mediafire.com.de Open in urlscan Pro
162.0.229.134 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://mediafire.com.de/arceus-x
Submission: On May 25 via api (May 25th 2023, 8:16:26 pm UTC) from FI — Scanned from DE

Summary HTTP 26 Redirects Links 10 Behaviour Indicators

Summary

This website contacted 7 IPs in 3 countries across 6 domains to perform 26 HTTP transactions. The main IP is 162.0.229.134, located in United States and belongs to NAMECHEAP-NET, US. The main domain is mediafire.com.de.
TLS certificate: Issued by ZeroSSL RSA Domain Secure Site CA on April 28th 2023. Valid for: 3 months.

This is the only time mediafire.com.de was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Scam (Online)

Domain & IP information

	IP Address	AS Autonomous System
6	162.0.229.134 162.0.229.134	22612 (NAMECHEAP...) (NAMECHEAP-NET)
1	2a00:1450:400... 2a00:1450:4001:827::200a	15169 (GOOGLE) (GOOGLE)
1	2600:9000:249... 2600:9000:2491:7400:d:e9c:2500:21	16509 (AMAZON-02) (AMAZON-02)
5	2600:9000:223... 2600:9000:223d:0:15:7da0:ecc0:21	16509 (AMAZON-02) (AMAZON-02)
1	2a03:2880:f17... 2a03:2880:f176:84:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
10	104.16.54.48 104.16.54.48	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a03:2880:f08... 2a03:2880:f083:9:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
26	7

6 162.0.229.134 (United States)

ASN22612 (NAMECHEAP-NET, US)
PTR: premium120-4.web-hosting.com

mediafire.com.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:827::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2491:7400:d:e9c:2500:21 (United States)

ASN16509 (AMAZON-02, US)

d2bb5k76l7oivo.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2600:9000:223d:0:15:7da0:ecc0:21 (United States)

ASN16509 (AMAZON-02, US)

d3ikgzh4osba2b.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f176:84:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 104.16.54.48 (None, )

ASN13335 (CLOUDFLARENET, US)

static.mediafire.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.mediafire.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f083:9:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

static.xx.fbcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	mediafire.com static.mediafire.com — Cisco Umbrella Rank: 54483 www.mediafire.com — Cisco Umbrella Rank: 32303	89 KB
6	cloudfront.net d2bb5k76l7oivo.cloudfront.net d3ikgzh4osba2b.cloudfront.net	26 KB
6	com.de mediafire.com.de	26 KB
2	fbcdn.net static.xx.fbcdn.net — Cisco Umbrella Rank: 797	134 KB
1	facebook.com www.facebook.com — Cisco Umbrella Rank: 102	16 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 35	775 B
26	6

	Domain	Requested by
8	static.mediafire.com	mediafire.com.de
6	mediafire.com.de	mediafire.com.de
5	d3ikgzh4osba2b.cloudfront.net	d2bb5k76l7oivo.cloudfront.net
2	static.xx.fbcdn.net	www.facebook.com
2	www.mediafire.com	mediafire.com.de
1	www.facebook.com	mediafire.com.de
1	d2bb5k76l7oivo.cloudfront.net	mediafire.com.de
1	fonts.googleapis.com	mediafire.com.de
26	8

This site contains links to these domains. Also see Links.

Domain
www.mediafire.com
blog.mediafire.com
vividengine.com
mediafire.zendesk.com
twitter.com
www.facebook.com

Subject Issuer	Validity	Valid
mediafire.com.de ZeroSSL RSA Domain Secure Site CA	`2023-04-28` - `2023-07-27`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-05-08` - `2023-07-31`	3 months	crt.sh
*.cloudfront.net Amazon RSA 2048 M01	`2022-12-08` - `2023-12-07`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-03-04` - `2023-06-02`	3 months	crt.sh
*.mediafire.com Sectigo RSA Domain Validation Secure Server CA	`2022-08-30` - `2023-09-30`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://mediafire.com.de/arceus-x
Frame ID: 05155CD282A976A7D5F94A6AAB7F2251
Requests: 23 HTTP requests in this frame

Frame: https://www.facebook.com/plugins/like.php?href=http://www.facebook.com/MediaFire&width=193&layout=button_count&action=like&show_faces=false&share=true&height=30&appId=124578887583575
Frame ID: A0FE6D9935DDE5A26275A2486C889A78
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Roblox_ArceusX_Ubirt.Us.apk

Detected technologies

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Page Statistics

26
Requests

100 %
HTTPS

71 %
IPv6

6
Domains

8
Subdomains

7
IPs

3
Countries

291 kB
Transfer

982 kB
Size

2
Cookies

10 Outgoing links

These are links going to different origins than the main page.

URL: https://www.mediafire.com/
Title: MediaFire

Search URL Search Domain Scan URL

URL: https://www.mediafire.com/upgrade/
Title: Sign Up

Search URL Search Domain Scan URL

URL: https://www.mediafire.com/login/
Title: Log In

Search URL Search Domain Scan URL

URL: http://blog.mediafire.com/
Title: Company Blog

Search URL Search Domain Scan URL

URL: https://vividengine.com/
Title: On-Demand Video Encoding

Search URL Search Domain Scan URL

URL: https://mediafire.zendesk.com/hc/en-us
Title: Support

Search URL Search Domain Scan URL

URL: https://twitter.com/#!/mediafire

Search URL Search Domain Scan URL

URL: https://www.facebook.com/mediafire

Search URL Search Domain Scan URL

URL: https://twitter.com/mediafire
Title: Twitter Page

Search URL Search Domain Scan URL

URL: https://blog.mediafire.com/
Title: MediaFire Blog

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

26 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request arceus-x Show response
mediafire.com.de/ 20 KB
5 KB 1356ms
825ms Document
text/html 162.0.229.134
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://mediafire.com.de/arceus-x

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

162.0.229.134 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

premium120-4.web-hosting.com

Software

LiteSpeed /

Resource Hash

e17ee2288cc708ba3baafd0f9d67d80f65d7579a13d86e104ffb1fb726e40c2c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-encoding: br
content-type: text/html; charset=utf-8
cross-origin-opener-policy: same-origin
date: Thu, 25 May 2023 20:16:21 GMT
referrer-policy: same-origin
server: LiteSpeed
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: DENY
x-turbo-charged-by: LiteSpeed

GET
H2 200 icon
fonts.googleapis.com/ 569 B
775 B 38ms
17ms Stylesheet
text/css 2a00:1450:4001:827::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/icon?family=Material+Icons

Requested by

Host: mediafire.com.de
URL: https://mediafire.com.de/arceus-x

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

5848fed0499a99763526e2178efc1bec18842259a88cb1cf12600be9ddabbdcd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 25 May 2023 20:16:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 25 May 2023 20:16:22 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 25 May 2023 20:16:22 GMT

GET
H2 200 main.css
mediafire.com.de/static/css/ 112 KB
16 KB 521ms
520ms Stylesheet
text/css 162.0.229.134
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://mediafire.com.de/static/css/main.css
Requested by: Host: mediafire.com.de
URL: https://mediafire.com.de/arceus-x
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.0.229.134 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: premium120-4.web-hosting.com
Software: LiteSpeed /
Resource Hash: 5b0cb943a7b4f838935e2ad1eca549c74a0d8cb060043a26786aaadf9d3a62ca

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mediafire.com.de/arceus-x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Thu, 25 May 2023 20:16:22 GMT
content-encoding: br
last-modified: Thu, 28 Apr 2022 16:18:18 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
content-length: 16200
expires: Thu, 01 Jun 2023 20:16:22 GMT

GET
H2 200 0bf745d.js Show response
d2bb5k76l7oivo.cloudfront.net/ 24 KB
7 KB 227ms
199ms Script
application/javascript 2600:9000:2491:7400:d:e9c:2500:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d2bb5k76l7oivo.cloudfront.net/0bf745d.js
Requested by: Host: mediafire.com.de
URL: https://mediafire.com.de/arceus-x
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2491:7400:d:e9c:2500:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a28be45144d377ab16527a8b5d2d60fae4d780f9dec17e4327567ad90482f293

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Thu, 25 May 2023 19:53:32 GMT
content-encoding: gzip
via: 1.1 93efd892a8e99dc59164afbee331cd56.cloudfront.net (CloudFront)
last-modified: Sat, 13 May 2023 22:59:48 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P7
age: 1381
etag: W/"2bfd2a5b8ac2dbc95efed9f39bf259ff"
vary: Accept-Encoding
x-cache: Error from cloudfront
content-type: application/javascript
x-amz-cf-id: 23wPBqnqfvDDsQab2GJChQW_gKOffplu_UN_RcZln0GKUiNzkQSjrA==

GET
H2 200 html.3302079.2520b.0.js Show response
d3ikgzh4osba2b.cloudfront.net/public/external/v2/ 9 KB
9 KB 353ms
317ms Script
application/javascript 2600:9000:223d:0:15:7da0:ecc0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d3ikgzh4osba2b.cloudfront.net/public/external/v2/html.3302079.2520b.0.js
Requested by: Host: d2bb5k76l7oivo.cloudfront.net
URL: https://d2bb5k76l7oivo.cloudfront.net/0bf745d.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223d:0:15:7da0:ecc0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.51 () OpenSSL/1.0.2k-fips PHP/7.4.11 / PHP/7.4.11
Resource Hash: a9e5800ede2b6116b073fe2391c812f8ed94994b072245a5a9f1ae53c4658575

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Thu, 25 May 2023 20:16:22 GMT
via: 1.1 6851af5c4f6d355fa4ec39cc8cc0c358.cloudfront.net (CloudFront)
server: Apache/2.4.51 () OpenSSL/1.0.2k-fips PHP/7.4.11
x-amz-cf-pop: FRA56-P3
x-powered-by: PHP/7.4.11
x-cache: Miss from cloudfront
content-type: application/javascript
x-amz-cf-id: V6I0vpGlAS1mwcLIu-Zhc7p8ogWiT8LwbomROnYfcKsVsBRDCthkcg==

GET
H2 200 css_front.css
d3ikgzh4osba2b.cloudfront.net/public/external/ 6 KB
7 KB 349ms
313ms Stylesheet
text/css 2600:9000:223d:0:15:7da0:ecc0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d3ikgzh4osba2b.cloudfront.net/public/external/css_front.css
Requested by: Host: d2bb5k76l7oivo.cloudfront.net
URL: https://d2bb5k76l7oivo.cloudfront.net/0bf745d.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223d:0:15:7da0:ecc0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.46 () OpenSSL/1.0.2k-fips PHP/7.4.11 /
Resource Hash: a7bd79b6fba60944ee3a9c153108ff0819d2db57850116ac7065a86db08af4ec

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Thu, 25 May 2023 20:16:22 GMT
via: 1.1 6851af5c4f6d355fa4ec39cc8cc0c358.cloudfront.net (CloudFront)
last-modified: Tue, 23 Jun 2020 20:06:47 GMT
server: Apache/2.4.46 () OpenSSL/1.0.2k-fips PHP/7.4.11
x-amz-cf-pop: FRA56-P3
etag: "19c4-5a8c5e62e9d0a"
x-cache: Miss from cloudfront
content-type: text/css
accept-ranges: bytes
content-length: 6596
x-amz-cf-id: KvVhYc_Y9uZkSuucSBOMDgZ7-PgqRRE9ItmHU7AGFfUgP7l17knH9A==

GET
H2 200 like.php Show response
www.facebook.com/plugins/ Frame A0FE 45 KB
16 KB 161ms
146ms Document
text/html 2a03:2880:f176:84:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/plugins/like.php?href=http://www.facebook.com/MediaFire&width=193&layout=button_count&action=like&show_faces=false&share=true&height=30&appId=124578887583575

Requested by

Host: mediafire.com.de
URL: https://mediafire.com.de/arceus-x

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f176:84:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

123118e5296c12c0821f5a958786e692c97317b1e9b5d778204900bd9d09d653

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval';style-src fonts.googleapis.com .fbcdn.net data: .facebook.com 'unsafe-inline';connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com;font-src data: .gstatic.com .facebook.com .fbcdn.net .fbsbx.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com .tenor.co media.tenor.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net .giphy.com connect.facebook.net .carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com .whatsapp.net .fb.com .oculuscdn.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com https://.giphy.com data:;frame-src .doubleclick.net .google.com .facebook.com www.googleadservices.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com https://sandbox.paywithmybank.com;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: private, no-cache, no-store, must-revalidate
content-encoding: br
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval';style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com https://sandbox.paywithmybank.com;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
content-type: text/html; charset="utf-8"
cross-origin-opener-policy: unsafe-none
date: Thu, 25 May 2023 20:16:22 GMT
document-policy: force-load-at-top
expires: Sat, 01 Jan 2000 00:00:00 GMT
origin-agent-cluster: ?0
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), midi=(), screen-wake-lock=(), serial=(), usb=()
pragma: no-cache
report-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}
strict-transport-security: max-age=15552000; preload
vary: Accept-Encoding
x-content-type-options: nosniff
x-fb-debug: yKOk2tLIvW50LPBGNzBsm30AQP3o/C7jypIoD/j46+A/aBCPgEDQ0ijkTJ53hXzDrUvaLPpvcu+ZwMV+9txgEA==
x-fb-rlafr: 0
x-xss-protection: 0

GET
H2 200 mf_logo_full_color.svg
static.mediafire.com/images/backgrounds/header/ 3 KB
2 KB 60ms
32ms Image
image/svg+xml 104.16.54.48
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.mediafire.com/images/backgrounds/header/mf_logo_full_color.svg
Requested by: Host: mediafire.com.de
URL: https://mediafire.com.de/arceus-x
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.16.54.48 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8539c91ae0a82f8cab27d481ea38ac4e66d1e5b36701fe295bcba4399b9255bd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mediafire.com.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Thu, 25 May 2023 20:16:22 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Fri, 28 Oct 2016 22:22:42 GMT
server: cloudflare
age: 3870
etag: W/"5813cfb2-d1d"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cf-ray: 7cd074ad8821381f-FRA

GET
H2 200 file-zip-v3.png
mediafire.com.de/static/css/ 2 KB
2 KB 260ms
259ms Image
image/png 162.0.229.134
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mediafire.com.de/static/css/file-zip-v3.png
Requested by: Host: mediafire.com.de
URL: https://mediafire.com.de/static/css/main.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.0.229.134 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: premium120-4.web-hosting.com
Software: LiteSpeed /
Resource Hash: 4448e430d3c53bad548a5d135e1c7e2f9593e806ba47892640d430ea752e979e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mediafire.com.de/static/css/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Thu, 25 May 2023 20:16:22 GMT
last-modified: Thu, 28 Apr 2022 16:18:18 GMT
server: LiteSpeed
content-type: image/png
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
content-length: 1872
expires: Thu, 01 Jun 2023 20:16:22 GMT

GET
H2 200 icons_sprite.svg
www.mediafire.com/images/icons/svg_light/ 36 KB
8 KB 70ms
43ms Image
image/svg+xml 104.16.54.48
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.mediafire.com/images/icons/svg_light/icons_sprite.svg
Requested by: Host: mediafire.com.de
URL: https://mediafire.com.de/static/css/main.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.16.54.48 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7ba1bc2084def769e77a7dbf97cd91d68fe6c6d55b5d183a7d36630da8da2b02

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mediafire.com.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Thu, 25 May 2023 20:16:22 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
server: cloudflare
age: 3537
etag: W/"62deda56-90ab"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cf-ray: 7cd074ad79eb1c8b-FRA

GET
H2 200 dl_promo_logo.png
static.mediafire.com/images/backgrounds/download/ 2 KB
2 KB 59ms
33ms Image
image/png 104.16.54.48
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.mediafire.com/images/backgrounds/download/dl_promo_logo.png
Requested by: Host: mediafire.com.de
URL: https://mediafire.com.de/static/css/main.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.16.54.48 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 174d0ce23ddaa3923575af7a8e047e1dbf75199ebee7df1aca5e5713c4a1dd62

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mediafire.com.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Thu, 25 May 2023 20:16:22 GMT
cf-cache-status: HIT
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
server: cloudflare
age: 3426
etag: "62deda56-8c0"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 7cd074ad8822381f-FRA
content-length: 2240
expires: Sat, 24 Jun 2023 15:59:37 GMT

GET
H2 200 arrow_dropdown.svg
www.mediafire.com/images/icons/svg_dark/ 315 B
624 B 52ms
25ms Image
image/svg+xml 104.16.54.48
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.mediafire.com/images/icons/svg_dark/arrow_dropdown.svg
Requested by: Host: mediafire.com.de
URL: https://mediafire.com.de/static/css/main.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.16.54.48 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 82b94716473aa225e715e117802145c5d2d725aa1ba9d476d61a5d3da16a8c26

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mediafire.com.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Thu, 25 May 2023 20:16:22 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
server: cloudflare
age: 3832
etag: W/"62deda56-13b"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cf-ray: 7cd074ad79ed1c8b-FRA

GET
H2 200 check_circle_green.svg
mediafire.com.de/static/css/ 444 B
472 B 262ms
261ms Image
image/svg+xml 162.0.229.134
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mediafire.com.de/static/css/check_circle_green.svg
Requested by: Host: mediafire.com.de
URL: https://mediafire.com.de/static/css/main.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.0.229.134 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: premium120-4.web-hosting.com
Software: LiteSpeed /
Resource Hash: 03c8d2dc7d985c3004ff2cd6d8148dd03560f37ed15efdf6c2d7f4d771d0e599

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mediafire.com.de/static/css/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Thu, 25 May 2023 20:16:22 GMT
content-encoding: br
last-modified: Thu, 28 Apr 2022 16:18:18 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
content-length: 247
expires: Thu, 01 Jun 2023 20:16:22 GMT

GET
H2 200 world.svg
static.mediafire.com/images/backgrounds/download/additional_content/ 143 KB
53 KB 68ms
42ms Image
image/svg+xml 104.16.54.48
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.mediafire.com/images/backgrounds/download/additional_content/world.svg
Requested by: Host: mediafire.com.de
URL: https://mediafire.com.de/static/css/main.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.16.54.48 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4342feac38021c4fe3069eba0edf1c2e1b4345e2b548b0afb7ab21b7369b3bc8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mediafire.com.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Thu, 25 May 2023 20:16:22 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
server: cloudflare
age: 3858
etag: W/"62deda56-23ce2"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cf-ray: 7cd074ad8824381f-FRA

GET
H2 200 continent-na.svg
static.mediafire.com/images/backgrounds/download/additional_content/ 50 KB
19 KB 60ms
34ms Image
image/svg+xml 104.16.54.48
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.mediafire.com/images/backgrounds/download/additional_content/continent-na.svg
Requested by: Host: mediafire.com.de
URL: https://mediafire.com.de/static/css/main.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.16.54.48 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 05cfe92d9794a54258a19bfec7ae0faa73f61b66416983136594b4f95bb114dd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mediafire.com.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Thu, 25 May 2023 20:16:22 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
server: cloudflare
age: 3101
etag: W/"62deda56-c817"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cf-ray: 7cd074ad8823381f-FRA

GET
H2 200 usa.svg
static.mediafire.com/images/flags_svg/ 1 KB
730 B 181ms
155ms Image
image/svg+xml 104.16.54.48
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.mediafire.com/images/flags_svg/usa.svg
Requested by: Host: mediafire.com.de
URL: https://mediafire.com.de/static/css/main.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.16.54.48 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8bacb685be7cec7f41a0270e694fa90c0fb448b2c0ded5f1734baf51050d695c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mediafire.com.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Thu, 25 May 2023 20:16:22 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
server: cloudflare
etag: W/"62deda56-5c7"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cf-ray: 7cd074ad8825381f-FRA

GET
H2 200 virustotal.png
mediafire.com.de/static/css/ 1 KB
2 KB 260ms
259ms Image
image/png 162.0.229.134
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mediafire.com.de/static/css/virustotal.png
Requested by: Host: mediafire.com.de
URL: https://mediafire.com.de/static/css/main.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.0.229.134 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: premium120-4.web-hosting.com
Software: LiteSpeed /
Resource Hash: c6ef16fd857d73cf53d3adabb33db0ac7f7fd53662908a5ab1c1cba0968c081b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mediafire.com.de/static/css/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Thu, 25 May 2023 20:16:22 GMT
last-modified: Thu, 28 Apr 2022 16:18:18 GMT
server: LiteSpeed
content-type: image/png
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
content-length: 1344
expires: Thu, 01 Jun 2023 20:16:22 GMT

GET
H2 200 fb_16x16.png
static.mediafire.com/images/backgrounds/download/social/ 181 B
598 B 57ms
31ms Image
image/png 104.16.54.48
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.mediafire.com/images/backgrounds/download/social/fb_16x16.png
Requested by: Host: mediafire.com.de
URL: https://mediafire.com.de/static/css/main.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.16.54.48 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 720671166ac43aba99e3952b0b9341ab4e0fee1fd891db54e2a07f05db653142

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mediafire.com.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Thu, 25 May 2023 20:16:22 GMT
cf-cache-status: HIT
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
server: cloudflare
age: 14400
etag: "62deda56-b5"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 7cd074ad8826381f-FRA
content-length: 181
expires: Sat, 24 Jun 2023 15:10:44 GMT

GET
H2 200 mf_round.svg
mediafire.com.de/static/css/ 1 KB
960 B 260ms
259ms Image
image/svg+xml 162.0.229.134
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mediafire.com.de/static/css/mf_round.svg
Requested by: Host: mediafire.com.de
URL: https://mediafire.com.de/static/css/main.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.0.229.134 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: premium120-4.web-hosting.com
Software: LiteSpeed /
Resource Hash: f1a67642fc97b508ce07cf6df329022bf5184a1c573044dc021e0d6e64688c64

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mediafire.com.de/static/css/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Thu, 25 May 2023 20:16:22 GMT
content-encoding: br
last-modified: Thu, 28 Apr 2022 16:18:18 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
content-length: 735
expires: Thu, 01 Jun 2023 20:16:22 GMT

GET
H2 200 browser_chrome.svg
static.mediafire.com/images/backgrounds/download/additional_content/ 8 KB
2 KB 53ms
35ms Image
image/svg+xml 104.16.54.48
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.mediafire.com/images/backgrounds/download/additional_content/browser_chrome.svg
Requested by: Host: mediafire.com.de
URL: https://mediafire.com.de/static/css/main.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.16.54.48 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1c6ba1010c2cc88c59de9e9584728da124770fa399643ffc1beffcec54b84be7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mediafire.com.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Thu, 25 May 2023 20:16:22 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
server: cloudflare
age: 3485
etag: W/"62deda56-1e24"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cf-ray: 7cd074ad881e381f-FRA

GET
H2 200 footerIcons.png
static.mediafire.com/images/backgrounds/footer/social/ 583 B
685 B 26ms
25ms Image
image/png 104.16.54.48
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.mediafire.com/images/backgrounds/footer/social/footerIcons.png
Requested by: Host: mediafire.com.de
URL: https://mediafire.com.de/static/css/main.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.16.54.48 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f917a9105c311331b1d40f4d2bdbf11233c1c465616c1a9c46232f451463b061

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mediafire.com.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Thu, 25 May 2023 20:16:22 GMT
cf-cache-status: HIT
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
server: cloudflare
age: 3792
etag: "62deda56-247"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 7cd074ada840381f-FRA
content-length: 583
expires: Sat, 24 Jun 2023 19:10:21 GMT

GET
H2 200 FEppCFCt76d.png
static.xx.fbcdn.net/rsrc.php/v3/yD/r/ Frame A0FE 299 B
883 B 26ms
7ms Image
image/png 2a03:2880:f083:9:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yD/r/FEppCFCt76d.png

Requested by

Host: www.facebook.com
URL: https://www.facebook.com/plugins/like.php?href=http://www.facebook.com/MediaFire&width=193&layout=button_count&action=like&show_faces=false&share=true&height=30&appId=124578887583575

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f083:9:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

d65f4b2e8eee94ddc7f762d098de19558d879a3b597c8913b4d075532e3ed4b4

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Thu, 25 May 2023 20:16:22 GMT
x-content-type-options: nosniff
content-md5: OIlAxCmR79nrM/Ez4ygGlg==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 299
x-fb-rlafr: 0
x-fb-debug: bzFbN6K7qXNzK1hRA4WBB5wtqu/2uRuOyzkngpuUHc33AoF/aGoCM2XLU4CljDSOkFNzMqdw8W1bk7zQZtIGrQ==
x-fb-trip-id: 1679558926
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
content-type: image/png
access-control-allow-origin: *
origin-agent-cluster: ?0
cache-control: public,max-age=31536000,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
timing-allow-origin: *
expires: Thu, 23 May 2024 22:19:56 GMT

GET
H3 200 GRRBjzYu5MF.js Show response
static.xx.fbcdn.net/rsrc.php/v3iAxA4/yJ/l/de_DE/ Frame A0FE 514 KB
133 KB 16ms
8ms XHR
application/x-javascript 2a03:2880:f083:9:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3iAxA4/yJ/l/de_DE/GRRBjzYu5MF.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f083:9:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

fcace9a8a61eba27e7b9dce01f420a262a5ba72a131ef1b6db960da81b0458ac

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Thu, 25 May 2023 20:16:22 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: YZt3vDBxqsmz2RFEyNXi0w==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 135873
x-fb-rlafr: 0
x-fb-debug: 718GUv51xrfkG4zL6Rm6wifDPPgCHAypl/dL7Vs2mjOmCbKpbz7AC8+MxNrdGhkNQ4GT+qRfXKQc6/5e3EMddw==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
origin-agent-cluster: ?0
cache-control: public,max-age=31536000,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
timing-allow-origin: *
priority: u=1,i
expires: Thu, 23 May 2024 21:24:17 GMT

GET
H2 200 css.css
d3ikgzh4osba2b.cloudfront.net/public/clockers/PrimeApps/ 1010 B
1 KB 309ms
308ms Stylesheet
text/css 2600:9000:223d:0:15:7da0:ecc0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d3ikgzh4osba2b.cloudfront.net/public/clockers/PrimeApps/css.css
Requested by: Host: d2bb5k76l7oivo.cloudfront.net
URL: https://d2bb5k76l7oivo.cloudfront.net/0bf745d.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223d:0:15:7da0:ecc0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.46 () OpenSSL/1.0.2k-fips PHP/7.4.11 /
Resource Hash: a7081a117335212b9e7f2e348f7369a64423d51db1666310b3451e7375f0b7de

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Thu, 25 May 2023 20:16:23 GMT
via: 1.1 6851af5c4f6d355fa4ec39cc8cc0c358.cloudfront.net (CloudFront)
last-modified: Fri, 10 Apr 2020 22:29:00 GMT
server: Apache/2.4.46 () OpenSSL/1.0.2k-fips PHP/7.4.11
x-amz-cf-pop: FRA56-P3
etag: "3f2-5a2f7428ae907"
x-cache: Miss from cloudfront
content-type: text/css
accept-ranges: bytes
content-length: 1010
x-amz-cf-id: rFFnDamxmKjKDfkbwSSuR5-KBKHQ1yh32q4jM5re6dOw2mRUquIMuQ==

GET
H2 200 guid Show response
d3ikgzh4osba2b.cloudfront.net/public/ 0
277 B 311ms
310ms Script
text/html 2600:9000:223d:0:15:7da0:ecc0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d3ikgzh4osba2b.cloudfront.net/public/guid?cpguid=jjisa04fg&e=ll&t=1685045783602
Requested by: Host: d2bb5k76l7oivo.cloudfront.net
URL: https://d2bb5k76l7oivo.cloudfront.net/0bf745d.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223d:0:15:7da0:ecc0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.51 () OpenSSL/1.0.2k-fips PHP/7.4.11 / PHP/7.4.11
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Thu, 25 May 2023 20:16:23 GMT
via: 1.1 6851af5c4f6d355fa4ec39cc8cc0c358.cloudfront.net (CloudFront)
server: Apache/2.4.51 () OpenSSL/1.0.2k-fips PHP/7.4.11
x-amz-cf-pop: FRA56-P3
x-powered-by: PHP/7.4.11
x-cache: Miss from cloudfront
content-type: text/html; charset=UTF-8
content-length: 0
x-amz-cf-id: _JI4hNCh718-P13QGFwgyPOiSemNuoGHMKunJyE30AB_C3XJHgMucw==

GET
H2 200 check.php Show response
d3ikgzh4osba2b.cloudfront.net/public/external/ 78 B
373 B 313ms
312ms Script
application/javascript 2600:9000:223d:0:15:7da0:ecc0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d3ikgzh4osba2b.cloudfront.net/public/external/check.php?it=3302079&time=1685045784968
Requested by: Host: d2bb5k76l7oivo.cloudfront.net
URL: https://d2bb5k76l7oivo.cloudfront.net/0bf745d.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223d:0:15:7da0:ecc0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.51 () OpenSSL/1.0.2k-fips PHP/7.4.11 / PHP/7.4.11
Resource Hash: 9ef4a63fc5e0a14a7301d693d65d6acfc44cdf14853c4a20890198f2d5e52e3b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Thu, 25 May 2023 20:16:25 GMT
via: 1.1 6851af5c4f6d355fa4ec39cc8cc0c358.cloudfront.net (CloudFront)
server: Apache/2.4.51 () OpenSSL/1.0.2k-fips PHP/7.4.11
x-amz-cf-pop: FRA56-P3
x-powered-by: PHP/7.4.11
x-cache: Miss from cloudfront
content-type: application/javascript
content-length: 78
x-amz-cf-id: BcJnRsXKBw1k-ry4bd-vLSv4MPITSX-17mwQzUyBbi23jTEGHUR0aw==

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Scam (Online)

20 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			mediafire.com.de/	1970-01-20 12:18:29	Name: _cpguid Value: jjisa04fg
			.mediafire.com/	1970-01-20 12:04:07	Name: __cf_bm Value: DltFnoaAKV67TMo.EtJGLKNAJuGXlRVW0sskkw0ku78-1685045782-0-ASqtzrKwaER1TiwB+RGD4106TbdZgOwFXdZGVO2KR+oPDD5EFklkUjjh0AvKSxvJEqsJppXtanilBoIkg9wpFA8=

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	URL: https://mediafire.com.de/arceus-x(Line 562) Message: Mixed Content: The page at 'https://mediafire.com.de/arceus-x' was loaded over HTTPS, but requested an insecure element 'http://static.mediafire.com/images/backgrounds/header/mf_logo_full_color.svg'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'ambient-light-sensor'.
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'bluetooth'.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

d2bb5k76l7oivo.cloudfront.net
d3ikgzh4osba2b.cloudfront.net
fonts.googleapis.com
mediafire.com.de
static.mediafire.com
static.xx.fbcdn.net
www.facebook.com
www.mediafire.com
104.16.54.48
162.0.229.134
2600:9000:223d:0:15:7da0:ecc0:21
2600:9000:2491:7400:d:e9c:2500:21
2a00:1450:4001:827::200a
2a03:2880:f083:9:face:b00c:0:3
2a03:2880:f176:84:face:b00c:0:25de
03c8d2dc7d985c3004ff2cd6d8148dd03560f37ed15efdf6c2d7f4d771d0e599
05cfe92d9794a54258a19bfec7ae0faa73f61b66416983136594b4f95bb114dd
123118e5296c12c0821f5a958786e692c97317b1e9b5d778204900bd9d09d653
174d0ce23ddaa3923575af7a8e047e1dbf75199ebee7df1aca5e5713c4a1dd62
1c6ba1010c2cc88c59de9e9584728da124770fa399643ffc1beffcec54b84be7
4342feac38021c4fe3069eba0edf1c2e1b4345e2b548b0afb7ab21b7369b3bc8
4448e430d3c53bad548a5d135e1c7e2f9593e806ba47892640d430ea752e979e
5848fed0499a99763526e2178efc1bec18842259a88cb1cf12600be9ddabbdcd
5b0cb943a7b4f838935e2ad1eca549c74a0d8cb060043a26786aaadf9d3a62ca
720671166ac43aba99e3952b0b9341ab4e0fee1fd891db54e2a07f05db653142
7ba1bc2084def769e77a7dbf97cd91d68fe6c6d55b5d183a7d36630da8da2b02
82b94716473aa225e715e117802145c5d2d725aa1ba9d476d61a5d3da16a8c26
8539c91ae0a82f8cab27d481ea38ac4e66d1e5b36701fe295bcba4399b9255bd
8bacb685be7cec7f41a0270e694fa90c0fb448b2c0ded5f1734baf51050d695c
9ef4a63fc5e0a14a7301d693d65d6acfc44cdf14853c4a20890198f2d5e52e3b
a28be45144d377ab16527a8b5d2d60fae4d780f9dec17e4327567ad90482f293
a7081a117335212b9e7f2e348f7369a64423d51db1666310b3451e7375f0b7de
a7bd79b6fba60944ee3a9c153108ff0819d2db57850116ac7065a86db08af4ec
a9e5800ede2b6116b073fe2391c812f8ed94994b072245a5a9f1ae53c4658575
c6ef16fd857d73cf53d3adabb33db0ac7f7fd53662908a5ab1c1cba0968c081b
d65f4b2e8eee94ddc7f762d098de19558d879a3b597c8913b4d075532e3ed4b4
e17ee2288cc708ba3baafd0f9d67d80f65d7579a13d86e104ffb1fb726e40c2c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f1a67642fc97b508ce07cf6df329022bf5184a1c573044dc021e0d6e64688c64
f917a9105c311331b1d40f4d2bdbf11233c1c465616c1a9c46232f451463b061
fcace9a8a61eba27e7b9dce01f420a262a5ba72a131ef1b6db960da81b0458ac

mediafire.com.de Open in urlscan Pro 162.0.229.134 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

26 Requests

100 %HTTPS

71 %IPv6

6 Domains

8 Subdomains

7 IPs

3 Countries

291 kBTransfer

982 kBSize

2 Cookies

10 Outgoing links

Redirected requests

26 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

20 JavaScript Global Variables

2 Cookies

3 Console Messages

Security Headers

mediafire.com.de Open in urlscan Pro
162.0.229.134 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

26
Requests

100 %
HTTPS

71 %
IPv6

6
Domains

8
Subdomains

7
IPs

3
Countries

291 kB
Transfer

982 kB
Size

2
Cookies

26 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!