iZXIiOjIsImFkX3Nsb3RfaW5kZXgiOjAsInBhZ2V2aWV3X2lkIjoiNDJlMmU0YzEtOThmMS00YWJiLTliZTAtMDM2ODQyY2M5ZGZkIiwiZG9tYWluX2lkIjo0ODQ0NzAsImFkX3VuaXQiOiJtZWRpYWZpcmVfY29tLWVkZ2UtMSIsInRfdGltZSI6IjIwMjYtMDYtMTMgMDc6Mzg6NDgiLCJyZWNvcmRfdHlwZSI6ImN1c3RvbV9ldmVudCIsImV2ZW50X2lkIjoiOTgzZDE5MDUtMjMwNi00ZTdjLThkZWQtMTE1MTI3MWQ5NmUzIiwiZXZlbnRfbmFtZSI6InJldmVudWVfdXNkIiwiZXZlbnRfdmFsIjoiMC4wMDAzIiwiZXZlbnRfZXBvY2giOjE3ODEzNTQzMzEsImlzX3Zpc2libGUiOmZhbHNlfV0=
Requested by
Host:
URL: ez-standalone.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2406:da18:9d0:143f:2124:4e9c:36a9:d9de Singapore, Singapore, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
/
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

access-control-max-age
1728000
cache-control
private, max-age=0, must-revalidate, no-cache, no-store
access-control-allow-methods
HEAD, PUT, POST, GET, OPTIONS
expires
Fri, 12 Jun 2026 12:38:54 GMT
access-control-allow-origin
https://www.mediafire.com
content-length
43
date
Sat, 13 Jun 2026 12:38:54 GMT
x-middleton-display
imp_sol
content-type
image/gif
vary
Accept-Encoding
access-control-allow-headers
Content-Type
POST
H2
200
adop.gif
g.ezoic.net/porpoiseant/
43 B
73 B
150ms
143ms
Ping
image/gif
2406:da18:9d0:143f:2124:4e9c:36a9:d9de
Amazon.com
General
Full URL
https://g.ezoic.net/porpoiseant/adop.gif?orig=0&sts=W3siZ3JvdXBfaWQiOiJtZWRpYWZpcmVfY29tLWVkZ2UtMS8yMDI2LTA2LTEzLzg5MTMwMTk4NzA2NTcwNjgiLCJhdHRlbXB0X251bWJlciI6MiwiYWRfc2xvdF9pbmRleCI6MCwicGFnZXZpZXdfaWQiOiI0MmUyZTRjMS05OGYxLTRhYmItOWJlMC0wMzY4NDJjYzlkZmQiLCJkb21haW5faWQiOjQ4NDQ3MCwiYWRfdW5pdCI6Im1lZGlhZmlyZV9jb20tZWRnZS0xIiwidF90aW1lIjoiMjAyNi0wNi0xMyAwNzozODo0OCIsInJlY29yZF90eXBlIjoiY3VzdG9tX2V2ZW50IiwiZXZlbnRfaWQiOiJlYmQxYmQ3Zi0xZGMxLTQ2ZjYtYTY2ZC0xZDA1OGVmZTVjYTAiLCJldmVudF9uYW1lIjoiZXN0X3JldmVudWVfdXNkIiwiZXZlbnRfdmFsIjoiMC4wMDAzIiwiZXZlbnRfZXBvY2giOjE3ODEzNTQzMzEsImlzX3Zpc2libGUiOmZhbHNlfSx7Imdyb3VwX2lkIjoibWVkaWFmaXJlX2NvbS1lZGdlLTEvMjAyNi0wNi0xMy84OTEzMDE5ODcwNjU3MDY4IiwiYXR0ZW1wdF9udW1iZXIiOjIsImFkX3Nsb3RfaW5kZXgiOjAsInBhZ2V2aWV3X2lkIjoiNDJlMmU0YzEtOThmMS00YWJiLTliZTAtMDM2ODQyY2M5ZGZkIiwiZG9tYWluX2lkIjo0ODQ0NzAsImFkX3VuaXQiOiJtZWRpYWZpcmVfY29tLWVkZ2UtMSIsInRfdGltZSI6IjIwMjYtMDYtMTMgMDc6Mzg6NDgiLCJyZWNvcmRfdHlwZSI6ImN1c3RvbV9ldmVudCIsImV2ZW50X2lkIjoiYTM2Yzc4ZDItNmFlNS00MTIwLWE3YjItMjViYjc5YmMyODQ2IiwiZXZlbnRfbmFtZSI6ImFkX3NvdXJjZSIsImV2ZW50X3ZhbCI6ImdhbSIsImV2ZW50X2Vwb2NoIjoxNzgxMzU0MzMxLCJpc192aXNpYmxlIjpmYWxzZX0seyJncm91cF9pZCI6Im1lZGlhZmlyZV9jb20tbWVkcmVjdGFuZ2xlLTQvMjAyNi0wNi0xMy82ODc5ODE5MTI0NjUzODk0IiwiYXR0ZW1wdF9udW1iZXIiOjIsImFkX3Nsb3RfaW5kZXgiOjAsInBhZ2V2aWV3X2lkIjoiNDJlMmU0YzEtOThmMS00YWJiLTliZTAtMDM2ODQyY2M5ZGZkIiwiZG9tYWluX2lkIjo0ODQ0NzAsImFkX3VuaXQiOiJtZWRpYWZpcmVfY29tLW1lZHJlY3RhbmdsZS00IiwidF90aW1lIjoiMjAyNi0wNi0xMyAwNzozODo0OCIsInJlY29yZF90eXBlIjoiY3VzdG9tX2V2ZW50IiwiZXZlbnRfaWQiOiI5OWRmMTliMi0yMTYyLTQyYjgtYjIzZC0yYzJmNWYyMjdmYTYiLCJldmVudF9uYW1lIjoibm9fZmlsbF9yZWFzb24iLCJldmVudF92YWwiOiJyZXRyeV9lbXB0eSIsImV2ZW50X2Vwb2NoIjoxNzgxMzU0MzMxLCJpc192aXNpYmxlIjpmYWxzZX0seyJncm91cF9pZCI6Im1lZGlhZmlyZV9jb20tYmFubmVyLTEvMjAyNi0wNi0xMy8zODY4Mzg0ODY2NTI1ODEiLCJhdHRlbXB0X251bWJlciI6MiwiYWRfc2xvdF9pbmRleCI6MCwicGFnZXZpZXdfaWQiOiI0MmUyZTRjMS05OGYxLTRhYmItOWJlMC0wMzY4NDJjYzlkZmQiLCJkb21haW5faWQiOjQ4NDQ3MCwiYWRfdW5pdCI6Im1lZGlhZmlyZV9jb20tYmFubmVyLTEiLCJ0X3RpbWUiOiIyMDI2LTA2LTEzIDA3OjM4OjQ4IiwicmVjb3JkX3R5cGUiOiJjdXN0b21fZXZlbnQiLCJldmVudF9pZCI6IjI5YTc3MTczLWZlZjYtNDY5MC1iYzg3LWEwODFmMDFjMWQ4NSIsImV2ZW50X25hbWUiOiJub19maWxsX3JlYXNvbiIsImV2ZW50X3ZhbCI6InJldHJ5X2VtcHR5IiwiZXZlbnRfZXBvY2giOjE3ODEzNTQzMzEsImlzX3Zpc2libGUiOmZhbHNlfSx7Imdyb3VwX2lkIjoibWVkaWFmaXJlX2NvbS1ib3gtMi8yMDI2LTA2LTEzLzIyNzQxNzY2MjA1NTgiLCJhZF9zbG90X2luZGV4IjowLCJwYWdldmlld19pZCI6IjQyZTJlNGMxLTk4ZjEtNGFiYi05YmUwLTAzNjg0MmNjOWRmZCIsImRvbWFpbl9pZCI6NDg0NDcwLCJhZF91bml0IjoibWVkaWFmaXJlX2NvbS1ib3gtMiIsImFkX3Bvc2l0aW9uIjoxMTAzLCJhZF90eXBlIjoiZGlzcGxheSIsImFkX3NvdXJjZSI6ImdhbSIsInJlcXVlc3RlZF9zaXplcyI6IjcyOHg5MCIsImJpZF9mbG9vciI6MCwiaWQiOiIzODgzNGY0Ni0wMDQ4LTQ3OGUtYWI5MC0yNmMxMjY4YjVjOTciLCJoYW5kbGVfaWQiOiIzODgzNGY0Ni0wMDQ4LTQ3OGUtYWI5MC0yNmMxMjY4YjVjOTciLCJrZXkiOiJtZWRpYWZpcmVfY29tLWJveC0yLzIwMjYtMDYtMTMvMjI3NDE3NjYyMDU1OHwwfDMiLCJhdHRlbXB0X251bWJlciI6MywidF90aW1lIjoiMjAyNi0wNi0xMyAwNzozODo0OCIsImZldGNoX2Vwb2NoIjoxNzgxMzU0MzMxLCJ2ZXJzaW9uIjoyLCJzdGF0dXMiOiJmZXRjaGVkIiwibGFzdF9ldmVudCI6ImZldGNoZWQiLCJsYXN0X3VwZGF0ZWRfbXMiOjE3ODEzNTQzMzE2MTEsInJlY29yZF90eXBlIjoib3Bwb3J0dW5pdHkifSx7Imdyb3VwX2lkIjoibWVkaWFmaXJlX2NvbS1tZWRyZWN0YW5nbGUtMy8yMDI2LTA2LTEzLzQ3ODQ2OTc4OTA2NTMwNDMiLCJhZF9zbG90X2luZGV4IjowLCJwYWdldmlld19pZCI6IjQyZTJlNGMxLTk4ZjEtNGFiYi05YmUwLTAzNjg0MmNjOWRmZCIsImRvbWFpbl9pZCI6NDg0NDcwLCJhZF91bml0IjoibWVkaWFmaXJlX2NvbS1tZWRyZWN0YW5nbGUtMyIsImFkX3Bvc2l0aW9uIjoxMTA0LCJhZF90eXBlIjoiZGlzcGxheSIsImFkX3NvdXJjZSI6ImdhbSIsInJlcXVlc3RlZF9zaXplcyI6IjMzNngyODAiLCJiaWRfZmxvb3IiOjAuMiwiaWQiOiJmOGU3ODNiNC03MTE1LTRkMzMtOWUxNS1jYmNhMzVhMjQ5MjMiLCJoYW5kbGVfaWQiOiJmOGU3ODNiNC03MTE1LTRkMzMtOWUxNS1jYmNhMzVhMjQ5MjMiLCJrZXkiOiJtZWRpYWZpcmVfY29tLW1lZHJlY3RhbmdsZS0zLzIwMjYtMDYtMTMvNDc4NDY5Nzg5MDY1MzA0M3wwfDMiLCJhdHRlbXB0X251bWJlciI6MywidF90aW1lIjoiMjAyNi0wNi0xMyAwNzozODo0OCIsImZldGNoX2Vwb2NoIjoxNzgxMzU0MzMxLCJ2ZXJzaW9uIjoyLCJzdGF0dXMiOiJmZXRjaGVkIiwibGFzdF9ldmVudCI6ImZldGNoZWQiLCJsYXN0X3VwZGF0ZWRfbXMiOjE3ODEzNTQzMzE2MTQsInJlY29yZF90eXBlIjoib3Bwb3J0dW5pdHkifSx7Imdyb3VwX2lkIjoibWVkaWFmaXJlX2NvbS1tZWRyZWN0YW5nbGUtMi8yMDI2LTA2LTEzLzgwNzQ2NzUyOTY2Mjk4MDUiLCJhZF9zbG90X2luZGV4IjoxLCJwYWdldmlld19pZCI6IjQyZTJlNGMxLTk4ZjEtNGFiYi05YmUwLTAzNjg0MmNjOWRmZCIsImRvbWFpbl9pZCI6NDg0NDcwLCJhZF91bml0IjoibWVkaWFmaXJlX2NvbS1tZWRyZWN0YW5nbGUtMiIsImFkX3Bvc2l0aW9uIjoxMTAwLCJhZF90eXBlIjoiZmxvYXRpbmciLCJhZF9zb3VyY2UiOiJnYW0iLCJyZXF1ZXN0ZWRfc2l6ZXMiOiI3Mjh4OTAiLCJiaWRfZmxvb3IiOjAsImlkIjoiZGMxZDg4OWQtY2VlZC00ZmJlLWFhZjAtZTc5NDVhM2JkYmU5IiwiaGFuZGxlX2lkIjoiZGMxZDg4OWQtY2VlZC00ZmJlLWFhZjAtZTc5NDVhM2JkYmU5Iiwia2V5IjoibWVkaWFmaXJlX2NvbS1tZWRyZWN0YW5nbGUtMi8yMDI2LTA2LTEzLzgwNzQ2NzUyOTY2Mjk4MDV8MXwzIiwiYXR0ZW1wdF9udW1iZXIiOjMsInRfdGltZSI6IjIwMjYtMDYtMTMgMDc6Mzg6NDgiLCJmZXRjaF9lcG9jaCI6MTc4MTM1NDMzMSwidmVyc2lvbiI6Miwic3RhdHVzIjoiZmV0Y2hlZCIsImxhc3RfZXZlbnQiOiJmZXRjaGVkIiwibGFzdF91cGRhdGVkX21zIjoxNzgxMzU0MzMxNjE3LCJyZWNvcmRfdHlwZSI6Im9wcG9ydHVuaXR5In0seyJncm91cF9pZCI6Im1lZGlhZmlyZV9jb20tbWVkcmVjdGFuZ2xlLTQvMjAyNi0wNi0xMy82ODc5ODE5MTI0NjUzODk0IiwiYWRfc2xvdF9pbmRleCI6MCwicGFnZXZpZXdfaWQiOiI0MmUyZTRjMS05OGYxLTRhYmItOWJlMC0wMzY4NDJjYzlkZmQiLCJkb21haW5faWQiOjQ4NDQ3MCwiYWRfdW5pdCI6Im1lZGlhZmlyZV9jb20tbWVkcmVjdGFuZ2xlLTQiLCJhZF9wb3NpdGlvbiI6MTEwNSwiYWRfdHlwZSI6ImRpc3BsYXkiLCJhZF9zb3VyY2UiOiJnYW0iLCJyZXF1ZXN0ZWRfc2l6ZXMiOiIzMDB4MjUwLDMzNngyODAiLCJiaWRfZmxvb3IiOjAsImlkIjoiNWUwOTZhMmYtMTc4NS00ZDA5LThjMzUtODg4OWYxZjk1ZjdmIiwiaGFuZGxlX2lkIjoiNWUwOTZhMmYtMTc4NS00ZDA5LThjMzUtODg4OWYxZjk1ZjdmIiwia2V5IjoibWVkaWFmaXJlX2NvbS1tZWRyZWN0YW5nbGUtNC8yMDI2LTA2LTEzLzY4Nzk4MTkxMjQ2NTM4OTR8MHwzIiwiYXR0ZW1wdF9udW1iZXIiOjMsInRfdGltZSI6IjIwMjYtMDYtMTMgMDc6Mzg6NDgiLCJmZXRjaF9lcG9jaCI6MTc4MTM1NDMzMSwidmVyc2lvbiI6Miwic3RhdHVzIjoiZmV0Y2hlZCIsImxhc3RfZXZlbnQiOiJmZXRjaGVkIiwibGFzdF91cGRhdGVkX21zIjoxNzgxMzU0MzMxNjMzLCJyZWNvcmRfdHlwZSI6Im9wcG9ydHVuaXR5In0seyJncm91cF9pZCI6Im1lZGlhZmlyZV9jb20tYmFubmVyLTEvMjAyNi0wNi0xMy8zODY4Mzg0ODY2NTI1ODEiLCJhZF9zbG90X2luZGV4IjowLCJwYWdldmlld19pZCI6IjQyZTJlNGMxLTk4ZjEtNGFiYi05YmUwLTAzNjg0MmNjOWRmZCIsImRvbWFpbl9pZCI6NDg0NDcwLCJhZF91bml0IjoibWVkaWFmaXJlX2NvbS1iYW5uZXItMSIsImFkX3Bvc2l0aW9uIjoxMTA3LCJhZF90eXBlIjoiZGlzcGxheSIsImFkX3NvdXJjZSI6ImdhbSIsInJlcXVlc3RlZF9zaXplcyI6IjcyOHg5MCIsImJpZF9mbG9vciI6MCwiaWQiOiI4ZGE0NDIxMy1kN2ZkLTQzOWUtYWIyZi0yMWNlMTRmNjk0ZGEiLCJoYW5kbGVfaWQiOiI4ZGE0NDIxMy1kN2ZkLTQzOWUtYWIyZi0yMWNlMTRmNjk0ZGEiLCJrZXkiOiJtZWRpYWZpcmVfY29tLWJhbm5lci0xLzIwMjYtMDYtMTMvMzg2ODM4NDg2NjUyNTgxfDB8MyIsImF0dGVtcHRfbnVtYmVyIjozLCJ0X3RpbWUiOiIyMDI2LTA2LTEzIDA3OjM4OjQ4IiwiZmV0Y2hfZXBvY2giOjE3ODEzNTQzMzEsInZlcnNpb24iOjIsInN0YXR1cyI6ImZldGNoZWQiLCJsYXN0X2V2ZW50IjoiZmV0Y2hlZCIsImxhc3RfdXBkYXRlZF9tcyI6MTc4MTM1NDMzMTYzNywicmVjb3JkX3R5cGUiOiJvcHBvcnR1bml0eSJ9LHsiZ3JvdXBfaWQiOiJtZWRpYWZpcmVfY29tLW1lZHJlY3RhbmdsZS0zLzIwMjYtMDYtMTMvNDc4NDY5Nzg5MDY1MzA0MyIsImF0dGVtcHRfbnVtYmVyIjozLCJhZF9zbG90X2luZGV4IjowLCJwYWdldmlld19pZCI6IjQyZTJlNGMxLTk4ZjEtNGFiYi05YmUwLTAzNjg0MmNjOWRmZCIsImRvbWFpbl9pZCI6NDg0NDcwLCJhZF91bml0IjoibWVkaWFmaXJlX2NvbS1tZWRyZWN0YW5nbGUtMyIsInRfdGltZSI6IjIwMjYtMDYtMTMgMDc6Mzg6NDgiLCJyZWNvcmRfdHlwZSI6ImN1c3RvbV9ldmVudCIsImV2ZW50X2lkIjoiYzAwMDIwOGQtMTk0Ny00ODQ3LWFjOTctOGZmYjcxNmY0YjZhIiwiZXZlbnRfbmFtZSI6InZpZXdlZCIsImV2ZW50X3ZhbCI6InRydWUiLCJldmVudF9lcG9jaCI6MTc4MTM1NDMzMSwiaXNfdmlzaWJsZSI6ZmFsc2V9XQ==
Requested by
Host:
URL: ez-standalone.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2406:da18:9d0:143f:2124:4e9c:36a9:d9de Singapore, Singapore, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
/
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

access-control-max-age
1728000
cache-control
private, max-age=0, must-revalidate, no-cache, no-store
access-control-allow-methods
HEAD, PUT, POST, GET, OPTIONS
expires
Fri, 12 Jun 2026 12:38:54 GMT
access-control-allow-origin
https://www.mediafire.com
content-length
43
date
Sat, 13 Jun 2026 12:38:54 GMT
x-middleton-display
imp_sol
content-type
image/gif
vary
Accept-Encoding
access-control-allow-headers
Content-Type
POST
H2
200
adop.gif
g.ezoic.net/porpoiseant/
43 B
119 B
150ms
144ms
Ping
image/gif
2406:da18:9d0:143f:2124:4e9c:36a9:d9de
Amazon.com
General
Full URL
https://g.ezoic.net/porpoiseant/adop.gif?orig=0&sts=W3siZ3JvdXBfaWQiOiJtZWRpYWZpcmVfY29tLWJveC0yLzIwMjYtMDYtMTMvMjI3NDE3NjYyMDU1OCIsImF0dGVtcHRfbnVtYmVyIjozLCJhZF9zbG90X2luZGV4IjowLCJwYWdldmlld19pZCI6IjQyZTJlNGMxLTk4ZjEtNGFiYi05YmUwLTAzNjg0MmNjOWRmZCIsImRvbWFpbl9pZCI6NDg0NDcwLCJhZF91bml0IjoibWVkaWFmaXJlX2NvbS1ib3gtMiIsInRfdGltZSI6IjIwMjYtMDYtMTMgMDc6Mzg6NDgiLCJyZWNvcmRfdHlwZSI6ImN1c3RvbV9ldmVudCIsImV2ZW50X2lkIjoiMWNmMWM5MzQtZTc0OS00NjU3LTljODMtYzJjZjEwYmUxYzFkIiwiZXZlbnRfbmFtZSI6Im5vX2ZpbGxfcmVhc29uIiwiZXZlbnRfdmFsIjoiZW1wdHkiLCJldmVudF9lcG9jaCI6MTc4MTM1NDMzMiwiaXNfdmlzaWJsZSI6ZmFsc2V9LHsiZ3JvdXBfaWQiOiJtZWRpYWZpcmVfY29tLWJhbm5lci0xLzIwMjYtMDYtMTMvMzg2ODM4NDg2NjUyNTgxIiwiYXR0ZW1wdF9udW1iZXIiOjMsImFkX3Nsb3RfaW5kZXgiOjAsInBhZ2V2aWV3X2lkIjoiNDJlMmU0YzEtOThmMS00YWJiLTliZTAtMDM2ODQyY2M5ZGZkIiwiZG9tYWluX2lkIjo0ODQ0NzAsImFkX3VuaXQiOiJtZWRpYWZpcmVfY29tLWJhbm5lci0xIiwidF90aW1lIjoiMjAyNi0wNi0xMyAwNzozODo0OCIsInJlY29yZF90eXBlIjoiY3VzdG9tX2V2ZW50IiwiZXZlbnRfaWQiOiJhM2ZlMGJjMy0yMGQ0LTQxNzMtOTQ1ZC05MTc3NDllNGUxM2YiLCJldmVudF9uYW1lIjoibm9fZmlsbF9yZWFzb24iLCJldmVudF92YWwiOiJlbXB0eSIsImV2ZW50X2Vwb2NoIjoxNzgxMzU0MzMyLCJpc192aXNpYmxlIjpmYWxzZX0seyJncm91cF9pZCI6Im1lZGlhZmlyZV9jb20tbWVkcmVjdGFuZ2xlLTIvMjAyNi0wNi0xMy84MDc0Njc1Mjk2NjI5ODA1IiwiYXR0ZW1wdF9udW1iZXIiOjMsImFkX3Nsb3RfaW5kZXgiOjEsInBhZ2V2aWV3X2lkIjoiNDJlMmU0YzEtOThmMS00YWJiLTliZTAtMDM2ODQyY2M5ZGZkIiwiZG9tYWluX2lkIjo0ODQ0NzAsImFkX3VuaXQiOiJtZWRpYWZpcmVfY29tLW1lZHJlY3RhbmdsZS0yIiwidF90aW1lIjoiMjAyNi0wNi0xMyAwNzozODo0OCIsInJlY29yZF90eXBlIjoiY3VzdG9tX2V2ZW50IiwiZXZlbnRfaWQiOiIyOTA5OGQyMy03M2UyLTQ1YTctYTJlMi03MTlkOTI4MTI4MjQiLCJldmVudF9uYW1lIjoibm9fZmlsbF9yZWFzb24iLCJldmVudF92YWwiOiJyZXRyeV9lbXB0eSIsImV2ZW50X2Vwb2NoIjoxNzgxMzU0MzMyLCJpc192aXNpYmxlIjpmYWxzZX0seyJncm91cF9pZCI6Im1lZGlhZmlyZV9jb20tZWRnZS0yLzIwMjYtMDYtMTMvODg1NDEyMTAwODYyODcyNiIsImF0dGVtcHRfbnVtYmVyIjozLCJhZF9zbG90X2luZGV4IjowLCJwYWdldmlld19pZCI6IjQyZTJlNGMxLTk4ZjEtNGFiYi05YmUwLTAzNjg0MmNjOWRmZCIsImRvbWFpbl9pZCI6NDg0NDcwLCJhZF91bml0IjoibWVkaWFmaXJlX2NvbS1lZGdlLTIiLCJ0X3RpbWUiOiIyMDI2LTA2LTEzIDA3OjM4OjQ4IiwicmVjb3JkX3R5cGUiOiJjdXN0b21fZXZlbnQiLCJldmVudF9pZCI6IjhlODBkZTU2LTEwM2ItNGU5Zi1hNzMwLTQ1MDgwMDIyZDAxZCIsImV2ZW50X25hbWUiOiJub19maWxsX3JlYXNvbiIsImV2ZW50X3ZhbCI6InJldHJ5X2VtcHR5IiwiZXZlbnRfZXBvY2giOjE3ODEzNTQzMzIsImlzX3Zpc2libGUiOmZhbHNlfSx7Imdyb3VwX2lkIjoibWVkaWFmaXJlX2NvbS1tZWRyZWN0YW5nbGUtMi8yMDI2LTA2LTEzLzgwNzQ2NzUyOTY2Mjk4MDUiLCJhdHRlbXB0X251bWJlciI6MywiYWRfc2xvdF9pbmRleCI6MCwicGFnZXZpZXdfaWQiOiI0MmUyZTRjMS05OGYxLTRhYmItOWJlMC0wMzY4NDJjYzlkZmQiLCJkb21haW5faWQiOjQ4NDQ3MCwiYWRfdW5pdCI6Im1lZGlhZmlyZV9jb20tbWVkcmVjdGFuZ2xlLTIiLCJ0X3RpbWUiOiIyMDI2LTA2LTEzIDA3OjM4OjQ4IiwicmVjb3JkX3R5cGUiOiJjdXN0b21fZXZlbnQiLCJldmVudF9pZCI6Ijc3MWE2NzMyLTFmY2ItNGI3OC04NzlhLTIxZTczMTAzNTQyZCIsImV2ZW50X25hbWUiOiJub19maWxsX3JlYXNvbiIsImV2ZW50X3ZhbCI6InJldHJ5X2VtcHR5IiwiZXZlbnRfZXBvY2giOjE3ODEzNTQzMzIsImlzX3Zpc2libGUiOmZhbHNlfSx7Imdyb3VwX2lkIjoibWVkaWFmaXJlX2NvbS1tZWRyZWN0YW5nbGUtMy8yMDI2LTA2LTEzLzQ3ODQ2OTc4OTA2NTMwNDMiLCJhdHRlbXB0X251bWJlciI6MywiYWRfc2xvdF9pbmRleCI6MCwicGFnZXZpZXdfaWQiOiI0MmUyZTRjMS05OGYxLTRhYmItOWJlMC0wMzY4NDJjYzlkZmQiLCJkb21haW5faWQiOjQ4NDQ3MCwiYWRfdW5pdCI6Im1lZGlhZmlyZV9jb20tbWVkcmVjdGFuZ2xlLTMiLCJ0X3RpbWUiOiIyMDI2LTA2LTEzIDA3OjM4OjQ4IiwicmVjb3JkX3R5cGUiOiJjdXN0b21fZXZlbnQiLCJldmVudF9pZCI6IjhjODA2ZjUxLTU0NjItNGJhMi04NjNiLTQyYjM0ODY4ZTcyYyIsImV2ZW50X25hbWUiOiJub19maWxsX3JlYXNvbiIsImV2ZW50X3ZhbCI6InJldHJ5X2VtcHR5IiwiZXZlbnRfZXBvY2giOjE3ODEzNTQzMzIsImlzX3Zpc2libGUiOmZhbHNlfSx7Imdyb3VwX2lkIjoibWVkaWFmaXJlX2NvbS1tZWRyZWN0YW5nbGUtNC8yMDI2LTA2LTEzLzY4Nzk4MTkxMjQ2NTM4OTQiLCJhdHRlbXB0X251bWJlciI6MywiYWRfc2xvdF9pbmRleCI6MCwicGFnZXZpZXdfaWQiOiI0MmUyZTRjMS05OGYxLTRhYmItOWJlMC0wMzY4NDJjYzlkZmQiLCJkb21haW5faWQiOjQ4NDQ3MCwiYWRfdW5pdCI6Im1lZGlhZmlyZV9jb20tbWVkcmVjdGFuZ2xlLTQiLCJ0X3RpbWUiOiIyMDI2LTA2LTEzIDA3OjM4OjQ4IiwicmVjb3JkX3R5cGUiOiJjdXN0b21fZXZlbnQiLCJldmVudF9pZCI6IjgzNDhkYjY1LTM4MTYtNDEzNS04NGQyLTg4OWEzY2JjNDUxZCIsImV2ZW50X25hbWUiOiJub19maWxsX3JlYXNvbiIsImV2ZW50X3ZhbCI6ImVtcHR5IiwiZXZlbnRfZXBvY2giOjE3ODEzNTQzMzIsImlzX3Zpc2libGUiOmZhbHNlfSx7Imdyb3VwX2lkIjoibWVkaWFmaXJlX2NvbS1tZWRyZWN0YW5nbGUtMi8yMDI2LTA2LTEzLzgwNzQ2NzUyOTY2Mjk4MDUiLCJhZF9zbG90X2luZGV4IjoxLCJwYWdldmlld19pZCI6IjQyZTJlNGMxLTk4ZjEtNGFiYi05YmUwLTAzNjg0MmNjOWRmZCIsImRvbWFpbl9pZCI6NDg0NDcwLCJhZF91bml0IjoibWVkaWFmaXJlX2NvbS1tZWRyZWN0YW5nbGUtMiIsImFkX3Bvc2l0aW9uIjoxMTAwLCJhZF90eXBlIjoiZmxvYXRpbmciLCJhZF9zb3VyY2UiOiJnYW0iLCJyZXF1ZXN0ZWRfc2l6ZXMiOiI3Mjh4OTAiLCJiaWRfZmxvb3IiOjAsImlkIjoiNjliMjljYjktNjhkZC00NTE5LWE0ZWItMzA0OTM1MjVlMDg2IiwiaGFuZGxlX2lkIjoiNjliMjljYjktNjhkZC00NTE5LWE0ZWItMzA0OTM1MjVlMDg2Iiwia2V5IjoibWVkaWFmaXJlX2NvbS1tZWRyZWN0YW5nbGUtMi8yMDI2LTA2LTEzLzgwNzQ2NzUyOTY2Mjk4MDV8MXw0IiwiYXR0ZW1wdF9udW1iZXIiOjQsInRfdGltZSI6IjIwMjYtMDYtMTMgMDc6Mzg6NDgiLCJmZXRjaF9lcG9jaCI6MTc4MTM1NDMzMiwidmVyc2lvbiI6Miwic3RhdHVzIjoiZmV0Y2hlZCIsImxhc3RfZXZlbnQiOiJmZXRjaGVkIiwibGFzdF91cGRhdGVkX21zIjoxNzgxMzU0MzMyNTE0LCJyZWNvcmRfdHlwZSI6Im9wcG9ydHVuaXR5In0seyJncm91cF9pZCI6Im1lZGlhZmlyZV9jb20tZWRnZS0yLzIwMjYtMDYtMTMvODg1NDEyMTAwODYyODcyNiIsImFkX3Nsb3RfaW5kZXgiOjAsInBhZ2V2aWV3X2lkIjoiNDJlMmU0YzEtOThmMS00YWJiLTliZTAtMDM2ODQyY2M5ZGZkIiwiZG9tYWluX2lkIjo0ODQ0NzAsImFkX3VuaXQiOiJtZWRpYWZpcmVfY29tLWVkZ2UtMiIsImFkX3Bvc2l0aW9uIjoxMTAyLCJhZF90eXBlIjoiZGlzcGxheSIsImFkX3NvdXJjZSI6ImdhbSIsInJlcXVlc3RlZF9zaXplcyI6IjE2MHg2MDAiLCJiaWRfZmxvb3IiOjAuMDQsImlkIjoiY2IyNWU5ZTgtNjUyNC00ODQyLTlhZTMtZjg3ZjVmYzUwM2FiIiwiaGFuZGxlX2lkIjoiY2IyNWU5ZTgtNjUyNC00ODQyLTlhZTMtZjg3ZjVmYzUwM2FiIiwia2V5IjoibWVkaWFmaXJlX2NvbS1lZGdlLTIvMjAyNi0wNi0xMy84ODU0MTIxMDA4NjI4NzI2fDB8NCIsImF0dGVtcHRfbnVtYmVyIjo0LCJ0X3RpbWUiOiIyMDI2LTA2LTEzIDA3OjM4OjQ4IiwiZmV0Y2hfZXBvY2giOjE3ODEzNTQzMzIsInZlcnNpb24iOjIsInN0YXR1cyI6ImZldGNoZWQiLCJsYXN0X2V2ZW50IjoiZmV0Y2hlZCIsImxhc3RfdXBkYXRlZF9tcyI6MTc4MTM1NDMzMjUyMSwicmVjb3JkX3R5cGUiOiJvcHBvcnR1bml0eSJ9LHsiZ3JvdXBfaWQiOiJtZWRpYWZpcmVfY29tLW1lZHJlY3RhbmdsZS0yLzIwMjYtMDYtMTMvODA3NDY3NTI5NjYyOTgwNSIsImFkX3Nsb3RfaW5kZXgiOjAsInBhZ2V2aWV3X2lkIjoiNDJlMmU0YzEtOThmMS00YWJiLTliZTAtMDM2ODQyY2M5ZGZkIiwiZG9tYWluX2lkIjo0ODQ0NzAsImFkX3VuaXQiOiJtZWRpYWZpcmVfY29tLW1lZHJlY3RhbmdsZS0yIiwiYWRfcG9zaXRpb24iOjExMDAsImFkX3R5cGUiOiJmbG9hdGluZyIsImFkX3NvdXJjZSI6ImdhbSIsInJlcXVlc3RlZF9zaXplcyI6IjcyOHg5MCIsImJpZF9mbG9vciI6MCwiaWQiOiI1ODM2NjkwMC1iMTIxLTRlYWMtOWY4NS02Y2JkOTQzNGYxNGQiLCJoYW5kbGVfaWQiOiI1ODM2NjkwMC1iMTIxLTRlYWMtOWY4NS02Y2JkOTQzNGYxNGQiLCJrZXkiOiJtZWRpYWZpcmVfY29tLW1lZHJlY3RhbmdsZS0yLzIwMjYtMDYtMTMvODA3NDY3NTI5NjYyOTgwNXwwfDQiLCJhdHRlbXB0X251bWJlciI6NCwidF90aW1lIjoiMjAyNi0wNi0xMyAwNzozODo0OCIsImZldGNoX2Vwb2NoIjoxNzgxMzU0MzMyLCJ2ZXJzaW9uIjoyLCJzdGF0dXMiOiJmZXRjaGVkIiwibGFzdF9ldmVudCI6ImZldGNoZWQiLCJsYXN0X3VwZGF0ZWRfbXMiOjE3ODEzNTQzMzI1MjYsInJlY29yZF90eXBlIjoib3Bwb3J0dW5pdHkifV0=
Requested by
Host:
URL: ez-standalone.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2406:da18:9d0:143f:2124:4e9c:36a9:d9de Singapore, Singapore, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
/
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

access-control-max-age
1728000
cache-control
private, max-age=0, must-revalidate, no-cache, no-store
access-control-allow-methods
HEAD, PUT, POST, GET, OPTIONS
expires
Fri, 12 Jun 2026 12:38:55 GMT
access-control-allow-origin
https://www.mediafire.com
content-length
43
date
Sat, 13 Jun 2026 12:38:55 GMT
x-middleton-display
imp_sol
content-type
image/gif
vary
Accept-Encoding
access-control-allow-headers
Content-Type
POST
H2
200
adop.gif
g.ezoic.net/porpoiseant/
43 B
73 B
154ms
149ms
Ping
image/gif
2406:da18:9d0:143f:2124:4e9c:36a9:d9de
Amazon.com
General
Full URL
https://g.ezoic.net/porpoiseant/adop.gif?orig=0&sts=W3siZ3JvdXBfaWQiOiJtZWRpYWZpcmVfY29tLWVkZ2UtMS8yMDI2LTA2LTEzLzg5MTMwMTk4NzA2NTcwNjgiLCJhdHRlbXB0X251bWJlciI6MiwiYWRfc2xvdF9pbmRleCI6MCwicGFnZXZpZXdfaWQiOiI0MmUyZTRjMS05OGYxLTRhYmItOWJlMC0wMzY4NDJjYzlkZmQiLCJkb21haW5faWQiOjQ4NDQ3MCwiYWRfdW5pdCI6Im1lZGlhZmlyZV9jb20tZWRnZS0xIiwidF90aW1lIjoiMjAyNi0wNi0xMyAwNzozODo0OCIsInJlY29yZF90eXBlIjoiY3VzdG9tX2V2ZW50IiwiZXZlbnRfaWQiOiJmODFmMGY5OC1lMjIwLTQ5NzgtYmU1Mi1hYzk3YjI4Yjk4NmEiLCJldmVudF9uYW1lIjoidmlld2VkIiwiZXZlbnRfdmFsIjoidHJ1ZSIsImV2ZW50X2Vwb2NoIjoxNzgxMzU0MzMyLCJpc192aXNpYmxlIjpmYWxzZX0seyJncm91cF9pZCI6Im1lZGlhZmlyZV9jb20tbWVkcmVjdGFuZ2xlLTIvMjAyNi0wNi0xMy84MDc0Njc1Mjk2NjI5ODA1IiwiYXR0ZW1wdF9udW1iZXIiOjQsImFkX3Nsb3RfaW5kZXgiOjEsInBhZ2V2aWV3X2lkIjoiNDJlMmU0YzEtOThmMS00YWJiLTliZTAtMDM2ODQyY2M5ZGZkIiwiZG9tYWluX2lkIjo0ODQ0NzAsImFkX3VuaXQiOiJtZWRpYWZpcmVfY29tLW1lZHJlY3RhbmdsZS0yIiwidF90aW1lIjoiMjAyNi0wNi0xMyAwNzozODo0OCIsInJlY29yZF90eXBlIjoiY3VzdG9tX2V2ZW50IiwiZXZlbnRfaWQiOiI5ZjBiMDhlMi1mYWExLTQ4MTMtODM4My03YjU3MjViZTNkNDUiLCJldmVudF9uYW1lIjoibm9fZmlsbF9yZWFzb24iLCJldmVudF92YWwiOiJlbXB0eSIsImV2ZW50X2Vwb2NoIjoxNzgxMzU0MzMzLCJpc192aXNpYmxlIjpmYWxzZX0seyJncm91cF9pZCI6Im1lZGlhZmlyZV9jb20tZWRnZS0yLzIwMjYtMDYtMTMvODg1NDEyMTAwODYyODcyNiIsImF0dGVtcHRfbnVtYmVyIjo0LCJhZF9zbG90X2luZGV4IjowLCJwYWdldmlld19pZCI6IjQyZTJlNGMxLTk4ZjEtNGFiYi05YmUwLTAzNjg0MmNjOWRmZCIsImRvbWFpbl9pZCI6NDg0NDcwLCJhZF91bml0IjoibWVkaWFmaXJlX2NvbS1lZGdlLTIiLCJ0X3RpbWUiOiIyMDI2LTA2LTEzIDA3OjM4OjQ4IiwicmVjb3JkX3R5cGUiOiJjdXN0b21fZXZlbnQiLCJldmVudF9pZCI6IjYyZGViNWIzLWY0YmMtNGRhNy1hMDdmLTBiNzY2YWIxODE4MCIsImV2ZW50X25hbWUiOiJub19maWxsX3JlYXNvbiIsImV2ZW50X3ZhbCI6InJldHJ5X2VtcHR5IiwiZXZlbnRfZXBvY2giOjE3ODEzNTQzMzMsImlzX3Zpc2libGUiOmZhbHNlfSx7Imdyb3VwX2lkIjoibWVkaWFmaXJlX2NvbS1tZWRyZWN0YW5nbGUtMi8yMDI2LTA2LTEzLzgwNzQ2NzUyOTY2Mjk4MDUiLCJhdHRlbXB0X251bWJlciI6NCwiYWRfc2xvdF9pbmRleCI6MCwicGFnZXZpZXdfaWQiOiI0MmUyZTRjMS05OGYxLTRhYmItOWJlMC0wMzY4NDJjYzlkZmQiLCJkb21haW5faWQiOjQ4NDQ3MCwiYWRfdW5pdCI6Im1lZGlhZmlyZV9jb20tbWVkcmVjdGFuZ2xlLTIiLCJ0X3RpbWUiOiIyMDI2LTA2LTEzIDA3OjM4OjQ4IiwicmVjb3JkX3R5cGUiOiJjdXN0b21fZXZlbnQiLCJldmVudF9pZCI6ImRiMDI5Y2Y3LTBmMjItNGM1Yi04YmM1LTk0NDQ5NDNmMDFiOSIsImV2ZW50X25hbWUiOiJub19maWxsX3JlYXNvbiIsImV2ZW50X3ZhbCI6ImVtcHR5IiwiZXZlbnRfZXBvY2giOjE3ODEzNTQzMzMsImlzX3Zpc2libGUiOmZhbHNlfSx7Imdyb3VwX2lkIjoibWVkaWFmaXJlX2NvbS1lZGdlLTIvMjAyNi0wNi0xMy84ODU0MTIxMDA4NjI4NzI2IiwiYWRfc2xvdF9pbmRleCI6MCwicGFnZXZpZXdfaWQiOiI0MmUyZTRjMS05OGYxLTRhYmItOWJlMC0wMzY4NDJjYzlkZmQiLCJkb21haW5faWQiOjQ4NDQ3MCwiYWRfdW5pdCI6Im1lZGlhZmlyZV9jb20tZWRnZS0yIiwiYWRfcG9zaXRpb24iOjExMDIsImFkX3R5cGUiOiJkaXNwbGF5IiwiYWRfc291cmNlIjoiZ2FtIiwicmVxdWVzdGVkX3NpemVzIjoiMTYweDYwMCIsImJpZF9mbG9vciI6MC4wMiwiaWQiOiJhNjAzMmRjNS1iYjEyLTQ0N2YtYjk4MS1iZWQ3MWJmYzU5ODciLCJoYW5kbGVfaWQiOiJhNjAzMmRjNS1iYjEyLTQ0N2YtYjk4MS1iZWQ3MWJmYzU5ODciLCJrZXkiOiJtZWRpYWZpcmVfY29tLWVkZ2UtMi8yMDI2LTA2LTEzLzg4NTQxMjEwMDg2Mjg3MjZ8MHw1IiwiYXR0ZW1wdF9udW1iZXIiOjUsInRfdGltZSI6IjIwMjYtMDYtMTMgMDc6Mzg6NDgiLCJmZXRjaF9lcG9jaCI6MTc4MTM1NDMzMywidmVyc2lvbiI6Miwic3RhdHVzIjoiZmV0Y2hlZCIsImxhc3RfZXZlbnQiOiJmZXRjaGVkIiwibGFzdF91cGRhdGVkX21zIjoxNzgxMzU0MzMzNTQ4LCJyZWNvcmRfdHlwZSI6Im9wcG9ydHVuaXR5In0seyJncm91cF9pZCI6Im1lZGlhZmlyZV9jb20tZWRnZS0yLzIwMjYtMDYtMTMvODg1NDEyMTAwODYyODcyNiIsImF0dGVtcHRfbnVtYmVyIjo1LCJhZF9zbG90X2luZGV4IjowLCJwYWdldmlld19pZCI6IjQyZTJlNGMxLTk4ZjEtNGFiYi05YmUwLTAzNjg0MmNjOWRmZCIsImRvbWFpbl9pZCI6NDg0NDcwLCJhZF91bml0IjoibWVkaWFmaXJlX2NvbS1lZGdlLTIiLCJ0X3RpbWUiOiIyMDI2LTA2LTEzIDA3OjM4OjQ4IiwicmVjb3JkX3R5cGUiOiJjdXN0b21fZXZlbnQiLCJldmVudF9pZCI6ImEyOWNkNWY2LTQ1NGUtNDQ1OC1iMTZhLTdmMzFlY2JlZDYwYSIsImV2ZW50X25hbWUiOiJub19maWxsX3JlYXNvbiIsImV2ZW50X3ZhbCI6InJldHJ5X2VtcHR5IiwiZXZlbnRfZXBvY2giOjE3ODEzNTQzMzQsImlzX3Zpc2libGUiOmZhbHNlfSx7Imdyb3VwX2lkIjoibWVkaWFmaXJlX2NvbS1lZGdlLTIvMjAyNi0wNi0xMy84ODU0MTIxMDA4NjI4NzI2IiwiYWRfc2xvdF9pbmRleCI6MCwicGFnZXZpZXdfaWQiOiI0MmUyZTRjMS05OGYxLTRhYmItOWJlMC0wMzY4NDJjYzlkZmQiLCJkb21haW5faWQiOjQ4NDQ3MCwiYWRfdW5pdCI6Im1lZGlhZmlyZV9jb20tZWRnZS0yIiwiYWRfcG9zaXRpb24iOjExMDIsImFkX3R5cGUiOiJkaXNwbGF5IiwiYWRfc291cmNlIjoiZ2FtIiwicmVxdWVzdGVkX3NpemVzIjoiMTYweDYwMCIsImJpZF9mbG9vciI6MCwiaWQiOiI1NmJlMTAxZS0zNTdiLTRkNzMtYjI1Ny0wY2UyMDk4YzVkZjMiLCJoYW5kbGVfaWQiOiI1NmJlMTAxZS0zNTdiLTRkNzMtYjI1Ny0wY2UyMDk4YzVkZjMiLCJrZXkiOiJtZWRpYWZpcmVfY29tLWVkZ2UtMi8yMDI2LTA2LTEzLzg4NTQxMjEwMDg2Mjg3MjZ8MHw2IiwiYXR0ZW1wdF9udW1iZXIiOjYsInRfdGltZSI6IjIwMjYtMDYtMTMgMDc6Mzg6NDgiLCJmZXRjaF9lcG9jaCI6MTc4MTM1NDMzNCwidmVyc2lvbiI6Miwic3RhdHVzIjoiZmV0Y2hlZCIsImxhc3RfZXZlbnQiOiJmZXRjaGVkIiwibGFzdF91cGRhdGVkX21zIjoxNzgxMzU0MzM0NTQ1LCJyZWNvcmRfdHlwZSI6Im9wcG9ydHVuaXR5In1d
Requested by
Host:
URL: ez-standalone.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2406:da18:9d0:143f:2124:4e9c:36a9:d9de Singapore, Singapore, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
/
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

access-control-max-age
1728000
cache-control
private, max-age=0, must-revalidate, no-cache, no-store
access-control-allow-methods
HEAD, PUT, POST, GET, OPTIONS
expires
Fri, 12 Jun 2026 12:38:55 GMT
access-control-allow-origin
https://www.mediafire.com
content-length
43
date
Sat, 13 Jun 2026 12:38:55 GMT
x-middleton-display
imp_sol
content-type
image/gif
vary
Accept-Encoding
access-control-allow-headers
Content-Type
GET
H3
200
ads Show response
securepubads.g.doubleclick.net/gampad/
522 B
255 B
274ms
272ms
Fetch
text/plain
142.251.23.157
Google LLC
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1001161376096050&correlator=427936974741868&eid=31098216%2C95393146&output=ldjh&gdfp_req=1&vrg=202606090101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-edge-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=160x600&ifi=28&didk=2994425013&dids=div-gpt-ad-mediafire_com-edge-&adfs=982453029&sfv=1-0-45&rcs=5&eri=1&sc=1&cookie=ID%3Da72da8f8dac4dbe8%3AT%3D1781354330%3ART%3D1781354330%3AS%3DALNI_MZCBh_ptzlSFjn4mKG_I6_ZJqzdog&gpic=UID%3D0000146865d5f26d%3AT%3D1781354330%3ART%3D1781354330%3AS%3DALNI_MY7xi4RFbTEF4Q5wPKl_IsjF120uA&abxe=1&dt=1781354335217&lmt=1781354335&adxs=1440&adys=300&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=4&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=540&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE0OS4wLjc4MjcuMTAyIixudWxsLDAsbnVsbCwiNjQiLFtbIkNocm9taXVtIiwiMTQ5LjAuMC4wIl0sWyJHb29nbGUgQ2hyb21lIiwiMTQ5LjAuMC4wIl0sWyJOb3QtQS5CcmFuZCIsIjI0LjAuMC4wIl1dLDBd&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F41kkjh07tibblti%2FAINCRAD%2BFF%2BINJECTOR.apk%2Ffile%3Fdkey%3Drv5x6b8wlt0%26r%3D125&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&a3p=EmwKDGlkNS1zeW5jLmNvbRJaSUQ1KmlQVFhWenNHeFltYS0xQU96Nmk4UVhmaTB2WHY0d0JIdEJuVWpzRHBiMVRfXzJvdFQxdGFBQUVCQ21vdFQxb0F1S2ZKaktlZDd4TEtNVkF1MXRtTHdBWAESNgoMYWRzZXJ2ZXIub3JnEiQwZjUxNzEyMC02ODNjLTRjZTktOTJhZC1jZDE5MjY2ZDZkZWRYARK7AQoKY3JpdGVvLmNvbRKqAVNaYU16bDlvZDFKcVNuSjRVVzlNY25oRGRGbHJkM05TYUVKcVNVRnVObVZ6TlRGcmVVdDFXRGt5TkhRbE1rSnNhVGgxTkhWc05HbG1keVV5Um5GdFpVZE1WblZUYVdVMVNtNDBXR1ZhSlRKQ1RuaERlWEJYTlcxMU16RkpkbWR2YmtGeVJIQnliVlowSlRKQ1QxRnNKVEpHVFdwWVNYZ2xNa1pEWXlVelJBWAESNAoKcHViY2lkLm9yZxIkM2JmYmY3YmQtYjc2NC00NmZiLTliMjQtZGQyNzk5YmUyZDkxWAESWgoNY3J3ZGNudHJsLm5ldBJAZmI3ZWM1NWQyOWRmYzI1ZGFkMzVkYzRkZTQ2NzE4NWNhMDJjNTIwZGZjZWU5NzhlMmVjMzIyMmU3NmQ2M2ZmMBj58_eH7DNIABIdCg5lc3AuY3JpdGVvLmNvbRiw8PeH7DNIAFICCGQSGAoJeWFob28uY29tGNvx94fsM0gAUgIIbxI-CgVvcGVueBIsZXlKcElqb2lZa05NZFRkTFZ6SlNVSFU0UVU1WE5IWnpka3hPWnowOUluMD0Y0Pj3h-wzSAASrgIKCHJ0YmhvdXNlEpgCb2o0TWU4T0xkckdQbksyTUUyUmY3ODl0aU04V2RvNUt5ZzBwSzM2NU9iZmRUdFExcUdubTZCckF3V0tGaFdhRWJEQ3F0SXpSMlkzRVlkRGM5dmF5U1JsU24wcGE3cFR0cm14WHBHclpJZWhIQkd3V1cwMXVtZTZvZElZS0J5OE5FUitoWjdkaSsvaVdQSzBjYXB4eFVVZzRTMGlVUTJKQXVNbTdSWjV5aDBaN1k4aWtvUTV1RG1CY2ZsTDFUZ1c0RjJ6ZXo2QzI1eEIxWnFFR0pHeGI0UVd2OWJwd3Y3MnhDU291djNWUllyN0IwQUJuMmtqZ1lRckVjRHFOREtJQlduRGx2QStaZDdJRGkrenNOUzB0dWc9PRjn-PeH7DNIAA..&dlt=1781354328063&idt=1996&ppid=5594807e3b73660db22cc026894621f4&uule=a%20cm9sZToxIHByb2R1Y2VyOjEyIGxvYzoiMTQwLTAwMDEsSlAi&prev_scp=a%3D1%26iid1%3D8854121008628726%26eid%3D8854121008628726%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D1%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252F41kkjh07tibblti%252FAINCRAD%252BFF%252BINJECTOR.apk%252Ffile%253Fdkey%253Drv5x6b8wlt0%2526r%253D125%26path%3D%252Ffile%252F41kkjh07tibblti%252FAINCRAD%252BFF%252BINJECTOR.apk%252Ffile%26ap%3D1102%26sap%3D1102%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D6%26at%3Dmbf%26adr%3D399%26ezosn%3D3%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D39%26al%3D1039%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-edge-2%26tap%3Dmediafire_com-edge-2-8854121008628726%26eb_br%3Dzero%26eba%3D0%26bv%3D54%26bvm%3D0%26bvr%3D15%26avc%3D25%26evc%3D27%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D0%26br2%3D8%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D157%2C131%2C0%2C0%2C0%2C168%2C184%2C20%2C0%2C0%2C192%2C31%2C902%2C903%2C901%2C902%2C903%26deal1%3D3856%2C8229%26osb%3DLinux%252FChrome%26dbg%3Drc%253A4%26reqt%3D1781354334544&adks=697308627&frm=20&eo_id_str=ID%3Dc9df7b54bcd371a2%3AT%3D1781354330%3ART%3D1781354330%3AS%3DAA-Afja4gVi1oGpU66Pr7KR0wygQ&pbbce=1
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.23.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
rl-in-f157.1e100.net
Software
cafe /
Resource Hash
55ee467b89e74dc52629e2a5c16b860f715dfe2ba5f305fdd7ad62b6a7d62807
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
dcb
google-lineitem-id
-2
observe-browsing-topics
?1
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sat, 13 Jun 2026 12:38:55 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-2
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
224
x-xss-protection
0
server
cafe
POST
H2
200
ad_impression Show response
pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/
60 B
337 B
132ms
129ms
Fetch
application/json
44.227.112.76
Amazon.com
General
Full URL
https://pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ad_impression
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
44.227.112.76 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-44-227-112-76.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
ee63979b621d070be7f6aee315971acb7959ff766758fda88f01c822fd24a7b0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
Content-Type
application/json
sec-ch-ua-mobile
?0

Response headers

access-control-allow-origin
https://www.mediafire.com
content-length
60
date
Sat, 13 Jun 2026 12:38:55 GMT
content-type
application/json; charset=utf-8
vary
Origin
access-control-allow-credentials
true
GET
H3
200
audins.js Show response
go.ezodn.com/detroitchicago/
516 B
777 B
21ms
20ms
Script
application/javascript
172.67.142.121
Cloudflare
General
Full URL
https://go.ezodn.com/detroitchicago/audins.js?cb=3
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.142.121 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
bcf7993523efcd42f5599e1c210b6433e35a39de688c9e5ae90829741937df71

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-robots-tag
noindex, follow
content-encoding
br
cf-cache-status
HIT
age
2770150
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=CAY4%2FQH9Aq5ROJFp1RlWCVcxBsKBVUC2a9lNO6bcaTCVY7%2F9x5m5pEwRXwLfkAGXaaL2a%2FMe8wfRXmkOzrhU%2Fm3VzKiWA8qmDBN8SSC23ZUWJPUJdonMTu91JmE%2FkF8%3D"}]}
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sat, 13 Jun 2026 12:38:55 GMT
x-middleton-display
sol-js
last-modified
Sat, 16 May 2026 03:00:30 GMT
content-type
application/javascript
vary
Accept-Encoding
priority
u=3,i=?0
cache-control
public, max-age=31536000
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray
a0b127b6ded27076-NRT
accept-ranges
bytes
content-length
275
server
cloudflare
GET
H2
200
quant.js Show response
secure.quantserve.com/
34 KB
13 KB
228ms
68ms
Script
application/javascript
2620:116:800e:21:6c50:dbee:bef5:203d
Amazon.com
General
Full URL
https://secure.quantserve.com/quant.js
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/audins.js?cb=3
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:116:800e:21:6c50:dbee:bef5:203d , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
/
Resource Hash
ed893b2ddcb5f51b7fa6a2ac76df6ff7c49719118d9df242846f1e3a1d9a918b

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
private, max-age=86400
content-encoding
gzip
etag
"t25IzPHNFM0irRtNYpnoMQ=="
expires
Sun, 14 Jun 2026 12:38:56 GMT
accept-ranges
bytes
date
Sat, 13 Jun 2026 12:38:56 GMT
content-type
application/javascript
vary
Accept-Encoding
GET
H2
200
rules-p-31iz6hfFutd16.js Show response
rules.quantcount.com/
160 B
632 B
24ms
4ms
Script
application/javascript
2600:9000:2957:2000:6:44e3:f8c0:93a1
Amazon.com
General
Full URL
https://rules.quantcount.com/rules-p-31iz6hfFutd16.js
Requested by
Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2957:2000:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
4718dd9f68e969d1cb5e1b6172206b7150ad1d8cd5c5c1fe5812dd0e1646d426

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

etag
"af15ecfe46737cb2a37226fd060f23a6"
age
1735
access-control-allow-methods
GET
x-cache
Hit from cloudfront
x-amz-cf-id
GFqn_13dehOmrcbhQ_wo9RzLiQCI1R0sWhDHimQDiMIwPc02KKav7g==
date
Sat, 13 Jun 2026 12:10:02 GMT
content-type
application/javascript
vary
Accept-Encoding
last-modified
Fri, 14 Oct 2022 00:41:49 GMT
cache-control
max-age=3600
cross-origin-resource-policy
cross-origin
via
1.1 dc6dade6047e6d91dbbd071c6ea0b920.cloudfront.net (CloudFront)
accept-ranges
bytes
access-control-allow-origin
*
content-length
160
x-amz-cf-pop
NRT12-P9
server
AmazonS3
x-amz-server-side-encryption
AES256
GET
H2
200
cs Show response
pixel.quantserve.com/
Redirect Chain
  • https://pixel.quantserve.com/cs?a=p-31iz6hfFutd16&gdpr=0&sf2=1
  • https://pixel.quantserve.com/cs?a=p-31iz6hfFutd16&gdpr=0&sf2=1&__qcmcs=1
666 B
931 B
71ms
70ms
Fetch
application/json
2620:116:800e:21:6c50:dbee:bef5:203d
Amazon.com
General
Full URL
https://pixel.quantserve.com/cs?a=p-31iz6hfFutd16&gdpr=0&sf2=1&__qcmcs=1
Protocol
H2
Server
2620:116:800e:21:6c50:dbee:bef5:203d , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
/
Resource Hash
550812d0ec9143ebd797f26af9b8b9db86e3aba933bdc2e29e6f9d4f64d2e3a8

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

access-control-allow-origin
https://www.mediafire.com
content-length
666
date
Sat, 13 Jun 2026 12:38:56 GMT
content-type
application/json
vary
Origin
access-control-allow-credentials
true

Redirect headers

strict-transport-security
max-age=86400
cache-control
private, no-store, proxy-revalidate
location
https://pixel.quantserve.com/cs?a=p-31iz6hfFutd16&gdpr=0&sf2=1&__qcmcs=1
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
0
date
Sat, 13 Jun 2026 12:38:56 GMT
vary
Origin
GET
H2
200
pixel;r=73211558;labels=Domain.mediafire_com%2CDomainId.484470;rf=0;a=p-31iz6hfFutd16;url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F41kkjh07tibblti%2FAINCRAD%2BFF%2BINJECTOR.apk%2Ffile%3Fdkey%3Drv5x...
pixel.quantserve.com/
35 B
243 B
70ms
69ms
Image
image/gif
2620:116:800e:21:6c50:dbee:bef5:203d
Amazon.com
General
Full URL
https://pixel.quantserve.com/pixel;r=73211558;labels=Domain.mediafire_com%2CDomainId.484470;rf=0;a=p-31iz6hfFutd16;url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F41kkjh07tibblti%2FAINCRAD%2BFF%2BINJECTOR.apk%2Ffile%3Fdkey%3Drv5x6b8wlt0%26r%3D125;ns=0;ce=1;qjs=1;qv=b414f28e-20260609162752;ref=;dst=0;et=1781354336182;tzo=-540;ogl=type.website%2Csite_name.MediaFire%2Clocale.en_US%2Curl.https%3A%2F%2Fwww%252Emediafire%252Ecom%2Ffile%2F41kkjh07tibblti%2F%2525F0%25259F%252594%2525A5_%2525F0%25259D%252%2Ctitle.%F0%9F%94%A5%20%F0%9D%97%94%F0%9D%97%9C%F0%9D%97%A1%F0%9D%97%96%F0%9D%97%A5%F0%9D%97%94%F0%9D%97%97%20%F0%9D%97%A0%F0%9D%97%A2%F0%9D%97%97%F0%9D%97%A6%20%F0%9D%97%99%F0%9D%97%99%20%F0%9D%97%A0%F0%9D%97%94%F0%9D%97%AB%20%F0%9F%98%B2%20%F0%9D%97%A1%F0%9D%97%A2%20%F0%9D%97%95%F0%9D%97%94%F0%9D%97%A1%20%20%F0%9F%9B%A1%EF%B8%8F%2Cimage.https%3A%2F%2Fstatic%252Emediafire%252Ecom%2Fimages%2Ffiletype%2Fdownload%2Fzip%252Ejpg%2Cdescription.;d=mediafire.com;uht=2;fpan=1;fpa=P1-43f07f64-3383-43d8-ae41-f5f099347065;pbc=f0d67061-f42d-44ae-b55d-8489de42251a;_ses=42ba017f-b19c-4ad0-a326-8c69b48cc08f;_seg=0;_ss=1;_gacid=56541922.1781354330;_gasid=K68XP6D85D_1781354329;_gam=a;gdpr=0;mdl=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:116:800e:21:6c50:dbee:bef5:203d , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
/
Resource Hash
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=86400
cache-control
private, no-store, proxy-revalidate
content-length
35
date
Sat, 13 Jun 2026 12:38:56 GMT
content-type
image/gif
GET
H3
200
ads Show response
securepubads.g.doubleclick.net/gampad/
60 KB
9 KB
268ms
265ms
Fetch
text/plain
142.251.23.157
Google LLC
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1001161376096050&correlator=2329201950321891&eid=31098216%2C95393146&output=ldjh&gdfp_req=1&vrg=202606090101&ptt=17&impl=fif&gdpr=0&iu_parts=1254144%3A183096492%2Cmediafire_com-edge-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=160x600&ifi=29&didk=2994425013&dids=div-gpt-ad-mediafire_com-edge-&adfs=982453029&sfv=1-0-45&rcs=6&eri=1&sc=1&cookie=ID%3Da72da8f8dac4dbe8%3AT%3D1781354330%3ART%3D1781354330%3AS%3DALNI_MZCBh_ptzlSFjn4mKG_I6_ZJqzdog&gpic=UID%3D0000146865d5f26d%3AT%3D1781354330%3ART%3D1781354330%3AS%3DALNI_MY7xi4RFbTEF4Q5wPKl_IsjF120uA&abxe=1&dt=1781354336217&lmt=1781354336&adxs=1440&adys=300&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=4&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=540&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE0OS4wLjc4MjcuMTAyIixudWxsLDAsbnVsbCwiNjQiLFtbIkNocm9taXVtIiwiMTQ5LjAuMC4wIl0sWyJHb29nbGUgQ2hyb21lIiwiMTQ5LjAuMC4wIl0sWyJOb3QtQS5CcmFuZCIsIjI0LjAuMC4wIl1dLDBd&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F41kkjh07tibblti%2FAINCRAD%2BFF%2BINJECTOR.apk%2Ffile%3Fdkey%3Drv5x6b8wlt0%26r%3D125&vis=1&aee=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&a3p=EmwKDGlkNS1zeW5jLmNvbRJaSUQ1KmlQVFhWenNHeFltYS0xQU96Nmk4UVhmaTB2WHY0d0JIdEJuVWpzRHBiMVRfXzJvdFQxdGFBQUVCQ21vdFQxb0F1S2ZKaktlZDd4TEtNVkF1MXRtTHdBWAESNgoMYWRzZXJ2ZXIub3JnEiQwZjUxNzEyMC02ODNjLTRjZTktOTJhZC1jZDE5MjY2ZDZkZWRYARK7AQoKY3JpdGVvLmNvbRKqAVNaYU16bDlvZDFKcVNuSjRVVzlNY25oRGRGbHJkM05TYUVKcVNVRnVObVZ6TlRGcmVVdDFXRGt5TkhRbE1rSnNhVGgxTkhWc05HbG1keVV5Um5GdFpVZE1WblZUYVdVMVNtNDBXR1ZhSlRKQ1RuaERlWEJYTlcxMU16RkpkbWR2YmtGeVJIQnliVlowSlRKQ1QxRnNKVEpHVFdwWVNYZ2xNa1pEWXlVelJBWAESNAoKcHViY2lkLm9yZxIkM2JmYmY3YmQtYjc2NC00NmZiLTliMjQtZGQyNzk5YmUyZDkxWAESWgoNY3J3ZGNudHJsLm5ldBJAZmI3ZWM1NWQyOWRmYzI1ZGFkMzVkYzRkZTQ2NzE4NWNhMDJjNTIwZGZjZWU5NzhlMmVjMzIyMmU3NmQ2M2ZmMBj58_eH7DNIABIdCg5lc3AuY3JpdGVvLmNvbRiw8PeH7DNIAFICCGQSGAoJeWFob28uY29tGNvx94fsM0gAUgIIbxI-CgVvcGVueBIsZXlKcElqb2lZa05NZFRkTFZ6SlNVSFU0UVU1WE5IWnpka3hPWnowOUluMD0Y0Pj3h-wzSAASrgIKCHJ0YmhvdXNlEpgCb2o0TWU4T0xkckdQbksyTUUyUmY3ODl0aU04V2RvNUt5ZzBwSzM2NU9iZmRUdFExcUdubTZCckF3V0tGaFdhRWJEQ3F0SXpSMlkzRVlkRGM5dmF5U1JsU24wcGE3cFR0cm14WHBHclpJZWhIQkd3V1cwMXVtZTZvZElZS0J5OE5FUitoWjdkaSsvaVdQSzBjYXB4eFVVZzRTMGlVUTJKQXVNbTdSWjV5aDBaN1k4aWtvUTV1RG1CY2ZsTDFUZ1c0RjJ6ZXo2QzI1eEIxWnFFR0pHeGI0UVd2OWJwd3Y3MnhDU291djNWUllyN0IwQUJuMmtqZ1lRckVjRHFOREtJQlduRGx2QStaZDdJRGkrenNOUzB0dWc9PRjn-PeH7DNIAA..&dlt=1781354328063&idt=1996&ppid=5594807e3b73660db22cc026894621f4&uule=a%20cm9sZToxIHByb2R1Y2VyOjEyIGxvYzoiMTQwLTAwMDEsSlAi&prev_scp=a%3D1%26iid1%3D8854121008628726%26eid%3D8854121008628726%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D1%26adnum%3D1%26url%3Dhttps%253A%252F%252Fwww.mediafire.com%252Ffile%252F41kkjh07tibblti%252FAINCRAD%252BFF%252BINJECTOR.apk%252Ffile%253Fdkey%253Drv5x6b8wlt0%2526r%253D125%26path%3D%252Ffile%252F41kkjh07tibblti%252FAINCRAD%252BFF%252BINJECTOR.apk%252Ffile%26ap%3D1102%26sap%3D1102%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D7%26at%3Dmbf%26adr%3D399%26ezosn%3D3%26reft%3Dn%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D39%26al%3D1039%26compid%3D0%26dfpsn%3D%252F1254144%252C183096492%252Fmediafire_com-edge-2%26tap%3Dmediafire_com-edge-2-8854121008628726%26eb_br%3Dzero%26eba%3D0%26bv%3D54%26bvm%3D0%26bvr%3D15%26avc%3D25%26evc%3D27%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D0%26br2%3D8%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D157%2C131%2C0%2C0%2C0%2C168%2C184%2C20%2C0%2C0%2C192%2C31%2C902%2C903%2C901%2C902%2C903%26deal1%3D3856%2C8229%26osb%3DLinux%252FChrome%26dbg%3Drc%253A4%26reqt%3D1781354335565&adks=697308627&frm=20&eo_id_str=ID%3Dc9df7b54bcd371a2%3AT%3D1781354330%3ART%3D1781354330%3AS%3DAA-Afja4gVi1oGpU66Pr7KR0wygQ&pbbce=1
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.23.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
rl-in-f157.1e100.net
Software
cafe /
Resource Hash
5e365e29ff49e2d8683417faaf8b50702031af935cf90b886b9ac92f471569c0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

access-control-expose-headers
x-google-amp-ad-validated-version
content-encoding
dcb
google-lineitem-id
-1
observe-browsing-topics
?1
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Sat, 13 Jun 2026 12:38:56 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-1
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.mediafire.com
content-length
8871
x-xss-protection
0
server
cafe
GET
H2
200
sync
pippio.com/api/
Redirect Chain
  • https://idsync.rlcdn.com/380609.gif?gdpr=0&partner_uid=nvl1Epz-cUaFq3VPzf1qQpCpc0eF-iROzK5s9AWc
  • https://idsync.rlcdn.com/1000.gif?memo=CMGdFxIzCi8IARCfOBoobnZsMUVwei1jVWFGcTNWUHpmMXFRcENwYzBlRi1pUk96SzVzOUFXYxAAGg0I4J610QYSBQjoBxAAQgBKAA
  • https://pippio.com/api/sync?pid=5324&it=1&iv=a3ab3322fe014925833aff72e406fb782fd6781bf37a27d79971593cdf2e5967791426b5417dce21&_=2
42 B
570 B
192ms
172ms
Image
image/gif
107.178.254.65
Google LLC
General
Full URL
https://pippio.com/api/sync?pid=5324&it=1&iv=a3ab3322fe014925833aff72e406fb782fd6781bf37a27d79971593cdf2e5967791426b5417dce21&_=2
Protocol
H2
Server
107.178.254.65 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS
65.254.178.107.bc.googleusercontent.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

cache-control
no-cache, no-store
timing-allow-origin
*
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length
42
date
Sat, 13 Jun 2026 12:38:56 GMT
content-type
image/gif

Redirect headers

cache-control
no-cache, no-store
timing-allow-origin
*
location
https://pippio.com/api/sync?pid=5324&it=1&iv=a3ab3322fe014925833aff72e406fb782fd6781bf37a27d79971593cdf2e5967791426b5417dce21&_=2
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length
0
date
Sat, 13 Jun 2026 12:38:56 GMT
GET
H3
200
rum
dsum-sec.casalemedia.com/
Redirect Chain
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=81&gdpr=0&external_user_id=HRWQjB8SlNgGR5DRThGP3BNFltkGFsHQT0Lk8T7Z
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=81&gdpr=0&external_user_id=HRWQjB8SlNgGR5DRThGP3BNFltkGFsHQT0Lk8T7Z&C=1
43 B
740 B
15ms
14ms
Image
image/gif
104.18.27.193
Cloudflare
General
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=81&gdpr=0&external_user_id=HRWQjB8SlNgGR5DRThGP3BNFltkGFsHQT0Lk8T7Z&C=1
Protocol
H3
Server
104.18.27.193 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Referer
https://www.mediafire.com/

Response headers

cache-control
no-cache
nel
{"report_to":"cf-nel","success_fraction":0.01,"max_age":604800}
cf-cache-status
DYNAMIC
pragma
no-cache
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=2iykuq4LmVUZnfcaAnvPkEVBi1SoFb0nlSWwzdHrWp8Kaewt5GpVQf6GqYXnxS4D%2BrnGa7XpSu8NkDnbX96Lgp%2B4JDNfQNbHMc2oziR5zpEsWSbC1MKp6z%2B96w8MHtKtvGXHa5ASJcS7zg%3D%3D"}]}
cf-ray
a0b127ba38a0d5c8-NRT
expires
0
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
content-length
43
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date
Sat, 13 Jun 2026 12:38:56 GMT
content-type
image/gif
server
cloudflare
priority
u=3,i

Redirect headers

cache-control
no-cache
location
/rum?cm_dsp_id=81&gdpr=0&external_user_id=HRWQjB8SlNgGR5DRThGP3BNFltkGFsHQT0Lk8T7Z&C=1
cf-cache-status
DYNAMIC
pragma
no-cache
nel
{"report_to":"cf-nel","success_fraction":0.01,"max_age":604800}
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=D0BsMpyHli%2FQjU7xKzxsMw9IFv7mBrPT5lfDp3kcoqh%2FObdUXKCc4outmbdBiGO%2FK2IKuhDcAZzJoVV8ybtj9Hfd%2FU82Mi3k4Uq%2FH0eU7Wvkz%2Bx5Kg66Xtv9VHedCuN2ORysRwWl1BT8hQ%3D%3D"}]}
cf-ray
a0b127ba2838d5c8-NRT
expires
0
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
content-length
0
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date
Sat, 13 Jun 2026 12:38:56 GMT
server
cloudflare
priority
u=3,i
GET
H2
200
Pug
image2.pubmatic.com/AdServer/
42 B
598 B
47ms
7ms
Image
image/gif
207.65.34.80
PubMatic
General
Full URL
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=6zwy_-k7NqvwbjKiuDgtr-VsNKrwP2OjuWvDiPMl
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
207.65.34.80 , United States, ASN62713 (AS-PUBMATIC - PubMatic, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=16070400; includeSubDomains

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=16070400; includeSubDomains
cache-control
no-store, no-cache, private
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date
Sat, 13 Jun 2026 12:38:56 GMT
content-type
image/gif; charset=utf-8
server
nginx
GET
H/1.1
200
OK
tap.php
pixel.rubiconproject.com/
42 B
1 KB
300ms
74ms
Image
image/gif
69.173.158.64
Magnite
General
Full URL
https://pixel.rubiconproject.com/tap.php?v=4939&nid=1902&gdpr=0&put=zmPNicxkyd3VMc3UnWfS2cAzy9zVYJzVnDRZHLYz
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
69.173.158.64 Singapore, Singapore, ASN26667 (RUBICONPROJECT - Magnite, Inc., US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
0d2bd05215470efb17ae41aff76c3f98
Pragma
no-cache
content-length
42
Content-Type
image/gif
GET
H2
200
pixel
cm.g.doubleclick.net/
170 B
409 B
64ms
41ms
Image
image/png
142.251.24.155
Google LLC
General
Full URL
https://cm.g.doubleclick.net/pixel?gdpr=0&google_nid=B765081F39B1F7&google_push=&google_hm=CH60G031jqVax6g7Fyz_mg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.24.155 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
rj-in-f155.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
date
Sat, 13 Jun 2026 12:38:56 GMT
x-xss-protection
0
content-type
image/png
server
HTTP server (unknown)
GET
H2
200
amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012605071401000/ Frame 7345
196 KB
0
30ms
4ms
Script
text/javascript
2404:6800:400b:c005::84
Google LLC
General
Full URL
https://cdn.ampproject.org/rtv/012605071401000/amp4ads-v0.mjs
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202606090101/pubads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:400b:c005::84 , Japan, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
19e6bf3356536c59e3a9aa5791665905d004766bda6b46fcf8e8457958020e28
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
etag
"9eade6bfff02340f"
age
349177
report-to
{"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
x-content-type-options
nosniff
expires
Wed, 09 Jun 2027 11:39:13 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 09 Jun 2026 11:39:13 GMT
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="amphtml-china-available"
content-length
56125
x-xss-protection
0
server
sffe
GET
H2
200
amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012605071401000/v0/ Frame 7345
15 KB
0
35ms
9ms
Script
text/javascript
2404:6800:400b:c005::84
Google LLC
General
Full URL
https://cdn.ampproject.org/rtv/012605071401000/v0/amp-ad-exit-0.1.mjs
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202606090101/pubads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:400b:c005::84 , Japan, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
f4b0148628292afd7b50bd67548ba6d3e97d564ee9ef938c963b4657747ac60b
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
etag
"88c4cbda6719bc74"
age
468038
report-to
{"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
x-content-type-options
nosniff
expires
Tue, 08 Jun 2027 02:38:12 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 08 Jun 2026 02:38:12 GMT
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="amphtml-china-available"
content-length
5221
x-xss-protection
0
server
sffe
GET
H2
200
amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012605071401000/v0/ Frame 7345
95 KB
0
32ms
7ms
Script
text/javascript
2404:6800:400b:c005::84
Google LLC
General
Full URL
https://cdn.ampproject.org/rtv/012605071401000/v0/amp-analytics-0.1.mjs
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202606090101/pubads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:400b:c005::84 , Japan, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
91171ed1478c24131b918c94dbc8bcc3cbc3a55dca8bb00f21cd64387b2ea8a6
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
etag
"97215e1667de42f6"
age
335010
report-to
{"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
x-content-type-options
nosniff
expires
Wed, 09 Jun 2027 15:35:20 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 09 Jun 2026 15:35:20 GMT
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="amphtml-china-available"
content-length
29021
x-xss-protection
0
server
sffe
GET
H2
200
amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012605071401000/v0/ Frame 7345
5 KB
0
36ms
10ms
Script
text/javascript
2404:6800:400b:c005::84
Google LLC
General
Full URL
https://cdn.ampproject.org/rtv/012605071401000/v0/amp-fit-text-0.1.mjs
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202606090101/pubads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:400b:c005::84 , Japan, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
dce1ce383bed84a4ed739e972b11f44c4c45a1339a1bdf75c3598b88d46cc69d
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
etag
"4871326834a6f544"
age
463868
report-to
{"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
x-content-type-options
nosniff
expires
Tue, 08 Jun 2027 03:47:42 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 08 Jun 2026 03:47:42 GMT
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="amphtml-china-available"
content-length
1920
x-xss-protection
0
server
sffe
GET
H2
200
amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012605071401000/v0/ Frame 7345
40 KB
0
28ms
3ms
Script
text/javascript
2404:6800:400b:c005::84
Google LLC
General
Full URL
https://cdn.ampproject.org/rtv/012605071401000/v0/amp-form-0.1.mjs
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202606090101/pubads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:400b:c005::84 , Japan, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
513bcb26bd9e258e314f0fa39e4f8d57be3305e65101ccbeb63ae1617073547f
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
etag
"ce7dfc1b22abf1b0"
age
304362
report-to
{"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
x-content-type-options
nosniff
expires
Thu, 10 Jun 2027 00:06:08 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 10 Jun 2026 00:06:08 GMT
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="amphtml-china-available"
content-length
12959
x-xss-protection
0
server
sffe
GET
H2
200
en.png
tpc.googlesyndication.com/pagead/images/abg/ Frame 7345
3 KB
0
21ms
6ms
Image
image/png
2404:6800:400b:c006::84
Google LLC
General
Full URL
https://tpc.googlesyndication.com/pagead/images/abg/en.png
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202606090101/pubads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:400b:c006::84 , Japan, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
85a64faec356c3a72f249a98a037317adc730ec6d38e47653cd53be5485d80a1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=86400
timing-allow-origin
*
etag
15880770647744369592
age
16266
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Sun, 14 Jun 2026 08:07:44 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
2982
x-xss-protection
0
date
Sat, 13 Jun 2026 08:07:44 GMT
content-type
image/png
vary
Accept-Encoding
server
cafe
GET
H2
200
adchoices_blue_wb.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 7345
209 B
0
21ms
7ms
Image
image/png
2404:6800:400b:c006::84
Google LLC
General
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/adchoices_blue_wb.png
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202606090101/pubads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:400b:c006::84 , Japan, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
135fe1822959b8811afafc20effec079f339c96788df6e47e933a7d0c267921b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=86400
timing-allow-origin
*
etag
2799713854418114702
age
69389
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Sat, 13 Jun 2026 17:22:21 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
209
x-xss-protection
0
date
Fri, 12 Jun 2026 17:22:21 GMT
content-type
image/png
vary
Accept-Encoding
server
cafe
GET
H3
200
8271334654635481260
tpc.googlesyndication.com/daca_images/simgad/ Frame 7345
143 KB
143 KB
21ms
20ms
Image
image/webp
142.250.23.132
Google LLC
General
Full URL
https://tpc.googlesyndication.com/daca_images/simgad/8271334654635481260
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.23.132 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
zj-in-f132.1e100.net
Software
sffe /
Resource Hash
365a751f65b69186beb57129399d80f061620fc6ff5f0a0392c3e440bdb18442
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

age
31557
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
x-content-type-options
nosniff
expires
Sun, 13 Jun 2027 03:52:59 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons
true
date
Sat, 13 Jun 2026 03:52:59 GMT
last-modified
Tue, 26 May 2026 06:55:55 GMT
content-type
image/webp
cache-control
public, max-age=31536000
timing-allow-origin
*
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
content-length
146074
x-xss-protection
0
server
sffe
GET

l
www.google.com/ads/measurement/ Frame 7345
0
0


GET

adview
securepubads.g.doubleclick.net/pagead/ Frame 7345
0
0


POST
H2
200
ad_impression Show response
pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/
60 B
337 B
135ms
133ms
Fetch
application/json
44.227.112.76
Amazon.com
General
Full URL
https://pb-ing-02.ccgateway.net/v1.0/parent/0dae949f4b/engagement/trigger/ad_impression
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
44.227.112.76 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-44-227-112-76.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
ee63979b621d070be7f6aee315971acb7959ff766758fda88f01c822fd24a7b0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
Content-Type
application/json
sec-ch-ua-mobile
?0

Response headers

access-control-allow-origin
https://www.mediafire.com
content-length
60
date
Sat, 13 Jun 2026 12:38:56 GMT
content-type
application/json; charset=utf-8
vary
Origin
access-control-allow-credentials
true
GET
DATA
200
OK
truncated
/ Frame 7345
213 B
0
Image
image/png

General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d443f4f3c93f41532712967c32d6da8008c13d4d3e2aeebba0df5f218f25c1ca

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/png
POST
H3
204
collect
analytics.google.com/g/
0
0
41ms
40ms
Fetch
text/plain
142.251.23.139
Google LLC
General
Full URL
https://analytics.google.com/g/collect?v=2&tid=G-K68XP6D85D&gtm=45je66a1v887485693za20gzb6304663zd6304663&_p=1781354328508&gcs=G111&gcd=13n3n3n3n5l1&npa=0&dma=0&tcfd=10000&_eu=AEIAAGQC&are=1&cid=56541922.1781354330&frm=0&pscdl=noapi&rcb=19&sr=1600x1200&uaa=x86&uab=64&uafvl=Chromium%3B149.0.0.0%7CGoogle%2520Chrome%3B149.0.0.0%7CNot-A.Brand%3B24.0.0.0&uam=&uamb=0&uap=Linux&uapv=&uaw=0&ul=ja-jp&gaf=2&tag_exp=115616985~115938465~115938469~118012008~119392696~119392704~119456239~119456247&sid=1781354329&sct=1&seg=0&dl=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F41kkjh07tibblti%2FAINCRAD%2BFF%2BINJECTOR.apk%2Ffile%3Fdkey%3Drv5x6b8wlt0%26r%3D125&dt=%F0%9F%94%A5%20%F0%9D%97%94%F0%9D%97%9C%F0%9D%97%A1%F0%9D%97%96%F0%9D%97%A5%F0%9D%97%94%F0%9D%97%97%20%F0%9D%97%A0%F0%9D%97%A2%F0%9D%97%97%F0%9D%97%A6%20%F0%9D%97%99%F0%9D%97%99%20%F0%9D%97%A0%F0%9D%97%94%F0%9D%97%AB%20%F0%9F%98%B2%20%F0%9D%97%A1%F0%9D%97%A2%20%F0%9D%97%95%F0%9D%97%94%F0%9D%97%A1%20%F0%9F%9B%A1%EF%B8%8F&_s=3&tfd=9097
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/portland.js?gcb=16&cb=d264be6c81
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.23.139 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
rl-in-f139.1e100.net
Software
Golfe2 /
Resource Hash

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
Content-Type
text/plain;charset=UTF-8
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:196:0
report-to
{"group":"ascnsrsggc:196:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:196:0"}],}
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
https://www.mediafire.com
cross-origin-opener-policy-report-only
same-origin; report-to=ascnsrsggc:196:0
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 13 Jun 2026 12:38:56 GMT
content-type
text/plain
server
Golfe2
GET
H3
204
ping
pagead2.googlesyndication.com/pagead/ Frame 7345
0
20 B
38ms
38ms
Image
image/gif
142.251.24.157
Google LLC
General
Full URL
https://pagead2.googlesyndication.com/pagead/ping?e=4&d=ChiyAhUKEwiKnrqDnoSVAxXrecMGHeuGIRI
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.24.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
rj-in-f157.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Sat, 13 Jun 2026 12:38:56 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
GET

view
securepubads.g.doubleclick.net/btr/ Frame 7345
0
0


GET
H3
200
activeview
pagead2.googlesyndication.com/pcs/ Frame 7345
42 B
65 B
14ms
12ms
Image
image/gif
142.251.24.157
Google LLC
General
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssJawowFGBAkKXtaV1mOKGRGsWUK6O7vxSo50x3eNe_aTV9XuTFMFUGprQrItu_6OLvdXeg2v5-b9CIo8vmHenrUwNXEFJdc8Sl4zLNMuraZLSYe93IvrB09foP3_xi1BF9XpPRn5x6LUTBZDJcyCllnAW95tjYmD71Hxchiyl9ojHuJx0ZIkFXxENBl-ml9jNRriKg6F_d4hxzjuJo0g&sai=AMfl-YRmVi2yBgr-oFiyrEJIzJmZ6HRw5_P3m1zPMTK2dzNsGvqYGxGnwEk9974uT9OMOnMhKFvf7w3oHp0k1VGCJtN9wiGW6T6BSTrsX3y8-NmeDMuhU3csyIb-BZXA3sNzxMlnDLof7_irSIFW1btzyeYbR06gI4Co48Yi0McxJVFUlOBfPo6cO5zSNBWIKFeUyqOc0Ng0q0bssEfmJ85P7gGy-XhH1LG-CMpMMmhLjZ_gAVlLlzeb_5JrQmlbfeR65eZCpYrgPgOL8nkEEsZhBfyVbgYow5_HyT-hp6cc1Jgj7s4HvmNwL9m3cwk_WAaRynvLftrX4vmDLZ2MCeiBAawH9j08LDCVB-YZOukkaBRWyzvh60tHgDSooW80prexWEpaC_jjQ_Wlw3I&sig=Cg0ArKJSzJyNvRsJ77b8EAE&cid=CAQShgIAEQoqgZd6WgId4gnIf8RTdpIGuS1ffNHv7XZQJl3odRVFX6fOck9nqs_PxzrOVdKdn_rC7FmiFRBHQPVgWiS_xzWUfNcY7_zqjATbAa0sESMq5Q5VQ35quMUnO_MbnlqOAxR7fxJw5AA94IqjCSsz5qR_jHCdA1Ja5VwiM6UN6KwM9kB4N0AD14FmzpCgA6r1vO9KohsoJh2hn42GhH-1r5tnKWvT8nUl1_vRH10SpKtXdVfbcqirvcCTz-emIyb5WeJ603vLKpguWWd72XEriGrFmjFUq_NRvR7QRkHqZ6VADmuzMadqaCzOBwNqkB0bNMVF3ubZMO7p4a0pToe5TTv87hExGAE&id=ampim&o=1440,300&d=160,600&ss=1600,1200&bs=1600,1200&mcvt=1000&mtos=0,0,1000,1000,1000&tos=0,0,1000,0,0&tfs=90&tls=1090&g=100&h=100&tt=1090&r=v&avms=ampa&uap=Linux&uapv=&uaa=x86&uam=&uafv=149.0.7827.102&uab=64&uafvl=%5B%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22149.0.0.0%22%7D%2C%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22149.0.0.0%22%7D%2C%7B%22brand%22%3A%22Not-A.Brand%22%2C%22version%22%3A%2224.0.0.0%22%7D%5D&uaw=false&adk=0
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.24.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
rj-in-f157.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
42
date
Sat, 13 Jun 2026 12:38:57 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
OPTIONS

log
translate.googleapis.com/element/ Frame
0
0


POST

log
translate.googleapis.com/element/
0
0


POST
H2
200
adop.gif
g.ezoic.net/porpoiseant/
43 B
119 B
74ms
73ms
Ping
image/gif
2406:da18:9d0:143f:2124:4e9c:36a9:d9de
Amazon.com
General
Full URL
https://g.ezoic.net/porpoiseant/adop.gif?orig=0&sts=W3siZ3JvdXBfaWQiOiJtZWRpYWZpcmVfY29tLWVkZ2UtMi8yMDI2LTA2LTEzLzg4NTQxMjEwMDg2Mjg3MjYiLCJhdHRlbXB0X251bWJlciI6NiwiYWRfc2xvdF9pbmRleCI6MCwicGFnZXZpZXdfaWQiOiI0MmUyZTRjMS05OGYxLTRhYmItOWJlMC0wMzY4NDJjYzlkZmQiLCJkb21haW5faWQiOjQ4NDQ3MCwiYWRfdW5pdCI6Im1lZGlhZmlyZV9jb20tZWRnZS0yIiwidF90aW1lIjoiMjAyNi0wNi0xMyAwNzozODo0OCIsInJlY29yZF90eXBlIjoiY3VzdG9tX2V2ZW50IiwiZXZlbnRfaWQiOiI3OTE3NDdhMy04MmYwLTRkYTctYjdlNi1kOGE3OGZkYTU1ODgiLCJldmVudF9uYW1lIjoibm9fZmlsbF9yZWFzb24iLCJldmVudF92YWwiOiJyZXRyeV9lbXB0eSIsImV2ZW50X2Vwb2NoIjoxNzgxMzU0MzM1LCJpc192aXNpYmxlIjpmYWxzZX0seyJncm91cF9pZCI6Im1lZGlhZmlyZV9jb20tZWRnZS0yLzIwMjYtMDYtMTMvODg1NDEyMTAwODYyODcyNiIsImFkX3Nsb3RfaW5kZXgiOjAsInBhZ2V2aWV3X2lkIjoiNDJlMmU0YzEtOThmMS00YWJiLTliZTAtMDM2ODQyY2M5ZGZkIiwiZG9tYWluX2lkIjo0ODQ0NzAsImFkX3VuaXQiOiJtZWRpYWZpcmVfY29tLWVkZ2UtMiIsImFkX3Bvc2l0aW9uIjoxMTAyLCJhZF90eXBlIjoiZGlzcGxheSIsImFkX3NvdXJjZSI6ImdhbSIsInJlcXVlc3RlZF9zaXplcyI6IjE2MHg2MDAiLCJiaWRfZmxvb3IiOjAsImlkIjoiNDkxZjg0YTYtZmViNy00ZjhhLTg4ZmUtMGIxODlkNzFjYzU0IiwiaGFuZGxlX2lkIjoiNDkxZjg0YTYtZmViNy00ZjhhLTg4ZmUtMGIxODlkNzFjYzU0Iiwia2V5IjoibWVkaWFmaXJlX2NvbS1lZGdlLTIvMjAyNi0wNi0xMy84ODU0MTIxMDA4NjI4NzI2fDB8NyIsImF0dGVtcHRfbnVtYmVyIjo3LCJ0X3RpbWUiOiIyMDI2LTA2LTEzIDA3OjM4OjQ4IiwiZmV0Y2hfZXBvY2giOjE3ODEzNTQzMzUsInZlcnNpb24iOjIsInN0YXR1cyI6ImZldGNoZWQiLCJsYXN0X2V2ZW50IjoiZmV0Y2hlZCIsImxhc3RfdXBkYXRlZF9tcyI6MTc4MTM1NDMzNTU2NywicmVjb3JkX3R5cGUiOiJvcHBvcnR1bml0eSJ9LHsiZ3JvdXBfaWQiOiJtZWRpYWZpcmVfY29tLWVkZ2UtMi8yMDI2LTA2LTEzLzg4NTQxMjEwMDg2Mjg3MjYiLCJhdHRlbXB0X251bWJlciI6NywiYWRfc2xvdF9pbmRleCI6MCwicGFnZXZpZXdfaWQiOiI0MmUyZTRjMS05OGYxLTRhYmItOWJlMC0wMzY4NDJjYzlkZmQiLCJkb21haW5faWQiOjQ4NDQ3MCwiYWRfdW5pdCI6Im1lZGlhZmlyZV9jb20tZWRnZS0yIiwidF90aW1lIjoiMjAyNi0wNi0xMyAwNzozODo0OCIsInJlY29yZF90eXBlIjoiY3VzdG9tX2V2ZW50IiwiZXZlbnRfaWQiOiJhNjQ2NjJkOC01NWM1LTQyZDktYjVkMC05NjlkZmM4ZWVkMzgiLCJldmVudF9uYW1lIjoibG9hZGVkIiwiZXZlbnRfdmFsIjoidHJ1ZSIsImV2ZW50X2Vwb2NoIjoxNzgxMzU0MzM2LCJpc192aXNpYmxlIjpmYWxzZX0seyJncm91cF9pZCI6Im1lZGlhZmlyZV9jb20tZWRnZS0yLzIwMjYtMDYtMTMvODg1NDEyMTAwODYyODcyNiIsImF0dGVtcHRfbnVtYmVyIjo3LCJhZF9zbG90X2luZGV4IjowLCJwYWdldmlld19pZCI6IjQyZTJlNGMxLTk4ZjEtNGFiYi05YmUwLTAzNjg0MmNjOWRmZCIsImRvbWFpbl9pZCI6NDg0NDcwLCJhZF91bml0IjoibWVkaWFmaXJlX2NvbS1lZGdlLTIiLCJ0X3RpbWUiOiIyMDI2LTA2LTEzIDA3OjM4OjQ4IiwicmVjb3JkX3R5cGUiOiJjdXN0b21fZXZlbnQiLCJldmVudF9pZCI6IjdjNjFhNjg2LTcxZTQtNDk0Yy05NzdjLWMyMjRjMDYyODcxNyIsImV2ZW50X25hbWUiOiJzdGF0X3NvdXJjZV9pZCIsImV2ZW50X3ZhbCI6IjM1IiwiZXZlbnRfZXBvY2giOjE3ODEzNTQzMzYsImlzX3Zpc2libGUiOmZhbHNlfSx7Imdyb3VwX2lkIjoibWVkaWFmaXJlX2NvbS1lZGdlLTIvMjAyNi0wNi0xMy84ODU0MTIxMDA4NjI4NzI2IiwiYXR0ZW1wdF9udW1iZXIiOjcsImFkX3Nsb3RfaW5kZXgiOjAsInBhZ2V2aWV3X2lkIjoiNDJlMmU0YzEtOThmMS00YWJiLTliZTAtMDM2ODQyY2M5ZGZkIiwiZG9tYWluX2lkIjo0ODQ0NzAsImFkX3VuaXQiOiJtZWRpYWZpcmVfY29tLWVkZ2UtMiIsInRfdGltZSI6IjIwMjYtMDYtMTMgMDc6Mzg6NDgiLCJyZWNvcmRfdHlwZSI6ImN1c3RvbV9ldmVudCIsImV2ZW50X2lkIjoiZDkwMmZkOGMtMzEwMy00NmEwLWFlMDYtMzIwZDZmZWMxY2YyIiwiZXZlbnRfbmFtZSI6ImNyZWF0aXZlX2lkIiwiZXZlbnRfdmFsIjoiMTM4NDg2MTQ4NzQ0IiwiZXZlbnRfZXBvY2giOjE3ODEzNTQzMzYsImlzX3Zpc2libGUiOmZhbHNlfSx7Imdyb3VwX2lkIjoibWVkaWFmaXJlX2NvbS1lZGdlLTIvMjAyNi0wNi0xMy84ODU0MTIxMDA4NjI4NzI2IiwiYXR0ZW1wdF9udW1iZXIiOjcsImFkX3Nsb3RfaW5kZXgiOjAsInBhZ2V2aWV3X2lkIjoiNDJlMmU0YzEtOThmMS00YWJiLTliZTAtMDM2ODQyY2M5ZGZkIiwiZG9tYWluX2lkIjo0ODQ0NzAsImFkX3VuaXQiOiJtZWRpYWZpcmVfY29tLWVkZ2UtMiIsInRfdGltZSI6IjIwMjYtMDYtMTMgMDc6Mzg6NDgiLCJyZWNvcmRfdHlwZSI6ImN1c3RvbV9ldmVudCIsImV2ZW50X2lkIjoiZmI5NGNlNWYtZjM0Zi00MWI3LTkyN2QtZjY2NmNjNWE5N2U1IiwiZXZlbnRfbmFtZSI6ImxpbmVpdGVtX2lkIiwiZXZlbnRfdmFsIjoiMjg2ODcyNzQiLCJldmVudF9lcG9jaCI6MTc4MTM1NDMzNiwiaXNfdmlzaWJsZSI6ZmFsc2V9LHsiZ3JvdXBfaWQiOiJtZWRpYWZpcmVfY29tLWVkZ2UtMi8yMDI2LTA2LTEzLzg4NTQxMjEwMDg2Mjg3MjYiLCJhdHRlbXB0X251bWJlciI6NywiYWRfc2xvdF9pbmRleCI6MCwicGFnZXZpZXdfaWQiOiI0MmUyZTRjMS05OGYxLTRhYmItOWJlMC0wMzY4NDJjYzlkZmQiLCJkb21haW5faWQiOjQ4NDQ3MCwiYWRfdW5pdCI6Im1lZGlhZmlyZV9jb20tZWRnZS0yIiwidF90aW1lIjoiMjAyNi0wNi0xMyAwNzozODo0OCIsInJlY29yZF90eXBlIjoiY3VzdG9tX2V2ZW50IiwiZXZlbnRfaWQiOiJhMjg4MWFjNi01MDFkLTQ2NTAtYWQ1MC0xMzI0MWRlMmUwZjkiLCJldmVudF9uYW1lIjoiZmlsbGVkX3NpemUiLCJldmVudF92YWwiOiIxNjB4NjAwIiwiZXZlbnRfZXBvY2giOjE3ODEzNTQzMzYsImlzX3Zpc2libGUiOmZhbHNlfSx7Imdyb3VwX2lkIjoibWVkaWFmaXJlX2NvbS1lZGdlLTIvMjAyNi0wNi0xMy84ODU0MTIxMDA4NjI4NzI2IiwiYXR0ZW1wdF9udW1iZXIiOjcsImFkX3Nsb3RfaW5kZXgiOjAsInBhZ2V2aWV3X2lkIjoiNDJlMmU0YzEtOThmMS00YWJiLTliZTAtMDM2ODQyY2M5ZGZkIiwiZG9tYWluX2lkIjo0ODQ0NzAsImFkX3VuaXQiOiJtZWRpYWZpcmVfY29tLWVkZ2UtMiIsInRfdGltZSI6IjIwMjYtMDYtMTMgMDc6Mzg6NDgiLCJyZWNvcmRfdHlwZSI6ImN1c3RvbV9ldmVudCIsImV2ZW50X2lkIjoiNGJlOGMwN2MtODgzMi00MmExLWE3Y2MtMmVmODhkYTI1ZTEwIiwiZXZlbnRfbmFtZSI6ImdhbV9pc19lbXB0eSIsImV2ZW50X3ZhbCI6ImZhbHNlIiwiZXZlbnRfZXBvY2giOjE3ODEzNTQzMzYsImlzX3Zpc2libGUiOmZhbHNlfSx7Imdyb3VwX2lkIjoibWVkaWFmaXJlX2NvbS1lZGdlLTIvMjAyNi0wNi0xMy84ODU0MTIxMDA4NjI4NzI2IiwiYXR0ZW1wdF9udW1iZXIiOjcsImFkX3Nsb3RfaW5kZXgiOjAsInBhZ2V2aWV3X2lkIjoiNDJlMmU0YzEtOThmMS00YWJiLTliZTAtMDM2ODQyY2M5ZGZkIiwiZG9tYWluX2lkIjo0ODQ0NzAsImFkX3VuaXQiOiJtZWRpYWZpcmVfY29tLWVkZ2UtMiIsInRfdGltZSI6IjIwMjYtMDYtMTMgMDc6Mzg6NDgiLCJyZWNvcmRfdHlwZSI6ImN1c3RvbV9ldmVudCIsImV2ZW50X2lkIjoiODYzMjlmNWYtZmZiNS00NzAyLTlkMWEtZjNjNWRlMjZiYzQ3IiwiZXZlbnRfbmFtZSI6ImdhbV9nb29nbGVfcXVlcnlfaWQiLCJldmVudF92YWwiOiJDSXFldW9PZWhKVURGZXQ1d3dZZDY0WWhFZyIsImV2ZW50X2Vwb2NoIjoxNzgxMzU0MzM2LCJpc192aXNpYmxlIjpmYWxzZX0seyJncm91cF9pZCI6Im1lZGlhZmlyZV9jb20tZWRnZS0yLzIwMjYtMDYtMTMvODg1NDEyMTAwODYyODcyNiIsImF0dGVtcHRfbnVtYmVyIjo3LCJhZF9zbG90X2luZGV4IjowLCJwYWdldmlld19pZCI6IjQyZTJlNGMxLTk4ZjEtNGFiYi05YmUwLTAzNjg0MmNjOWRmZCIsImRvbWFpbl9pZCI6NDg0NDcwLCJhZF91bml0IjoibWVkaWFmaXJlX2NvbS1lZGdlLTIiLCJ0X3RpbWUiOiIyMDI2LTA2LTEzIDA3OjM4OjQ4IiwicmVjb3JkX3R5cGUiOiJjdXN0b21fZXZlbnQiLCJldmVudF9pZCI6ImQ3ODk4ZWZhLTMyMWItNGU5My04N2ZjLTlmODgxZjA2NzRkMiIsImV2ZW50X25hbWUiOiJzdG9yZV9maWxsZWRfc291cmNlIiwiZXZlbnRfdmFsIjoiZ2FtX3Nsb3RfcmVuZGVyZWQiLCJldmVudF9lcG9jaCI6MTc4MTM1NDMzNiwiaXNfdmlzaWJsZSI6ZmFsc2V9XQ==
Requested by
Host:
URL: ez-standalone.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2406:da18:9d0:143f:2124:4e9c:36a9:d9de Singapore, Singapore, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
/
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

access-control-max-age
1728000
cache-control
private, max-age=0, must-revalidate, no-cache, no-store
access-control-allow-methods
HEAD, PUT, POST, GET, OPTIONS
expires
Fri, 12 Jun 2026 12:38:59 GMT
access-control-allow-origin
https://www.mediafire.com
content-length
43
date
Sat, 13 Jun 2026 12:38:59 GMT
x-middleton-display
imp_sol
content-type
image/gif
vary
Accept-Encoding
access-control-allow-headers
Content-Type
POST
H2
200
adop.gif
g.ezoic.net/porpoiseant/
43 B
73 B
75ms
75ms
Ping
image/gif
2406:da18:9d0:143f:2124:4e9c:36a9:d9de
Amazon.com
General
Full URL
https://g.ezoic.net/porpoiseant/adop.gif?orig=0&sts=W3siZ3JvdXBfaWQiOiJtZWRpYWZpcmVfY29tLWVkZ2UtMi8yMDI2LTA2LTEzLzg4NTQxMjEwMDg2Mjg3MjYiLCJhdHRlbXB0X251bWJlciI6NywiYWRfc2xvdF9pbmRleCI6MCwicGFnZXZpZXdfaWQiOiI0MmUyZTRjMS05OGYxLTRhYmItOWJlMC0wMzY4NDJjYzlkZmQiLCJkb21haW5faWQiOjQ4NDQ3MCwiYWRfdW5pdCI6Im1lZGlhZmlyZV9jb20tZWRnZS0yIiwidF90aW1lIjoiMjAyNi0wNi0xMyAwNzozODo0OCIsInJlY29yZF90eXBlIjoiY3VzdG9tX2V2ZW50IiwiZXZlbnRfaWQiOiJmMWJkZjgwZC05YmVmLTRiODUtODliNS04ZDRiYzczYWNkNTMiLCJldmVudF9uYW1lIjoicmV2ZW51ZV91c2QiLCJldmVudF92YWwiOiIwLjAwMDAwMiIsImV2ZW50X2Vwb2NoIjoxNzgxMzU0MzM2LCJpc192aXNpYmxlIjpmYWxzZX0seyJncm91cF9pZCI6Im1lZGlhZmlyZV9jb20tZWRnZS0yLzIwMjYtMDYtMTMvODg1NDEyMTAwODYyODcyNiIsImF0dGVtcHRfbnVtYmVyIjo3LCJhZF9zbG90X2luZGV4IjowLCJwYWdldmlld19pZCI6IjQyZTJlNGMxLTk4ZjEtNGFiYi05YmUwLTAzNjg0MmNjOWRmZCIsImRvbWFpbl9pZCI6NDg0NDcwLCJhZF91bml0IjoibWVkaWFmaXJlX2NvbS1lZGdlLTIiLCJ0X3RpbWUiOiIyMDI2LTA2LTEzIDA3OjM4OjQ4IiwicmVjb3JkX3R5cGUiOiJjdXN0b21fZXZlbnQiLCJldmVudF9pZCI6IjhkMzNlNTk5LTJjNDctNDNmYS04MmQwLWExZWRhM2U2OGQxOCIsImV2ZW50X25hbWUiOiJlc3RfcmV2ZW51ZV91c2QiLCJldmVudF92YWwiOiIwLjAwMDAwMiIsImV2ZW50X2Vwb2NoIjoxNzgxMzU0MzM2LCJpc192aXNpYmxlIjpmYWxzZX0seyJncm91cF9pZCI6Im1lZGlhZmlyZV9jb20tZWRnZS0yLzIwMjYtMDYtMTMvODg1NDEyMTAwODYyODcyNiIsImF0dGVtcHRfbnVtYmVyIjo3LCJhZF9zbG90X2luZGV4IjowLCJwYWdldmlld19pZCI6IjQyZTJlNGMxLTk4ZjEtNGFiYi05YmUwLTAzNjg0MmNjOWRmZCIsImRvbWFpbl9pZCI6NDg0NDcwLCJhZF91bml0IjoibWVkaWFmaXJlX2NvbS1lZGdlLTIiLCJ0X3RpbWUiOiIyMDI2LTA2LTEzIDA3OjM4OjQ4IiwicmVjb3JkX3R5cGUiOiJjdXN0b21fZXZlbnQiLCJldmVudF9pZCI6IjFiNGM0ZjE0LTJlNDUtNDM1Zi1hYjdjLTQ5MDZjZDliZWQwYyIsImV2ZW50X25hbWUiOiJhZF9zb3VyY2UiLCJldmVudF92YWwiOiJnYW0iLCJldmVudF9lcG9jaCI6MTc4MTM1NDMzNiwiaXNfdmlzaWJsZSI6ZmFsc2V9LHsiZ3JvdXBfaWQiOiJtZWRpYWZpcmVfY29tLWVkZ2UtMi8yMDI2LTA2LTEzLzg4NTQxMjEwMDg2Mjg3MjYiLCJhdHRlbXB0X251bWJlciI6NywiYWRfc2xvdF9pbmRleCI6MCwicGFnZXZpZXdfaWQiOiI0MmUyZTRjMS05OGYxLTRhYmItOWJlMC0wMzY4NDJjYzlkZmQiLCJkb21haW5faWQiOjQ4NDQ3MCwiYWRfdW5pdCI6Im1lZGlhZmlyZV9jb20tZWRnZS0yIiwidF90aW1lIjoiMjAyNi0wNi0xMyAwNzozODo0OCIsInJlY29yZF90eXBlIjoiY3VzdG9tX2V2ZW50IiwiZXZlbnRfaWQiOiI5YWQyNzNhNi0yNjE5LTQxYjUtYmE1ZS1mN2Y5MjU5ZTg0ZTUiLCJldmVudF9uYW1lIjoidmlld2VkIiwiZXZlbnRfdmFsIjoidHJ1ZSIsImV2ZW50X2Vwb2NoIjoxNzgxMzU0MzM3LCJpc192aXNpYmxlIjpmYWxzZX1d
Requested by
Host:
URL: ez-standalone.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2406:da18:9d0:143f:2124:4e9c:36a9:d9de Singapore, Singapore, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
/
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

access-control-max-age
1728000
cache-control
private, max-age=0, must-revalidate, no-cache, no-store
access-control-allow-methods
HEAD, PUT, POST, GET, OPTIONS
expires
Fri, 12 Jun 2026 12:38:59 GMT
access-control-allow-origin
https://www.mediafire.com
content-length
43
date
Sat, 13 Jun 2026 12:38:59 GMT
x-middleton-display
imp_sol
content-type
image/gif
vary
Accept-Encoding
access-control-allow-headers
Content-Type
POST
H2
204
greenoaks.gif
g.ezoic.net/detroitchicago/
0
69 B
74ms
72ms
Ping
text/plain
2406:da18:9d0:143f:2124:4e9c:36a9:d9de
Amazon.com
General
Full URL
https://g.ezoic.net/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwidmlzaXRfdXVpZCI6ImFhNjljNzlhLWRhYTktNDM2Yy03MGM3LTNmZTI1ZWNhMjM1MCIsInBhZ2V2aWV3X2lkIjoiNDJlMmU0YzEtOThmMS00YWJiLTliZTAtMDM2ODQyY2M5ZGZkIiwiZG9tYWluX2lkIjoiNDg0NDcwIiwidF9lcG9jaCI6MTc4MTM1NDMyOCwiZGF0YSI6W3sibmFtZSI6InN0YW5kYWxvbmVfbG9hZF90aW1lIiwidmFsIjoiMjQ4In0seyJuYW1lIjoiZGV2aWNlX3dpZHRoIiwidmFsIjoiMTYwMCJ9LHsibmFtZSI6ImRldmljZV9oZWlnaHQiLCJ2YWwiOiIxMjAwIn0seyJuYW1lIjoidF9sb2NhbF9kYXRlIiwidmFsIjoiMjAyNi0wNi0xMyJ9LHsibmFtZSI6InRfbG9jYWxfaG91ciIsInZhbCI6IjIxIn0seyJuYW1lIjoidF9sb2NhbF9kYXlfb2Zfd2VlayIsInZhbCI6IjYifSx7Im5hbWUiOiJ0X2xvY2FsX3RpbWV6b25lIiwidmFsIjoiLTU0MCJ9LHsibmFtZSI6Imxhbmd1YWdlX3RhZyIsInZhbCI6ImphLUpQIn0seyJuYW1lIjoibGFuZ3VhZ2VfcHJpbWFyeV9zdWJ0YWciLCJ2YWwiOiJqYSJ9LHsibmFtZSI6InRpbWVyX2ZpcnN0X2FkX3JlcXVlc3QiLCJ2YWwiOiI3NTgifSx7Im5hbWUiOiJ0aW1lcl9maXJzdF9hZF9sb2FkIiwidmFsIjoiOTQ5In0seyJuYW1lIjoiZXN0X3JldmVudWVfdXNkIiwidmFsIjoiMC4wMDA0In0seyJuYW1lIjoibmF2aWdhdGlvbl90eXBlIiwidmFsIjoiMCJ9LHsibmFtZSI6InJlZGlyZWN0X2NvdW50IiwidmFsIjoiMCJ9LHsibmFtZSI6InBlcmZfaXNfdHJhY2tlZCIsInZhbCI6IjEifSx7Im5hbWUiOiJwZXJmX25hdl90b19jb25uZWN0IiwidmFsIjoiMTEifSx7Im5hbWUiOiJwZXJmX2Nvbm5lY3RfdG9fcmVzcF9zdGFydCIsInZhbCI6IjU2MSJ9LHsibmFtZSI6InBlcmZfcmVzcF90aW1lIiwidmFsIjoiNjA2In0seyJuYW1lIjoicGVyZl9pbnRlcmFjdGl2ZSIsInZhbCI6IjU0NyJ9LHsibmFtZSI6InBlcmZfY29udGVudGxvYWRlZCIsInZhbCI6IjU3OCJ9LHsibmFtZSI6InBlcmZfY29tcGxldGUiLCJ2YWwiOiIyMTQ3In0seyJuYW1lIjoiZmlyc3RfcGFpbnQiLCJ2YWwiOiIxMDgwIn0seyJuYW1lIjoiZmlyc3RfY29udGVudGZ1bF9wYWludCIsInZhbCI6IjEwODAifSx7Im5hbWUiOiJjb25uZWN0aW9uX2VmZmVjdGl2ZV90eXBlIiwidmFsIjoiNGcifSx7Im5hbWUiOiJjb25uZWN0aW9uX2Rvd25saW5rIiwidmFsIjoiMTAifSx7Im5hbWUiOiJjb25uZWN0aW9uX3J0dCIsInZhbCI6IjAifSx7Im5hbWUiOiJlc3RfcmV2ZW51ZV91c2QiLCJ2YWwiOiIwLjAwMDMifSx7Im5hbWUiOiJkaXNwbGF5X2FkX3ZpZXdwb3J0X3B4IiwidmFsIjoiMCJ9LHsibmFtZSI6ImRpc3BsYXlfYWRfdmlld3BvcnRfY291bnQiLCJ2YWwiOiIwIn0seyJuYW1lIjoibmF0aXZlX2FkX3ZpZXdwb3J0X3B4IiwidmFsIjoiMCJ9LHsibmFtZSI6Im5hdGl2ZV9hZF92aWV3cG9ydF9jb3VudCIsInZhbCI6IjAifSx7Im5hbWUiOiJkaXNwbGF5X2FkX2RvY19weCIsInZhbCI6IjAifSx7Im5hbWUiOiJkaXNwbGF5X2FkX2RvY19jb3VudCIsInZhbCI6IjIifSx7Im5hbWUiOiJuYXRpdmVfYWRfZG9jX3B4IiwidmFsIjoiMCJ9LHsibmFtZSI6Im5hdGl2ZV9hZF9kb2NfY291bnQiLCJ2YWwiOiIwIn0seyJuYW1lIjoidmlld3BvcnRfc2l6ZSIsInZhbCI6IjE2MDB4MTIwMCJ9LHsibmFtZSI6InZpZXdwb3J0X3B4IiwidmFsIjoiMTkyMDAwMCJ9LHsibmFtZSI6ImRvY19weCIsInZhbCI6IjM1OTM2MDAifSx7Im5hbWUiOiJkb2NfaGVpZ2h0IiwidmFsIjoiMjI0NiJ9LHsibmFtZSI6ImRpc3BsYXlfYWRfdmlld3BvcnRfcHgiLCJ2YWwiOiIxMzQ2NDAifSx7Im5hbWUiOiJkaXNwbGF5X2FkX3ZpZXdwb3J0X2NvdW50IiwidmFsIjoiMiJ9LHsibmFtZSI6Im5hdGl2ZV9hZF92aWV3cG9ydF9weCIsInZhbCI6IjAifSx7Im5hbWUiOiJuYXRpdmVfYWRfdmlld3BvcnRfY291bnQiLCJ2YWwiOiIwIn0seyJuYW1lIjoiZGlzcGxheV9hZF9kb2NfcHgiLCJ2YWwiOiIxMzQ2NDAifSx7Im5hbWUiOiJkaXNwbGF5X2FkX2RvY19jb3VudCIsInZhbCI6IjQifSx7Im5hbWUiOiJuYXRpdmVfYWRfZG9jX3B4IiwidmFsIjoiMCJ9LHsibmFtZSI6Im5hdGl2ZV9hZF9kb2NfY291bnQiLCJ2YWwiOiIwIn0seyJuYW1lIjoidmlld3BvcnRfc2l6ZSIsInZhbCI6IjE2MDB4MTIwMCJ9LHsibmFtZSI6InZpZXdwb3J0X3B4IiwidmFsIjoiMTkyMDAwMCJ9LHsibmFtZSI6ImRvY19weCIsInZhbCI6IjM1OTM2MDAifSx7Im5hbWUiOiJkb2NfaGVpZ2h0IiwidmFsIjoiMjI0NiJ9LHsibmFtZSI6ImVzdF9yZXZlbnVlX3VzZCIsInZhbCI6IjAuMDAwMDAyIn0seyJuYW1lIjoiZGlzcGxheV9hZF92aWV3cG9ydF9weCIsInZhbCI6IjI2OTI4MCJ9LHsibmFtZSI6ImRpc3BsYXlfYWRfdmlld3BvcnRfY291bnQiLCJ2YWwiOiI0In0seyJuYW1lIjoibmF0aXZlX2FkX3ZpZXdwb3J0X3B4IiwidmFsIjoiMCJ9LHsibmFtZSI6Im5hdGl2ZV9hZF92aWV3cG9ydF9jb3VudCIsInZhbCI6IjAifSx7Im5hbWUiOiJkaXNwbGF5X2FkX2RvY19weCIsInZhbCI6IjI2OTI4MCJ9LHsibmFtZSI6ImRpc3BsYXlfYWRfZG9jX2NvdW50IiwidmFsIjoiNiJ9LHsibmFtZSI6Im5hdGl2ZV9hZF9kb2NfcHgiLCJ2YWwiOiIwIn0seyJuYW1lIjoibmF0aXZlX2FkX2RvY19jb3VudCIsInZhbCI6IjAifSx7Im5hbWUiOiJ2aWV3cG9ydF9zaXplIiwidmFsIjoiMTYwMHgxMjAwIn0seyJuYW1lIjoidmlld3BvcnRfcHgiLCJ2YWwiOiIxOTIwMDAwIn0seyJuYW1lIjoiZG9jX3B4IiwidmFsIjoiMzU5MzYwMCJ9LHsibmFtZSI6ImRvY19oZWlnaHQiLCJ2YWwiOiIyMjQ2In0seyJuYW1lIjoiZGlzcGxheV9hZF92aWV3cG9ydF9weCIsInZhbCI6IjQwMzkyMCJ9LHsibmFtZSI6ImRpc3BsYXlfYWRfdmlld3BvcnRfY291bnQiLCJ2YWwiOiI2In0seyJuYW1lIjoibmF0aXZlX2FkX3ZpZXdwb3J0X3B4IiwidmFsIjoiMCJ9LHsibmFtZSI6Im5hdGl2ZV9hZF92aWV3cG9ydF9jb3VudCIsInZhbCI6IjAifSx7Im5hbWUiOiJkaXNwbGF5X2FkX2RvY19weCIsInZhbCI6IjQwMzkyMCJ9LHsibmFtZSI6ImRpc3BsYXlfYWRfZG9jX2NvdW50IiwidmFsIjoiOCJ9LHsibmFtZSI6Im5hdGl2ZV9hZF9kb2NfcHgiLCJ2YWwiOiIwIn0seyJuYW1lIjoibmF0aXZlX2FkX2RvY19jb3VudCIsInZhbCI6IjAifSx7Im5hbWUiOiJ2aWV3cG9ydF9zaXplIiwidmFsIjoiMTYwMHgxMjAwIn0seyJuYW1lIjoidmlld3BvcnRfcHgiLCJ2YWwiOiIxOTIwMDAwIn0seyJuYW1lIjoiZG9jX3B4IiwidmFsIjoiMzU5MzYwMCJ9LHsibmFtZSI6ImRvY19oZWlnaHQiLCJ2YWwiOiIyMjQ2In1dfV0=
Requested by
Host:
URL: ez-standalone.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2406:da18:9d0:143f:2124:4e9c:36a9:d9de Singapore, Singapore, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

expires
Fri, 12 Jun 2026 12:39:04 GMT
access-control-allow-origin
https://www.mediafire.com
cache-control
private, max-age=0, must-revalidate, no-cache, no-store
date
Sat, 13 Jun 2026 12:39:04 GMT
x-middleton-display
ezp_sol
vary
Accept-Encoding

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
id.crwdcntrl.net
URL
https://id.crwdcntrl.net/id?gdpr_applies=false
Domain
securepubads.g.doubleclick.net
URL
https://securepubads.g.doubleclick.net/pagead/adview?ai=C4IhZWk8tatOxEMPejeYPu5uw2QOH9IDRhwHc6_Lm6BX4r5SYQxABIPT5xiVgifPFhPQToAGcuMeXA8gBAqkCQUZt63DNOj7gAgCoAwHIAwiqBIUDT9Az2P-22eDdJwHJvZJn-5h7mqF9Ly0M7QrbsxuVbabyMdnTOPzPb6BmNOXXYKrRL3njm_Ey4svu43p1H5HH5uZ5--M1Bc65V9QFC30D5xL6vWwqeJt_X89UYyrSsLIKBOMOVN67pop0RQI_LNQvIn3SsMRNusEFIr5-xl9hTyWaulHxt1XbVqwA2SRnlba7c33MnZHSHNJE1uAT_mQ-xg1zOGBiOqODLNuJtjlLwfzRe9fMrLd8xA8IaZJSugVNqaN_Ebfw7AuBkITwyCfioo5lciiNQgX6ovEc0B3W9AlMnZy90zgqTdtAF13K0UC_slR1ECvlPLpP0JvMLw3fCnKpZO5VAwM5s-HLl9UpkZ7cbQURmpRXo4cKz6LTAQByHXGb1EpeGEWWDet1xiODX_nAtz6DXmH5ZtmqmI0JoQhlnVEaYq-tOtxI0xgjV21UME0Ru7GlmlMlPVSgkuNI8Hs-LEsgyt0w_ualQcseqht7TcPmICRID8I8KQZpOCVHGAAIOATABKefk5ypBeAEAYgFn_eU2lSSBQQIBBgBkgUECAUYBKAGAoAHzMe4aKgHp8yxAqgH4tixAqgHpr4bqAfMzrECqAfz0RuoB5bYG6gHqpuxAqgHjs4bqAeT2BuoB_DgG6gH7paxAqgH_p6xAqgHr76xAqgH1ckbqAfZtrECqAf3wrEC2AcB8gcEEOi8GNIIMgiAYRABGB0yCIqCgICAgIAIOg-AQIDAgICAgKiAAqiDgBBIvf3BOliSm8qAnoSVA2ABgAoDyAsBogwDkAEBqg0CSlDiDRMIs_vKgJ6ElQMVQ2_DBh27DSw76g0TCKLsy4CehJUDFUNvwwYduw0sO4gO____________AdgTDNAVAZgWAcoWAgoA-BYBgBcBshcuChwIABIUcHViLTE5NjY3MjExOTI3MDk2MDYYvskHGAEqCjMzNDUzODM3NzRQBroXAjgBqhgXCQAAAACgeRhBEgozMzQ1MzgzNzc0GAGyGAkSArBTGAIiAQDQGAHoGAHCGQIIAQ&sigh=UURE8Elmwpw&uach_m=%5BUACH%5D&cid=CAQSmQIAEQoqgcsDN8q9GKkqph7aLk_HHpjOscPA47zSg2OmqU3nxvJSgfdIr4kZoAKVMmUCADUoOFDLH9nN3A8FZtuAKvlUKHoBJER61vw6cEH0aM_naWTWweoVtBYN9EsAy9ErSACkJ13emXE56W_1qjk17tuvxEuFr4x7DT0E2-Fa1I2uepudwDwUslJalsmDIEIVi3g-ovO6OznXSnUjtT9sxDnhPAasWhujrbz6DbyzOMTVKerCVJnXMnaiNTyywhkLpkFikjdcxn-x3fC143gc1Qp9MQi7rvCbgdHAdYpiJqfz5u0sexsNUK0-CLrNOuPb0DjcwLIqhMVWp30XnEoLu6G2QAU-U3QTqNeA_xaKfOytWLdyx28dMhgB&ebtr=1
Domain
googleads.g.doubleclick.net
URL
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Domain
securepubads.g.doubleclick.net
URL
https://securepubads.g.doubleclick.net/btr/view?ai=C4IhZWk8tatOxEMPejeYPu5uw2QOH9IDRhwHc6_Lm6BX4r5SYQxABIPT5xiVgifPFhPQToAGcuMeXA8gBAqkCQUZt63DNOj7gAgCoAwHIAwiqBIUDT9Az2P-22eDdJwHJvZJn-5h7mqF9Ly0M7QrbsxuVbabyMdnTOPzPb6BmNOXXYKrRL3njm_Ey4svu43p1H5HH5uZ5--M1Bc65V9QFC30D5xL6vWwqeJt_X89UYyrSsLIKBOMOVN67pop0RQI_LNQvIn3SsMRNusEFIr5-xl9hTyWaulHxt1XbVqwA2SRnlba7c33MnZHSHNJE1uAT_mQ-xg1zOGBiOqODLNuJtjlLwfzRe9fMrLd8xA8IaZJSugVNqaN_Ebfw7AuBkITwyCfioo5lciiNQgX6ovEc0B3W9AlMnZy90zgqTdtAF13K0UC_slR1ECvlPLpP0JvMLw3fCnKpZO5VAwM5s-HLl9UpkZ7cbQURmpRXo4cKz6LTAQByHXGb1EpeGEWWDet1xiODX_nAtz6DXmH5ZtmqmI0JoQhlnVEaYq-tOtxI0xgjV21UME0Ru7GlmlMlPVSgkuNI8Hs-LEsgyt0w_ualQcseqht7TcPmICRID8I8KQZpOCVHGAAIOATABKefk5ypBeAEAYgFn_eU2lSSBQQIBBgBkgUECAUYBKAGAoAHzMe4aKgHp8yxAqgH4tixAqgHpr4bqAfMzrECqAfz0RuoB5bYG6gHqpuxAqgHjs4bqAeT2BuoB_DgG6gH7paxAqgH_p6xAqgHr76xAqgH1ckbqAfZtrECqAf3wrEC2AcB8gcEEOi8GNIIMgiAYRABGB0yCIqCgICAgIAIOg-AQIDAgICAgKiAAqiDgBBIvf3BOliSm8qAnoSVA2ABgAoDyAsBogwDkAEBqg0CSlDiDRMIs_vKgJ6ElQMVQ2_DBh27DSw76g0TCKLsy4CehJUDFUNvwwYduw0sO4gO____________AdgTDNAVAZgWAcoWAgoA-BYBgBcBshcuChwIABIUcHViLTE5NjY3MjExOTI3MDk2MDYYvskHGAEqCjMzNDUzODM3NzRQBroXAjgBqhgXCQAAAACgeRhBEgozMzQ1MzgzNzc0GAGyGAkSArBTGAIiAQDQGAHoGAHCGQIIAQ&sigh=UURE8Elmwpw&uach_m=%5B%5D&cid=CAQSmQIAEQoqgcsDN8q9GKkqph7aLk_HHpjOscPA47zSg2OmqU3nxvJSgfdIr4kZoAKVMmUCADUoOFDLH9nN3A8FZtuAKvlUKHoBJER61vw6cEH0aM_naWTWweoVtBYN9EsAy9ErSACkJ13emXE56W_1qjk17tuvxEuFr4x7DT0E2-Fa1I2uepudwDwUslJalsmDIEIVi3g-ovO6OznXSnUjtT9sxDnhPAasWhujrbz6DbyzOMTVKerCVJnXMnaiNTyywhkLpkFikjdcxn-x3fC143gc1Qp9MQi7rvCbgdHAdYpiJqfz5u0sexsNUK0-CLrNOuPb0DjcwLIqhMVWp30XnEoLu6G2QAU-U3QTqNeA_xaKfOytWLdyx28dMhgB&ibtr=1
Domain
ps.eyeota.net
URL
https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&bid=1mpr7m0&r=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F123%2F1%2F8.gif%3Fpuid%3D%7BUUID%7D%26gdpr%3D0%26gdpr_consent%3D
Domain
www.google.com
URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaTdRRzsylbthuyXmeymHMO32NBZkoi4vLE072CC8E0X3XqPnTiBxPzIhkY3uZ223wBRIqZyKL81_wVR5JhB9kQUk-DLcA
Domain
securepubads.g.doubleclick.net
URL
https://securepubads.g.doubleclick.net/pagead/adview?ai=CyvJ3W08taqPODYKWjeYP_77SkQvHr6S8hwHXjNWq7hXt65DylkgQASD0-cYlYInzxYT0E6ABnLjHlwPIAQOpAkFGbetwzTo-4AIAqAMByAMIqgSDA0_QO6rCpPoi63QLnOGDYu8Nvtj4WcHBqHytYmWml9EWHk5SNdMb1ks3AzEmIrzUNXkdIGwMHPDiiXDYyGFOmRjQK0TphgNOh3Xaoi8K8FW6aNzTuCg-fLx4taa4ztElW3jsu6cvS2kG13_L3oAQx19xiGiq2he7ofi-hwy-k1rlpunfOVsqEsaSjVroM7dDpROixcmN5L1bZNsPgnJGilINVgwcpmQiR1ryz7BQHHlDYX2W6-DHl8NWIaU2D81Kjb-xeJShFXFKkzpmoHLebgMxL6Rkk3Sy_aql2Y5KBH4nAVLW1oOoNZsXDpwRz9h5dAL4Yr7VTKIoSktFTZS7BqtaO_fCK96-IXwsfkUS2E6suzBdwjEZHJD8tguqLdNd8SvBXnzI66fyiTBpqDoKHnzj3eXT8I0lLzBfmgNye0MgTJ5Z_R53_xNZfCGmnjJQomE-Vk07EuT_JdDs3mOdzqNbeIQQ2MZT-juHkT_pr8kAWrg-KM3i7H4BewJuF4_Qv1nhS8AE05WPkOMF4AQBiAXGubG-WJIFBAgEGAGSBQQIBRgEoAYDgAfMx7hoqAenzLECqAfi2LECqAemvhuoB8zOsQKoB_PRG6gHltgbqAeqm7ECqAeOzhuoB5PYG6gH8OAbqAfulrECqAf-nrECqAevvrECqAfVyRuoB9m2sQKoB_fCsQLYBwHyBwQQyK8S0ggyCIBhEAEYHTIIioKAgICAgAg6D4BAgMCAgICAqIACqIOAEEi9_cE6WKTIhYGehJUDYAGACgPICwGiDAOQAQGqDQJKUOINEwjq7IWBnoSVAxUCS8MGHX-fNLLqDRMI3sKGgZ6ElQMVAkvDBh1_nzSyiA7___________8B2BMM0BUBmBYByhYCCgD4FgGAFwGyFy4KHAgAEhRwdWItMTk2NjcyMTE5MjcwOTYwNhi-yQcYASoKMzM0NTM4Mzc3NFAGuhcCOAGqGBcJAAAAACBfEkESCjMzNDUzODM3NzQYAbIYCRICsFMYAyIBANAYAegYAcIZAggB&sigh=stwqWz7EUB8&uach_m=%5BUACH%5D&cid=CAQShgIAEQoqgXoZDjiwdmAR3lLp8alT61ZPEE4phptS_GL4pOSpMyvKF_Gf3fUC-RmhCw3eSwiHWTYkCdKoWyqMryDZLpATpQqehux2qQhbzQ9L1qahcPc7DJRtzpZENK7OGG1LDSKWqkea5Eq2g-Egc4RlU2kw_Q_oo9s3Vp8PAmI2DGojgKemmCO020hBLzT0SJRHYK5gYtwyzaGU4RlMrnYR6allZH4ZwZOkAit3rW3RyEbWjZjfyXDYLCi8K7uCfX31t9rkoI0H4MmyYm9douYy4lALsHpDtR0HuO_GzTFugUi3-_b4Bl0POyq_yZdC0pYac8S5-cLmmDZA5fMtbt6xEJNBqOFyGAE&ebtr=1
Domain
securepubads.g.doubleclick.net
URL
https://securepubads.g.doubleclick.net/btr/view?ai=CyvJ3W08taqPODYKWjeYP_77SkQvHr6S8hwHXjNWq7hXt65DylkgQASD0-cYlYInzxYT0E6ABnLjHlwPIAQOpAkFGbetwzTo-4AIAqAMByAMIqgSDA0_QO6rCpPoi63QLnOGDYu8Nvtj4WcHBqHytYmWml9EWHk5SNdMb1ks3AzEmIrzUNXkdIGwMHPDiiXDYyGFOmRjQK0TphgNOh3Xaoi8K8FW6aNzTuCg-fLx4taa4ztElW3jsu6cvS2kG13_L3oAQx19xiGiq2he7ofi-hwy-k1rlpunfOVsqEsaSjVroM7dDpROixcmN5L1bZNsPgnJGilINVgwcpmQiR1ryz7BQHHlDYX2W6-DHl8NWIaU2D81Kjb-xeJShFXFKkzpmoHLebgMxL6Rkk3Sy_aql2Y5KBH4nAVLW1oOoNZsXDpwRz9h5dAL4Yr7VTKIoSktFTZS7BqtaO_fCK96-IXwsfkUS2E6suzBdwjEZHJD8tguqLdNd8SvBXnzI66fyiTBpqDoKHnzj3eXT8I0lLzBfmgNye0MgTJ5Z_R53_xNZfCGmnjJQomE-Vk07EuT_JdDs3mOdzqNbeIQQ2MZT-juHkT_pr8kAWrg-KM3i7H4BewJuF4_Qv1nhS8AE05WPkOMF4AQBiAXGubG-WJIFBAgEGAGSBQQIBRgEoAYDgAfMx7hoqAenzLECqAfi2LECqAemvhuoB8zOsQKoB_PRG6gHltgbqAeqm7ECqAeOzhuoB5PYG6gH8OAbqAfulrECqAf-nrECqAevvrECqAfVyRuoB9m2sQKoB_fCsQLYBwHyBwQQyK8S0ggyCIBhEAEYHTIIioKAgICAgAg6D4BAgMCAgICAqIACqIOAEEi9_cE6WKTIhYGehJUDYAGACgPICwGiDAOQAQGqDQJKUOINEwjq7IWBnoSVAxUCS8MGHX-fNLLqDRMI3sKGgZ6ElQMVAkvDBh1_nzSyiA7___________8B2BMM0BUBmBYByhYCCgD4FgGAFwGyFy4KHAgAEhRwdWItMTk2NjcyMTE5MjcwOTYwNhi-yQcYASoKMzM0NTM4Mzc3NFAGuhcCOAGqGBcJAAAAACBfEkESCjMzNDUzODM3NzQYAbIYCRICsFMYAyIBANAYAegYAcIZAggB&sigh=stwqWz7EUB8&uach_m=%5B%5D&cid=CAQShgIAEQoqgXoZDjiwdmAR3lLp8alT61ZPEE4phptS_GL4pOSpMyvKF_Gf3fUC-RmhCw3eSwiHWTYkCdKoWyqMryDZLpATpQqehux2qQhbzQ9L1qahcPc7DJRtzpZENK7OGG1LDSKWqkea5Eq2g-Egc4RlU2kw_Q_oo9s3Vp8PAmI2DGojgKemmCO020hBLzT0SJRHYK5gYtwyzaGU4RlMrnYR6allZH4ZwZOkAit3rW3RyEbWjZjfyXDYLCi8K7uCfX31t9rkoI0H4MmyYm9douYy4lALsHpDtR0HuO_GzTFugUi3-_b4Bl0POyq_yZdC0pYac8S5-cLmmDZA5fMtbt6xEJNBqOFyGAE&ibtr=1
Domain
www.google.com
URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaRPEQp7cxdpBlaN86cRXPfpmT0xpjZliF_XuVo38wLx0hJ4nTXEwkia5E7DClvYXn_9tH3jaX6IhGtVNKFyO4W9FKR46g
Domain
securepubads.g.doubleclick.net
URL
https://securepubads.g.doubleclick.net/pagead/adview?ai=C-ZrUYE8taoruD-vzjeYP642GkQHHr6S8hwHHidWq7hXt65DylkgQASD0-cYlYInzxYT0E6ABnLjHlwPIAQOpAkFGbetwzTo-4AIAqAMByAMIqgSDA0_QbypgzaYMnjcdjBrXHBk-grzSizcnmdc20ODcso3hUUutIv5Zx9iUW1dWAchjDfijLTUzW8r3-iecdOzoKYpW2Tgy7Do4ezOdQkCnvCah3nVVCtVP3G71HKpPD7bwGeWNH7BCzASnpFwRVOG3MXZxCiHC9UeyfMoKUcEXyrSEe1XuPFFKMSIHc6cBBK_2entTD86eMvXTksCmWbpvoG1m0PFxT9uhnRmBcMGlhEYcj9BqRT2vTAhcXzIWrmKLoHzJcqpNlSR-NiIrWVBrbbZ-5SFSEQcDcZw8TqpOZC9Lh8shKmxDtisLYnSEJ0lR0QsOJL2yPdPxxKfm8gZQ3xertbYVxqgOOcXO_7PJKPleLrJXHNKHSJDb8zQ7y8bQyQyDtCPF7NrvnGgZobrduFl9uQYKkUQOr1Z_OZpZU9Ucvkv3wyESqoTo_19cxoiPiWPrSR8mS01xUSBV71vXkEBMrHqgeLF3utZHnknFNtNr8_fhGL1-gFhMyJZuGa7cRKLv88AE05WPkOMF4AQBiAXGubG-WJIFBAgEGAGSBQQIBRgEoAYDgAfMx7hoqAenzLECqAfi2LECqAemvhuoB8zOsQKoB_PRG6gHltgbqAeqm7ECqAeOzhuoB5PYG6gH8OAbqAfulrECqAf-nrECqAevvrECqAfVyRuoB9m2sQKoB_fCsQLYBwHyBwQQiJUG0ggyCIBhEAEYHTIIioKAgICAgAg6D4BAgMCAgICAqIACqIOAEEi9_cE6WLLouIOehJUDYAGACgPICwGiDAOQAQGqDQJKUOINEwiDlLmDnoSVAxXrecMGHeuGIRLqDRMIzP65g56ElQMV63nDBh3rhiESiA7___________8B2BMM0BUBmBYByhYCCgD4FgGAFwGyFy4KHAgAEhRwdWItMTk2NjcyMTE5MjcwOTYwNhi-yQcYASoKMzM0NTM4Mzc3NFAGuhcCOAGqGBcJAAAAAICo-EASCjMzNDUzODM3NzQYAbIYCRICsFMYAyIBANAYAegYAcIZAggB&sigh=Ji5sku4Mhgc&uach_m=%5BUACH%5D&cid=CAQShgIAEQoqgZd6WgId4gnIf8RTdpIGuS1ffNHv7XZQJl3odRVFX6fOck9nqs_PxzrOVdKdn_rC7FmiFRBHQPVgWiS_xzWUfNcY7_zqjATbAa0sESMq5Q5VQ35quMUnO_MbnlqOAxR7fxJw5AA94IqjCSsz5qR_jHCdA1Ja5VwiM6UN6KwM9kB4N0AD14FmzpCgA6r1vO9KohsoJh2hn42GhH-1r5tnKWvT8nUl1_vRH10SpKtXdVfbcqirvcCTz-emIyb5WeJ603vLKpguWWd72XEriGrFmjFUq_NRvR7QRkHqZ6VADmuzMadqaCzOBwNqkB0bNMVF3ubZMO7p4a0pToe5TTv87hExGAE&ebtr=1
Domain
securepubads.g.doubleclick.net
URL
https://securepubads.g.doubleclick.net/btr/view?ai=C-ZrUYE8taoruD-vzjeYP642GkQHHr6S8hwHHidWq7hXt65DylkgQASD0-cYlYInzxYT0E6ABnLjHlwPIAQOpAkFGbetwzTo-4AIAqAMByAMIqgSDA0_QbypgzaYMnjcdjBrXHBk-grzSizcnmdc20ODcso3hUUutIv5Zx9iUW1dWAchjDfijLTUzW8r3-iecdOzoKYpW2Tgy7Do4ezOdQkCnvCah3nVVCtVP3G71HKpPD7bwGeWNH7BCzASnpFwRVOG3MXZxCiHC9UeyfMoKUcEXyrSEe1XuPFFKMSIHc6cBBK_2entTD86eMvXTksCmWbpvoG1m0PFxT9uhnRmBcMGlhEYcj9BqRT2vTAhcXzIWrmKLoHzJcqpNlSR-NiIrWVBrbbZ-5SFSEQcDcZw8TqpOZC9Lh8shKmxDtisLYnSEJ0lR0QsOJL2yPdPxxKfm8gZQ3xertbYVxqgOOcXO_7PJKPleLrJXHNKHSJDb8zQ7y8bQyQyDtCPF7NrvnGgZobrduFl9uQYKkUQOr1Z_OZpZU9Ucvkv3wyESqoTo_19cxoiPiWPrSR8mS01xUSBV71vXkEBMrHqgeLF3utZHnknFNtNr8_fhGL1-gFhMyJZuGa7cRKLv88AE05WPkOMF4AQBiAXGubG-WJIFBAgEGAGSBQQIBRgEoAYDgAfMx7hoqAenzLECqAfi2LECqAemvhuoB8zOsQKoB_PRG6gHltgbqAeqm7ECqAeOzhuoB5PYG6gH8OAbqAfulrECqAf-nrECqAevvrECqAfVyRuoB9m2sQKoB_fCsQLYBwHyBwQQiJUG0ggyCIBhEAEYHTIIioKAgICAgAg6D4BAgMCAgICAqIACqIOAEEi9_cE6WLLouIOehJUDYAGACgPICwGiDAOQAQGqDQJKUOINEwiDlLmDnoSVAxXrecMGHeuGIRLqDRMIzP65g56ElQMV63nDBh3rhiESiA7___________8B2BMM0BUBmBYByhYCCgD4FgGAFwGyFy4KHAgAEhRwdWItMTk2NjcyMTE5MjcwOTYwNhi-yQcYASoKMzM0NTM4Mzc3NFAGuhcCOAGqGBcJAAAAAICo-EASCjMzNDUzODM3NzQYAbIYCRICsFMYAyIBANAYAegYAcIZAggB&sigh=Ji5sku4Mhgc&uach_m=%5B%5D&cid=CAQShgIAEQoqgZd6WgId4gnIf8RTdpIGuS1ffNHv7XZQJl3odRVFX6fOck9nqs_PxzrOVdKdn_rC7FmiFRBHQPVgWiS_xzWUfNcY7_zqjATbAa0sESMq5Q5VQ35quMUnO_MbnlqOAxR7fxJw5AA94IqjCSsz5qR_jHCdA1Ja5VwiM6UN6KwM9kB4N0AD14FmzpCgA6r1vO9KohsoJh2hn42GhH-1r5tnKWvT8nUl1_vRH10SpKtXdVfbcqirvcCTz-emIyb5WeJ603vLKpguWWd72XEriGrFmjFUq_NRvR7QRkHqZ6VADmuzMadqaCzOBwNqkB0bNMVF3ubZMO7p4a0pToe5TTv87hExGAE&ibtr=1
Domain
translate.googleapis.com
URL
https://translate.googleapis.com/element/log?format=json&hasfast=true&authuser=0
Domain
translate.googleapis.com
URL
https://translate.googleapis.com/element/log?format=json&hasfast=true&authuser=0

Verdicts & Comments Add Verdict or Comment

419 JavaScript Window variables

These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| 6 object| 7 object| 8 object| 9 object| 10 object| 11 object| 12 boolean| displayAds function| __tcfapi object| ezTcfConsent object| ezCMPQueue function| __setCMPv2RequestData function| __getCMPv2InitialSelectedLanguage function| setupEzTcfApi function| _emitEzConsentEvent object| _CMPv2RequestData object| ezstandalone object| googletag string| sAdSupplier string| sStartSrc object| adLazyLoadQueue function| fLoadGoogleAds function| checkEzoicSplitResult function| gtag object| dataLayer object| amp object| amplitude function| initDownload function| countDown function| upgradeToUltra object| sticky object| compatSelect object| compat object| nonCompat function| googFooterTranslate object| __AMPLITUDE__ object| __bt_edge_data object| __bt object| __bt_intrnl boolean| __bt_already_invoked object| __bt_tag_d object| regeneratorRuntime object| _ez boolean| __ezStandaloneMessageListenerAdded boolean| _ez_sa boolean| __ezOrcaPreloaded string| _ezStandalonePageViewId string| ezAnalyticsDefine string| ezStandaloneCookies object| __ez string| ez__tacApiKey object| _ezaq number| did string| ezoTemplate function| create_ezolpl function| attach_ezolpl function| __ezDotData string| __ezScriptHost string| ezdomain boolean| userInEzoicSample boolean| bEzoicSelected function| isInRect function| getDownloadUrl object| allowed object| el function| rAb function| InfCustomFPSTAMobileFunc function| InfCustomSTAMobileFunc function| InfCustomFPSTAFunc function| InfCustomerCallback function| InfPreFastPopAttachCallback function| InfSkipBindDocumentClick function| InfMediafireMobileFunc number| iAdCountInterval function| acceptCookieFooter function| reloadPage function| noop function| ClearStatusMessages function| setCookieSeconds function| Re function| aU function| setCookie function| getCookie function| loadHotjar function| registerGoogleLang function| trackDownloadEvent function| closeStatusMessage function| showStatusMessage object| upgradeWidget function| downloadOptIn function| showTDOptInDialog function| closeMobileTD function| trackTurboDownload function| showDesktopDownloadArrow function| hideDesktopDownloadArrow function| onLegacyCopyLink function| openShareDialog function| saveToMyfiles function| copyShareLink function| startLazyLoad function| InfPreInterstitialProcessCallback function| InfClickEventCallback function| InfCustomerPopLoadedCallback function| MfUpdateCheckoutSource string| chkout_src_cookie object| storedData function| _DumpException object| default_tr object| _F_toggles_default_tr function| _exportVersion function| _getCallbackFunction function| _loadJs function| _loadCss function| _isNS function| _setupNS object| google object| __cfBeacon object| google_tag_data object| google_tag_manager string| GoogleAnalyticsObject function| ga object| FingerprintJS object| ezoicIdentity object| __ezAmazonPublisherAudience object| epbjs object| __ezDataCollector object| __ezTransUnion object| g367CB268B1094004A3689751E7AC568F function| UAParser object| closure_lm_950213 object| gaplugins object| gaGlobal object| gaData object| __id5_finalization_registry object| ID5 function| onYouTubeIframeAPIReady function| ezUnion string| ezStandaloneDefine string| ezStandaloneDisplay object| ezSelectedPlaceholders object| ezSelectedPlaceholdersMap number| ezDisplayAdMax object| ezasVars string| __sellerid string| __ez_nid string| __ez_gcb object| link function| ezjsps object| __s2sbidders object| __s2sinstreambidders object| __s2soutstreambidders object| __allBidders object| __allSiteApprovedBidders object| __ezExtraAuctionExcludedBidders object| __ezPrebidGeoTargeting string| ez__id5pd string| ez__uIdHash string| ez__sspDomain object| __advertiserRule object| ezoibfh object| ezaxmns object| ezaucmns function| __ez_init_slot object| divNode object| parentNode object| _ezim_d object| ezS string| ezAnchorPosition number| __ez_edge_mw string| __ez_edge_v string| __ez_edge_h function| handleResponsiveAdsense object| google_reactive_ads_global_state function| ezasBuild function| ezasvEvent function| ezaslEvent object| ezaslWatch object| ezoSTPixels function| ezoSTPixelAdd function| ezoGetSlotById function| ezoSTPixelFire object| ezOrca boolean| ezhbopt function| __ez_get_largest_ad_size function| ezogetbrkey string| ezoadxnc string| ezoadhb object| __ezAdRewardTranslations object| __banger_pmp_deals function| _ezAnchorCompTriggerUpdate function| __ez_fad_position object| ez_ad_units object| IL11ILILIIlLLLILILLLLIILLLIIL11111LLILiiLIliLlILlLiiLLIiILL function| __ez_close_anchor object| id5_pbjs_et object| pbjs function| getEzConsentData string| _audins_dom number| _audins_did function| _setEzCookies function| addEzCookies object| ezCookieQueue object| ggeac object| google_js_reporting_queue object| epbjsChunk object| _pbjsGlobals object| __ezoicPrebidAdapter object| mnet function| sidebarWall function| __ez_close_rail function| __ez_handle_rail_loaded object| __ezsbwcmd object| __ezct object| ezdent object| ezDenty function| ez_attachEvent function| ez_attachEventWithCapture function| ez_detachEvent function| ez_getQueryString object| _ezfd object| ezRBA function| uglipop object| PrebidImpressionController function| PrebidImpression object| ezoptbid boolean| __ezOpenRtbEIDInjectorInstalled function| getSlotForhb function| epbjsRequestAdUnits function| epbjsBidRequest function| getOrtb2BannerPos function| epbjsApplyResponsiveSizes function| epbjsRefreshSlot function| isValid256Hash object| D9v object| D9r object| __epbjsConfigReady function| triggerPbjsAdWin boolean| __epbjsReady object| magnite object| ez_pel_cmd number| google_unique_id object| ezoicEvent function| reportEzError function| reportEzReqError object| metricNameMap function| ezlogVital object| webVitals function| initEzux object| riveted object| ezux object| id5Prebid string| send object| d9PendingXDR object| criteo_syncframe_state object| criteo_pubtag object| criteo_identitytag_107209 object| Criteo object| Criteo_identitytag_107209 function| lotameIsCompatible function| sync16589_aa function| sync16589_c function| sync16589_ca object| sync16589_g function| sync16589_h function| sync16589_ea function| sync16589_ha object| sync16589_ object| sync16589_na object| sync16589_oa object| sync16589_p object| sync16589_Ba function| sync16589_a function| sync16589_b function| sync16589_f function| sync16589_da function| sync16589_fa function| sync16589_i function| sync16589_ga function| sync16589_j function| sync16589_k function| sync16589_l function| sync16589_ia function| sync16589_m function| sync16589_n function| sync16589_o function| sync16589_ka function| sync16589_ja function| sync16589_la function| sync16589_ma function| sync16589_q function| sync16589_s function| sync16589_t function| sync16589_u function| sync16589_pa function| sync16589_qa function| sync16589_v function| sync16589_ra function| sync16589_w function| sync16589_x function| sync16589_r function| sync16589_z function| sync16589_sa function| sync16589_ta function| sync16589_ua function| sync16589_A function| sync16589_B function| sync16589_C function| sync16589_va function| sync16589_D function| sync16589_E function| sync16589_F function| sync16589_H function| sync16589_J function| sync16589_I function| sync16589_K function| sync16589_L function| sync16589_G function| sync16589_wa function| sync16589_xa function| sync16589_ya function| sync16589_za function| sync16589_Aa function| sync16589_M function| sync16589_N function| sync16589_Ca function| sync16589_O function| sync16589_Da function| sync16589_Ea function| sync16589_Fa function| sync16589_P function| sync16589_Ga function| sync16589_Ha function| sync16589_Ia function| sync16589_Ja function| sync16589_Q function| sync16589_Ka function| sync16589_R function| sync16589_S function| sync16589_T function| sync16589_U function| sync16589_La function| sync16589_V function| sync16589_W function| sync16589_X function| sync16589_Y function| sync16589_Z function| sync16589__ function| sync16589_0 function| sync16589_Ma function| sync16589_1 function| sync16589_Oa function| sync16589_Na function| sync16589_2 function| sync16589_Qa function| sync16589_Ra function| sync16589_Pa function| sync16589_Sa function| sync16589_Va function| sync16589_Ua function| sync16589_Ta function| sync16589_Xa function| sync16589_Za function| sync16589_Wa function| sync16589_5 function| sync16589_Ya function| sync16589_1a function| sync16589_2a function| sync16589_0a function| sync16589__a function| sync16589_6 function| sync16589_3 function| sync16589_4 function| sync16589_7 function| sync16589_8 function| sync16589_3a function| sync16589_4a function| sync16589_5a function| sync16589_6a function| sync16589_9 function| sync16589_7a function| sync16589_$ function| sync16589_8a function| sync16589_9a function| sync16589_$a object| lotame_sync_16589 object| ox_esp object| firedEvents object| ezRewardedAds object| signal_decrypted object| ampInaboxPositionObserver object| ampInaboxFrameOverlayManager object| _ccScriptSettings object| _ccLauncherSettings object| ccao object| cca object| _ccReady object| _ccApiReady object| carbonApi object| carbon object| perf_vals object| GoogleGcLKhOms function| privacyCallback string| _carbonUID object| carbonUIDCache object| carbonReady object| google_image_requests object| _ccSettings object| ccRefresh function| slotElementAttachClick function| buildGtmEventData object| _qevents function| quantserve function| __qc

134 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path Expires Name / Value
www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk 1969-12-31
23:59:59
Name: g36FastPopSessionRequestNumber
Value: 1
www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk 1970-01-21
23:34:50
Name: ezux_lpl_484470
Value: 1781354330803|42e2e4c1-98f1-4abb-9be0-036842cc9dfd|false
.mediafire.com/ 1970-01-22
00:25:14
Name: ukey
Value: 09kb5kfmw3buu2qt9x52cv60b270c76y
.mediafire.com/ 1970-01-21
14:53:33
Name: 41v2
Value: 1
.mediafire.com/ 1970-01-21
15:32:26
Name: conv_tracking_data-2
Value: %7B%22mf_source%22%3A%22regular_download-59%22%2C%22mf_content%22%3A%22Free%22%2C%22mf_medium%22%3A%22linux%5C%2FChrome%22%2C%22mf_campaign%22%3A%2241kkjh07tibblti%22%2C%22mf_term%22%3A%22a060a64957a4df397707dfc48bbc13df%22%7D
.mediafire.com/ 1970-01-21
23:34:50
Name: amp_28916b
Value: u-F2pTHYffxAM84XOUbYLI...1jr0frshe.1jr0frshf.0.1.1
.mediafire.com/ 1970-01-21
14:49:15
Name: ezfs_484470
Value: 1921962356
.mediafire.com/ 1970-01-21
14:49:21
Name: ezoab_484470
Value: mod1
.mediafire.com/ 1970-01-21
14:52:07
Name: ezovuuidtime_484470
Value: 1781354328
.mediafire.com/ 1970-01-21
14:49:16
Name: lp_484470
Value: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125
.mediafire.com/ 1970-01-21
14:49:16
Name: ezovuuid_484470
Value: aa69c79a-daa9-436c-70c7-3fe25eca2350
.mediafire.com/ 1970-01-21
14:49:16
Name: ezoref_484470
Value:
www.mediafire.com/ 1970-01-21
14:52:07
Name: ezstandaloneuser
Value: true
www.mediafire.com/ 1970-01-21
14:59:19
Name: chkout_src
Value: eyJ0ZW1wbGF0ZUlkIjoiNTkiLCJydWxlSWQiOiIxMTkifQ%3D%3D
.mediafire.com/ 1970-01-21
23:34:50
Name: cf_clearance
Value: pHDyo49ldSlKmM9o7erjN4A0_lxt5alSVG4fGVMvzQw-1781354329-1.2.1.1-l2Cq.7trikS81pdq48bqGoSwbioQzvIk_tNg0nhcEP8MXlkTEtAy_eP2l9wCFwz5iOJDCQ4yfgt_vwEEopevvoinxkekfig8f2gI8BX50AmzvnRJ49zzBSsfNwLvATUQkNxYg0ntVbwAQOh_c4I0dK9quuP0Fc2eDPvrFhwEjduLnTKVG9YRN.LQkPOYAZCeiYVoO.ZEtPpLmp4lgvc.iKtvpyzv.5CEiVbjmoKgLGuhuHekuCWtMoK5gSeckGIMOxOITUkoIwCJuAKeUBTayfz5PmfqFRc9_WRYB3OWzjaXFOsl18eFKvu9NXccSgRfhJ.PHc5wuzvyhZvr2dr1wA
.mediafire.com/ 1970-01-21
14:49:16
Name: __cf_bm
Value: rgsxws_epmeWyZmSMMvzWEiuhIe.iYiN7LfLZR5kgwE-1781354329.3426564-1.0.1.1-1FvEYjXcTEXy29E3vdI0jw.B.KK3LyoHzIUSJVsTRlh3HI_a7xYvsC7HCoM.rsaWC2Jo5_UbkNTPBTxuWzhLbo2.LWnI_v10YKtVBVhXNLXTugEf7b1lssmYzU1.gbDN
.ezoic.net/ 1970-01-21
23:34:50
Name: ezoid
Value: 5bab178f-235b-4157-6379-f8a0d2f50979
.mediafire.com/ 1970-01-21
14:50:40
Name: _gid
Value: GA1.2.1545355754.1781354330
.mediafire.com/ 1970-01-21
14:49:14
Name: _gat_gtag_UA_829541_1
Value: 1
econventa.com/ 1969-12-31
23:59:59
Name: IKSR
Value: %7B%7D
econventa.com/ 1969-12-31
23:59:59
Name: INF_DFL8
Value: false
econventa.com/ 1970-01-22
00:25:14
Name: IUID
Value: 88f9d43a-720c-4ffc-9a5c-325d993bea9e
econventa.com/ 1969-12-31
23:59:59
Name: ISSH
Value: 840056
econventa.com/ 1969-12-31
23:59:59
Name: VMI
Value:
econventa.com/ 1970-01-22
00:25:14
Name: IPLH
Value: %23%7B%7D
econventa.com/ 1970-01-22
00:25:14
Name: IPLH_Q
Value: %23%5B%5D
econventa.com/ 1970-01-22
00:25:14
Name: CHN
Value: %23%5B%5D
econventa.com/ 1970-01-22
00:25:14
Name: MSSH
Value: %23%7B%7D
econventa.com/ 1970-01-22
00:25:14
Name: MSRH
Value: %23%7B%7D
econventa.com/ 1970-01-22
00:25:14
Name: IPMPLU
Value: %2301%2F01%2F0001%2000%3A00%3A00
econventa.com/ 1970-01-22
00:25:14
Name: IPMUID
Value: %23
econventa.com/ 1970-01-22
00:25:14
Name: BSWUID
Value: %23
econventa.com/ 1970-01-22
00:25:14
Name: IBL
Value: %23%5B%5D
econventa.com/ 1970-01-22
00:25:14
Name: IOPT
Value: %23%5B%5D
econventa.com/ 1970-01-22
00:25:14
Name: IPLSH
Value: %23%7B%7D
econventa.com/ 1970-01-22
00:25:14
Name: IPLSH_Q
Value: %23%5B%5D
econventa.com/ 1970-01-22
00:25:14
Name: IZH
Value: %23%7B%7D
econventa.com/ 1970-01-22
00:25:14
Name: IZH_Q
Value: %23%5B%5D
econventa.com/ 1970-01-22
00:25:14
Name: IMCH
Value: %23%7B%7D
econventa.com/ 1970-01-22
00:25:14
Name: IMCH_Q
Value: %23%5B%5D
econventa.com/ 1970-01-22
00:25:14
Name: IMH
Value: %23%7B%7D
econventa.com/ 1970-01-22
00:25:14
Name: IMH_Q
Value: %23%5B%5D
econventa.com/ 1970-01-22
00:25:14
Name: ISH
Value: %23%7B%22101%22%3A%5B%7B%22SId%22%3A%22840056%22%2C%22D%22%3A%2226%2F6%2F13T12%3A38%3A49%22%7D%5D%7D
econventa.com/ 1970-01-22
00:25:14
Name: ISH_Q
Value: %23%5B101%5D
econventa.com/ 1970-01-22
00:25:14
Name: ISPH
Value: %23%7B%7D
econventa.com/ 1970-01-22
00:25:14
Name: ISPH_Q
Value: %23%5B%5D
econventa.com/ 1970-01-22
00:25:14
Name: ICH
Value: %23%7B%7D
econventa.com/ 1970-01-22
00:25:14
Name: ICH_Q
Value: %23%5B%5D
.mediafire.com/ 1970-01-22
00:25:14
Name: _ga
Value: GA1.1.56541922.1781354330
.mediafire.com/ 1970-01-21
14:49:21
Name: ezorab_484470
Value: rmod1
.mediafire.com/ 1970-01-21
23:34:50
Name: ezoid
Value: 5bab178f-235b-4157-6379-f8a0d2f50979
.mediafire.com/ 1970-01-21
14:52:07
Name: active_template::484470
Value: pub_site.1781354329
.mediafire.com/ 1970-01-21
14:49:16
Name: ezopvc_484470
Value: 2
www.mediafire.com/ 1970-01-22
00:25:14
Name: ezds
Value: ffid%3D1%2Cw%3D1600%2Ch%3D1200
www.mediafire.com/ 1970-01-22
00:25:14
Name: ezohw
Value: w%3D1600%2Ch%3D1200
.mediafire.com/ 1970-01-21
23:34:50
Name: _sharedid
Value: 3bfbf7bd-b764-46fb-9b24-dd2799be2d91
.mediafire.com/ 1970-01-21
23:34:50
Name: _sharedid_cst
Value: SBp4Zg%3D%3D
www.mediafire.com/ 1970-01-21
14:49:17
Name: _lr_retry_request
Value: true
www.mediafire.com/ 1970-01-21
15:32:26
Name: _lr_env_src_ats
Value: false
.criteo.com/ 1970-01-22
00:10:50
Name: uid
Value: e00e89de-6661-4193-95c0-a8fcb9df3694
.adsrvr.org/ 1970-01-21
23:34:50
Name: TDID
Value: 0f517120-683c-4ce9-92ad-cd19266d6ded
www.mediafire.com/ 1970-01-21
21:18:02
Name: ezppid_ck
Value: 5594807e3b73660db22cc026894621f4
.a-mx.com/ 1970-01-21
23:34:50
Name: amuid2
Value: f3595a37-4a9d-4b24-9cd9-94bf18e66c2c
.a-mx.com/ 1970-01-21
23:34:50
Name: amuid2_p
Value: f3595a37-4a9d-4b24-9cd9-94bf18e66c2c
.a-mx.com/ 1970-01-21
23:34:50
Name: amdt_t
Value: g::1781354330181
.a-mx.com/ 1970-01-21
23:34:50
Name: amdt_t_p
Value: g::1781354330181
www.mediafire.com/ 1970-01-21
16:15:38
Name: pbjs-unifiedid
Value: %7B%22TDID%22%3A%220f517120-683c-4ce9-92ad-cd19266d6ded%22%2C%22TDID_LOOKUP%22%3A%22FALSE%22%2C%22TDID_CREATED_AT%22%3A%222026-06-13T12%3A38%3A50%22%7D
www.mediafire.com/ 1970-01-21
16:15:38
Name: pbjs-unifiedid_cst
Value: SBp4Zg%3D%3D
.mediafire.com/ 1970-01-21
14:49:14
Name: lotame_domain_check
Value: mediafire.com
.mediafire.com/ 1970-01-21
21:18:02
Name: _pubcid
Value: f0d67061-f42d-44ae-b55d-8489de42251a
.flashtalking.com/ 1970-01-21
23:34:50
Name: _D9J
Value: 4e4c7c746f3c464594b9b3095790775c
.a-mo.net/ 1970-01-21
23:34:50
Name: amuid2
Value: f3595a37-4a9d-4b24-9cd9-94bf18e66c2c
.a-mo.net/ 1970-01-21
23:34:50
Name: amuid2_p
Value: f3595a37-4a9d-4b24-9cd9-94bf18e66c2c
.a-mo.net/ 1970-01-21
23:34:50
Name: amdt_t
Value: p::1781354330411
.a-mo.net/ 1970-01-21
23:34:50
Name: amdt_t_p
Value: p::1781354330411
.yahoo.com/ 1970-01-21
23:35:11
Name: A3
Value: d=AQABBFpPLWoCEOFUn1ZUmebGZi4BLqE9JzEFEgEBAQGgLmo3amChyyMA_eMDAA&S=AQAAAgqOVz1Re79981fUJjh3qFM
.crwdcntrl.net/ 1970-01-21
21:18:00
Name: _cc_dc
Value: 2
.crwdcntrl.net/ 1970-01-21
21:18:00
Name: _cc_id
Value: 522f503f52da3f25f1c2a54198675e
.mediafire.com/ 1970-01-21
21:18:02
Name: _cc_id
Value: 522f503f52da3f25f1c2a54198675e
.mediafire.com/ 1970-01-21
14:59:19
Name: panoramaId_expiry
Value: 1781959130570
.mediafire.com/ 1970-01-21
14:59:19
Name: panoramaId
Value: fb7ec55d29dfc25dad35dc4de467185ca02c520dfcee978e2ec3222e76d63ff0
.mediafire.com/ 1970-01-21
14:59:19
Name: panoramaIdType
Value: panoDevice
.mediafire.com/ 1970-01-22
00:10:50
Name: __gads
Value: ID=a72da8f8dac4dbe8:T=1781354330:RT=1781354330:S=ALNI_MZCBh_ptzlSFjn4mKG_I6_ZJqzdog
.mediafire.com/ 1970-01-22
00:10:50
Name: __gpi
Value: UID=0000146865d5f26d:T=1781354330:RT=1781354330:S=ALNI_MY7xi4RFbTEF4Q5wPKl_IsjF120uA
.mediafire.com/ 1970-01-21
19:08:26
Name: __eoi
Value: ID=c9df7b54bcd371a2:T=1781354330:RT=1781354330:S=AA-Afja4gVi1oGpU66Pr7KR0wygQ
.doubleclick.net/ 1970-01-22
00:25:14
Name: IDE
Value: AHWqTUlTIPqLfdcLit-z1YcaW-UPRXoz4_vNZaNa95qmqaEJowFQD-1Ah63IH7TAnfY
.doubleclick.net/ 1970-01-21
14:49:17
Name: DSID
Value: NO_DATA
.openx.net/ 1970-01-21
23:34:50
Name: i
Value: 6c22eeec-a5b6-44fb-bc00-d5b8becbcb36|1781354330
.openx.net/ 1970-01-21
15:10:50
Name: pd
Value: v2|1781354331|jEvOhIiuwA
.ladsp.com/ 1970-01-21
14:49:17
Name: cr
Value: 1
.ladsp.com/ 1970-01-22
00:25:14
Name: smn_uid
Value: 2NgF7e6NtZrWrb-80cllkylvb9PnChI
.ladsp.com/ 1970-01-22
00:25:14
Name: lum
Value: CLT594fsMxIFCAMQ0AU
.ccgateway.net/ 1970-01-21
16:57:23
Name: ccuid
Value: 9b68d783-d333-44c9-b65b-8e99d95257a9
.ccgateway.net/ 1970-01-21
14:49:16
Name: ccsid
Value: 4823239f-dab8-43f2-afac-812a4b24d12d
.3lift.com/ 1970-01-21
16:58:50
Name: tluid
Value: 1442466936165105232497
.id5-sync.com/ 1970-01-21
16:58:50
Name: id5
Value: 45774d11-209b-7738-a8d8-2b3b37005f53#1781354330580#4
.tapad.com/ 1970-01-21
16:15:38
Name: TapAd_TS
Value: 1781354331728
.tapad.com/ 1970-01-21
16:15:38
Name: TapAd_DID
Value: 1a939850-f88b-4746-a81a-76f7cf5f305d
.tapad.com/ 1970-01-21
16:15:38
Name: TapAd_3WAY_SYNCS
Value:
.mediafire.com/ 1970-01-21
23:34:50
Name: connectId
Value: %7B%22ttl%22%3A86400000%2C%22lastUsed%22%3A1781354332086%2C%22lastSynced%22%3A1781354330534%7D
www.mediafire.com/ 1970-01-21
23:34:50
Name: _tfpvi
Value: ZDNiZmIwMWMtYjkxNC00MWNkLWIwM2QtODgwMmEyMzUwMTUxIy01LTk%3D
.criteo.com/ 1970-01-22
00:10:50
Name: cto_bundle
Value: W2-cnl9MaEJDeFhCaXVHbWtWQUxIVzNGODNXWUpwZ2FzWnklMkZaZ1lKYUxaczNaMVRZT2hyMzZJYnYwNzNaSDVESCUyRnFaNDM5RWZCbWt0NnAxaWFFUWElMkZwc21tSVFLbSUyQlgzM2UxcyUyRmNhYXpXWUxMYVpoZUJuc0J6SWJPTFY2Sks3T21WUmEzbmFhSmNCNGdLU1JaWmx1cWE0WmVRJTNEJTNE
.mediafire.com/ 1970-01-22
00:11:22
Name: cto_bundle
Value: 39MORF9oaW9XS2olMkZ5SEhIa2tmSU9MbGpPOFUlMkJsTzhyVTg3NUU5TUc4OG91QXg4TldEQzNJYlI5cTRNVktKZmRUMUJCJTJCSnFxSlpJQWhhdiUyQkQ1bVBRbEtUd3JWQ3A4dlNWSVlDcm1HV29FRVklMkZPMWFhbE11QVRkdzZ5bEw4anE4QWNEU0FvJTJGNSUyRkI4UlJsd2ZzWTVGa2xmekpFQSUzRCUzRA
.mediafire.com/ 1970-01-22
00:11:22
Name: cto_bidid
Value: SZaMzl9od1JqSnJ4UW9McnhDdFlrd3NSaEJqSUFuNmVzNTFreUt1WDkyNHQlMkJsaTh1NHVsNGlmdyUyRnFtZUdMVnVTaWU1Sm40WGVaJTJCTnhDeXBXNW11MzFJdmdvbkFyRHBybVZ0JTJCT1FsJTJGTWpYSXglMkZDYyUzRA
.adnxs.com/ 1970-01-21
16:58:50
Name: XANDR_PANID
Value: o-ozZsZruPdxeR0QgAP6xIkUPTz6XOjk1qpN9dQkD-KVmEFl_0BUMQKQDo1KgbHNx9NwCkVCN-kzN89FDdSz45UYJWZqhGNO66ic-Av0mo0.
.adnxs.com/ 1970-01-21
16:58:50
Name: uuid2
Value: 1314968767185625243
.opera.com/ 1970-01-21
23:34:50
Name: OAU
Value: OPU641eaebb53714bc7a8270d3a66a5d1f0
.adsrvr.org/ 1970-01-21
23:34:50
Name: TDCPM
Value: CAEYASABKAIyCwjq1YrO7tSkPxAFOAFaBzhoOXUxMWhgAg..
.temu.com/ 1970-01-21
14:49:16
Name: __cf_bm
Value: KVJ7D_hhZFyzDUAnPKkHhcLqY8d7gLamPrTJ2kmhNgk-1781354332.2727363-1.0.1.1-vI.cIKfZSGHB2N2_snhS.BM30EHZsYEzB4dHAW.zTviOGO.etMkpwoJZpWHnsnEPenDA_koDH2kTwusYvTnxZUDVFcTVvGM5p3MTZtZ8IzoCQdIE8.mYPq02lOHk5.Y7
.gumgum.com/ 1970-01-21
23:34:50
Name: vst
Value: a_b01e4b5c-f5af-49cf-92e1-8a10bc11d763
.mathtag.com/ 1970-01-22
00:15:09
Name: uuid
Value: 255b6a2d-4f5d-4000-99ab-c292ff5b11b2
.sitescout.com/ 1970-01-21
23:34:50
Name: ssi
Value: dedddd13-148e-41df-ab45-c0a1f4c23902#1781354334285
.sitescout.com/ 1970-01-21
15:32:26
Name: _ssuma
Value: eyIzOSI6MTc4MTM1NDMzNDM5NCwiNyI6MTc4MTM1NDMzNDM5NH0
.id5-sync.com/ 1970-01-21
16:58:50
Name: 3pi
Value: 2#1781354332355#-1806569820|19#1781354333586#1168712842|3#1781354334054#1752147756|264#1781354332816#847690439#0f517120-683c-4ce9-92ad-cd19266d6ded|441#1781354333119#967713348#a_b01e4b5c-f5af-49cf-92e1-8a10bc11d763|170#1781354331836#-111070480|826#1781354334686#-1555869221#dedddd13-148e-41df-ab45-c0a1f4c23902-6a2d4f5e-4a50|108#1781354332109#810151894
.quantserve.com/ 1970-01-22
00:19:28
Name: mc
Value: 6a2d4f60-37917-2eaa8-739de
.mediafire.com/ 1970-01-22
00:13:43
Name: __qca
Value: P1-43f07f64-3383-43d8-ae41-f5f099347065
.quantserve.com/ 1970-01-21
16:58:50
Name: sp
Value: CgkI0aYCEgMQsxIKCQiF_wISAxCzEgoICIkNEgMQsxIKCAieDRIDELMSCggI2WUSAxCzEg==
.casalemedia.com/ 1970-01-21
23:34:50
Name: CMID
Value: ai1PYBdaRFsAIKYpCDBQGQAA
.casalemedia.com/ 1970-01-21
16:58:50
Name: CMPS
Value: 5400
.casalemedia.com/ 1970-01-21
16:58:50
Name: CMPRO
Value: 5400
.pubmatic.com/ 1970-01-21
16:58:50
Name: KRTBCOOKIE_153
Value: 19420-6zwy_-k7NqvwbjKiuDgtr-VsNKrwP2OjuWvDiPMl&KRTB&22979-6zwy_-k7NqvwbjKiuDgtr-VsNKrwP2OjuWvDiPMl&KRTB&23462-6zwy_-k7NqvwbjKiuDgtr-VsNKrwP2OjuWvDiPMl&KRTB&23661-6zwy_-k7NqvwbjKiuDgtr-VsNKrwP2OjuWvDiPMl
.pubmatic.com/ 1970-01-21
15:32:26
Name: PugT
Value: 1781354336
.rlcdn.com/ 1970-01-21
23:34:50
Name: rlas3
Value: UPjiTbmkxJFWEQeISKg8naFVSzQcA4AmZ+4ZA9uH50I=
.mediafire.com/ 1970-01-22
00:25:14
Name: _ga_K68XP6D85D
Value: GS2.1.s1781354329$o1$g0$t1781354336$j54$l0$h0
.rubiconproject.com/ 1970-01-21
23:34:50
Name: audit_p
Value: 1|fdDfl0XMJZ5UIt+83jr/ahdJU0IsINHBHA8AbIGMX2IRdwtRav1lhjdJCvzyohVO17cO9c+TknaM1KxoLazIt+FVxDHbQllAxKbtwwKGtDqLw3sECZpCB+8Vj/FZW5PJ4GT4ezxMNeEOGk8XelxrtT2SRa9577uTuxvOKZ4JsmCKKj+FU8ZOFiFwYvlTl0qppmvllXEtYN4=
.rubiconproject.com/ 1970-01-21
23:34:50
Name: khaos
Value: MQCCDMX6-X-EWS6
.rubiconproject.com/ 1970-01-21
23:34:50
Name: khaos_p
Value: MQCCDMX6-X-EWS6
.rubiconproject.com/ 1970-01-21
23:34:50
Name: audit
Value: 1|fdDfl0XMJZ5UIt+83jr/ahdJU0IsINHBHA8AbIGMX2IRdwtRav1lhjdJCvzyohVO17cO9c+TknaM1KxoLazIt+FVxDHbQllAxKbtwwKGtDqLw3sECZpCB+8Vj/FZW5PJ4GT4ezxMNeEOGk8XelxrtT2SRa9577uTuxvOKZ4JsmCKKj+FU8ZOFiFwYvlTl0qppmvllXEtYN4=
.rubiconproject.com/ 1970-01-21
16:58:50
Name: receive-cookie-deprecation
Value: 1
.rlcdn.com/ 1970-01-21
16:15:38
Name: pxrc
Value: COCetdEGEgUI6AcQABIFCOhHEAA=
.pippio.com/ 1970-01-21
23:34:50
Name: did
Value: EctO5Fv9Zawfeh-g
.pippio.com/ 1970-01-21
23:34:50
Name: didts
Value: 1781354336
.pippio.com/ 1970-01-21
16:15:38
Name: nnls
Value:
.pippio.com/ 1970-01-21
16:15:38
Name: pxrc
Value: CAA=

7 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source Level URL
Text
security warning URL: https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file?dkey=rv5x6b8wlt0&r=125(Line 1399)
Message:
document.domain mutation is ignored because the surrounding agent cluster is origin-keyed.
security warning
Message:
Error with Permissions-Policy header: Unrecognized feature: 'bluetooth'.
network error URL: https://www.mediafiredls.com/onclick/0
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://id.crwdcntrl.net/id?gdpr_applies=false
Message:
Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network error URL: https://ups.analytics.yahoo.com/ups/58713/fed?v=1&1p=0&gdpr=0&gdpr_consent=&us_privacy=&url=https://www.mediafire.com/file/41kkjh07tibblti/AINCRAD+FF+INJECTOR.apk/file&pixelId=58713
Message:
Failed to load resource: the server responded with a status of 400 ()
network error URL: https://ups.analytics.yahoo.com/ups/58813/fed?gpp_sid=-1&gdpr=false&gdpr_consent=&v=1&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F41kkjh07tibblti%2FAINCRAD%2BFF%2BINJECTOR.apk%2Ffile
Message:
Failed to load resource: the server responded with a status of 400 ()
rendering warning URL: https://ep2.adtrafficquality.google/sodar/sodar2/254/runner.html
Message:
[GroupMarkerNotSet(crbug.com/242999)!:9C4034240A0]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader (about:flags#enable-unsafe-swiftshader) flag to opt in to lower security guarantees for trusted content.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=0
X-Frame-Options SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ab.dns-finder.com
ad-delivery.net
ad.doubleclick.net
analytics.google.com
api.amplitude.com
api.btloader.com
api.rlcdn.com
at.teads.tv
bcp.crwdcntrl.net
btloader.com
c3.a-mo.net
carbon-cdn.ccgateway.net
cdn.amplitude.com
cdn.ampproject.org
cdn.api.btloader.com
cdn.btloader.com
cdn.econventa.com
cdn.id5-sync.com
cdn.jsdelivr.net
cm.g.doubleclick.net
cmp.gatekeeperconsent.com
connectid.analytics.yahoo.com
cr-p3.ladsp.com
d9.flashtalking.com
dsum-sec.casalemedia.com
e9be73191e89464b00225c44fbcba626.safeframe.googlesyndication.com
econventa.com
ep1.adtrafficquality.google
ep2.adtrafficquality.google
esp.rtbhouse.com
fonts.gstatic.com
g.ezoic.net
go.ezodn.com
google-bidout-d.openx.net
googleads.g.doubleclick.net
gum.criteo.com
ib.adnxs.com
id.a-mx.com
id.crwdcntrl.net
id.hadron.ad.gt
id5-sync.com
idsync.rlcdn.com
image2.pubmatic.com
image6.pubmatic.com
invstatic101.creativecdn.com
jp-u.openx.net
lb.eu-1-id5-sync.com
lbs.eu-1-id5-sync.com
lexicon.33across.com
link.rubiconproject.com
match.adsrvr.org
mug.criteo.com
oa.openxcdn.net
oajs.openx.net
pagead2.googlesyndication.com
pb-ing-02.ccgateway.net
pippio.com
pixel-sync.sitescout.com
pixel.quantserve.com
pixel.rubiconproject.com
pixel.tapad.com
privacy-location-edge.ccgateway.net
privacy.gatekeeperconsent.com
ps.eyeota.net
rtb.gumgum.com
rules.quantcount.com
script-api.ccgateway.net
secure.quantserve.com
securepubads.g.doubleclick.net
static.cloudflareinsights.com
static.criteo.net
static.mediafire.com
static.xx.fbcdn.net
stats.g.doubleclick.net
sync.crwdcntrl.net
sync.mathtag.com
t.adx.opera.com
t.oa.opera.com
tags.crwdcntrl.net
the.gatekeeperconsent.com
tpc.googlesyndication.com
translate-pa.googleapis.com
translate.google.com
translate.googleapis.com
u.openx.net
ups.analytics.yahoo.com
us-u.openx.net
www.ezojs.com
www.facebook.com
www.google-analytics.com
www.google.co.jp
www.google.com
www.googletagmanager.com
www.gstatic.com
www.mediafire.com
www.mediafiredls.com
www.temu.com
googleads.g.doubleclick.net
id.crwdcntrl.net
ps.eyeota.net
securepubads.g.doubleclick.net
translate.googleapis.com
www.google.com
104.17.147.83
104.18.27.193
107.178.254.65
130.211.23.194
135.125.170.104
135.125.170.106
142.250.23.132
142.250.23.94
142.251.155.119
142.251.23.139
142.251.23.157
142.251.24.149
142.251.24.154
142.251.24.155
142.251.24.157
142.251.24.94
151.101.129.229
151.101.130.132
162.159.141.246
172.67.142.121
172.67.170.144
172.67.199.186
172.67.69.81
18.212.140.196
18.65.207.116
182.161.74.19
2001:41d0:72f:6100::
2001:4860:4802:32::223
2001:4860:4802:34::181
207.65.34.80
207.65.34.81
2400:52e0:1500::1180:1
2400:52e0:1500::869:1
2404:6800:400a:1002::8b
2404:6800:400b:c005::5f
2404:6800:400b:c005::61
2404:6800:400b:c005::64
2404:6800:400b:c005::84
2404:6800:400b:c006::84
2404:6800:400b:c00e::5e
2404:6800:400b:c015::9d
2406:2000:a4:807::
2406:2600:4::13
2406:2600:4::2e
2406:da18:9d0:143f:2124:4e9c:36a9:d9de
2600:140b:1c00:38a::2300
2600:9000:26a6:1200:10:dd8:5e40:93a1
2600:9000:2957:2000:6:44e3:f8c0:93a1
2606:4700:10::6814:14bd
2606:4700:10::ac42:948c
2606:4700:10::ac42:949f
2606:4700:10::ac42:a937
2606:4700:10::ac42:ab85
2606:4700:20::681a:3ad
2606:4700::6810:5049
2620:116:800e:21:6c50:dbee:bef5:203d
2a04:4e42::485
3.173.219.76
3.173.238.102
3.33.220.150
34.102.146.192
34.107.165.188
34.111.113.62
34.120.107.143
34.224.42.28
34.36.200.111
34.36.216.150
34.96.70.87
35.190.39.111
35.244.154.8
35.244.159.8
35.74.31.108
37.19.206.163
4.243.157.74
44.227.112.76
44.230.239.150
52.76.86.147
54.254.71.150
57.144.44.1
57.144.44.128
69.173.158.64
74.121.143.245
82.145.213.8
033bd2b7f73cb447bf4ee25bdd45ce8a9639fd91fb7015c2bb49af94b7ff3cea
03c8d2dc7d985c3004ff2cd6d8148dd03560f37ed15efdf6c2d7f4d771d0e599
04c94ecaae50f713607dd45d40c5756d0e6a9e58c6398433ac098bc9bee89f5d
05cfe92d9794a54258a19bfec7ae0faa73f61b66416983136594b4f95bb114dd
06c87cfc79d31896761b14ed789b3f747f1b885dac0ed193c16fb8d1d305083d
07a54e49f65745ec3e0c0bfec9c0005b787370f8f65476b8da936e14d9ceaaa1
09d2b2627320c673aac1db56db4d500f3e7e462ce6cba816f27bec0ec305fa0f
0a4b3d40394f9bd80ee9c1b885bdf66e066783a4cf59d6649a773909793821fd
0a9da3cf7efd1a7499a1c888d44ab103ca6c92a9ab354e17e146384b39cead50
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0d0d88d0f6ba67df0491df41ea3c956b200b73066d19954e0c37ab9ebb6afe5e
0ecbd1374ebd05d9733e3230e6ccaefadbfd8907cd151221d8af6fdf881b4e09
128eb2ddabc22c456e73db5c95d723d0493dd69fb68dc59ab4ac2b295e3814ea
135fe1822959b8811afafc20effec079f339c96788df6e47e933a7d0c267921b
1723c7ced14c0a75280f6ef41b3249858fe97b0f750d8fe83c00e3b1ca6d2b03
18120a6bee05cd823d5f4ab0c52006863a059a5d6c535c790a31bdd2ee8c45e7
19e6bf3356536c59e3a9aa5791665905d004766bda6b46fcf8e8457958020e28
1b414884f5f29c8dcf0613ec285a82e5b8cc6afcad28bf6d422a39b2d7e50c38
1b7c4edd444f73d828aacb88e0f35efd212c8378d07e5ff848d699adf68ba550
1c3c94a31ffd750ef9ab669b67d499e9a1e1df647d849c377f39c7501f5951bf
1c55d9b826e8dfa994370e306ae8dc2e849f3e003381dc848a0b95f782c0c0e3
1c6ba1010c2cc88c59de9e9584728da124770fa399643ffc1beffcec54b84be7
1dd32b12fc30d36cacdb563ae9a8189e226c0342333a03b552c3a3d472c0b285
1f0eaf56b1f181194ca996ec9d07da4e006dc9e1837dcc07f7bbc3a7a6d7b7c5
1f9c27df3d36106a364d45b01ae4a5fb8c1b66d208b469bd27facbfbd3527411
2450e5580136f94bda7ccf95e3167b57e15b05b513a430967943a50036fa47a4
25bbe4a504be526e3861291e6afd0f641c9a9ac7b6cf0f48b969495a5eabf1f1
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
2779077c7b2d5740b5a7eac2c5e5bdca293e99343a1d7db03ba196d17b710f06
2a23e36756513502777f853fccedfe57bc5ffb7c25d540c1ed215b5ade49e41a
2c059db5a9c8d8ab63540fb456a2bc6bac2d87a40a7b21582b8265a56441ad0b
2d7b2dff34fbaa4e7532a1cd5616015b9c83a75116384a66366c59bb7ac6ddd4
2e5f5cb912c0619933ea6c3ad8ac1466a005f792e3338d96a8432d144c63520f
2fc364844767afcfcadb2bd75ae41d008d1ac70351d355f03d3d4814c09bc09d
2fefe95d72c358e17861e136a809e2ae3a6359cd23f8f008a31d05f724ef0889
309499ed1b15193a35bcf698ecdf7f5f9cb454b165e06f3169787595bc75d033
30be558393bd8b0585c806a6eaed6d6f5b51d1ca63c0113061dfe35eaa128ce3
30efb77cc288905ea319e4607f6043db2e034cf9582acd97dc1cafbf9abc6380
30f1570e0bca7ac216d47126b186e268719195f4967fb017d8cae01004a07c03
315d41c6369ea71cc48eb9922a31c8dac638660b6ddd83a2091f56e65f6d972e
345dbaad5cd394bb195e79a7d835ee2af91c02c76413d974f2e7fd3b9fcbfe39
34d74ebadd5a665de4e719f81f48ad5644a4e2ba4dfd4483fbcd2cc5639a7515
35fdf7828a207f57fbacc0019a0bf07b7f25e5e0b4e82151776362191848849f
365a751f65b69186beb57129399d80f061620fc6ff5f0a0392c3e440bdb18442
36ef51309485a22f2c3dfc9b3ec7249384174589bdbb6c62062137c91bdbd1d9
39593d60b1858399a28bd01a6f53cb9916e4d90e9bd3667425c63b511da1d0d9
3a9f306824d6e118cf7248a9331b18520750b67af9096c6cb7b026651b419d3b
3d196968aa9a9415ba8e0408223a0dbe7a38b3c16702040df8ef3ce611f1eb3f
3e9ef1f1c1e7933c4e0548e703e96fc3fcd7f8c5cd3811b0957cfe9c2dbd4511
42ac4b37770b42c56312aeb1f888ddae261ade1b9ca92f871fbfe616648a057f
4342feac38021c4fe3069eba0edf1c2e1b4345e2b548b0afb7ab21b7369b3bc8
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
4448e430d3c53bad548a5d135e1c7e2f9593e806ba47892640d430ea752e979e
446a24acf9272b37cf14bf847684201154b6648113a148f1381b7489db6294f3
4718dd9f68e969d1cb5e1b6172206b7150ad1d8cd5c5c1fe5812dd0e1646d426
4dac0026fbfa2615dce30c0af12830863fe885f84387a0147b9e338f548d5d82
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4f80695681b18a07d94035985cb04ead72840e5c5e2f0147cf0f38d1392653c0
50a63bf06dcdc62ce03de6a07d10770dc80cfa47ef2b63db1e9f6a5fbd786a7d
513bcb26bd9e258e314f0fa39e4f8d57be3305e65101ccbeb63ae1617073547f
5340fb84bcdfe8399820fc1d8d480e8161a83308075d7e66a322ab751026d53d
544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9
550812d0ec9143ebd797f26af9b8b9db86e3aba933bdc2e29e6f9d4f64d2e3a8
55ee467b89e74dc52629e2a5c16b860f715dfe2ba5f305fdd7ad62b6a7d62807
56351c084d8d56437d41f1e58b7eb184b563871e88bab60f6b15486c39f13996
57d0f4cce3986f9b84224fcece55e57c32efa46b9078721c89fdb471fff689be
58519eda1b841f9c3ce898c2dc7755881ad8953312b43b0c8f83008324f52935
58db8c4b619b75568a74a190ae75fd53397fc70f028f3e86b1cbe35a67593b7e
59377c67e4abd19dc6fee9800b0b9383958655bb52dec02e4d700a373cd337a7
59f4e0057c651cb962d4637e70ff0d239f2b9c2cf4b31345d0145e03320b5b5a
5ad32e1ddfb68ed8df6e2b675b777a6e71238dd0ac6fedb136342734e2d37f82
5adfa8fdf36805dec0395a90e3347559da75fe8fc8830c48e22c94b18f8d9753
5b03993da08ad46dced1836ab4ae0c79e1425a3c6f807b5fdfa75798312af92c
5e365e29ff49e2d8683417faaf8b50702031af935cf90b886b9ac92f471569c0
6013e3da151047bfcdddc1d3a2ade401538d489eff88ad1782a87c0d1ae9cd6a
6318394f737c66f0e2ccfcd88e3935c6667633a1b95fa29fba2b75431d55eef2
64dc6955dce4fee4070b12c20684745a49317312b4083b4a58f93efc3b303391
6677729edaa19336effedec3661ae22bcaa33a79c41edd9db159a6d9f3901a1f
6a163c9c1e18a0fae78f3ce587d463c4aa6d39991639580d1106a9fa0774b8e8
6b9ae1fa0d1fc51ee0ad3feb565083bee200289c71bb346020f9b3d80cf73636
6d794178f6d2cd9368bcf750c6dc4f558f50f7222e34fdc239e6e5008760beb7
6df984f948e3979f54a89506b99e18bec9a79ee1b49b008fc613579157999f23
7135a18ee90c92703cc114588a9402e52aad20f7525ec200af5250f1b2c20261
720671166ac43aba99e3952b0b9341ab4e0fee1fd891db54e2a07f05db653142
7464e0ac888a78474a72e61d604a76946c2fa2854a0ae3b3d060040edd8630cc
76382cf74ce4ab45eb4bcd033c2d89b991f7a29a08a173dcfdde8f03573ee006
76b14705bcd5752ac05035c95c7f53bfe8e65dda03bc77662e0aff067e3258e7
789a0b260659565f639a7079d607c835feac8fde7413014ed6255a81e989cee4
79b7571ea8e8bea10d979e9d170a96673bce36db591affde3f4d21d2ac8debcb
79c11813ce33697436f915958c84f8e219608cacf74158e1fdb347c32342f067
79ddd28426bb771b99d42145307e5c9fe7a0fdf39fabb5f8dbcb154215969fd8
7ba1bc2084def769e77a7dbf97cd91d68fe6c6d55b5d183a7d36630da8da2b02
7bb75772b56f70600178314460caa184424aa0314b54a534769d0f9f02e8dcde
7e7814b89942a3f9fd5b75c10616363d313d902b3ccfd19ac5ab7437cbdde013
80f0686aefd05de787e5507e0dd657439b9bd9f1235a297227e9808f153637fa
82b94716473aa225e715e117802145c5d2d725aa1ba9d476d61a5d3da16a8c26
8539c91ae0a82f8cab27d481ea38ac4e66d1e5b36701fe295bcba4399b9255bd
85a64faec356c3a72f249a98a037317adc730ec6d38e47653cd53be5485d80a1
880444af8f79aca9fdb01d819bb615c7d8ce8fb9327df856784f7027819de58b
893719087a8bc6dcdfabc4e1d54fd6d724953d40da2ad369f8b4fb5f689394d7
8952b91af1705fc7fddb2a9bcc53534d55f136755e48e957711d85b038287542
896a5824d810b766c901dac3554d27015d9513ae24a75cccce5fb79393d4759f
8af2d4d39123c52a7c0ab7f7e4fbf96c5bfeb969ccce59ceb2bc7c96a7624f2b
8bacb685be7cec7f41a0270e694fa90c0fb448b2c0ded5f1734baf51050d695c
8d5b5f10f54ff6206d2ff9ec46ea10e38b0c52d83a83df6114037f3030f63519
8fb0902cb2d17d83fa68fa9a81a2e2872675c67bac55f2aced4aa2c5540f6655
904431e8567e9c3d82cd397fc851a83079e07453c6be22f39db889532abec1d7
91171ed1478c24131b918c94dbc8bcc3cbc3a55dca8bb00f21cd64387b2ea8a6
925a247fa807fc6ebb96dee3a6114c4fe9267db22c430b69a431b8a4162ccc4c
984b903229be986e646516844f0a36f2a7a3b5993874403674093ca2da9f8ad3
99a1838e99f86fb86e3fbbef8719ebd9fc0a8632781bdc9c6c8cb72d5a195f9d
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a09179dd962df38a01440ce2e4748c37bd832fe1ac2f65ad974490a89d63d129
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a11d3b4b6f2902037c365146ff80b5bf95923f3176f1a827355e45177314d423
a2140778f429118df810b50336d49b28830a0e988210fa7a6a2925477c65c212
aa8a5c4a92b78ce2c775274d190dafb720a44b4facce02c94e63f63c90c60a57
ab5c23a05e39deed14d9d8262b0dce9f024f86105a27196cad37d14a3f516e09
ac5a4a0937632f257b63ebd53a656fd045529bc506cf4abb880bec8421e8eb60
aca701811d62eb608d12b174231be1ceae3449fe0f4bc847469ff22aab8ca9a5
aca73fc574e12740e3368860b88a284d01b643456f3ed6a06322ecb47750563f
aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
af4afc0b356a3d01670e4234b685e6c5c269b39dd25f1946bfe6579d5941e794
b044342cfff5fe7697723acdb5d665bfb7d3c5c2bf98bc8931d9156f5dbf2e02
b0e1c971e01bd6e96d4cfee0ed2beee1a883728b9315176070ef9edae3df2af7
b13e94c675a8d34d359a94002285b33ee0241412a678a14a7fe1d99db32b2092
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b2e52ac1d50555583c8124e598f510f48a937f7427b5161bfcce214ba687645d
b6197626a798e196b76a19dd8a211666d8305affab15261747755056235c703e
b6e7602b7a190d77f2ceb56a9f8a1f668ab0efeb75a82c6cc9aef5a7f101341e
b837449c7254dd5887b620b7903bb4dbafbf2424ae3eb25e7a9f3471ff105365
bc4e0cbab332daab268a3dbee01019d0026b3a3817b58d846e9781cd8b0bfa1a
bcf7993523efcd42f5599e1c210b6433e35a39de688c9e5ae90829741937df71
c03c74e3dfa5656dcd9841f61549cec816a1b2ec377dcc439761ca77a46ab1e2
c1143c5335c119c5e774eb8a1979677d4107922d3751323c29346439bd9c59a8
c289b9aaa1c8a69478679cb4a1f9ee046b4d6a303448cc67d0babcca102cff16
c648cd5f984a8f4e9d6fab93264e476a0ffe8710cc077587e4e0bc5776679ffe
c656d50263d423e681e4963066e86f087cb646cab3b440b3b082a0da28eb79ea
c6c094bc0054f9cbe34102ff49f86b3928b5ac09f3d2ac87e170d0500675921f
c700c58e763a5ae34f446713819957ed9755025d35b8497ec1150f428f5ff227
c73c612fac1b3a7e0b0f62fa464e3932d3463aa79557205221e6551d8c62d662
c879e20b7fd8e872a394d588a3363a46561ca1bd1bdaabee0d213d4f429a4ed9
c8a2767949c5430a767cbb9263b8c7114fcd027fd38d60a53fbcd613be219b7d
c97762a3080b01be49374c9835618573e957af81e9e5c6e73358bef6287c2b1e
cb6c1a2d4e9a1239a7887de158b87d86ecbd7047e9ed8214f367406762730003
cb8d603426932f2666666f4bd32b3dde726161c7f7413e385d2e124e6e03039c
cc9fc34cc8204f5f55da2b50bc51524db4e28807a34cab1ff36b8a7d87fd6fe9
cdc78cc8b2994712a041a2a4cb02f488afbab00981771bdd3a8036c2dddf540f
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d204aa686be22209ad9666af1336f4e46dd3d3b05c4f6f5e7c88001f4dc95af0
d443f4f3c93f41532712967c32d6da8008c13d4d3e2aeebba0df5f218f25c1ca
d5029954faac1e200614108f193af4345c878d1d84250e009914bf391502c778
d50ac2d5a45de14775079aebb08671f8be6d828e2a4f976d1b7faeb09fd92dce
d72fa312a40a9aa7e847e5c2dbd6babdb6cb567992ff2d1c83c4baf833ff9687
d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8
da3b728baa75c96e29d60af2cfd03ca2bea0a302c62a225f7c92c326a7eed0ba
dc987a618ea91a37323b1432cfef45dba1292483a0d5e75e8f2cb05b45f64e4f
dce1ce383bed84a4ed739e972b11f44c4c45a1339a1bdf75c3598b88d46cc69d
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
e12bc1fca47f992f263407fdc0b3d6cb30d860ab0ed5e93a662387174e597d7b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e46d6ebbbc492b3e687b408f201fa80e9757aaac62e37fac626776cabc8bbc82
e6a7022f9fe86b29e80df139592b7b08c7703679ff9883e24457710df05ba594
e814d50a228f54aecf40d8a58e41d48ce1dfc4376fd5fbedc28078fe0a8c5526
e9124c970d7475f4471197cbf13bc226200f81bba0a34a562a1c87a8f97a68d6
ec295aced7429b6b7e407bfe5188b65e632a748495ef8be93ac9296778e15d46
ed1e8e91099715b5b8c29748f9bfcd11d9696ca83c34dad258179ec55ba84b75
ed893b2ddcb5f51b7fa6a2ac76df6ff7c49719118d9df242846f1e3a1d9a918b
ee63979b621d070be7f6aee315971acb7959ff766758fda88f01c822fd24a7b0
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef1cb6fe965a9b02f8a04a03f93897884ac7df8c0d898a80f13b53af709d8e7c
f04474a1439c9579744b26351ace051c3a9740e7af5f214c7231c75b8dd1e3ba
f1a61277e3f902f50ab42015d8b07218db9b7601bb0967e54a52bfdcb4fa7e81
f1a67642fc97b508ce07cf6df329022bf5184a1c573044dc021e0d6e64688c64
f1a68bf826c55985468304f4284a09cb8a68e82503d764166e611a7c58a85a4b
f4160beaedaafd7b8b2218473f2ea847bf3f385cf9df106f06132d2afdb9b1b7
f478d280d06f28fd8e5fc61c4cf0fcbd650da49b1954f4a1dfa88723e29ffa7c
f4b0148628292afd7b50bd67548ba6d3e97d564ee9ef938c963b4657747ac60b
f52a0c7d9fa7ae8e45916c491ae7193f9a1e289f128f05264122c53d8da970db
f560890e55f5238f5bede1aa9eb78ac22a16ae0b3a814b5b3ae8c64db672dd22
f735895129e780b83844afa73d27bd9de32471fbe243fa9ec72b9e37aff04a6f
f917a9105c311331b1d40f4d2bdbf11233c1c465616c1a9c46232f451463b061
fa71e011d720fe2c49f414b4e47daa81c873bf8910adb3b1c51b1e18bc820b8f
fe2eddeaa8adad53d570fdeeb04412a07ec65ad99b25fe5beb092dfe4fb78cc9
ff5146e7e0ea898c04e214789d592a741cb08d803315f0d64e1c22069ea0dd76