mediafire.com.de Open in urlscan Pro
162.0.229.134 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://mediafire.com.de/com-roblox-client
Submission Tags: https://phish.report @phish_report Search All
Submission: On July 20 via api (July 20th 2023, 2:55:09 pm UTC) from FI — Scanned from DE

Summary HTTP 24 Redirects Links 10 Behaviour Indicators

Summary

This website contacted 6 IPs in 3 countries across 5 domains to perform 24 HTTP transactions. The main IP is 162.0.229.134, located in United States and belongs to NAMECHEAP-NET, US. The main domain is mediafire.com.de.
TLS certificate: Issued by ZeroSSL RSA Domain Secure Site CA on April 28th 2023. Valid for: 3 months.

This is the only time mediafire.com.de was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Scam (Online)

Domain & IP information

	IP Address	AS Autonomous System
6	162.0.229.134 162.0.229.134	22612 (NAMECHEAP...) (NAMECHEAP-NET)
1	2a00:1450:400... 2a00:1450:4001:812::200a	15169 (GOOGLE) (GOOGLE)
1	2600:9000:249... 2600:9000:2491:4c00:d:e9c:2500:21	16509 (AMAZON-02) (AMAZON-02)
5	2600:9000:236... 2600:9000:236e:f000:1f:53d:d500:21	16509 (AMAZON-02) (AMAZON-02)
1	2a03:2880:f17... 2a03:2880:f177:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
10	104.16.54.48 104.16.54.48	13335 (CLOUDFLAR...) (CLOUDFLARENET)
24	6

6 162.0.229.134 (United States)

ASN22612 (NAMECHEAP-NET, US)
PTR: premium120-4.web-hosting.com

mediafire.com.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:812::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2491:4c00:d:e9c:2500:21 (United States)

ASN16509 (AMAZON-02, US)

d2bb5k76l7oivo.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2600:9000:236e:f000:1f:53d:d500:21 (United States)

ASN16509 (AMAZON-02, US)

d2u5m3g6vn5zro.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f177:83:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 104.16.54.48 (None, )

ASN13335 (CLOUDFLARENET, US)

static.mediafire.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.mediafire.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	mediafire.com static.mediafire.com — Cisco Umbrella Rank: 62864 www.mediafire.com — Cisco Umbrella Rank: 34036	89 KB
6	cloudfront.net d2bb5k76l7oivo.cloudfront.net d2u5m3g6vn5zro.cloudfront.net	25 KB
6	com.de mediafire.com.de	26 KB
1	facebook.com www.facebook.com — Cisco Umbrella Rank: 108	2 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 74	775 B
24	5

	Domain	Requested by
8	static.mediafire.com	mediafire.com.de
6	mediafire.com.de	mediafire.com.de
5	d2u5m3g6vn5zro.cloudfront.net	d2bb5k76l7oivo.cloudfront.net
2	www.mediafire.com	mediafire.com.de
1	www.facebook.com	mediafire.com.de
1	d2bb5k76l7oivo.cloudfront.net	mediafire.com.de
1	fonts.googleapis.com	mediafire.com.de
24	7

This site contains links to these domains. Also see Links.

Domain
www.mediafire.com
blog.mediafire.com
vividengine.com
mediafire.zendesk.com
twitter.com
www.facebook.com

Subject Issuer	Validity	Valid
mediafire.com.de ZeroSSL RSA Domain Secure Site CA	`2023-04-28` - `2023-07-27`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-07-03` - `2023-09-25`	3 months	crt.sh
*.cloudfront.net Amazon RSA 2048 M01	`2022-12-08` - `2023-12-07`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-04-28` - `2023-07-27`	3 months	crt.sh
*.mediafire.com Sectigo RSA Domain Validation Secure Server CA	`2022-08-30` - `2023-09-30`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://mediafire.com.de/com-roblox-client
Frame ID: 80F87A0852E426C979813E86C793A249
Requests: 23 HTTP requests in this frame

Frame: https://www.facebook.com/plugins/like.php?href=http://www.facebook.com/MediaFire&width=193&layout=button_count&action=like&show_faces=false&share=true&height=30&appId=124578887583575
Frame ID: 0B0C7AD8DF669E04CC6673E6E32DC773
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Roblox_v2.526.426-Mod-ubirt.us.apk

Detected technologies

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Page Statistics

24
Requests

100 %
HTTPS

67 %
IPv6

5
Domains

7
Subdomains

6
IPs

3
Countries

143 kB
Transfer

423 kB
Size

2
Cookies

10 Outgoing links

These are links going to different origins than the main page.

URL: https://www.mediafire.com/
Title: MediaFire

Search URL Search Domain Scan URL

URL: https://www.mediafire.com/upgrade/
Title: Sign Up

Search URL Search Domain Scan URL

URL: https://www.mediafire.com/login/
Title: Log In

Search URL Search Domain Scan URL

URL: http://blog.mediafire.com/
Title: Company Blog

Search URL Search Domain Scan URL

URL: https://vividengine.com/
Title: On-Demand Video Encoding

Search URL Search Domain Scan URL

URL: https://mediafire.zendesk.com/hc/en-us
Title: Support

Search URL Search Domain Scan URL

URL: https://twitter.com/#!/mediafire

Search URL Search Domain Scan URL

URL: https://www.facebook.com/mediafire

Search URL Search Domain Scan URL

URL: https://twitter.com/mediafire
Title: Twitter Page

Search URL Search Domain Scan URL

URL: https://blog.mediafire.com/
Title: MediaFire Blog

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

24 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request com-roblox-client Show response
mediafire.com.de/ 20 KB
5 KB 1388ms
931ms Document
text/html 162.0.229.134
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://mediafire.com.de/com-roblox-client

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

162.0.229.134 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

premium120-4.web-hosting.com

Software

LiteSpeed /

Resource Hash

76891388a30122b6f19b5363be73fd56d622f2aba5107bc54467d5346b131779

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-encoding: br
content-type: text/html; charset=utf-8
cross-origin-opener-policy: same-origin
date: Thu, 20 Jul 2023 14:55:04 GMT
referrer-policy: same-origin
server: LiteSpeed
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: DENY
x-turbo-charged-by: LiteSpeed

GET
H2 200 icon
fonts.googleapis.com/ 569 B
775 B 78ms
30ms Stylesheet
text/css 2a00:1450:4001:812::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/icon?family=Material+Icons

Requested by

Host: mediafire.com.de
URL: https://mediafire.com.de/com-roblox-client

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

5848fed0499a99763526e2178efc1bec18842259a88cb1cf12600be9ddabbdcd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 20 Jul 2023 14:55:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 14:55:04 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 20 Jul 2023 14:55:04 GMT

GET
H2 200 main.css
mediafire.com.de/static/css/ 112 KB
16 KB 350ms
350ms Stylesheet
text/css 162.0.229.134
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://mediafire.com.de/static/css/main.css
Requested by: Host: mediafire.com.de
URL: https://mediafire.com.de/com-roblox-client
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.0.229.134 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: premium120-4.web-hosting.com
Software: LiteSpeed /
Resource Hash: 5b0cb943a7b4f838935e2ad1eca549c74a0d8cb060043a26786aaadf9d3a62ca

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mediafire.com.de/com-roblox-client
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

date: Thu, 20 Jul 2023 14:55:04 GMT
content-encoding: br
last-modified: Thu, 28 Apr 2022 16:18:18 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
content-length: 16200
expires: Thu, 27 Jul 2023 14:55:04 GMT

GET
H2 200 0bf745d.js Show response
d2bb5k76l7oivo.cloudfront.net/ 24 KB
7 KB 425ms
363ms Script
application/javascript 2600:9000:2491:4c00:d:e9c:2500:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d2bb5k76l7oivo.cloudfront.net/0bf745d.js
Requested by: Host: mediafire.com.de
URL: https://mediafire.com.de/com-roblox-client
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2491:4c00:d:e9c:2500:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 7cbce275a31a0b2113cb9469ddb1fe41b820be2ba9eb221f618d4cf92c0cafd4

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

date: Thu, 20 Jul 2023 14:39:18 GMT
content-encoding: br
via: 1.1 45144f4effc6db6c846de623ab8b639a.cloudfront.net (CloudFront)
last-modified: Tue, 27 Jun 2023 13:23:05 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P7
age: 993
etag: W/"07ace30cbd77eb9d6e74843abfd10980"
vary: Accept-Encoding
x-cache: Error from cloudfront
content-type: application/javascript
x-amz-cf-id: hLKTe9G6FLk6_spjywunb53KQVzbgA3ZN6JVtwf9zKblznAboXZvzw==

GET
H2 200 html.3302079.2520b.0.js Show response
d2u5m3g6vn5zro.cloudfront.net/public/external/v2/ 9 KB
9 KB 393ms
340ms Script
application/javascript 2600:9000:236e:f000:1f:53d:d500:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d2u5m3g6vn5zro.cloudfront.net/public/external/v2/html.3302079.2520b.0.js
Requested by: Host: d2bb5k76l7oivo.cloudfront.net
URL: https://d2bb5k76l7oivo.cloudfront.net/0bf745d.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:236e:f000:1f:53d:d500:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.46 () OpenSSL/1.0.2k-fips PHP/7.4.11 / PHP/7.4.11
Resource Hash: a9e5800ede2b6116b073fe2391c812f8ed94994b072245a5a9f1ae53c4658575

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

date: Thu, 20 Jul 2023 14:55:04 GMT
via: 1.1 857b0dca772798c338c78a1be69c955c.cloudfront.net (CloudFront)
server: Apache/2.4.46 () OpenSSL/1.0.2k-fips PHP/7.4.11
x-amz-cf-pop: FRA60-P1
x-powered-by: PHP/7.4.11
x-cache: Miss from cloudfront
content-type: application/javascript
x-amz-cf-id: f9elbQWwQRDBPTnhoUZnTngqiH7SYZUhgwd12kxreNkULfIJD09cew==

GET
H2 200 css_front.css
d2u5m3g6vn5zro.cloudfront.net/public/external/ 6 KB
7 KB 234ms
181ms Stylesheet
text/css 2600:9000:236e:f000:1f:53d:d500:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d2u5m3g6vn5zro.cloudfront.net/public/external/css_front.css
Requested by: Host: d2bb5k76l7oivo.cloudfront.net
URL: https://d2bb5k76l7oivo.cloudfront.net/0bf745d.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:236e:f000:1f:53d:d500:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.51 () OpenSSL/1.0.2k-fips PHP/7.4.11 /
Resource Hash: a7bd79b6fba60944ee3a9c153108ff0819d2db57850116ac7065a86db08af4ec

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

date: Thu, 20 Jul 2023 14:55:04 GMT
via: 1.1 857b0dca772798c338c78a1be69c955c.cloudfront.net (CloudFront)
last-modified: Tue, 23 Jun 2020 20:06:47 GMT
server: Apache/2.4.51 () OpenSSL/1.0.2k-fips PHP/7.4.11
x-amz-cf-pop: FRA60-P1
etag: "19c4-5a8c5e62e9d0a"
x-cache: Miss from cloudfront
content-type: text/css
accept-ranges: bytes
content-length: 6596
x-amz-cf-id: aCyOCza8c0GyJmAty26q0__p3qZE92q7o2eVwbAK2aBs5NAGUvIkBw==

GET
H2 200 like.php Show response
www.facebook.com/plugins/ Frame 0B0C 0
2 KB 85ms
45ms Document
text/html 2a03:2880:f177:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/plugins/like.php?href=http://www.facebook.com/MediaFire&width=193&layout=button_count&action=like&show_faces=false&share=true&height=30&appId=124578887583575

Requested by

Host: mediafire.com.de
URL: https://mediafire.com.de/com-roblox-client

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f177:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval';style-src fonts.googleapis.com .fbcdn.net data: .facebook.com 'unsafe-inline';connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com;font-src data: .gstatic.com .facebook.com .fbcdn.net .fbsbx.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com .tenor.co media.tenor.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net .giphy.com connect.facebook.net .carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com .whatsapp.net .fb.com .oculuscdn.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com https://.giphy.com data:;frame-src .doubleclick.net .google.com .facebook.com www.googleadservices.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com https://sandbox.paywithmybank.com;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: private, no-cache, no-store, must-revalidate
content-length: 0
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval';style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com https://sandbox.paywithmybank.com;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
content-type: text/html;charset=utf-8
cross-origin-opener-policy: same-origin-allow-popups
date: Thu, 20 Jul 2023 14:55:04 GMT
expires: Sat, 01 Jan 2000 00:00:00 GMT
pragma: no-cache
report-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}
x-content-type-options: nosniff
x-fb-debug: JX67olXFVqEdMe2ECfkZ6fTTb6IYxdKceKzW8vU7Rpwr00y2DscliDIJLp4kPeXS21JWt90XtAiWT43V8+HBjg==
x-xss-protection: 0

GET
H2 200 mf_logo_full_color.svg
static.mediafire.com/images/backgrounds/header/ 3 KB
2 KB 102ms
49ms Image
image/svg+xml 104.16.54.48
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.mediafire.com/images/backgrounds/header/mf_logo_full_color.svg
Requested by: Host: mediafire.com.de
URL: https://mediafire.com.de/com-roblox-client
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.16.54.48 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8539c91ae0a82f8cab27d481ea38ac4e66d1e5b36701fe295bcba4399b9255bd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mediafire.com.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

date: Thu, 20 Jul 2023 14:55:04 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Fri, 28 Oct 2016 22:22:42 GMT
server: cloudflare
age: 5512
etag: W/"5813cfb2-d1d"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cf-ray: 7e9c0b066e69bbcb-FRA

GET
H2 200 file-zip-v3.png
mediafire.com.de/static/css/ 2 KB
2 KB 174ms
174ms Image
image/png 162.0.229.134
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mediafire.com.de/static/css/file-zip-v3.png
Requested by: Host: mediafire.com.de
URL: https://mediafire.com.de/static/css/main.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.0.229.134 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: premium120-4.web-hosting.com
Software: LiteSpeed /
Resource Hash: 4448e430d3c53bad548a5d135e1c7e2f9593e806ba47892640d430ea752e979e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mediafire.com.de/static/css/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

date: Thu, 20 Jul 2023 14:55:04 GMT
last-modified: Thu, 28 Apr 2022 16:18:18 GMT
server: LiteSpeed
content-type: image/png
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
content-length: 1872
expires: Thu, 27 Jul 2023 14:55:04 GMT

GET
H2 200 icons_sprite.svg
www.mediafire.com/images/icons/svg_light/ 36 KB
9 KB 98ms
43ms Image
image/svg+xml 104.16.54.48
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.mediafire.com/images/icons/svg_light/icons_sprite.svg
Requested by: Host: mediafire.com.de
URL: https://mediafire.com.de/static/css/main.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.16.54.48 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7ba1bc2084def769e77a7dbf97cd91d68fe6c6d55b5d183a7d36630da8da2b02

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mediafire.com.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

date: Thu, 20 Jul 2023 14:55:04 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
server: cloudflare
age: 4523
etag: W/"62deda56-90ab"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cf-ray: 7e9c0b066fccbb65-FRA

GET
H2 200 dl_promo_logo.png
static.mediafire.com/images/backgrounds/download/ 2 KB
3 KB 99ms
47ms Image
image/png 104.16.54.48
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.mediafire.com/images/backgrounds/download/dl_promo_logo.png
Requested by: Host: mediafire.com.de
URL: https://mediafire.com.de/static/css/main.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.16.54.48 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 174d0ce23ddaa3923575af7a8e047e1dbf75199ebee7df1aca5e5713c4a1dd62

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mediafire.com.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

date: Thu, 20 Jul 2023 14:55:04 GMT
cf-cache-status: HIT
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
server: cloudflare
age: 11103
etag: "62deda56-8c0"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 7e9c0b066e74bbcb-FRA
content-length: 2240
expires: Sat, 19 Aug 2023 08:38:52 GMT

GET
H2 200 arrow_dropdown.svg
www.mediafire.com/images/icons/svg_dark/ 315 B
518 B 105ms
50ms Image
image/svg+xml 104.16.54.48
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.mediafire.com/images/icons/svg_dark/arrow_dropdown.svg
Requested by: Host: mediafire.com.de
URL: https://mediafire.com.de/static/css/main.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.16.54.48 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 82b94716473aa225e715e117802145c5d2d725aa1ba9d476d61a5d3da16a8c26

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mediafire.com.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

date: Thu, 20 Jul 2023 14:55:04 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
server: cloudflare
age: 4575
etag: W/"62deda56-13b"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cf-ray: 7e9c0b066fcebb65-FRA

GET
H2 200 check_circle_green.svg
mediafire.com.de/static/css/ 444 B
472 B 174ms
174ms Image
image/svg+xml 162.0.229.134
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mediafire.com.de/static/css/check_circle_green.svg
Requested by: Host: mediafire.com.de
URL: https://mediafire.com.de/static/css/main.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.0.229.134 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: premium120-4.web-hosting.com
Software: LiteSpeed /
Resource Hash: 03c8d2dc7d985c3004ff2cd6d8148dd03560f37ed15efdf6c2d7f4d771d0e599

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mediafire.com.de/static/css/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

date: Thu, 20 Jul 2023 14:55:04 GMT
content-encoding: br
last-modified: Thu, 28 Apr 2022 16:18:18 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
content-length: 247
expires: Thu, 27 Jul 2023 14:55:04 GMT

GET
H2 200 world.svg
static.mediafire.com/images/backgrounds/download/additional_content/ 143 KB
53 KB 117ms
66ms Image
image/svg+xml 104.16.54.48
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.mediafire.com/images/backgrounds/download/additional_content/world.svg
Requested by: Host: mediafire.com.de
URL: https://mediafire.com.de/static/css/main.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.16.54.48 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4342feac38021c4fe3069eba0edf1c2e1b4345e2b548b0afb7ab21b7369b3bc8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mediafire.com.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

date: Thu, 20 Jul 2023 14:55:04 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
server: cloudflare
age: 6482
etag: W/"62deda56-23ce2"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cf-ray: 7e9c0b066e78bbcb-FRA

GET
H2 200 continent-na.svg
static.mediafire.com/images/backgrounds/download/additional_content/ 50 KB
19 KB 102ms
51ms Image
image/svg+xml 104.16.54.48
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.mediafire.com/images/backgrounds/download/additional_content/continent-na.svg
Requested by: Host: mediafire.com.de
URL: https://mediafire.com.de/static/css/main.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.16.54.48 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 05cfe92d9794a54258a19bfec7ae0faa73f61b66416983136594b4f95bb114dd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mediafire.com.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

date: Thu, 20 Jul 2023 14:55:04 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
server: cloudflare
age: 8188
etag: W/"62deda56-c817"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cf-ray: 7e9c0b066e6ebbcb-FRA

GET
H2 200 usa.svg
static.mediafire.com/images/flags_svg/ 1 KB
733 B 101ms
50ms Image
image/svg+xml 104.16.54.48
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.mediafire.com/images/flags_svg/usa.svg
Requested by: Host: mediafire.com.de
URL: https://mediafire.com.de/static/css/main.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.16.54.48 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8bacb685be7cec7f41a0270e694fa90c0fb448b2c0ded5f1734baf51050d695c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mediafire.com.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

date: Thu, 20 Jul 2023 14:55:04 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
server: cloudflare
age: 1197
etag: W/"62deda56-5c7"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cf-ray: 7e9c0b066e70bbcb-FRA

GET
H2 200 virustotal.png
mediafire.com.de/static/css/ 1 KB
2 KB 174ms
174ms Image
image/png 162.0.229.134
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mediafire.com.de/static/css/virustotal.png
Requested by: Host: mediafire.com.de
URL: https://mediafire.com.de/static/css/main.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.0.229.134 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: premium120-4.web-hosting.com
Software: LiteSpeed /
Resource Hash: c6ef16fd857d73cf53d3adabb33db0ac7f7fd53662908a5ab1c1cba0968c081b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mediafire.com.de/static/css/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

date: Thu, 20 Jul 2023 14:55:04 GMT
last-modified: Thu, 28 Apr 2022 16:18:18 GMT
server: LiteSpeed
content-type: image/png
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
content-length: 1344
expires: Thu, 27 Jul 2023 14:55:04 GMT

GET
H2 200 fb_16x16.png
static.mediafire.com/images/backgrounds/download/social/ 181 B
480 B 99ms
49ms Image
image/png 104.16.54.48
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.mediafire.com/images/backgrounds/download/social/fb_16x16.png
Requested by: Host: mediafire.com.de
URL: https://mediafire.com.de/static/css/main.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.16.54.48 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 720671166ac43aba99e3952b0b9341ab4e0fee1fd891db54e2a07f05db653142

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mediafire.com.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

date: Thu, 20 Jul 2023 14:55:04 GMT
cf-cache-status: HIT
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
server: cloudflare
age: 2868
etag: "62deda56-b5"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 7e9c0b066e7bbbcb-FRA
content-length: 181
expires: Sat, 19 Aug 2023 12:41:37 GMT

GET
H2 200 mf_round.svg
mediafire.com.de/static/css/ 1 KB
960 B 174ms
174ms Image
image/svg+xml 162.0.229.134
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mediafire.com.de/static/css/mf_round.svg
Requested by: Host: mediafire.com.de
URL: https://mediafire.com.de/static/css/main.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.0.229.134 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: premium120-4.web-hosting.com
Software: LiteSpeed /
Resource Hash: f1a67642fc97b508ce07cf6df329022bf5184a1c573044dc021e0d6e64688c64

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mediafire.com.de/static/css/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

date: Thu, 20 Jul 2023 14:55:04 GMT
content-encoding: br
last-modified: Thu, 28 Apr 2022 16:18:18 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
content-length: 735
expires: Thu, 27 Jul 2023 14:55:04 GMT

GET
H2 200 browser_chrome.svg
static.mediafire.com/images/backgrounds/download/additional_content/ 8 KB
2 KB 89ms
44ms Image
image/svg+xml 104.16.54.48
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.mediafire.com/images/backgrounds/download/additional_content/browser_chrome.svg
Requested by: Host: mediafire.com.de
URL: https://mediafire.com.de/static/css/main.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.16.54.48 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1c6ba1010c2cc88c59de9e9584728da124770fa399643ffc1beffcec54b84be7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mediafire.com.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

date: Thu, 20 Jul 2023 14:55:04 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
server: cloudflare
age: 550
etag: W/"62deda56-1e24"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cf-ray: 7e9c0b066e64bbcb-FRA

GET
H2 200 footerIcons.png
static.mediafire.com/images/backgrounds/footer/social/ 583 B
685 B 40ms
40ms Image
image/png 104.16.54.48
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.mediafire.com/images/backgrounds/footer/social/footerIcons.png
Requested by: Host: mediafire.com.de
URL: https://mediafire.com.de/static/css/main.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.16.54.48 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f917a9105c311331b1d40f4d2bdbf11233c1c465616c1a9c46232f451463b061

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mediafire.com.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

date: Thu, 20 Jul 2023 14:55:04 GMT
cf-cache-status: HIT
last-modified: Mon, 25 Jul 2022 18:00:54 GMT
server: cloudflare
age: 6820
etag: "62deda56-247"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 7e9c0b06af04bbcb-FRA
content-length: 583
expires: Sat, 19 Aug 2023 12:34:55 GMT

GET
H2 200 css.css
d2u5m3g6vn5zro.cloudfront.net/public/clockers/PrimeApps/ 1010 B
1 KB 170ms
170ms Stylesheet
text/css 2600:9000:236e:f000:1f:53d:d500:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d2u5m3g6vn5zro.cloudfront.net/public/clockers/PrimeApps/css.css
Requested by: Host: d2bb5k76l7oivo.cloudfront.net
URL: https://d2bb5k76l7oivo.cloudfront.net/0bf745d.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:236e:f000:1f:53d:d500:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.51 () OpenSSL/1.0.2k-fips PHP/7.4.11 /
Resource Hash: a7081a117335212b9e7f2e348f7369a64423d51db1666310b3451e7375f0b7de

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

date: Thu, 20 Jul 2023 14:55:05 GMT
via: 1.1 857b0dca772798c338c78a1be69c955c.cloudfront.net (CloudFront)
last-modified: Fri, 10 Apr 2020 22:29:00 GMT
server: Apache/2.4.51 () OpenSSL/1.0.2k-fips PHP/7.4.11
x-amz-cf-pop: FRA60-P1
etag: "3f2-5a2f7428ae907"
x-cache: Miss from cloudfront
content-type: text/css
accept-ranges: bytes
content-length: 1010
x-amz-cf-id: h4noisX2rmkbeqv5uTZctyE4mcJ1_Mwv69BmB_GLpyVQin-9cwkqRg==

GET
H2 200 guid Show response
d2u5m3g6vn5zro.cloudfront.net/public/ 0
278 B 172ms
171ms Script
text/html 2600:9000:236e:f000:1f:53d:d500:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d2u5m3g6vn5zro.cloudfront.net/public/guid?cpguid=j6z114186&e=ll&t=1689864905641
Requested by: Host: d2bb5k76l7oivo.cloudfront.net
URL: https://d2bb5k76l7oivo.cloudfront.net/0bf745d.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:236e:f000:1f:53d:d500:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.41 () OpenSSL/1.0.2k-fips PHP/7.4.11 / PHP/7.4.11
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

date: Thu, 20 Jul 2023 14:55:05 GMT
via: 1.1 857b0dca772798c338c78a1be69c955c.cloudfront.net (CloudFront)
server: Apache/2.4.41 () OpenSSL/1.0.2k-fips PHP/7.4.11
x-amz-cf-pop: FRA60-P1
x-powered-by: PHP/7.4.11
x-cache: Miss from cloudfront
content-type: text/html; charset=UTF-8
content-length: 0
x-amz-cf-id: VmCjS6NwKaQmyD2aMTOxMEINoGoCNWXW_CgdX0jleT_S59VsSlgLFw==

GET
H2 200 check.php Show response
d2u5m3g6vn5zro.cloudfront.net/public/external/ 78 B
371 B 329ms
328ms Script
application/javascript 2600:9000:236e:f000:1f:53d:d500:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d2u5m3g6vn5zro.cloudfront.net/public/external/check.php?it=3302079&time=1689864907038
Requested by: Host: d2bb5k76l7oivo.cloudfront.net
URL: https://d2bb5k76l7oivo.cloudfront.net/0bf745d.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:236e:f000:1f:53d:d500:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.46 () OpenSSL/1.0.2k-fips PHP/7.4.11 / PHP/7.4.11
Resource Hash: 9ef4a63fc5e0a14a7301d693d65d6acfc44cdf14853c4a20890198f2d5e52e3b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

date: Thu, 20 Jul 2023 14:55:07 GMT
via: 1.1 857b0dca772798c338c78a1be69c955c.cloudfront.net (CloudFront)
server: Apache/2.4.46 () OpenSSL/1.0.2k-fips PHP/7.4.11
x-amz-cf-pop: FRA60-P1
x-powered-by: PHP/7.4.11
x-cache: Miss from cloudfront
content-type: application/javascript
content-length: 78
x-amz-cf-id: iU3atUECiVaHniqquY3VsFPB_mBaWiDcFMM5dhWQHMKM-I-A40N75A==

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Scam (Online)

19 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			mediafire.com.de/	1970-01-20 13:38:48	Name: _cpguid Value: j6z114186
			.mediafire.com/	1970-01-20 13:24:26	Name: __cf_bm Value: TFKoOlKl2khUu9LPICH3I6ba5J_QHbgoxJYkFjRzGEQ-1689864904-0-ARiQjJptA3eOnZDrBVF0PFBM/6udbNam/yjU9R7uBsDUjRxBmUesZye4mSvcfel1rHsof8R0bJVRr6CBArxJ5hs=

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	URL: https://mediafire.com.de/com-roblox-client(Line 562) Message: Mixed Content: The page at 'https://mediafire.com.de/com-roblox-client' was loaded over HTTPS, but requested an insecure element 'http://static.mediafire.com/images/backgrounds/header/mf_logo_full_color.svg'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

d2bb5k76l7oivo.cloudfront.net
d2u5m3g6vn5zro.cloudfront.net
fonts.googleapis.com
mediafire.com.de
static.mediafire.com
www.facebook.com
www.mediafire.com
104.16.54.48
162.0.229.134
2600:9000:236e:f000:1f:53d:d500:21
2600:9000:2491:4c00:d:e9c:2500:21
2a00:1450:4001:812::200a
2a03:2880:f177:83:face:b00c:0:25de
03c8d2dc7d985c3004ff2cd6d8148dd03560f37ed15efdf6c2d7f4d771d0e599
05cfe92d9794a54258a19bfec7ae0faa73f61b66416983136594b4f95bb114dd
174d0ce23ddaa3923575af7a8e047e1dbf75199ebee7df1aca5e5713c4a1dd62
1c6ba1010c2cc88c59de9e9584728da124770fa399643ffc1beffcec54b84be7
4342feac38021c4fe3069eba0edf1c2e1b4345e2b548b0afb7ab21b7369b3bc8
4448e430d3c53bad548a5d135e1c7e2f9593e806ba47892640d430ea752e979e
5848fed0499a99763526e2178efc1bec18842259a88cb1cf12600be9ddabbdcd
5b0cb943a7b4f838935e2ad1eca549c74a0d8cb060043a26786aaadf9d3a62ca
720671166ac43aba99e3952b0b9341ab4e0fee1fd891db54e2a07f05db653142
76891388a30122b6f19b5363be73fd56d622f2aba5107bc54467d5346b131779
7ba1bc2084def769e77a7dbf97cd91d68fe6c6d55b5d183a7d36630da8da2b02
7cbce275a31a0b2113cb9469ddb1fe41b820be2ba9eb221f618d4cf92c0cafd4
82b94716473aa225e715e117802145c5d2d725aa1ba9d476d61a5d3da16a8c26
8539c91ae0a82f8cab27d481ea38ac4e66d1e5b36701fe295bcba4399b9255bd
8bacb685be7cec7f41a0270e694fa90c0fb448b2c0ded5f1734baf51050d695c
9ef4a63fc5e0a14a7301d693d65d6acfc44cdf14853c4a20890198f2d5e52e3b
a7081a117335212b9e7f2e348f7369a64423d51db1666310b3451e7375f0b7de
a7bd79b6fba60944ee3a9c153108ff0819d2db57850116ac7065a86db08af4ec
a9e5800ede2b6116b073fe2391c812f8ed94994b072245a5a9f1ae53c4658575
c6ef16fd857d73cf53d3adabb33db0ac7f7fd53662908a5ab1c1cba0968c081b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f1a67642fc97b508ce07cf6df329022bf5184a1c573044dc021e0d6e64688c64
f917a9105c311331b1d40f4d2bdbf11233c1c465616c1a9c46232f451463b061

mediafire.com.de Open in urlscan Pro 162.0.229.134 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

24 Requests

100 %HTTPS

67 %IPv6

5 Domains

7 Subdomains

6 IPs

3 Countries

143 kBTransfer

423 kBSize

2 Cookies

10 Outgoing links

Redirected requests

24 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

19 JavaScript Global Variables

2 Cookies

1 Console Messages

Security Headers

Indicators

mediafire.com.de Open in urlscan Pro
162.0.229.134 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

24
Requests

100 %
HTTPS

67 %
IPv6

5
Domains

7
Subdomains

6
IPs

3
Countries

143 kB
Transfer

423 kB
Size

2
Cookies

24 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!