Return of Shadow
Data calls made by Return of Shadow
Overview of network connections made by Return of Shadow during the first 60 seconds after installation.
Return of Shadow contacted 9 different domains within the first minute of opening. This data was collected from 2 independent scans We identified 0 ad creatives being loaded, confirming active ad monetization. across servers in 🇺🇸 🇨🇳, providing transparency into the app's actual network behavior and data sharing practices.
Scan Runs
2
Unique Domains
9
Ad Creatives Found
0
Countries
🇺🇸🇨🇳
Contacted Domains (9)
| February 3, 2026 at 16:01:49 | Firebase firebaseinstallations.googleapis.com/v1/p... | 🇺🇸 Google LLC | Request: application/json Response: application/json | ||
| February 3, 2026 at 16:01:50 | Facebook graph.facebook.com/v14.0/app | 🇺🇸 Facebook, Inc. | Request: application/x-www-form-urlencoded Response: text/javascript | ||
| February 3, 2026 at 16:01:50 | Firebase firebase-settings.crashlytics.com/spi/v2 | 🇺🇸 Google LLC | Request: Response: application/json | ||
| February 3, 2026 at 16:01:50 | Facebook graph.facebook.com/v14.0/1415307665632922 | 🇺🇸 Facebook, Inc. | Request: application/x-www-form-urlencoded Response: text/javascript | ||
| February 3, 2026 at 16:01:49 | Facebook graph.facebook.com/v14.0/1415307665632922 | 🇺🇸 Facebook, Inc. | Request: application/x-www-form-urlencoded Response: text/javascript | ||
| February 3, 2026 at 16:02:03 | Firebase android.googleapis.com/auth/devicekey | 🇺🇸 Google LLC | Request: application/x-protobuf Response: text/html | ||
| October 4, 2025 at 09:34:08 | Facebook graph.facebook.com/v14.0/app | Request: application/x-www-form-urlencoded Response: text/javascript | |||
| October 4, 2025 at 09:34:08 | Facebook graph.facebook.com/v14.0/1415307665632922 | Request: application/x-www-form-urlencoded Response: text/javascript | |||
| October 4, 2025 at 09:34:09 | AIHelp starunion.aihelp.net/elva/api | 🇺🇸 SOFTLAYER | Request: Response: application/json | ||
| October 4, 2025 at 09:34:09 | AIHelp starunion.aihelp.net/elva/api | 🇺🇸 SOFTLAYER | Request: application/json Response: application/json | ||
| October 4, 2025 at 09:34:09 | AIHelp starunion.aihelp.net/elva/api | 🇺🇸 SOFTLAYER | Request: Response: application/json | ||
| October 4, 2025 at 09:34:09 | AppsFlyer cdn-settings.appsflyersdk.com/android/v1 | 🇺🇸 AMAZON-02 | Request: application/json Response: application/json | ||
| October 4, 2025 at 09:34:10 | AIHelp p1-config.cdn-aihelp.net/sdkconfig/locale... | CLOUDFLARENET | Request: Response: application/json | ||
| October 4, 2025 at 09:34:10 | AIHelp starunion.config.cdn-aihelp.net/OPerMode/... | CLOUDFLARENET | Request: Response: application/json | ||
| October 4, 2025 at 09:34:10 | AIHelp cdn.aihelp.net/elva/faq | CLOUDFLARENET | Request: Response: application/json | ||
| October 4, 2025 at 09:34:10 | AIHelp starunion.config.cdn-aihelp.net/text/default | CLOUDFLARENET | Request: Response: application/json | ||
| October 4, 2025 at 09:34:10 | AIHelp cdn.aihelp.net/elva/style | CLOUDFLARENET | Request: Response: application/json | ||
| October 4, 2025 at 09:34:10 | AIHelp starunion.config.cdn-aihelp.net/business/... | CLOUDFLARENET | Request: Response: application/json | ||
| October 4, 2025 at 09:34:10 | AppsFlyer conversions.appsflyersdk.com/api/v6.14 | 🇺🇸 AMAZON-02 | Request: application/octet-stream Response: text/plain | ||
| October 4, 2025 at 09:34:11 | allstarunion.com p0202.ga.allstarunion.com/auth/reportevent | 🇺🇸 AMAZON-02 | Request: application/json Response: application/json | ||
| October 4, 2025 at 09:34:11 | allstarunion.com p0202.ga.allstarunion.com/auth/checkupdate | 🇺🇸 AMAZON-02 | Request: application/json Response: application/json | ||
| October 4, 2025 at 09:34:11 | allstarunion.com p0202.ga.allstarunion.com/auth/reportevent | 🇺🇸 AMAZON-02 | Request: application/json Response: application/json | ||
| October 4, 2025 at 09:34:11 | QQ android.bugly.qq.com/rqd/async | 🇨🇳 Chinanet | Request: application/x-www-form-urlencoded Response: | ||
| October 4, 2025 at 09:34:11 | AppsFlyer inapps.appsflyersdk.com/api/v6.14 | 🇺🇸 AMAZON-02 | Request: application/octet-stream Response: text/plain | ||
| October 4, 2025 at 09:34:11 | AppsFlyer inapps.appsflyersdk.com/api/v6.14 | 🇺🇸 AMAZON-02 | Request: application/octet-stream Response: text/plain | ||
| October 4, 2025 at 09:34:11 | AppsFlyer inapps.appsflyersdk.com/api/v6.14 | 🇺🇸 AMAZON-02 | Request: application/octet-stream Response: text/plain | ||
| October 4, 2025 at 09:34:11 | AppsFlyer inapps.appsflyersdk.com/api/v6.14 | 🇺🇸 AMAZON-02 | Request: application/octet-stream Response: text/plain | ||
| October 4, 2025 at 09:34:11 | AppsFlyer inapps.appsflyersdk.com/api/v6.14 | 🇺🇸 AMAZON-02 | Request: application/octet-stream Response: text/plain | ||
| October 4, 2025 at 09:34:11 | allstarunion.com p0202.ga.allstarunion.com/auth/reportevent | 🇺🇸 AMAZON-02 | Request: application/json Response: application/json | ||
| October 4, 2025 at 09:34:12 | allstarunion.com p0202.ga.allstarunion.com/auth/reportevent | 🇺🇸 AMAZON-02 | Request: application/json Response: application/json | ||
| October 4, 2025 at 09:34:12 | allstarunion.com p0202.ga.allstarunion.com/auth/reportevent | 🇺🇸 AMAZON-02 | Request: application/json Response: application/json | ||
| October 4, 2025 at 09:34:12 | allstarunion.com p0801-production-cdn.allstarunion.com/hot... | 🇺🇸 AMAZON-02 | Request: Response: binary/octet-stream | ||
| October 4, 2025 at 09:34:12 | AppsFlyer inapps.appsflyersdk.com/api/v6.14 | 🇺🇸 AMAZON-02 | Request: application/octet-stream Response: text/plain | ||
| October 4, 2025 at 09:34:13 | allstarunion.com p0202.ga.allstarunion.com/auth/reportevent | 🇺🇸 AMAZON-02 | Request: application/json Response: application/json | ||
| October 4, 2025 at 09:34:13 | allstarunion.com p0202.ga.allstarunion.com/auth/reportevent | 🇺🇸 AMAZON-02 | Request: application/json Response: application/json | ||
| October 4, 2025 at 09:34:13 | AppsFlyer inapps.appsflyersdk.com/api/v6.14 | 🇺🇸 AMAZON-02 | Request: application/octet-stream Response: text/plain | ||
| October 4, 2025 at 09:34:13 | AppsFlyer inapps.appsflyersdk.com/api/v6.14 | 🇺🇸 AMAZON-02 | Request: application/octet-stream Response: text/plain | ||
| October 4, 2025 at 09:34:13 | allstarunion.com p0202.ga.allstarunion.com/auth/reportevent | 🇺🇸 AMAZON-02 | Request: application/json Response: application/json | ||
| October 4, 2025 at 09:34:13 | allstarunion.com p0801-production-cdn.allstarunion.com/hot... | 🇺🇸 AMAZON-02 | Request: Response: binary/octet-stream | ||
| October 4, 2025 at 09:34:13 | allstarunion.com p0801-production-cdn.allstarunion.com/hot... | 🇺🇸 AMAZON-02 | Request: Response: binary/octet-stream | ||
| October 4, 2025 at 09:34:25 | allstarunion.com p0202.ga.allstarunion.com/auth/reportevent | 🇺🇸 AMAZON-02 | Request: application/json Response: application/json | ||
| October 4, 2025 at 09:34:13 | allstarunion.com p0801-production-cdn.allstarunion.com/hot... | 🇺🇸 AMAZON-02 | Request: Response: binary/octet-stream | ||
| October 4, 2025 at 09:34:13 | allstarunion.com p0801-production-cdn.allstarunion.com/hot... | 🇺🇸 AMAZON-02 | Request: Response: binary/octet-stream | ||
| October 4, 2025 at 09:34:13 | allstarunion.com p0801-production-cdn.allstarunion.com/hot... | 🇺🇸 AMAZON-02 | Request: Response: binary/octet-stream | ||
| October 4, 2025 at 09:34:11 | AppsFlyer gcdsdk.appsflyersdk.com/install_data/v5.0 | 🇺🇸 AMAZON-02 | Request: application/json Response: application/json | ||
| October 4, 2025 at 09:34:14 | allstarunion.com p0202.ga.allstarunion.com/auth/reportevent | 🇺🇸 AMAZON-02 | Request: application/json Response: application/json | ||
| October 4, 2025 at 09:34:14 | allstarunion.com p0801-production-cdn.allstarunion.com/hot... | 🇺🇸 AMAZON-02 | Request: Response: binary/octet-stream | ||
| October 4, 2025 at 09:34:14 | allstarunion.com p0202.ga.allstarunion.com/auth/reportevent | 🇺🇸 AMAZON-02 | Request: application/json Response: application/json | ||
| October 4, 2025 at 09:34:14 | allstarunion.com p0801-production-cdn.allstarunion.com/hot... | 🇺🇸 AMAZON-02 | Request: Response: binary/octet-stream | ||
| October 4, 2025 at 09:34:14 | allstarunion.com p0202.ga.allstarunion.com/auth/reportevent | 🇺🇸 AMAZON-02 | Request: application/json Response: application/json |