www.mediafire.com Open in urlscan Pro
104.16.202.237  Public Scan

12 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 25

• https://www.google-analytics.com/r/collect?v=1&_v=j82&a=1973420004&t=pageview&_s=1&dl=http%3A%2F%2Fwww.mediafire.com%2Ffile%2Fkdmpe66t3jasmtq%2Fpaint_tool2.zip%2Ffile&ul=en-us&de=UTF-8&dt=paint%20tool2&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=IEBAAUAL~&jid=1249836107&gjid=1693754805&cid=330312553.1588967674&tid=UA-829541-1&_gid=340608390.1588967674&_r=1&cd1=unregistered&cd7=legacy&cd3=archive&cd4=1&cd5=zip&cd8=%2F100%2F&gtm=2ou4t0&z=24496427 HTTP 302
• https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-829541-1&cid=330312553.1588967674&jid=1249836107&_gid=340608390.1588967674&gjid=1693754805&_v=j82&z=24496427 HTTP 302
• https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-829541-1&cid=330312553.1588967674&jid=1249836107&_v=j82&z=24496427 HTTP 302
• https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-829541-1&cid=330312553.1588967674&jid=1249836107&_v=j82&z=24496427&slf_rd=1&random=1691387235

Request Chain 79

• http://www.google.com/pagead/drt/ui HTTP 302
• https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 94

• http://www.google.com/pagead/drt/ui HTTP 302
• https://googleads.g.doubleclick.net/pagead/drt/si

100 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Cookie set file Show response www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/	290 KB 84 KB	471ms 433ms	Document text/html	104.16.202.237 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file Protocol HTTP/1.1 Server 104.16.202.237 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f7f979f77a9b5b9ba16384157b7555611e9f3f880ad01af591a1260c161b21db Security Headers Name Value X-Frame-Options SAMEORIGIN Request headers Host www.mediafire.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 08 May 2020 19:54:33 GMT Content-Type text/html; charset=UTF-8 Transfer-Encoding chunked Connection keep-alive Set-Cookie __cfduid=d4c7b8430996c61d6edfc1fd6f4c738531588967672; expires=Sun, 07-Jun-20 19:54:32 GMT; path=/; domain=.mediafire.com; HttpOnly; SameSite=Lax ukey=irisocxdghphr2lrdb9t792ziw8j7hyh; expires=Fri, 25-Sep-2020 19:54:33 GMT; Max-Age=12096000; path=/; domain=.mediafire.com; httponly Access-Control-Allow-Origin http://www.mediafire.com Expires 0 Cache-Control no-cache, no-store, must-revalidate, max-age=0 post-check=0, pre-check=0 X-Robots-Tag noindex, nofollow X-Frame-Options SAMEORIGIN Pragma no-cache Content-Encoding gzip Vary Accept-Encoding set-cookie kds4=1; expires=Mon, 11-May-2020 19:54:33 GMT; Max-Age=259200; path=/; domain=.mediafire.com; httponly CF-Cache-Status DYNAMIC Server cloudflare CF-RAY 5905bbb3dd100bb5-AMS cf-request-id 029773a46a00000bb585bd5200000001
GET H2	200	js Show response www.googletagmanager.com/gtag/	81 KB 30 KB	42ms 21ms	Script application/javascript	2a00:1450:4001:809::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=UA-829541-1 Requested by Host: www.mediafire.com URL: http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:809::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash ffad56e1e8a5a9eb01c1c653537c30801a14217a3a151cc3b316bcf5fd9e1e93 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 08 May 2020 19:54:33 GMT content-encoding br vary Accept-Encoding status 200 alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 30415 x-xss-protection 0 last-modified Fri, 08 May 2020 18:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Fri, 08 May 2020 19:54:33 GMT
GET H2	200	gpt.js Show response securepubads.g.doubleclick.net/tag/js/	46 KB 15 KB	277ms 96ms	Script text/javascript	216.58.210.2 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/tag/js/gpt.js Requested by Host: www.mediafire.com URL: http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file Protocol H2 Security TLS 1.3, , AES_128_GCM Server 216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s07-in-f2.1e100.net Software sffe / Resource Hash 23da22f1b8cb46f059631f7465ebba97061c38ea5d3a176ea0d6894f96d1941d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 08 May 2020 19:54:33 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "510 / 977 of 1000 / last-modified: 1588867830" vary Accept-Encoding content-type text/javascript status 200 cache-control private, max-age=900, stale-while-revalidate=3600 timing-allow-origin * alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 15393 x-xss-protection 0 expires Fri, 08 May 2020 19:54:33 GMT
GET H/1.1	200 OK	prebid2.44.1.js Show response www.mediafire.com/js/	165 KB 53 KB	255ms 222ms	Script application/x-javascript	104.16.202.237 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://www.mediafire.com/js/prebid2.44.1.js Requested by Host: www.mediafire.com URL: http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file Protocol HTTP/1.1 Server 104.16.202.237 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0a7e39087bed30f124a891216762b67addf2644e1c730bc5e94fa9d0ad733266 Request headers Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 08 May 2020 19:54:33 GMT Content-Encoding gzip CF-Cache-Status DYNAMIC Last-Modified Tue, 04 Feb 2020 01:23:28 GMT Server cloudflare ETag W/"5e38c790-294a1" Vary Accept-Encoding Content-Type application/x-javascript Access-Control-Allow-Origin * Cache-Control max-age=2592000 Transfer-Encoding chunked Connection keep-alive CF-RAY 5905bbb70d84fa84-AMS cf-request-id 029773a6650000fa8435248200000001 Expires Sun, 07 Jun 2020 19:54:33 GMT
GET H2	200	aax.js Show response c.aaxads.com/	339 KB 93 KB	246ms 110ms	Script text/javascript	2.20.168.110 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://c.aaxads.com/aax.js?pub=AAX3221EY&hst=www.mediafire.com&ver=1.2 Requested by Host: www.mediafire.com URL: http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.20.168.110 , Ascension Island, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-20-168-110.deploy.static.akamaitechnologies.com Software Apache / Resource Hash 6e42b5f18d56b2bc371c6f685f0dc86623705bd96ca6613034d5d67973eb6a09 Security Headers Name Value Strict-Transport-Security max-age=604800 Request headers Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers strict-transport-security max-age=604800 content-encoding gzip server Apache date Fri, 08 May 2020 19:54:33 GMT vary Accept-Encoding x-mnet-h E content-type text/javascript; charset=utf-8 status 200 cache-control max-age=1800 expires Fri, 08 May 2020 20:24:33 GMT
GET H2	200	gtm.js Show response www.googletagmanager.com/	121 KB 39 KB	31ms 14ms	Script application/javascript	2a00:1450:4001:809::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-53LP4T Requested by Host: www.mediafire.com URL: http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:809::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 583f53fca8f8fe97cd9304d96e0346f34aa53047ff3688730328b222df7b1e59 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 08 May 2020 19:54:33 GMT content-encoding br vary Accept-Encoding status 200 alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 39135 x-xss-protection 0 last-modified Fri, 08 May 2020 18:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Fri, 08 May 2020 19:54:33 GMT
GET H/1.1	200 OK	mf_logo_full_color.svg static.mediafire.com/images/backgrounds/header/	3 KB 2 KB	127ms 94ms	Image image/svg+xml	104.16.203.237 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL http://static.mediafire.com/images/backgrounds/header/mf_logo_full_color.svg Requested by Host: www.mediafire.com URL: http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file Protocol HTTP/1.1 Server 104.16.203.237 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8539c91ae0a82f8cab27d481ea38ac4e66d1e5b36701fe295bcba4399b9255bd Request headers Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 08 May 2020 19:54:33 GMT Content-Encoding gzip CF-Cache-Status HIT Last-Modified Fri, 28 Oct 2016 22:22:42 GMT Server cloudflare Age 3802 ETag W/"5813cfb2-d1d" Vary Accept-Encoding Content-Type image/svg+xml Access-Control-Allow-Origin * Transfer-Encoding chunked Connection keep-alive CF-RAY 5905bbb70f3ec863-AMS cf-request-id 029773a6610000c8636d1f8200000001
GET H/1.1	200 OK	file-zip-v3.png static.mediafire.com/images/filetype/	2 KB 2 KB	128ms 95ms	Image image/png	104.16.203.237 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL http://static.mediafire.com/images/filetype/file-zip-v3.png Requested by Host: www.mediafire.com URL: http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file Protocol HTTP/1.1 Server 104.16.203.237 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4448e430d3c53bad548a5d135e1c7e2f9593e806ba47892640d430ea752e979e Request headers Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 08 May 2020 19:54:33 GMT CF-Cache-Status HIT Age 255187 Connection keep-alive Content-Length 1872 cf-request-id 029773a6690000d925cf1d3200000001 Last-Modified Fri, 11 Mar 2016 23:22:56 GMT Server cloudflare ETag "56e35350-750" Vary Accept-Encoding Content-Type image/png Access-Control-Allow-Origin * Cache-Control max-age=2592000 Accept-Ranges bytes CF-RAY 5905bbb70941d925-AMS Expires Thu, 04 Jun 2020 21:01:26 GMT
GET H/1.1	200 OK	icons_sprite.svg www.mediafire.com/images/icons/svg_light/	36 KB 9 KB	234ms 190ms	Image image/svg+xml	104.16.202.237 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL http://www.mediafire.com/images/icons/svg_light/icons_sprite.svg Requested by Host: www.mediafire.com URL: http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file Protocol HTTP/1.1 Server 104.16.202.237 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 315f5f67f80b413592a970d2d7a3875294be6039956c2edfa0aa9d3095fa6f2d Request headers Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 08 May 2020 19:54:33 GMT Content-Encoding gzip CF-Cache-Status DYNAMIC Last-Modified Tue, 17 Jul 2018 20:30:14 GMT Server cloudflare ETag W/"5b4e51d6-8f48" Transfer-Encoding chunked Content-Type image/svg+xml Access-Control-Allow-Origin * Connection keep-alive CF-RAY 5905bbb6fd260bb5-AMS cf-request-id 029773a65b00000bb585bf9200000001
GET H/1.1	200 OK	element.js Show response translate.google.com/translate_a/	2 KB 1 KB	22ms 16ms	Script text/javascript	2a00:1450:4001:80b::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL http://translate.google.com/translate_a/element.js?cb=googFooterTranslate Requested by Host: www.mediafire.com URL: http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file Protocol HTTP/1.1 Server 2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software HTTP server (unknown) / Resource Hash 0014e99ea5ff4969fa38233b78e56c23ecf2637ddc6ec5e7eed5d0990923525a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Date Fri, 08 May 2020 19:54:33 GMT Content-Encoding gzip X-Content-Type-Options nosniff Server HTTP server (unknown) Content-Language en Cache-Control no-cache, must-revalidate Content-Disposition attachment; filename="f.txt" Content-Type text/javascript; charset=UTF-8 Content-Length 797 X-XSS-Protection 0 Expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	dl_promo_logo.png static.mediafire.com/images/backgrounds/download/	2 KB 3 KB	139ms 62ms	Image image/png	104.16.203.237 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL http://static.mediafire.com/images/backgrounds/download/dl_promo_logo.png Requested by Host: www.mediafire.com URL: http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file Protocol HTTP/1.1 Server 104.16.203.237 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 174d0ce23ddaa3923575af7a8e047e1dbf75199ebee7df1aca5e5713c4a1dd62 Request headers Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 08 May 2020 19:54:33 GMT CF-Cache-Status HIT Age 255198 Connection keep-alive Content-Length 2240 cf-request-id 029773a6aa0000c8636d1fd200000001 Last-Modified Fri, 11 Mar 2016 23:22:56 GMT Server cloudflare ETag "56e35350-8c0" Vary Accept-Encoding Content-Type image/png Access-Control-Allow-Origin * Cache-Control max-age=2592000 Accept-Ranges bytes CF-RAY 5905bbb77865c863-AMS Expires Thu, 04 Jun 2020 21:01:15 GMT
GET H/1.1	200 OK	apps_list_sprite-v4.png static.mediafire.com/images/backgrounds/download/	7 KB 7 KB	145ms 68ms	Image image/png	104.16.203.237 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL http://static.mediafire.com/images/backgrounds/download/apps_list_sprite-v4.png Requested by Host: www.mediafire.com URL: http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file Protocol HTTP/1.1 Server 104.16.203.237 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ac9442c5ea66c76ecf230e9bd349d1f98354319765e366b4ec3150e76bea828c Request headers Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 08 May 2020 19:54:33 GMT CF-Cache-Status HIT Age 255190 Connection keep-alive Content-Length 6942 cf-request-id 029773a6af0000d925cf1d6200000001 Last-Modified Tue, 27 Aug 2019 21:08:04 GMT Server cloudflare ETag "5d659bb4-1b1e" Vary Accept-Encoding Content-Type image/png Access-Control-Allow-Origin * Cache-Control max-age=2592000 Accept-Ranges bytes CF-RAY 5905bbb77a3ed925-AMS Expires Thu, 04 Jun 2020 21:01:23 GMT
GET H/1.1	200 OK	arrow_dropdown.svg www.mediafire.com/images/icons/svg_dark/	315 B 649 B	469ms 281ms	Image image/svg+xml	104.16.202.237 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL http://www.mediafire.com/images/icons/svg_dark/arrow_dropdown.svg Requested by Host: www.mediafire.com URL: http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file Protocol HTTP/1.1 Server 104.16.202.237 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 82b94716473aa225e715e117802145c5d2d725aa1ba9d476d61a5d3da16a8c26 Request headers Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 08 May 2020 19:54:33 GMT Content-Encoding gzip CF-Cache-Status DYNAMIC Last-Modified Tue, 18 Dec 2018 18:09:53 GMT Server cloudflare ETag W/"5c1937f1-13b" Transfer-Encoding chunked Content-Type image/svg+xml Access-Control-Allow-Origin * Connection keep-alive CF-RAY 5905bbb838650bb5-AMS cf-request-id 029773a71f00000bb58580b200000001
GET H/1.1	200 OK	check_circle_green.svg static.mediafire.com/images/icons/svg_dark/	444 B 730 B	223ms 84ms	Image image/svg+xml	104.16.203.237 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL http://static.mediafire.com/images/icons/svg_dark/check_circle_green.svg Requested by Host: www.mediafire.com URL: http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file Protocol HTTP/1.1 Server 104.16.203.237 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 03c8d2dc7d985c3004ff2cd6d8148dd03560f37ed15efdf6c2d7f4d771d0e599 Request headers Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 08 May 2020 19:54:33 GMT Content-Encoding gzip CF-Cache-Status HIT Last-Modified Tue, 17 Jul 2018 20:30:14 GMT Server cloudflare Age 3794 ETag W/"5b4e51d6-1bc" Vary Accept-Encoding Content-Type image/svg+xml Access-Control-Allow-Origin * Transfer-Encoding chunked Connection keep-alive CF-RAY 5905bbb7d948c863-AMS cf-request-id 029773a6e90000c8636d201200000001
GET H/1.1	200 OK	fb_16x16.png static.mediafire.com/images/backgrounds/download/social/	181 B 657 B	193ms 77ms	Image image/png	104.16.203.237 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL http://static.mediafire.com/images/backgrounds/download/social/fb_16x16.png Requested by Host: www.mediafire.com URL: http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file Protocol HTTP/1.1 Server 104.16.203.237 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 720671166ac43aba99e3952b0b9341ab4e0fee1fd891db54e2a07f05db653142 Request headers Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 08 May 2020 19:54:33 GMT CF-Cache-Status HIT Age 255192 Connection keep-alive Content-Length 181 cf-request-id 029773a6f40000d925cf1db200000001 Last-Modified Fri, 11 Mar 2016 23:22:56 GMT Server cloudflare ETag "56e35350-b5" Vary Accept-Encoding Content-Type image/png Access-Control-Allow-Origin * Cache-Control max-age=2592000 Accept-Ranges bytes CF-RAY 5905bbb7eb0fd925-AMS Expires Thu, 04 Jun 2020 21:01:21 GMT
GET H2	200	analytics.js Show response www.google-analytics.com/	45 KB 18 KB	25ms 6ms	Script text/javascript	2a00:1450:4001:809::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=UA-829541-1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 2f1fd973e6c48489ae07c467e3278635b856c698d1f502e06af3ab555937deac Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Thu, 30 Apr 2020 21:54:13 GMT server Golfe2 age 4558 date Fri, 08 May 2020 18:38:35 GMT vary Accept-Encoding content-type text/javascript status 200 cache-control public, max-age=7200 alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 18433 expires Fri, 08 May 2020 20:38:35 GMT
GET H/1.1	200 OK	footerIcons.png static.mediafire.com/images/backgrounds/footer/social/	583 B 1 KB	213ms 69ms	Image image/png	104.16.203.237 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL http://static.mediafire.com/images/backgrounds/footer/social/footerIcons.png Requested by Host: www.mediafire.com URL: http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file Protocol HTTP/1.1 Server 104.16.203.237 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f917a9105c311331b1d40f4d2bdbf11233c1c465616c1a9c46232f451463b061 Request headers Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 08 May 2020 19:54:33 GMT CF-Cache-Status HIT Age 54211 Connection keep-alive Content-Length 583 cf-request-id 029773a7430000d925cf1e2200000001 Last-Modified Fri, 11 Mar 2016 23:22:56 GMT Server cloudflare ETag "56e35350-247" Vary Accept-Encoding Content-Type image/png Access-Control-Allow-Origin * Cache-Control max-age=2592000 Accept-Ranges bytes CF-RAY 5905bbb86c0bd925-AMS Expires Sun, 07 Jun 2020 04:51:02 GMT
GET H2	200	translateelement.css translate.googleapis.com/translate_static/css/	18 KB 4 KB	28ms 7ms	Stylesheet text/css	2a00:1450:4001:821::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://translate.googleapis.com/translate_static/css/translateelement.css Requested by Host: translate.google.com URL: http://translate.google.com/translate_a/element.js?cb=googFooterTranslate Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:821::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 6149f95c1ebdde5391898e22a79821a810336f6bd74318291b4f49f23fbf0fa8 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 08 May 2020 19:44:46 GMT content-encoding gzip x-content-type-options nosniff age 587 status 200 alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 3619 x-xss-protection 0 last-modified Wed, 12 Feb 2020 21:15:00 GMT server sffe vary Accept-Encoding content-type text/css access-control-allow-origin * cache-control public, max-age=3600 accept-ranges bytes expires Fri, 08 May 2020 20:44:46 GMT
GET H2	200	main.js Show response translate.googleapis.com/translate_static/js/element/	3 KB 2 KB	27ms 6ms	Script text/javascript	2a00:1450:4001:821::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://translate.googleapis.com/translate_static/js/element/main.js Requested by Host: translate.google.com URL: http://translate.google.com/translate_a/element.js?cb=googFooterTranslate Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:821::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash d3595816525dffb272cef29e6702c2cb9ff54531d2910591a7654e5f397ca850 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 08 May 2020 19:12:14 GMT content-encoding gzip x-content-type-options nosniff age 2539 status 200 alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1607 x-xss-protection 0 last-modified Thu, 07 May 2020 18:45:00 GMT server sffe vary Accept-Encoding content-type text/javascript access-control-allow-origin * cache-control public, max-age=3600 accept-ranges bytes expires Fri, 08 May 2020 20:12:14 GMT
GET H2	200	infinity.js.aspx Show response cdn.otnolatrnup.com/Scripts/	184 KB 75 KB	76ms 42ms	Script application/x-javascript	2606:4700::6813:d625 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.otnolatrnup.com/Scripts/infinity.js.aspx?guid=5ff0fb62-0643-4ff1-aaee-c737f9ffc0e0 Requested by Host: www.mediafire.com URL: http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:d625 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / ASP.NET Resource Hash 2ab51e328107f0117c347e183781cbc66d1b8179111e26101bedd2f961f4308e Request headers Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers cf-ray 5905bbb7b9c2dfc7-FRA date Fri, 08 May 2020 19:54:33 GMT content-encoding gzip cf-cache-status HIT server cloudflare age 106 status 200 x-powered-by ASP.NET expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding p3p CP="CAO PSA OUR IND" access-control-allow-origin * cache-control public, no-transform, max-age=900 content-type application/x-javascript; charset=utf-8 cf-request-id 029773a6ce0000dfc71daeb200000001
GET H2	200	like.php www.facebook.com/plugins/ Frame 6EED	0 0	69ms 55ms	Document text/html	2a03:2880:f11c:8183:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com/plugins/like.php?href=http://www.facebook.com/MediaFire&width=193&layout=button_count&action=like&show_faces=false&share=true&height=30&appId=124578887583575 Requested by Host: www.mediafire.com URL: http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash Security Headers Name Value Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests; Strict-Transport-Security max-age=15552000; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers :method GET :authority www.facebook.com :scheme https :path /plugins/like.php?href=http://www.facebook.com/MediaFire&width=193&layout=button_count&action=like&show_faces=false&share=true&height=30&appId=124578887583575 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file Response headers status 200 cache-control private, no-cache, no-store, must-revalidate pragma no-cache strict-transport-security max-age=15552000; preload content-encoding br timing-allow-origin * content-security-policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests; vary Accept-Encoding x-content-type-options nosniff x-xss-protection 0 expires Sat, 01 Jan 2000 00:00:00 GMT content-type text/html; charset="utf-8" x-fb-debug o70Lw0PU3heM3gVhdpUHyRelOlwH9BV1YktDBVYw2tepaSLGOxcIrLFHi5lWR5Ndyf6Qr7c8Tq6gr4Eg/KfJgg== date Fri, 08 May 2020 19:54:33 GMT
GET H2	200	ec.js Show response www.google-analytics.com/plugins/ua/	3 KB 1 KB	6ms 6ms	Script text/javascript	2a00:1450:4001:809::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/plugins/ua/ec.js Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 058ed961bfe422af7bfc65865f4c08531ec8ace995f8a1ec560a46581cb7712c Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 08 May 2020 19:43:18 GMT content-encoding gzip x-content-type-options nosniff last-modified Tue, 22 Oct 2019 18:15:00 GMT server sffe age 675 vary Accept-Encoding content-type text/javascript status 200 cache-control public, max-age=3600 accept-ranges bytes alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1306 x-xss-protection 0 expires Fri, 08 May 2020 20:43:18 GMT
GET H/1.1	200 OK	world.svg static.mediafire.com/images/backgrounds/download/additional_content/	143 KB 53 KB	180ms 72ms	Image image/svg+xml	104.16.203.237 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL http://static.mediafire.com/images/backgrounds/download/additional_content/world.svg Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol HTTP/1.1 Server 104.16.203.237 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4342feac38021c4fe3069eba0edf1c2e1b4345e2b548b0afb7ab21b7369b3bc8 Request headers Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 08 May 2020 19:54:33 GMT Content-Encoding gzip CF-Cache-Status HIT Last-Modified Tue, 17 Jul 2018 20:30:14 GMT Server cloudflare Age 3753 ETag W/"5b4e51d6-23ce2" Vary Accept-Encoding Content-Type image/svg+xml Access-Control-Allow-Origin * Transfer-Encoding chunked Connection keep-alive CF-RAY 5905bbb86a3fc863-AMS cf-request-id 029773a73f0000c8636d204200000001
GET H/1.1	200 OK	continent-na.svg static.mediafire.com/images/backgrounds/download/additional_content/	50 KB 19 KB	228ms 73ms	Image image/svg+xml	104.16.203.237 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL http://static.mediafire.com/images/backgrounds/download/additional_content/continent-na.svg Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol HTTP/1.1 Server 104.16.203.237 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 05cfe92d9794a54258a19bfec7ae0faa73f61b66416983136594b4f95bb114dd Request headers Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 08 May 2020 19:54:33 GMT Content-Encoding gzip CF-Cache-Status HIT Last-Modified Tue, 17 Jul 2018 20:30:14 GMT Server cloudflare Age 3642 ETag W/"5b4e51d6-c817" Vary Accept-Encoding Content-Type image/svg+xml Access-Control-Allow-Origin * Transfer-Encoding chunked Connection keep-alive CF-RAY 5905bbb8dd00d925-AMS cf-request-id 029773a7870000d925cf1e9200000001
GET H/1.1	200 OK	mex.svg static.mediafire.com/images/flags_svg/	219 KB 85 KB	272ms 69ms	Image image/svg+xml	104.16.203.237 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL http://static.mediafire.com/images/flags_svg/mex.svg Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol HTTP/1.1 Server 104.16.203.237 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b2d1b792e8f907b6a0be526d54a14957c07ea665826e9bbc3e0d97515b071797 Request headers Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 08 May 2020 19:54:33 GMT Content-Encoding gzip CF-Cache-Status HIT Last-Modified Tue, 17 Jul 2018 20:30:14 GMT Server cloudflare Age 3500 ETag W/"5b4e51d6-36bbc" Vary Accept-Encoding Content-Type image/svg+xml Access-Control-Allow-Origin * Transfer-Encoding chunked Connection keep-alive CF-RAY 5905bbb92c27c863-AMS cf-request-id 029773a7ba0000c8636d20d200000001
GET H/1.1	200 OK	flag.svg static.mediafire.com/images/backgrounds/download/additional_content/	234 B 632 B	230ms 71ms	Image image/svg+xml	104.16.203.237 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL http://static.mediafire.com/images/backgrounds/download/additional_content/flag.svg Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol HTTP/1.1 Server 104.16.203.237 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f52a0c7d9fa7ae8e45916c491ae7193f9a1e289f128f05264122c53d8da970db Request headers Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 08 May 2020 19:54:33 GMT Content-Encoding gzip CF-Cache-Status HIT Last-Modified Tue, 17 Jul 2018 20:30:14 GMT Server cloudflare Age 3772 ETag W/"5b4e51d6-ea" Vary Accept-Encoding Content-Type image/svg+xml Access-Control-Allow-Origin * Transfer-Encoding chunked Connection keep-alive CF-RAY 5905bbb96e3cd925-AMS cf-request-id 029773a7e00000d925cf1ef200000001
GET H2	200	ga-audiences www.google.de/ads/ Redirect Chain https://www.google-analytics.com/r/collect?v=1&_v=j82&a=1973420004&t=pageview&_s=1&dl=http%3A%2F%2Fwww.mediafire.com%2Ffile%2Fkdmpe66t3jasmtq%2Fpaint_tool2.zip%2Ffile&ul=en-us&de=UTF-8&dt=paint%20t... https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-829541-1&cid=330312553.1588967674&jid=1249836107&_gid=340608390.1588967674&gjid=1693754805&_v=j82&z=24496427 https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-829541-1&cid=330312553.1588967674&jid=1249836107&_v=j82&z=24496427 https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-829541-1&cid=330312553.1588967674&jid=1249836107&_v=j82&z=24496427&slf_rd=1&random=1691387235	42 B 517 B	38ms 17ms	Image image/gif	2a00:1450:4001:814::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-829541-1&cid=330312553.1588967674&jid=1249836107&_v=j82&z=24496427&slf_rd=1&random=1691387235 Requested by Host: www.mediafire.com URL: http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Fri, 08 May 2020 19:54:33 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control no-cache, no-store, must-revalidate content-type image/gif alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT Redirect headers pragma no-cache date Fri, 08 May 2020 19:54:33 GMT x-content-type-options nosniff server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 302 content-type text/html; charset=UTF-8 location https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-829541-1&cid=330312553.1588967674&jid=1249836107&_v=j82&z=24496427&slf_rd=1&random=1691387235 cache-control no-cache, no-store, must-revalidate timing-allow-origin * alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	collect www.google-analytics.com/r/	35 B 112 B	13ms 12ms	Image image/gif	2a00:1450:4001:809::200e GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google-analytics.com/r/collect?v=1&_v=j82&a=1973420004&t=pageview&_s=1&dl=http%3A%2F%2Fwww.mediafire.com%2Ffile%2Fkdmpe66t3jasmtq%2Fpaint_tool2.zip%2Ffile&ul=en-us&de=UTF-8&dt=paint%20tool2&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=aGDAAUAL~&jid=78416980&gjid=769368219&cid=330312553.1588967674&tid=UA-86547571-4&_gid=340608390.1588967674&_r=1&gtm=2wg4t053LP4T&z=1197872286 Requested by Host: www.mediafire.com URL: http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Fri, 08 May 2020 19:54:33 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 status 200 content-type image/gif access-control-allow-origin * cache-control no-cache, no-store, must-revalidate alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 35 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	element_main.js Show response translate.googleapis.com/element/TE_20200210_00/e/js/element/	240 KB 86 KB	6ms 6ms	Script text/javascript	2a00:1450:4001:821::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://translate.googleapis.com/element/TE_20200210_00/e/js/element/element_main.js Requested by Host: translate.googleapis.com URL: https://translate.googleapis.com/translate_static/js/element/main.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:821::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 1ec26d78a3de21cb3b0cda0638de148797f5168c1cc1127544f1fad21fd8b277 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 08 May 2020 19:32:32 GMT content-encoding gzip x-content-type-options nosniff age 1321 status 200 alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 88087 x-xss-protection 0 last-modified Mon, 10 Feb 2020 10:53:35 GMT server sffe vary Accept-Encoding content-type text/javascript access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes expires Sat, 08 May 2021 19:32:32 GMT
GET H2	200	/ Show response c.adsco.re/	34 KB 13 KB	68ms 25ms	Script text/html	2606:4700::6811:a7ba CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://c.adsco.re/ Requested by Host: cdn.otnolatrnup.com URL: https://cdn.otnolatrnup.com/Scripts/infinity.js.aspx?guid=5ff0fb62-0643-4ff1-aaee-c737f9ffc0e0 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:a7ba , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1df5dda5dda04d403a0c1d75898c8e67e74d6a68ea8b6de7d96e266e6cc259be Request headers Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 08 May 2020 19:54:33 GMT content-encoding gzip cf-cache-status HIT age 77089 status 200 alt-svc h3-27=":443"; ma=86400, h3-25=":443"; ma=86400, h3-24=":443"; ma=86400, h3-23=":443"; ma=86400 cf-request-id 029773a740000064b5b28bc200000001 server cloudflare etag W/"TfDfF8/DBqH7tF/j3/1Icw==" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/html cache-control max-age=43200,public,immutable,no-transform cf-ray 5905bbb86e6564b5-FRA link <//adsco.re/p>;rel=prefetch,<//6.adsco.re>;rel=prefetch expires Fri, 08 May 2020 10:29:44 GMT
GET H2	200	l Show response translate.googleapis.com/translate_a/	3 KB 1 KB	20ms 20ms	Script application/javascript	2a00:1450:4001:821::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://translate.googleapis.com/translate_a/l?client=te&alpha=true&hl=en&cb=_callbacks____0k9ymbrqn Requested by Host: translate.googleapis.com URL: https://translate.googleapis.com/element/TE_20200210_00/e/js/element/element_main.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:821::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 9addf8b8871514af6537dfffc5803337fb75c48bb7dee802a70c39b2b0f92e24 Security Headers Name Value Content-Security-Policy script-src 'report-sample' 'nonce-AT7bQtRjvKCdYq4ntxZY/w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/TranslateApiHttp/cspreport;worker-src 'self', script-src 'nonce-AT7bQtRjvKCdYq4ntxZY/w' 'self' 'unsafe-eval' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/TranslateApiHttp/cspreport X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache content-security-policy script-src 'report-sample' 'nonce-AT7bQtRjvKCdYq4ntxZY/w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/TranslateApiHttp/cspreport;worker-src 'self', script-src 'nonce-AT7bQtRjvKCdYq4ntxZY/w' 'self' 'unsafe-eval' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/TranslateApiHttp/cspreport content-encoding gzip x-content-type-options nosniff server ESF status 200 date Fri, 08 May 2020 19:54:33 GMT x-frame-options SAMEORIGIN content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control no-cache, no-store, max-age=0, must-revalidate alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 expires Mon, 01 Jan 1990 00:00:00 GMT
GET H2	200	translate_24dp.png www.gstatic.com/images/branding/product/1x/	825 B 916 B	30ms 7ms	Image image/png	2a00:1450:4001:81f::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.gstatic.com/images/branding/product/1x/translate_24dp.png Requested by Host: www.mediafire.com URL: http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 1bb2279aed6bc1438d2b17a5ffcbac9d37864582aedeeec8d301eab162b2c213 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 08 May 2020 11:20:21 GMT x-content-type-options nosniff last-modified Tue, 22 Oct 2019 18:15:00 GMT server sffe age 30852 vary Origin content-type image/png status 200 cache-control public, max-age=31536000 accept-ranges bytes alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 825 x-xss-protection 0 expires Sat, 08 May 2021 11:20:21 GMT
GET H2	200	googlelogo_color_42x16dp.png www.gstatic.com/images/branding/googlelogo/1x/	910 B 1 KB	16ms 6ms	Image image/png	2a00:1450:4001:81f::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.gstatic.com/images/branding/googlelogo/1x/googlelogo_color_42x16dp.png Requested by Host: www.mediafire.com URL: http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 6318394f737c66f0e2ccfcd88e3935c6667633a1b95fa29fba2b75431d55eef2 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 07 Apr 2020 17:49:07 GMT x-content-type-options nosniff last-modified Tue, 22 Oct 2019 18:15:00 GMT server sffe age 2685926 vary Origin content-type image/png status 200 cache-control public, max-age=31536000 accept-ranges bytes alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 910 x-xss-protection 0 expires Wed, 07 Apr 2021 17:49:07 GMT
GET H2	200	translate_24dp.png www.gstatic.com/images/branding/product/2x/	2 KB 2 KB	17ms 7ms	Image image/png	2a00:1450:4001:81f::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.gstatic.com/images/branding/product/2x/translate_24dp.png Requested by Host: www.mediafire.com URL: http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5fe03bfd95a2d4e640ed7d04dcb08ef991c327a5ab6f6fdb9eb06e1efc76af30 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://translate.googleapis.com/translate_static/css/translateelement.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Wed, 06 May 2020 03:40:53 GMT x-content-type-options nosniff last-modified Tue, 22 Oct 2019 18:15:00 GMT server sffe age 231220 vary Origin content-type image/png status 200 cache-control public, max-age=31536000 accept-ranges bytes alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1847 x-xss-protection 0 expires Thu, 06 May 2021 03:40:53 GMT
GET H2	200	integrator.js Show response adservice.google.pl/adsid/	109 B 894 B	40ms 19ms	Script application/javascript	2a00:1450:4001:819::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://adservice.google.pl/adsid/integrator.js?domain=www.mediafire.com Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:819::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers timing-allow-origin * date Fri, 08 May 2020 19:54:33 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info." status 200 cache-control private, no-cache, no-store content-disposition attachment; filename="f.txt" content-type application/javascript; charset=UTF-8 alt-svc h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 104 x-xss-protection 0
GET H2	200	integrator.js Show response adservice.google.com/adsid/	109 B 894 B	48ms 15ms	Script application/javascript	2a00:1450:4001:819::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://adservice.google.com/adsid/integrator.js?domain=www.mediafire.com Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:819::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers timing-allow-origin * date Fri, 08 May 2020 19:54:33 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info." status 200 cache-control private, no-cache, no-store content-disposition attachment; filename="f.txt" content-type application/javascript; charset=UTF-8 alt-svc h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 104 x-xss-protection 0
GET H2	200	pubads_impl_2020043001.js Show response securepubads.g.doubleclick.net/gpt/	239 KB 86 KB	94ms 94ms	Script text/javascript	216.58.210.2 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020043001.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s07-in-f2.1e100.net Software sffe / Resource Hash 2531e515d47b88300e3c5e3a91d5d22a292bdfdb6cec2e6399090bd9545ba92c Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 08 May 2020 19:54:33 GMT content-encoding gzip x-content-type-options nosniff last-modified Thu, 30 Apr 2020 13:07:28 GMT server sffe vary Accept-Encoding content-type text/javascript status 200 cache-control private, immutable, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 87920 x-xss-protection 0 expires Fri, 08 May 2020 19:54:33 GMT
POST H2	204	translator Show response hbopenbid.pubmatic.com/	0 117 B	266ms 87ms	XHR text/plain	185.64.189.112 AS-PUBMATIC
General Check archive.org Show headers Download Go to Full URL https://hbopenbid.pubmatic.com/translator?source=prebid-client Requested by Host: www.mediafire.com URL: http://www.mediafire.com/js/prebid2.44.1.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers status 204 date Fri, 08 May 2020 19:54:34 GMT cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true access-control-allow-origin http://www.mediafire.com
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/	19 B 712 B	104ms 73ms	XHR application/json	37.252.172.249 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL http://ib.adnxs.com/ut/v3/prebid Requested by Host: www.mediafire.com URL: http://www.mediafire.com/js/prebid2.44.1.js Protocol HTTP/1.1 Server 37.252.172.249 , Ascension Island, ASN29990 (ASN-APPNEX, US), Reverse DNS 534.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net Software nginx/1.13.4 / Resource Hash 0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5 Security Headers Name Value X-Xss-Protection 0 Request headers Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Fri, 08 May 2020 19:54:35 GMT X-Proxy-Origin 194.99.105.99; 194.99.105.99; 534.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.172.110:80 AN-X-Request-Uuid d05b4a2f-d101-43c1-bbe0-9626bfd6b309 Server nginx/1.13.4 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin http://www.mediafire.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 19 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H2	200	arj Show response mediafire-d.openx.net/w/1.0/	174 B 572 B	334ms 175ms	XHR application/json	35.244.233.96 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://mediafire-d.openx.net/w/1.0/arj?ju=http%3A%2F%2Fwww.mediafire.com%2Ffile%2Fkdmpe66t3jasmtq%2Fpaint_tool2.zip%2Ffile&ch=UTF-8&res=1600x1200x24&ifr=false&tz=-120&tws=1600x1200&be=1&bc=hb_pb_3.0.0&dddid=a4661dc1-0c34-4ca4-88b2-960904e2fd3d%2C44b4f44a-ba60-44b3-95a2-daa9383ad575%2Cec703800-dac6-4bef-8e3f-f9b806a2fe07%2C37da0977-b661-48f4-b526-9e2491fc8bf2%2C8893f391-9d58-49fe-90e8-9cc55086734f&nocache=1588967673711&aus=728x90%7C336x280%2C300x250%7C336x280%2C300x250%7C728x90%7C728x90&divIds=div-gpt-ad-1579280679906-0%2Cdiv-gpt-ad-1579280773917-0%2Cdiv-gpt-ad-1579280808862-0%2Cdiv-gpt-ad-1579280901640-0%2Cdiv-gpt-ad-1579281349230-0&auid=539074863%2C539074864%2C539074865%2C539074866%2C539074866& Requested by Host: www.mediafire.com URL: http://www.mediafire.com/js/prebid2.44.1.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 35.244.233.96 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS 96.233.244.35.bc.googleusercontent.com Software OXGW/16.185.0 / Resource Hash 4558a078c214417df0fb35f1505fc6c62feb0d1ba09ba50ec0cebe8bd5e28971 Request headers Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Fri, 08 May 2020 19:54:33 GMT content-encoding gzip server OXGW/16.185.0 status 200 vary Accept, Accept-Encoding p3p CP="CUR ADM OUR NOR STA NID" access-control-allow-origin http://www.mediafire.com cache-control private, max-age=0, no-cache access-control-allow-credentials true content-type application/json alt-svc clear content-length 165 via 1.1 google expires Mon, 26 Jul 1997 05:00:00 GMT
GET H/1.1	200 OK	p adsco.re/	0 323 B	1330ms 69ms	Other text/html	162.252.214.5 TUT-AS
General Check archive.org Show headers Download Go to Full URL https://adsco.re/p Requested by Host: www.mediafire.com URL: http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_256_CBC Server 162.252.214.5 , United States, ASN53334 (TUT-AS, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 08 May 2020 19:54:35 GMT Content-Encoding gzip Content-Type text/html; charset=UTF-8 AS-P-4 OK Transfer-Encoding chunked AS-P-1 OK Access-Control-Max-Age 2592000 Cache-Control no-transform Connection keep-alive AS-E ND AS-P-2 OK AS-P-3 OK
GET H2	200	/ 6.adsco.re/	0 266 B	53ms 51ms	Other text/plain	2606:4700::6811:a7ba CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://6.adsco.re/ Requested by Host: www.mediafire.com URL: http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:a7ba , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 08 May 2020 19:54:33 GMT content-encoding br server cloudflare access-control-allow-headers Content-Type status 200 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding access-control-allow-methods GET, HEAD, OPTIONS content-type text/plain;charset=UTF-8 access-control-allow-origin * access-control-max-age 2592000 cache-control max-age=600,public,immutable cf-ray 5905bbb8be9c64b5-FRA alt-svc h3-27=":443"; ma=86400, h3-25=":443"; ma=86400, h3-24=":443"; ma=86400, h3-23=":443"; ma=86400 cf-request-id 029773a774000064b5b28bf200000001
GET H2	200	pxusr.gif c.aaxads.com/	43 B 206 B	65ms 64ms	Image image/gif	2.20.168.110 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://c.aaxads.com/pxusr.gif Requested by Host: www.mediafire.com URL: http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.20.168.110 , Ascension Island, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-20-168-110.deploy.static.akamaitechnologies.com Software Apache / Resource Hash 8ac1703c1c34b2be426deda409d39258f82fae17f13e645f377f337a954aedde Security Headers Name Value Strict-Transport-Security max-age=604800 Request headers Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 08 May 2020 19:54:33 GMT last-modified Mon, 26 Feb 2018 13:29:58 GMT server Apache strict-transport-security max-age=604800 content-type image/gif status 200 cache-control max-age=376143 accept-ranges bytes content-length 43 expires Wed, 13 May 2020 04:23:36 GMT
GET H/1.1	200 OK	pxext.gif www.aaxdetect.com/	43 B 323 B	193ms 65ms	Image image/gif	2.20.166.209 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.aaxdetect.com/pxext.gif Requested by Host: www.mediafire.com URL: http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2.20.166.209 , Ascension Island, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-20-166-209.deploy.static.akamaitechnologies.com Software Apache / Resource Hash 8ac1703c1c34b2be426deda409d39258f82fae17f13e645f377f337a954aedde Request headers Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 08 May 2020 19:54:33 GMT Last-Modified Mon, 26 Feb 2018 13:29:58 GMT Server Apache Content-Type image/gif Cache-Control max-age=902068 Connection keep-alive Accept-Ranges bytes Content-Length 43 Expires Tue, 19 May 2020 06:29:01 GMT
POST H/1.1	200 OK	p Show response adsco.re/	0 418 B	459ms 177ms	XHR text/html	162.252.214.5 TUT-AS
General Check archive.org Show headers Download Go to Full URL http://adsco.re/p Requested by Host: c.adsco.re URL: https://c.adsco.re/ Protocol HTTP/1.1 Server 162.252.214.5 , United States, ASN53334 (TUT-AS, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers Date Fri, 08 May 2020 19:54:34 GMT Content-Encoding gzip Content-Type text/html; charset=UTF-8 AS-P-4 OK Transfer-Encoding chunked AS-P-1 OK Access-Control-Allow-Origin http://www.mediafire.com Access-Control-Max-Age 2592000 Cache-Control no-transform Access-Control-Allow-Credentials true Connection keep-alive AS-E ND AS-P-2 OK AS-P-3 OK
GET H/1.1	200 OK	/ Show response 6.adsco.re/	53 B 704 B	19ms 12ms	XHR text/plain	2606:4700::6811:a6ba CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://6.adsco.re/ Requested by Host: c.adsco.re URL: https://c.adsco.re/ Protocol HTTP/1.1 Server 2606:4700::6811:a6ba , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 12f310d36e9a9d454ad40ff78184fb0418ce74134dda23efe7f4244a5dd651d8 Request headers Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 08 May 2020 19:54:33 GMT Content-Encoding gzip Server cloudflare Access-Control-Allow-Headers Content-Type Vary Accept-Encoding Access-Control-Allow-Methods GET, HEAD, OPTIONS Content-Type text/plain;charset=UTF-8 Access-Control-Allow-Origin http://www.mediafire.com Access-Control-Max-Age 2592000 Cache-Control max-age=600,public,immutable Transfer-Encoding chunked Connection keep-alive CF-RAY 5905bbb93e09d715-FRA alt-svc h3-27=":443"; ma=86400, h3-25=":443"; ma=86400, h3-24=":443"; ma=86400, h3-23=":443"; ma=86400 cf-request-id 029773a7c60000d7150e1df200000001
GET		/ a3aztbd4ei6u.l.adsco.re/	0 0
GET		/ a3aztbd4ei6u.n.adsco.re/	0 0
GET		/ a3aztbd4ei6u.s.adsco.re/	0 0
GET H/1.1	200 OK	/ c.adsco.re/ Frame DBE2	0 0	57ms 51ms	Document text/html	2606:4700::6811:a7ba CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://c.adsco.re/ Requested by Host: c.adsco.re URL: https://c.adsco.re/ Protocol HTTP/1.1 Server 2606:4700::6811:a7ba , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers Host c.adsco.re Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file Response headers Date Fri, 08 May 2020 19:54:33 GMT Content-Type text/html Transfer-Encoding chunked Connection keep-alive Cache-Control max-age=43200,public,immutable,no-transform Link <//adsco.re/p>;rel=prefetch,<//6.adsco.re>;rel=prefetch Expires Fri, 08 May 2020 10:29:45 GMT ETag W/"TfDfF8/DBqH7tF/j3/1Icw==" Content-Encoding gzip CF-Cache-Status HIT Age 77088 Vary Accept-Encoding Server cloudflare CF-RAY 5905bbb94db696fe-FRA alt-svc h3-27=":443"; ma=86400, h3-25=":443"; ma=86400, h3-24=":443"; ma=86400, h3-23=":443"; ma=86400 cf-request-id 029773a7ca000096fe0a10f200000001
GET H2	200	log l3.aaxads.com/	35 B 194 B	72ms 71ms	Image image/gif	2.20.168.110 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://l3.aaxads.com/log?___stu13p=aveoaamactga5dnnuee25ti2rm86bcrodqacb&lwbsh=AAX&dewh=SSP_CLIENT&dgeg=0&dgw=desktop&flg=AAX3221EY&fw=WARSAW&ff=PL&xjg=4&oshu=1&skw=1842&slg=8PR6YK195&gq=mediafire.com&vhuyqdph=rtb-nv-dcos-ssp-10-6-46-202-37&vg=-1&vyu=0613_247_0708_134_ssp&vf=&yhuvlrq=4&yk=1200&yz=1585&yvlg=&ylg=00001588967673774032612948489347&vvsDeExfnhw=CONTROL&qsd=1&jgsu_hqi=1&fvha=0&jgivwu=Y--&jgsu=1&fvvwu=&wfi_fps=&wfi_vwdwxv=&wfi_sus=&xvs_hqi=1&xvs_vwdwxv=0&xvs_ogi=false&xvs_vwulqj=&xifd=-1&deg=2&gvwduw=53&ghqg=277&uhtxuo=http%3A%2F%2Fwww.mediafire.com%2Ffile%2Fkdmpe66t3jasmtq%2Fpaint_tool2.zip%2Ffile&nzui= Requested by Host: www.mediafire.com URL: http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.20.168.110 , Ascension Island, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-20-168-110.deploy.static.akamaitechnologies.com Software Jetty(9.4.25.v20191220) / Resource Hash 796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90 Request headers Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Fri, 08 May 2020 19:54:34 GMT server Jetty(9.4.25.v20191220) status 200 content-type image/gif access-control-allow-origin * cache-control max-age=0, no-cache, no-store content-length 35 expires Fri, 08 May 2020 19:54:34 GMT
GET H2	200	ads Show response securepubads.g.doubleclick.net/gampad/	57 KB 12 KB	493ms 492ms	XHR text/plain	216.58.210.2 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3059075393200520&correlator=3753800104849799&output=ldjh&impl=fifs&adsid=NT&eid=21065929%2C21066063%2C44716867&vrg=2020043001&guci=1.2.0.0.2.2.0.0&sc=0&sfv=1-0-37&ecs=20200508&iu_parts=21882844027%2CDesktop-Zone1&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&prev_scp=buildnumber%3D121533%26dladtemplate%3D1%26button_delay%3Ddisabled&eri=5&cookie_enabled=1&bc=23&abxe=1&lmt=1588967674&dt=1588967674060&dlt=1588967673311&idt=701&frm=20&biw=1585&bih=1200&oid=3&adxs=545&adys=10&adks=573839204&ucis=1&ifi=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=http%3A%2F%2Fwww.mediafire.com%2Ffile%2Fkdmpe66t3jasmtq%2Fpaint_tool2.zip%2Ffile&dssz=35&icsg=229544&std=0&vis=1&scr_x=0&scr_y=0&psz=960x1500&msz=728x-1&ga_vid=330312553.1588967674&ga_sid=1588967674&ga_hid=1973420004&fws=0&ohw=0 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020043001.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s07-in-f2.1e100.net Software cafe / Resource Hash 93b550651ce30918596f7e33916ad43b1f233a9fe26dfb91dcb96e382367e3e5 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 08 May 2020 19:54:34 GMT content-encoding br x-content-type-options nosniff p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" status 200 alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 12120 x-xss-protection 0 google-lineitem-id -1 pragma no-cache server cafe google-creative-id -1 content-type text/plain; charset=UTF-8 access-control-allow-origin http://www.mediafire.com access-control-expose-headers x-google-amp-ad-validated-version cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	container.html tpc.googlesyndication.com/safeframe/1-0-37/html/	0 0	25ms 6ms	Other text/html	2a00:1450:4001:801::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020043001.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash Request headers Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers
GET H2	200	ads Show response securepubads.g.doubleclick.net/gampad/	39 KB 10 KB	420ms 419ms	XHR text/plain	216.58.210.2 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3059075393200520&correlator=2564350594172772&output=ldjh&impl=fifs&adsid=NT&eid=21065929%2C21066063%2C44716867&vrg=2020043001&guci=1.2.0.0.2.2.0.0&sc=0&sfv=1-0-37&ecs=20200508&iu_parts=21882844027%2CDesktop-Zone2&enc_prev_ius=%2F0%2F1&prev_iu_szs=336x280%7C300x250&prev_scp=buildnumber%3D121533%26dladtemplate%3D1%26button_delay%3Ddisabled&eri=5&cookie_enabled=1&bc=23&abxe=1&lmt=1588967674&dt=1588967674077&dlt=1588967673311&idt=701&frm=20&biw=1585&bih=1200&oid=3&adxs=313&adys=120&adks=1218337638&ucis=2&ifi=2&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=http%3A%2F%2Fwww.mediafire.com%2Ffile%2Fkdmpe66t3jasmtq%2Fpaint_tool2.zip%2Ffile&dssz=35&icsg=229544&std=0&vis=1&scr_x=0&scr_y=0&psz=960x1500&msz=336x-1&ga_vid=330312553.1588967674&ga_sid=1588967674&ga_hid=1973420004&fws=0&ohw=0 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020043001.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s07-in-f2.1e100.net Software cafe / Resource Hash 0ed1134e81ad12f16103318d23ebb1e5fee24c6eb942d079e35717ad1bbb2499 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 08 May 2020 19:54:34 GMT content-encoding br x-content-type-options nosniff p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" status 200 alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 9401 x-xss-protection 0 google-lineitem-id -1 pragma no-cache server cafe google-creative-id -1 content-type text/plain; charset=UTF-8 access-control-allow-origin http://www.mediafire.com cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ads Show response securepubads.g.doubleclick.net/gampad/	4 KB 2 KB	441ms 441ms	XHR text/plain	216.58.210.2 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3059075393200520&correlator=606334703959074&output=ldjh&impl=fifs&adsid=NT&eid=21065929%2C21066063%2C44716867&vrg=2020043001&guci=1.2.0.0.2.2.0.0&sc=0&sfv=1-0-37&ecs=20200508&iu_parts=21882844027%2CDesktop-Zone3&enc_prev_ius=%2F0%2F1&prev_iu_szs=336x280%7C300x250&prev_scp=buildnumber%3D121533%26dladtemplate%3D1%26button_delay%3Ddisabled&eri=5&cookie_enabled=1&bc=23&abxe=1&lmt=1588967674&dt=1588967674085&dlt=1588967673311&idt=701&frm=20&biw=1585&bih=1200&oid=3&adxs=313&adys=420&adks=504956327&ucis=3&ifi=3&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=http%3A%2F%2Fwww.mediafire.com%2Ffile%2Fkdmpe66t3jasmtq%2Fpaint_tool2.zip%2Ffile&dssz=35&icsg=229544&std=0&vis=1&scr_x=0&scr_y=0&psz=960x1500&msz=336x-1&ga_vid=330312553.1588967674&ga_sid=1588967674&ga_hid=1973420004&fws=0&ohw=0 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020043001.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s07-in-f2.1e100.net Software cafe / Resource Hash a6d5cf6d9103614b5f01818dbbc90a11fb4461a82fce10b2162e29d3f1757902 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 08 May 2020 19:54:34 GMT content-encoding br x-content-type-options nosniff google-mediationgroup-id -2 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" status 200 alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2157 x-xss-protection 0 google-lineitem-id 5244421919 pragma no-cache server cafe google-mediationtag-id -2 google-creative-id 138297150633 content-type text/plain; charset=UTF-8 access-control-allow-origin http://www.mediafire.com cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
POST H/1.1	200 OK	p Show response adsco.re/	259 B 769 B	249ms 106ms	XHR text/html	162.252.214.5 TUT-AS
General Check archive.org Show headers Download Go to Full URL http://adsco.re/p Requested by Host: c.adsco.re URL: https://c.adsco.re/ Protocol HTTP/1.1 Server 162.252.214.5 , United States, ASN53334 (TUT-AS, US), Reverse DNS Software / Resource Hash 3b0b869582b4b7ea89b8f2876cb8dc837ea87dffc016c87226bac3b47d0adbda Request headers Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers AS-P-G OK Date Fri, 08 May 2020 19:54:34 GMT AS-P-7 OK AS-P-9 OK AS-P-C OK Transfer-Encoding chunked AS-P-5 OK AS-P-F OK Connection keep-alive Content-Encoding gzip AS-P-2 OK AS-P-D OK AS-P-6 OK AS-P-B OK AS-P-4 OK AS-P-A OK Access-Control-Max-Age 2592000 AS-P-1 OK Access-Control-Allow-Origin http://www.mediafire.com Cache-Control no-transform Access-Control-Allow-Credentials true AS-P-8 OK Content-Type text/html; charset=UTF-8 AS-P-E OK AS-P-3 OK
GET H2	200	verify Show response otnolatrnup.com/	17 B 439 B	53ms 35ms	XHR application/json	2606:4700::6813:d625 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://otnolatrnup.com/verify?sig=BAoAXrW4-gFetbj6gAGBAcAAILoqxyIOGnVgx5YD042qYVkFFJrkEDJIizhO94CwoJznwQAgpf1rh24apEGq2SBEfI0wnxKkWUJG8zaAcywAuKFgBszCACAJXDRktkX6o_KUCjFWaWp1dj0MTpfZ_7oFHl8nSqwbTcQAECoBBPgBklQUAAAAAAAAAALFABAdNgef3RfHiT3l9N7WtpjewwAgmFQrFJe9hFFNccYWzfg4Du1LVEVX83n1Nz4eR_FADXI Requested by Host: cdn.otnolatrnup.com URL: https://cdn.otnolatrnup.com/Scripts/infinity.js.aspx?guid=5ff0fb62-0643-4ff1-aaee-c737f9ffc0e0 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:d625 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 39ca3c85734717cf31f55ab2e7d04d8ad2438a3bd9f6f46fae350d12506b4699 Request headers Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 08 May 2020 19:54:34 GMT server cloudflare x-adscore-status bot status 200 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding access-control-allow-methods GET content-type application/json access-control-allow-origin * cache-control no-cache cf-ray 5905bbbd4d98dffb-FRA access-control-allow-headers Content-Type content-length 17 cf-request-id 029773aa480000dffb8bb5d200000001
GET H2	204	Tag.engine Show response otnolatrnup.com/	0 190 B	12ms 11ms	Script text/plain	2606:4700::6813:d625 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://otnolatrnup.com/Tag.engine?time=-120&id=5ff0fb62-0643-4ff1-aaee-c737f9ffc0e0&rand=87734&ver=async&referrerUrl=&fingerPrint=123&abr=false&stdTime=60&fpe=1&bw=1600&bh=1200&res=1600x1200&curl=http%3A%2F%2Fwww.mediafire.com%2Ffile%2Fkdmpe66t3jasmtq%2Fpaint_tool2.zip%2Ffile&kw=online%20storage%2Cfree%20storage%2Ccloud%20storage%2Ccollaboration%2Cbackup%20file%20sharing%2Cshare%20files%2Cphoto%20backup%2Cphoto%20sharing%2Cftp%20replacement%2Ccross%20platform%2Cremote%20access%2Cmobile%20access%2Csend%20large%20files%2Crecover%20files%2Cfile%20versioning%2Cundelete%2Cwindows%2Cpc%2Cmac%2Cos%20x%2Clinux%2Ciphone&sig=BAoAXrW4-gFetbj6gAGBAcAAILoqxyIOGnVgx5YD042qYVkFFJrkEDJIizhO94CwoJznwQAgpf1rh24apEGq2SBEfI0wnxKkWUJG8zaAcywAuKFgBszCACAJXDRktkX6o_KUCjFWaWp1dj0MTpfZ_7oFHl8nSqwbTcQAECoBBPgBklQUAAAAAAAAAALFABAdNgef3RfHiT3l9N7WtpjewwAgmFQrFJe9hFFNccYWzfg4Du1LVEVX83n1Nz4eR_FADXI Requested by Host: cdn.otnolatrnup.com URL: https://cdn.otnolatrnup.com/Scripts/infinity.js.aspx?guid=5ff0fb62-0643-4ff1-aaee-c737f9ffc0e0 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:d625 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers status 204 date Fri, 08 May 2020 19:54:34 GMT vary Accept-Encoding server cloudflare cf-ray 5905bbbd3a08dfc7-FRA expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" cf-request-id 029773aa440000dfc71db1f200000001
GET H2	200	container.html tpc.googlesyndication.com/safeframe/1-0-37/html/ Frame 6DA1	0 0	6ms 5ms	Document text/html	2a00:1450:4001:801::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020043001.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers :method GET :authority tpc.googlesyndication.com :scheme https :path /safeframe/1-0-37/html/container.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file Response headers status 200 accept-ranges bytes vary Accept-Encoding content-type text/html timing-allow-origin * content-length 5810 date Fri, 08 May 2020 19:27:21 GMT expires Sat, 08 May 2021 19:27:21 GMT last-modified Thu, 21 Nov 2019 16:01:11 GMT x-content-type-options nosniff server sffe x-xss-protection 0 cache-control public, immutable, max-age=31536000 age 1633 alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H2	200	osd.js Show response www.googletagservices.com/activeview/js/current/	73 KB 28 KB	102ms 101ms	Script text/javascript	216.58.210.2 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020043001.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s07-in-f2.1e100.net Software sffe / Resource Hash 5fcfe016fdfa44faab867329d353024c109f4456d71b83a6bd07af118f0e9994 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 08 May 2020 19:54:34 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1588787389460423" vary Accept-Encoding content-type text/javascript status 200 cache-control private, max-age=3000 accept-ranges bytes alt-svc h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 27856 x-xss-protection 0 expires Fri, 08 May 2020 19:54:34 GMT
GET H2	200	sodar Show response pagead2.googlesyndication.com/getconfig/	7 KB 6 KB	43ms 16ms	XHR application/json	2a00:1450:4001:819::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2020043001&st=env Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020043001.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:819::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 9648f5dc3854346c6188c6fb3ac4b8322703f49cb507b994f664ad5453fca377 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers timing-allow-origin * date Fri, 08 May 2020 19:54:34 GMT content-encoding gzip x-content-type-options nosniff server cafe status 200 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" access-control-allow-origin * cache-control private content-disposition attachment; filename="f.txt" content-type application/json; charset=UTF-8 alt-svc h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 5525 x-xss-protection 0
GET H2	200	ads Show response securepubads.g.doubleclick.net/gampad/	39 KB 10 KB	496ms 496ms	XHR text/plain	216.58.210.2 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3059075393200520&correlator=1614172718675408&output=ldjh&impl=fifs&adsid=NT&eid=21065929%2C21066063%2C44716867&vrg=2020043001&guci=1.2.0.0.2.2.0.0&sc=0&sfv=1-0-37&ecs=20200508&iu_parts=21882844027%2CDesktop-Zone4&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&prev_scp=buildnumber%3D121533%26dladtemplate%3D1%26button_delay%3Ddisabled&eri=5&cookie=ID%3Decc959e3fc9244c6%3AT%3D1588967674%3AS%3DALNI_MbpqqgiDaB5oze-n4yYqk8YXj2TDw&cookie_enabled=1&bc=23&abxe=1&lmt=1588967674&dt=1588967674529&dlt=1588967673311&idt=701&frm=20&biw=1585&bih=1200&oid=3&adxs=313&adys=720&adks=1742890523&ucis=4&ifi=4&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=http%3A%2F%2Fwww.mediafire.com%2Ffile%2Fkdmpe66t3jasmtq%2Fpaint_tool2.zip%2Ffile&dssz=36&icsg=34360656544&std=0&vis=1&scr_x=0&scr_y=0&psz=960x1500&msz=728x-1&ga_vid=330312553.1588967674&ga_sid=1588967674&ga_hid=1973420004&fws=0&ohw=0 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020043001.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s07-in-f2.1e100.net Software cafe / Resource Hash da9ff4456f9cb5102b67d5ee3559ef2052fe2a2d4f7785b91185a8965c19539f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 08 May 2020 19:54:34 GMT content-encoding br x-content-type-options nosniff p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" status 200 alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 10225 x-xss-protection 0 google-lineitem-id -1 pragma no-cache server cafe google-creative-id -1 content-type text/plain; charset=UTF-8 access-control-allow-origin http://www.mediafire.com access-control-expose-headers x-google-amp-ad-validated-version cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	container.html tpc.googlesyndication.com/safeframe/1-0-37/html/ Frame 0772	0 0	6ms 6ms	Document text/html	2a00:1450:4001:801::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020043001.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers :method GET :authority tpc.googlesyndication.com :scheme https :path /safeframe/1-0-37/html/container.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file Response headers status 200 accept-ranges bytes vary Accept-Encoding content-type text/html timing-allow-origin * content-length 5810 date Fri, 08 May 2020 19:27:21 GMT expires Sat, 08 May 2021 19:27:21 GMT last-modified Thu, 21 Nov 2019 16:01:11 GMT x-content-type-options nosniff server sffe x-xss-protection 0 cache-control public, immutable, max-age=31536000 age 1633 alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H2	200	amp4ads-v0.js Show response cdn.ampproject.org/rtv/012005012256000/ Frame 7F83	204 KB 57 KB	16ms 5ms	Script text/javascript	2a00:1450:4001:808::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012005012256000/amp4ads-v0.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020043001.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash d2b891e379840927eaf16ac1147b0e270c409d7a9e2655dd866a175b996dea9c Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer http://www.mediafire.com/ Origin http://www.mediafire.com Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 282479 status 200 alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 57019 x-xss-protection 0 server sffe date Tue, 05 May 2020 13:26:35 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "bf14143de8659308" accept-ranges bytes timing-allow-origin * expires Wed, 05 May 2021 13:26:35 GMT
GET H2	200	amp4ads-v0.js Show response cdn.ampproject.org/rtv/012005012256000/ Frame 7F83	204 KB 56 KB	28ms 18ms	Script text/javascript	2a00:1450:4001:808::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012005012256000/amp4ads-v0.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020043001.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash d2b891e379840927eaf16ac1147b0e270c409d7a9e2655dd866a175b996dea9c Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer http://www.mediafire.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 282479 status 200 alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 57019 x-xss-protection 0 server sffe date Tue, 05 May 2020 13:26:35 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "bf14143de8659308" accept-ranges bytes timing-allow-origin * expires Wed, 05 May 2021 13:26:35 GMT
GET H2	200	amp-ad-exit-0.1.js Show response cdn.ampproject.org/rtv/012005012256000/v0/ Frame 7F83	16 KB 6 KB	26ms 16ms	Script text/javascript	2a00:1450:4001:808::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012005012256000/v0/amp-ad-exit-0.1.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020043001.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 6911cdf8bbf72eff1b6ae5fa039c42f4ca431e578f4f657dd29c55a65f85fd22 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer http://www.mediafire.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 282479 status 200 alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 5877 x-xss-protection 0 server sffe date Tue, 05 May 2020 13:26:35 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "cf1fef681ae7494f" accept-ranges bytes timing-allow-origin * expires Wed, 05 May 2021 13:26:35 GMT
GET H2	200	amp-analytics-0.1.js Show response cdn.ampproject.org/rtv/012005012256000/v0/ Frame 7F83	98 KB 29 KB	19ms 10ms	Script text/javascript	2a00:1450:4001:808::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012005012256000/v0/amp-analytics-0.1.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020043001.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash dd0c4ff5bc4e85bcd1ff717afc9d15b8274efe8e644542489bc31fae0346541b Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer http://www.mediafire.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 282479 status 200 alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 30100 x-xss-protection 0 server sffe date Tue, 05 May 2020 13:26:35 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "023298bf906f9a2c" accept-ranges bytes timing-allow-origin * expires Wed, 05 May 2021 13:26:35 GMT
GET H2	200	amp-fit-text-0.1.js Show response cdn.ampproject.org/rtv/012005012256000/v0/ Frame 7F83	4 KB 2 KB	18ms 9ms	Script text/javascript	2a00:1450:4001:808::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012005012256000/v0/amp-fit-text-0.1.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020043001.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 0f9ff4042daa13aa0766bc4854140f7a2942e4deae37d352a617b95000fa54ba Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer http://www.mediafire.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 282479 status 200 alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1637 x-xss-protection 0 server sffe date Tue, 05 May 2020 13:26:35 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "eed6b15e1dd2165d" accept-ranges bytes timing-allow-origin * expires Wed, 05 May 2021 13:26:35 GMT
GET H2	200	amp-form-0.1.js Show response cdn.ampproject.org/rtv/012005012256000/v0/ Frame 7F83	48 KB 16 KB	17ms 8ms	Script text/javascript	2a00:1450:4001:808::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012005012256000/v0/amp-form-0.1.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020043001.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash a2c5d4e6a74355f147e25b3ced1d4a66288eab711d0bd3d449ef056fa777c184 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer http://www.mediafire.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 282479 status 200 alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 15361 x-xss-protection 0 server sffe date Tue, 05 May 2020 13:26:35 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "d0b45204c403cb94" accept-ranges bytes timing-allow-origin * expires Wed, 05 May 2021 13:26:35 GMT
GET H2	200	css fonts.googleapis.com/ Frame 7F83	4 KB 678 B	18ms 14ms	Stylesheet text/css	2a00:1450:4001:820::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020043001.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:820::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 02fec5849f8ab7bceb4450d167f382e9079bd3a5d0f33a00942869641811ab3a Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer http://www.mediafire.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff status 200 alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Fri, 08 May 2020 19:54:34 GMT server ESF date Fri, 08 May 2020 19:54:34 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Fri, 08 May 2020 19:54:34 GMT
GET H2	200	downsize_200k_v1 tpc.googlesyndication.com/simgad/16955503103052890963/ Frame 7F83	33 KB 33 KB	11ms 7ms	Image image/png	2a00:1450:4001:801::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/16955503103052890963/downsize_200k_v1 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020043001.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash c649cac7898b1c98031d305971583fc3cae1f3f0b9b4b413d74c3e9a56b2dcb9 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer http://www.mediafire.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 14 Apr 2020 21:07:22 GMT x-content-type-options nosniff age 2069232 x-dns-prefetch-control off status 200 alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 33932 x-xss-protection 0 last-modified Fri, 15 Nov 2019 17:59:25 GMT server sffe content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Wed, 14 Apr 2021 21:07:22 GMT
GET DATA	200 OK	truncated / Frame 7F83	219 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash b3d36d94ce31a470300e599d89b5b93aa50af5b47cd792cb77c1b67da72ada33 Request headers Referer http://www.mediafire.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET H2	200	amp4ads-host-v0.js Show response cdn.ampproject.org/rtv/012005012256000/	21 KB 7 KB	26ms 23ms	Script text/javascript	2a00:1450:4001:808::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012005012256000/amp4ads-host-v0.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020043001.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash f0517f76184f899b738515a124efe8f335f585847387b8889dfa7c0fb132f75a Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 282479 status 200 alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 7437 x-xss-protection 0 server sffe date Tue, 05 May 2020 13:26:35 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "1b9b229ae83eaa45" accept-ranges bytes timing-allow-origin * expires Wed, 05 May 2021 13:26:35 GMT
GET H2	200	en_bl.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame 7F83	2 KB 3 KB	9ms 6ms	Image image/png	2a00:1450:4001:801::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/en_bl.png Requested by Host: www.mediafire.com URL: http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash e1a3c83144fa5752c8668ca056742ec9e6d6dfe5cfb75a97a9e53d1150068f91 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer http://www.mediafire.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers timing-allow-origin * date Fri, 08 May 2020 02:29:30 GMT x-content-type-options nosniff server cafe age 62704 etag 11660698925711390587 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control public, max-age=86400 content-type image/png alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2471 x-xss-protection 0 expires Sat, 09 May 2020 02:29:30 GMT
GET H2	200	icon.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame 7F83	295 B 355 B	9ms 6ms	Image image/png	2a00:1450:4001:801::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png Requested by Host: www.mediafire.com URL: http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer http://www.mediafire.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers timing-allow-origin * date Thu, 07 May 2020 22:24:17 GMT x-content-type-options nosniff server cafe age 77417 etag 426692510519060060 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control public, max-age=86400 content-type image/png alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 295 x-xss-protection 0 expires Fri, 08 May 2020 22:24:17 GMT
GET H2	200	adview securepubads.g.doubleclick.net/pagead/ Frame 7F83	0 0	100ms 97ms	Image text/html	216.58.210.2 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://securepubads.g.doubleclick.net/pagead/adview?ai=C9ukD-ri1XrCTCOXkzAb90YPACqzx6p9codOGkpgLg-T0_QgQASDkgu0oYOnkyYXYGqAB_9uKyAPIAQHgAgCoAwGqBJACT9DZtUT2G6ZgFWOpTAjVi2VBhI9AAoW_mn3NZ2-mC0l0uQzdgetsz5dAJSlG0Z8nwaPjWn5Y0t5SgbAsK8OSPsHPk5u6ksVFrvHChyAzKTMpW4o7tH3X39KB-PJ_ypQAt5xKOPAIdiwZDIegUmqfOntdHD4BkeD6P7beEXA1yhU-Z7cMVqvULkyFU4xM6V1oBgiBbZTYhQVQRsP5SufP0R-ZPuc1noGbFH1Se_mZAzUDPaCnhJmob8pItvCnYvOEo6GkRuS3rGf89qI7fd1j8VAnC1FlOJdC71duU-p2KeyEnDStqBxMU5ZHD8Yi4HoBKMwOiriLm-cQoaIcbc2nb9drJJ4T9ongYn5_OJ9JICfABIzkicHaAuAEAZIFBAgEGAGSBQQIBRgEgAeG85wJqAeOzhuoB9XJG6gHk9gbqAe6BqgH8NkbqAfy2RuoB6a-G6gH7NUb2AcB8gcEEKGuAdIICQiA4YAQEAEYHYAKA8gLAdgTDIgUApgWAQ&sigh=ZgmnXK6KWnk&template_id=5001&tpd=AGWhJmvTxrQK5Z7vk9aTUVSYIqPOeXmDkVQ1ci3UtyMgjiiRDg Requested by Host: www.mediafire.com URL: http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file Protocol H2 Security TLS 1.3, , AES_128_GCM Server 216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s07-in-f2.1e100.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer http://www.mediafire.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers
GET H/1.1	200 OK	sodar2.js Show response tpc.googlesyndication.com/sodar/	14 KB 6 KB	29ms 17ms	Script text/javascript	2a00:1450:4001:801::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL http://tpc.googlesyndication.com/sodar/sodar2.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020043001.js Protocol HTTP/1.1 Server 2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash a47f17d6ebbf4621d8fe87ab790d8d8fb5c3086629194d9ff2d64faaa6e46ab6 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 08 May 2020 19:54:34 GMT Content-Encoding gzip X-Content-Type-Options nosniff Server sffe ETag "1582746470043195" Vary Accept-Encoding Content-Type text/javascript Cache-Control private, max-age=3000 Accept-Ranges bytes Content-Length 5456 X-XSS-Protection 0 Expires Fri, 08 May 2020 19:54:34 GMT
GET H2	200	4UaGrENHsxJlGDuGo1OIlL3Owp5eKQtG.woff2 fonts.gstatic.com/s/googlesans/v16/ Frame 7F83	14 KB 14 KB	38ms 7ms	Font font/woff2	2a00:1450:4001:825::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/googlesans/v16/4UaGrENHsxJlGDuGo1OIlL3Owp5eKQtG.woff2 Requested by Host: www.mediafire.com URL: http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash f199a20f1fee7dec152b3591272f9715b536ed88b4c36194488fd5a734caf707 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500 Origin http://www.mediafire.com Response headers date Sat, 04 Apr 2020 06:52:50 GMT x-content-type-options nosniff last-modified Wed, 04 Dec 2019 18:44:26 GMT server sffe age 2984504 status 200 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 14608 x-xss-protection 0 expires Sun, 04 Apr 2021 06:52:50 GMT
GET H2	200	4UabrENHsxJlGDuGo1OIlLU94YtzCwZsPF4o.woff2 fonts.gstatic.com/s/googlesans/v16/ Frame 7F83	14 KB 15 KB	26ms 6ms	Font font/woff2	2a00:1450:4001:825::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/googlesans/v16/4UabrENHsxJlGDuGo1OIlLU94YtzCwZsPF4o.woff2 Requested by Host: www.mediafire.com URL: http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 1daab0f66666bc3a1d05d70de979a80680d985cc924e233fab61eef2d03bafe2 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500 Origin http://www.mediafire.com Response headers date Mon, 13 Apr 2020 11:22:56 GMT x-content-type-options nosniff last-modified Wed, 04 Dec 2019 18:44:18 GMT server sffe age 2190698 status 200 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 14816 x-xss-protection 0 expires Tue, 13 Apr 2021 11:22:56 GMT
GET H2	200	runner.html tpc.googlesyndication.com/sodar/sodar2/209/ Frame AFED	0 0	8ms 7ms	Document text/html	2a00:1450:4001:801::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html Requested by Host: tpc.googlesyndication.com URL: http://tpc.googlesyndication.com/sodar/sodar2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers :method GET :authority tpc.googlesyndication.com :scheme https :path /sodar/sodar2/209/runner.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file Response headers status 200 accept-ranges bytes vary Accept-Encoding content-encoding gzip content-type text/html content-length 5727 date Fri, 08 May 2020 19:15:18 GMT expires Sat, 08 May 2021 19:15:18 GMT last-modified Tue, 25 Feb 2020 17:32:01 GMT x-content-type-options nosniff server sffe x-xss-protection 0 cache-control public, max-age=31536000 age 2356 alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H2	200	si googleads.g.doubleclick.net/pagead/drt/ Frame 7F83 Redirect Chain http://www.google.com/pagead/drt/ui https://googleads.g.doubleclick.net/pagead/drt/si	0 0	130ms 129ms	Image text/html	216.58.210.2 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://googleads.g.doubleclick.net/pagead/drt/si Protocol H2 Security TLS 1.3, , AES_128_GCM Server 216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s07-in-f2.1e100.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Redirect headers Date Fri, 08 May 2020 19:54:34 GMT X-Content-Type-Options nosniff Server safe Content-Type text/html; charset=UTF-8 Location https://googleads.g.doubleclick.net/pagead/drt/si Cache-Control private Content-Length 246 X-XSS-Protection 0
GET H2	200	en_bl.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame 7F83	2 KB 2 KB	9ms 9ms	Image image/png	2a00:1450:4001:801::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/en_bl.png Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012005012256000/amp4ads-v0.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash e1a3c83144fa5752c8668ca056742ec9e6d6dfe5cfb75a97a9e53d1150068f91 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer http://www.mediafire.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers timing-allow-origin * date Fri, 08 May 2020 02:29:30 GMT x-content-type-options nosniff server cafe age 62704 etag 11660698925711390587 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control public, max-age=86400 content-type image/png alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2471 x-xss-protection 0 expires Sat, 09 May 2020 02:29:30 GMT
GET H2	200	icon.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame 7F83	295 B 355 B	9ms 9ms	Image image/png	2a00:1450:4001:801::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012005012256000/amp4ads-v0.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer http://www.mediafire.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers timing-allow-origin * date Thu, 07 May 2020 22:24:17 GMT x-content-type-options nosniff server cafe age 77417 etag 426692510519060060 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control public, max-age=86400 content-type image/png alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 295 x-xss-protection 0 expires Fri, 08 May 2020 22:24:17 GMT
POST H2	204	csi csi.gstatic.com/ Frame 7F83	0 343 B	65ms 32ms	Other image/gif	2a00:1450:400c:c08::5e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://csi.gstatic.com/csi?s=ampad&ctx=2&puid=1~1588967674950&qqid=CLD4mu6FpekCFWUy0wod_egAqA&rt=a4a.link.3.t.b.6.0.0.18s6.17zv~a4a.script.4.1d.k.j.0.0.182y.17zv~cdn.script.4.t.2.h.0.0.4lk.4j9~aa.script.4.u.9.a.0.0.nap.n84~cdn.script.4.l.1.9.0.0.1bs.19h~cdn.script.4.j.1.8.0.0.cm9.bup~any.link.6.n.0.f.0.0.iu.gn~simg.css.9.h.4.8.0.0.qac.q6k~any.img.d.9.0.6.0.0.1zn.1wn~any.img.d.9.0.6.0.0.9v.87~any.img.d.2t.35.0.0.0.0.0~any.css.1b.1b.8.7.i.8.bd1.b9s~any.css.1p.q.1.6.0.0.bqj.bfk~any.img.9b.a.0.9.0.0.1yb.1wn~any.img.9c.a.0.9.0.0.9v.87&met.a4a=dcl.1~ol.262~nvs.1588967674581~ini.1588967674951 Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012005012256000/v0/amp-analytics-0.1.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c08::5e Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer http://www.mediafire.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers pragma no-cache date Fri, 08 May 2020 19:54:35 GMT last-modified Wed, 21 Jan 2004 19:51:30 GMT server Golfe2 status 204 content-type image/gif access-control-allow-origin * cache-control no-cache, no-store, must-revalidate alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	amp4ads-v0.js Show response cdn.ampproject.org/rtv/012005012256000/ Frame 9D6B	204 KB 56 KB	8ms 5ms	Script text/javascript	2a00:1450:4001:808::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012005012256000/amp4ads-v0.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020043001.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash d2b891e379840927eaf16ac1147b0e270c409d7a9e2655dd866a175b996dea9c Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer http://www.mediafire.com/ Origin http://www.mediafire.com Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 282480 status 200 alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 57019 x-xss-protection 0 server sffe date Tue, 05 May 2020 13:26:35 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "bf14143de8659308" accept-ranges bytes timing-allow-origin * expires Wed, 05 May 2021 13:26:35 GMT
GET H2	200	amp4ads-v0.js Show response cdn.ampproject.org/rtv/012005012256000/ Frame 9D6B	204 KB 56 KB	9ms 6ms	Script text/javascript	2a00:1450:4001:808::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012005012256000/amp4ads-v0.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020043001.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash d2b891e379840927eaf16ac1147b0e270c409d7a9e2655dd866a175b996dea9c Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer http://www.mediafire.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 282480 status 200 alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 57019 x-xss-protection 0 server sffe date Tue, 05 May 2020 13:26:35 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "bf14143de8659308" accept-ranges bytes timing-allow-origin * expires Wed, 05 May 2021 13:26:35 GMT
GET H2	200	amp-ad-exit-0.1.js Show response cdn.ampproject.org/rtv/012005012256000/v0/ Frame 9D6B	16 KB 6 KB	13ms 9ms	Script text/javascript	2a00:1450:4001:808::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012005012256000/v0/amp-ad-exit-0.1.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020043001.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 6911cdf8bbf72eff1b6ae5fa039c42f4ca431e578f4f657dd29c55a65f85fd22 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer http://www.mediafire.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 282480 status 200 alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 5877 x-xss-protection 0 server sffe date Tue, 05 May 2020 13:26:35 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "cf1fef681ae7494f" accept-ranges bytes timing-allow-origin * expires Wed, 05 May 2021 13:26:35 GMT
GET H2	200	amp-analytics-0.1.js Show response cdn.ampproject.org/rtv/012005012256000/v0/ Frame 9D6B	98 KB 29 KB	26ms 22ms	Script text/javascript	2a00:1450:4001:808::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012005012256000/v0/amp-analytics-0.1.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020043001.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash dd0c4ff5bc4e85bcd1ff717afc9d15b8274efe8e644542489bc31fae0346541b Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer http://www.mediafire.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 282480 status 200 alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 30100 x-xss-protection 0 server sffe date Tue, 05 May 2020 13:26:35 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "023298bf906f9a2c" accept-ranges bytes timing-allow-origin * expires Wed, 05 May 2021 13:26:35 GMT
GET H2	200	amp-fit-text-0.1.js Show response cdn.ampproject.org/rtv/012005012256000/v0/ Frame 9D6B	4 KB 2 KB	15ms 11ms	Script text/javascript	2a00:1450:4001:808::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012005012256000/v0/amp-fit-text-0.1.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020043001.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 0f9ff4042daa13aa0766bc4854140f7a2942e4deae37d352a617b95000fa54ba Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer http://www.mediafire.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 282480 status 200 alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1637 x-xss-protection 0 server sffe date Tue, 05 May 2020 13:26:35 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "eed6b15e1dd2165d" accept-ranges bytes timing-allow-origin * expires Wed, 05 May 2021 13:26:35 GMT
GET H2	200	amp-form-0.1.js Show response cdn.ampproject.org/rtv/012005012256000/v0/ Frame 9D6B	48 KB 15 KB	14ms 10ms	Script text/javascript	2a00:1450:4001:808::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012005012256000/v0/amp-form-0.1.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020043001.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash a2c5d4e6a74355f147e25b3ced1d4a66288eab711d0bd3d449ef056fa777c184 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer http://www.mediafire.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 282480 status 200 alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 15361 x-xss-protection 0 server sffe date Tue, 05 May 2020 13:26:35 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "d0b45204c403cb94" accept-ranges bytes timing-allow-origin * expires Wed, 05 May 2021 13:26:35 GMT
GET H2	200	icon.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame 9D6B	295 B 360 B	8ms 5ms	Image image/png	2a00:1450:4001:801::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020043001.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer http://www.mediafire.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers timing-allow-origin * date Thu, 07 May 2020 22:24:17 GMT x-content-type-options nosniff server cafe age 77418 etag 426692510519060060 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control public, max-age=86400 content-type image/png alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 295 x-xss-protection 0 expires Fri, 08 May 2020 22:24:17 GMT
GET DATA	200 OK	truncated / Frame 9D6B	213 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash e60af1e3ee8b7abcf816ff5b897b948d5d689a854624619cacf73271e3786dac Request headers Referer http://www.mediafire.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET H2	200	18011811960104628907 tpc.googlesyndication.com/simgad/ Frame 9D6B	17 KB 17 KB	7ms 6ms	Image image/png	2a00:1450:4001:801::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/18011811960104628907?sqp=4sqPyQQrQikqJwhfEAEdAAC0QiABKAEwCTgDQPCTCUgAUAFYAWBfcAJ4AcUBLbKdPg&rs=AOga4qlMEwAHynkhBnwEgqSltYnx4BnjJQ Requested by Host: www.mediafire.com URL: http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash a7275ced040583cb57ad76834e7317e4eaa50964ec3b6d7ac8e70e55f7af606f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer http://www.mediafire.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 24 Apr 2020 16:20:01 GMT x-content-type-options nosniff last-modified Fri, 24 Apr 2020 13:17:44 GMT server sffe age 1222474 status 200 content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 17620 x-xss-protection 0 expires Sat, 24 Apr 2021 16:20:01 GMT
GET H2	200	en.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame 9D6B	2 KB 3 KB	6ms 5ms	Image image/png	2a00:1450:4001:801::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/en.png Requested by Host: www.mediafire.com URL: http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer http://www.mediafire.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers timing-allow-origin * date Fri, 08 May 2020 11:08:58 GMT x-content-type-options nosniff server cafe age 31537 etag 14819457070020093239 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control public, max-age=86400 content-type image/png alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2502 x-xss-protection 0 expires Sat, 09 May 2020 11:08:58 GMT
GET H2	200	adview securepubads.g.doubleclick.net/pagead/ Frame 9D6B	0 0	99ms 98ms	Image text/html	216.58.210.2 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://securepubads.g.doubleclick.net/pagead/adview?ai=CWqrM-ri1Xu2aJMPDzQbRgqB4gsPxlF3Tq5e9sQu37riC3RsQASDkgu0oYOnkyYXYGqAB-tmsyQPIAQKpAtVUojl-DJA-4AIAqAMByAMIqgSKAk_Q3-FUI8u26bQZN6DJvj0SerhvbPq4NADbu6IEpT8B6Kh1HSzcq8WHD-mTojKotZw7f27s05BAqbqPilVp7JXiu2MzMfUjvJibqBqTnQcL90GuYtfmCwVVokCStui6NmhW-pF4kUHkrpBUJi7nPMapK1xX7GpIwEqKR4hJK2ZVGJSHMdu6X1rLfwC60yFsjn9-i4grr6IVgrAsmGV9eiE42Qz9A63k86Ix0ZWpmxd2uwuWVip-ZAeHsg4qoknhSZZ2SetIl3FXimpJids264X-DFsbYZ32OZIE1hsr5soNaMm5WR47H9_Z_RPFfnwKYc8sAB2S8cuI0NEUcsbxrKUl8FH0h-B3sh9GwASBpK-G-wLgBAGSBQQIBBgBkgUECAUYBKAGAoAH7qXTNqgHjs4bqAfVyRuoB5PYG6gHugaoB_DZG6gH8tkbqAemvhuoB-zVG9gHAfIHBBCm0gHSCAkIgOGAEBABGB2ACgPICwHYEwKYFgE&sigh=M3VGA5g5mXM&tpd=AGWhJmvgg2WT-0kNZoQH1cHZKEAitTYIbdod3igo10MR7HnnmA Requested by Host: www.mediafire.com URL: http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file Protocol H2 Security TLS 1.3, , AES_128_GCM Server 216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s07-in-f2.1e100.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer http://www.mediafire.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers
GET H2	200	si googleads.g.doubleclick.net/pagead/drt/ Frame 9D6B Redirect Chain http://www.google.com/pagead/drt/ui https://googleads.g.doubleclick.net/pagead/drt/si	0 0	121ms 120ms	Image text/html	216.58.210.2 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://googleads.g.doubleclick.net/pagead/drt/si Requested by Host: www.mediafire.com URL: http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file Protocol H2 Security TLS 1.3, , AES_128_GCM Server 216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s07-in-f2.1e100.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Redirect headers Date Fri, 08 May 2020 19:54:35 GMT X-Content-Type-Options nosniff Server safe Content-Type text/html; charset=UTF-8 Location https://googleads.g.doubleclick.net/pagead/drt/si Cache-Control private Content-Length 246 X-XSS-Protection 0
GET H2	204	gen_204 pagead2.googlesyndication.com/pagead/	0 59 B	95ms 95ms	Image image/gif	216.58.210.2 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=209&t=2&li=gpt_2020043001&jk=3059075393200520&bg=!uLulu6NYt-cuwYtKk3wCAAAAtlIAAAAVmQF4YiL6ME0wUO0V8IHE-g5nA0m6oocZzepwtfjh48YwMWCBJgVJB6wdB8KOYeeuGGCIL9WJa-_-1gZGjOuRjQYc32grlVs3W8o_2rbu8BUMLr9SGoDWeZ1SiRCU82Eknn3H9BhOZxwfvz1rXE7iUz9cFMXLE0mHMUaqOlycAss_J5iWmWWv-MVDC9G5c5Vjt2ozDB3YpOnThj3GGDKbSkRO3jeHnPdGGW_2j19DGoh9KzCkyrdut2BCMfxnmuJ_ba0W0cRmUEwfRhG4eNgVcBSYxjAE0QvlU0dwTaRvr91rQ4jPoixkFP4lOiRDRYVL8N3_uEoTGzlO023DGV9VrE8mP9deVUPCI7aJGKMcouWkya_xATAc08L27mM-D-Lwb1nnG3nGbkQED_YgqAmXLkpOTc7Ngmdavrx5zKoQCcVppSZb8xq2dTFjd-ZIXY_4XsrxXEJgyFZGbX2xEBpVj0RxtmkNQQbksrEpsoFXHbQcOrqcEbFgyKfIDA Protocol H2 Security TLS 1.3, , AES_128_GCM Server 216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s07-in-f2.1e100.net Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Fri, 08 May 2020 19:54:35 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 204 cache-control no-cache, must-revalidate content-type image/gif alt-svc h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	activeview pagead2.googlesyndication.com/pcs/ Frame 7F83	42 B 113 B	98ms 98ms	Image image/gif	216.58.210.2 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsujKGpnYEVZ631QI_tQm3Fj_BXRLowl0HFUd67r-sGBPBbrzxECgSdL0vGDnmrdiGG1eHWrOC6vHEaqlm2OO09seiWOxV3-d48kA-vZWxX-tPSqTgWVJlYeBZG19Q&sai=AMfl-YQnGBXQ-qPd-j1uA7dbCBsksO8xDv72zQqf4AO9K3T2zGn3Ss-_2tYBZMR1GDwE_uUqd20qRplQl5rpobUuVLEoyIpdvQ-9k25WqKt-&sig=Cg0ArKJSzOlzmnKSAt6IEAE&id=ampim&o=545,10&d=728,90&ss=1600,1200&bs=1600,1200&mcvt=1000&mtos=0,0,1000,1000,1000&tos=0,0,1000,0,0&tfs=143&tls=1143&g=100&h=100&tt=1143&r=v&avms=ampa&adk=573839204 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s07-in-f2.1e100.net Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer http://www.mediafire.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Fri, 08 May 2020 19:54:35 GMT x-content-type-options nosniff server cafe timing-allow-origin * status 200 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" access-control-allow-origin * cache-control no-cache, must-revalidate content-type image/gif alt-svc h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	activeview pagead2.googlesyndication.com/pcs/ Frame 9D6B	42 B 113 B	113ms 113ms	Image image/gif	216.58.210.2 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsspGievAGnhnfoG95nz_9nFV3xX8Q50Usx2qn3NGHQLuYN29wADz--zJparXP47AFhf-6kSTFJXfJCRyWbKtFXJgLhvFdttT65YN4uPLiAhT_nHSJGdDQJIYjA9k0-sGa0xrq9qiQXsgCD3cOG1WcIv&sai=AMfl-YTosCP7CPL99tOmjzYMK3WssXk2IWGu6xDk25qb45ZCATgMfGsr708Imhd-LEJiQJj73O9hHRsXj7Ha6_p9yExw1tOPb577v4aj35VAIrRtTe0aq7ejMA1AdXMa&sig=Cg0ArKJSzGEPJYsfcORFEAE&cid=CAASF-RovnEJxQkGji-XUz5OKnRDd54AR0tA&id=ampim&o=313,720&d=728,90&ss=1600,1200&bs=1600,1200&mcvt=1000&mtos=0,0,1000,1000,1000&tos=0,0,1000,0,0&tfs=108&tls=1108&g=100&h=100&tt=1109&r=v&avms=ampa&adk=1742890523 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s07-in-f2.1e100.net Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer http://www.mediafire.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Fri, 08 May 2020 19:54:36 GMT x-content-type-options nosniff server cafe timing-allow-origin * status 200 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" access-control-allow-origin * cache-control no-cache, must-revalidate content-type image/gif alt-svc h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	showad.js ads.pubmatic.com/AdServer/js/ Frame CB84	0 0	249ms 102ms	Document text/html	72.247.225.32 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://ads.pubmatic.com/AdServer/js/showad.js Requested by Host: www.mediafire.com URL: http://www.mediafire.com/js/prebid2.44.1.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 72.247.225.32 , United States, ASN16625 (AKAMAI-AS, US), Reverse DNS a72-247-225-32.deploy.static.akamaitechnologies.com Software Apache/2.2.15 (CentOS) / Resource Hash Request headers Host ads.pubmatic.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Sec-Fetch-Dest iframe Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file Response headers Last-Modified Tue, 14 Apr 2020 10:27:52 GMT ETag "13006b6-a4bb-5a33da6f1a023" Server Apache/2.2.15 (CentOS) Accept-Ranges bytes Content-Encoding gzip P3P CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Content-Length 15243 Content-Type text/html; charset=UTF-8 Cache-Control public, max-age=86531 Expires Sat, 09 May 2020 19:56:48 GMT Date Fri, 08 May 2020 19:54:37 GMT Connection keep-alive Vary Accept-Encoding
GET H2	200	pd eu-u.openx.net/w/1.0/ Frame 627B	0 0	92ms 90ms	Document text/html	35.244.233.96 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://eu-u.openx.net/w/1.0/pd?plm=10&ph=74c7d33a-f978-474b-98bd-3e72347fbee9&gdpr=1 Requested by Host: www.mediafire.com URL: http://www.mediafire.com/js/prebid2.44.1.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 35.244.233.96 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS 96.233.244.35.bc.googleusercontent.com Software OXGW/16.185.0 / Resource Hash Request headers :method GET :authority eu-u.openx.net :scheme https :path /w/1.0/pd?plm=10&ph=74c7d33a-f978-474b-98bd-3e72347fbee9&gdpr=1 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file accept-encoding gzip, deflate, br accept-language en-US cookie i=b11d66f3-9cd1-4eaa-87eb-dfa1a1728369|1588967676 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file Response headers status 200 vary Accept, Accept-Encoding set-cookie i=b11d66f3-9cd1-4eaa-87eb-dfa1a1728369|1588967676; Version=1; Expires=Sat, 08-May-2021 19:54:37 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1588967677|mOsLgqgikin0fcmWiygu; Version=1; Expires=Sat, 23-May-2020 19:54:37 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None server OXGW/16.185.0 p3p CP="CUR ADM OUR NOR STA NID" date Fri, 08 May 2020 19:54:37 GMT content-type text/html content-length 482 content-encoding gzip via 1.1 google alt-svc clear
GET H/1.1	200 OK	async_usersync.html acdn.adnxs.com/ib/static/usersync/v3/ Frame 58B4	0 0	347ms 65ms	Document text/html	151.101.13.108 FASTLY
General Check archive.org Show headers Download Go to Full URL http://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html Requested by Host: www.mediafire.com URL: http://www.mediafire.com/js/prebid2.44.1.js Protocol HTTP/1.1 Server 151.101.13.108 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software nginx/1.9.13 / Resource Hash Request headers Host acdn.adnxs.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer http://www.mediafire.com/file/kdmpe66t3jasmtq/paint_tool2.zip/file Response headers Server nginx/1.9.13 Content-Type text/html Last-Modified Fri, 20 May 2016 02:07:09 GMT ETag W/"573e714d-3e3" Expires Sun, 06 Aug 2017 09:41:59 GMT Cache-Control max-age=31536000 Access-Control-Allow-Origin * Content-Encoding gzip Via 1.1 varnish 1.1 varnish Content-Length 506 Accept-Ranges bytes Date Fri, 08 May 2020 19:54:37 GMT Age 23883162 Connection keep-alive X-Served-By cache-jfk8138-JFK, cache-fra19141-FRA X-Cache HIT, HIT X-Cache-Hits 391291, 3286076 X-Timer S1588967677.426295,VS0,VE0 Vary Accept-Encoding

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

a3aztbd4ei6u.l.adsco.re

URL

https://a3aztbd4ei6u.l.adsco.re/

Domain

a3aztbd4ei6u.n.adsco.re

URL

https://a3aztbd4ei6u.n.adsco.re/

Domain

a3aztbd4ei6u.s.adsco.re

URL

https://a3aztbd4ei6u.s.adsco.re/