urlscan.io logo urlscan.io
SecurityTrails logo

dcm.shivtr.com Open in urlscan Pro
45.33.21.148  Public Scan

Go To Rescan Add Verdict Report
URL: https://dcm.shivtr.com/forum_threads/3293455
Submission: On January 18 via manual from ID
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 11 IPs in 2 countries across 13 domains to perform 34 HTTP transactions. The main IP is 45.33.21.148, located in Dallas, United States and belongs to LINODE-AP Linode, LLC, US. The main domain is dcm.shivtr.com.
TLS certificate: Issued by R3 on January 1st 2021. Valid for: 3 months.
This is the only time dcm.shivtr.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

9    45.33.21.148 (Dallas, United States)

ASN63949 (LINODE-AP Linode, LLC, US)
PTR: li975-148.members.linode.com
dcm.shivtr.com
static.shivtr.com
1    23.111.9.57 (Phoenix, United States)

ASN33438 (HIGHWINDS2, US)
twemoji.maxcdn.com
10    2a00:1450:4001:801::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
pagead2.googlesyndication.com
adservice.google.de
adservice.google.com
googleads.g.doubleclick.net
www.googletagservices.com
2    52.216.152.110 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-1.amazonaws.com
s3.amazonaws.com
1    2600:1480:4000:e5:: (United States)

ASN33905 (AKAMAI-AMS, NL)
pbs.twimg.com
1    2a00:1450:4001:802::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
2    2a00:1450:4001:815::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
4    2a00:1450:4001:809::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
1    2a00:1450:4001:815::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
googleads.g.doubleclick.net
1    216.58.210.2 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: fra16s07-in-f2.1e100.net
partner.googleadservices.com
2    2a00:1450:4001:825::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
tpc.googlesyndication.com
Domain Requested by
7 static.shivtr.com dcm.shivtr.com
static.shivtr.com
5 pagead2.googlesyndication.com dcm.shivtr.com
pagead2.googlesyndication.com
4 fonts.gstatic.com fonts.googleapis.com
3 googleads.g.doubleclick.net pagead2.googlesyndication.com
2 tpc.googlesyndication.com pagead2.googlesyndication.com
tpc.googlesyndication.com
2 www.google-analytics.com dcm.shivtr.com
www.google-analytics.com
2 s3.amazonaws.com dcm.shivtr.com
static.shivtr.com
2 dcm.shivtr.com dcm.shivtr.com
1 www.googletagservices.com pagead2.googlesyndication.com
1 adservice.google.com pagead2.googlesyndication.com
1 adservice.google.de pagead2.googlesyndication.com
1 partner.googleadservices.com pagead2.googlesyndication.com
1 fonts.googleapis.com static.shivtr.com
1 pbs.twimg.com dcm.shivtr.com
1 twemoji.maxcdn.com dcm.shivtr.com
34 15

This site contains links to these domains. Also see Links.

Domain
www.okpal.com
shivtr.com
twitter.com
Subject Issuer Validity Valid
*.shivtr.com
R3		 2021-01-01 -
2021-04-01		 3 months crt.sh
twemoji.maxcdn.com
RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1		 2020-10-09 -
2021-11-09		 a year crt.sh
*.g.doubleclick.net
GTS CA 1O1		 2020-12-15 -
2021-03-09		 3 months crt.sh
s3.amazonaws.com
DigiCert Baltimore CA-2 G2		 2020-08-04 -
2021-08-09		 a year crt.sh
pbs.twimg.com
DigiCert SHA2 High Assurance Server CA		 2020-08-05 -
2021-08-10		 a year crt.sh
upload.video.google.com
GTS CA 1O1		 2020-12-15 -
2021-03-09		 3 months crt.sh
*.google-analytics.com
GTS CA 1O1		 2020-12-15 -
2021-03-09		 3 months crt.sh
*.gstatic.com
GTS CA 1O1		 2020-12-15 -
2021-03-09		 3 months crt.sh
*.googleadservices.com
GTS CA 1O1		 2020-12-15 -
2021-03-09		 3 months crt.sh
*.google.de
GTS CA 1O1		 2020-12-15 -
2021-03-09		 3 months crt.sh
*.google.com
GTS CA 1O1		 2020-12-15 -
2021-03-09		 3 months crt.sh
tpc.googlesyndication.com
GTS CA 1O1		 2020-12-15 -
2021-03-09		 3 months crt.sh

This page contains 5 frames:

Primary Page: https://dcm.shivtr.com/forum_threads/3293455
Frame ID: F9EC4A090DAAF396BA2BB91C1AF0D03C
Requests: 30 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20210112/r20190131/zrt_lookup.html
Frame ID: 08721FDF8FA3FCF24A8B92C3E0CDBE0A
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?guci=1.2.0.0.2.2.0.0&client=ca-pub-2367108048287515&output=html&adk=1812271804&adf=3025194257&lmt=1610986811&plat=1%3A32776%2C2%3A16809992%2C9%3A32776%2C10%3A32%2C11%3A32%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C40%3A32&format=0x0&url=https%3A%2F%2Fdcm.shivtr.com%2Fforum_threads%2F3293455&ea=0&flash=0&pra=5&wgl=1&dt=1610986811398&bpp=13&bdt=1034&idt=197&shv=r20210112&cbv=r20190131&ptt=9&saldr=aa&abxe=1&nras=1&correlator=3033230473865&frm=20&pv=2&ga_vid=1330882260.1610986812&ga_sid=1610986812&ga_hid=1867673623&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530672%2C21068769&oid=3&pvsid=441842281322571&pem=598&rx=0&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=8192&bc=31&ifi=0&uci=a!0&fsb=1&dtd=219
Frame ID: 774C6B845212DD079DAFB7E6326EAB18
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?guci=1.2.0.0.2.2.0.0&client=ca-pub-2367108048287515&output=html&h=90&slotname=2876344136&adk=4229348686&adf=4046715466&pi=t.ma~as.2876344136&w=728&lmt=1610986811&psa=0&format=728x90&url=https%3A%2F%2Fdcm.shivtr.com%2Fforum_threads%2F3293455&flash=0&wgl=1&dt=1610986811412&bpp=3&bdt=1048&idt=213&shv=r20210112&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=3033230473865&frm=20&pv=1&ga_vid=1330882260.1610986812&ga_sid=1610986812&ga_hid=1867673623&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=436&ady=237&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530672%2C21068769&oid=3&pvsid=441842281322571&pem=598&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=8192&bc=31&ifi=1&uci=a!1&fsb=1&xpc=Zj0hKBZjwR&p=https%3A//dcm.shivtr.com&dtd=218
Frame ID: 03FB7748431FD626326FB652B4B3D990
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/220/runner.html
Frame ID: D180121523965821BB4C47D6E89EC0C3
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

34
Requests

100 %
HTTPS

64 %
IPv6

13
Domains

15
Subdomains

11
IPs

2
Countries

987 kB
Transfer

1981 kB
Size

7
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

34 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request Cookie set 3293455
dcm.shivtr.com/forum_threads/ 		33 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://dcm.shivtr.com/forum_threads/3293455
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
45.33.21.148 Dallas, United States, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li975-148.members.linode.com
Software
nginx /
Resource Hash
497bdc1daf4f81bc90c9932fdc6dbc4882c821787ebf49a148ae8a0363bc4aef
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Host
dcm.shivtr.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Server
nginx
Date
Mon, 18 Jan 2021 16:20:10 GMT
Content-Type
text/html; charset=utf-8
Transfer-Encoding
chunked
Connection
keep-alive
Keep-Alive
timeout=25
Vary
Accept-Encoding
X-Frame-Options
SAMEORIGIN
X-XSS-Protection
1; mode=block
X-Content-Type-Options
nosniff
ETag
W/"497bdc1daf4f81bc90c9932fdc6dbc48"
Cache-Control
max-age=0, private, must-revalidate
Set-Cookie
site_game_id=175580; path=/ _shivtr_bakery=TTNVY1cwOXNIVmZBZVNlaWhmRnE3ODh0UVE3NEJwTDMzM2ZSMFM0NkZtekRoYjBPUG5LMkszNGtMQUQzQ2s0Y3M3MVRjNjloZXdPcWM4bktML3VnaWsrOXF5b3hHbjVaR2JNaTVGcm9OSjlIZ2gvQTI2ME1zK0ZtQUo0ODk3Z0EwMW5KSE1hcC9EM3B3c1RtNTFxWHdrbEp4UDMycjQ5NzgvWmdncGgwcGVSTjdqK256TkFOeHo5UWMzQmYvOTdoZVdoWXQvd2dxbjFhNTFFOGJMbWdlbkluM1NnMDA0ZEtkNU9jSXJnNHBTWjdod2JxaEpqUUcrR3V0dWhIczNSWHdNNzRIK010VE9QTFBseE50Y0Q3Z2dkd3pnQkY2VGg2TjBycytiUzJwczRSai9YR3luWWNNR3ZzYWF3TVZSZ09Fa0hsQjN4OFhRL0l1L3F4ejgyaHNRPT0tLUNPOTBuOGFFN3M3STN1cmNyQjRuZlE9PQ%3D%3D--a2694b1c0c9d92e8dac59a92e1a6fee92ab59d05; path=/; HttpOnly
X-Request-Id
7752de6e-e2e9-4535-8bae-03acf61b1c97
X-Runtime
0.215241
Content-Encoding
gzip
guild-79e744c44a0dcf82c7e667b73e1e4bcc3ad5421089fe9acebb6068086e703b82.css
static.shivtr.com/assets/manifests/ 		218 KB
35 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://static.shivtr.com/assets/manifests/guild-79e744c44a0dcf82c7e667b73e1e4bcc3ad5421089fe9acebb6068086e703b82.css
Requested by
Host: dcm.shivtr.com
URL: https://dcm.shivtr.com/forum_threads/3293455
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
45.33.21.148 Dallas, United States, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li975-148.members.linode.com
Software
nginx /
Resource Hash
3f90c6669df3f46cabe60a3b61daa85df115675d7b20bffc0bd95dd0ac6c80cc

Request headers

Referer
https://dcm.shivtr.com/forum_threads/3293455
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 18 Jan 2021 16:20:10 GMT
Content-Encoding
gzip
Server
nginx
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
max-age=31536000, public
Connection
keep-alive
Keep-Alive
timeout=25
Content-Length
35567
Expires
Tue, 18 Jan 2022 16:20:10 GMT
566664-1555346096.css
static.shivtr.com/css-cache/site_themes/ 		22 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://static.shivtr.com/css-cache/site_themes/566664-1555346096.css
Requested by
Host: dcm.shivtr.com
URL: https://dcm.shivtr.com/forum_threads/3293455
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
45.33.21.148 Dallas, United States, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li975-148.members.linode.com
Software
nginx /
Resource Hash
a32f65f7ea8161630acdbbc97dc48750d99f4e0fb11717d1b8fd00333ce6ab41

Request headers

Referer
https://dcm.shivtr.com/forum_threads/3293455
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 18 Jan 2021 16:20:10 GMT
Content-Encoding
gzip
Last-Modified
Mon, 22 Apr 2019 16:34:57 GMT
Server
nginx
ETag
W/"5cbded31-5769"
Vary
Accept-Encoding
Content-Type
text/css
Transfer-Encoding
chunked
Connection
keep-alive
Keep-Alive
timeout=25
guild-e6e5215e40d2a33d274c140ce0597a8633de523fead2ab8c46ec502f381eb304.js
static.shivtr.com/assets/ 		608 KB
158 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.shivtr.com/assets/guild-e6e5215e40d2a33d274c140ce0597a8633de523fead2ab8c46ec502f381eb304.js
Requested by
Host: dcm.shivtr.com
URL: https://dcm.shivtr.com/forum_threads/3293455
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
45.33.21.148 Dallas, United States, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li975-148.members.linode.com
Software
nginx /
Resource Hash
1dcb349b80875def2ee5087dda0859fc72a3f1a69780668727df9426761df7ad

Request headers

Referer
https://dcm.shivtr.com/forum_threads/3293455
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 18 Jan 2021 16:20:10 GMT
Content-Encoding
gzip
Server
nginx
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=31536000, public
Connection
keep-alive
Keep-Alive
timeout=25
Content-Length
161212
Expires
Tue, 18 Jan 2022 16:20:10 GMT
twemoji.min.js
twemoji.maxcdn.com/ 		15 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://twemoji.maxcdn.com/twemoji.min.js
Requested by
Host: dcm.shivtr.com
URL: https://dcm.shivtr.com/forum_threads/3293455
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.111.9.57 Phoenix, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software
NetDNA-cache/2.2 /
Resource Hash
637282f23b8352c04ecc9dd7b4e1ffb23f8102517d010afaa447b2fb889b689e

Request headers

Referer
https://dcm.shivtr.com/forum_threads/3293455
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fastly-request-id
1ba4b05dfff6c29d0d6888a5b45f9b4dee5fcd41
date
Mon, 18 Jan 2021 16:20:11 GMT
content-encoding
gzip
x-cache
HIT
powered-by
MaxCDN
last-modified
Fri, 17 Jul 2020 05:18:40 GMT
server
NetDNA-cache/2.2
x-github-request-id
5B30:44F6:1667D7:179E63:5FFDF3AC
etag
W/"5f1134b0-3bc8"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000
x-origin-cache
HIT
x-proxy-cache
MISS
expires
Wed, 17 Feb 2021 16:20:11 GMT
adsbygoogle.js
pagead2.googlesyndication.com/pagead/js/ 		133 KB
47 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Requested by
Host: dcm.shivtr.com
URL: https://dcm.shivtr.com/forum_threads/3293455
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
affb90a9db41ce467b2865015aef28d0e14c1a57b9fe14eed6f68698a03c9bc8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://dcm.shivtr.com/forum_threads/3293455
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 18 Jan 2021 16:20:11 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
47568
x-xss-protection
0
server
cafe
etag
12333406099156550822
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Mon, 18 Jan 2021 16:20:11 GMT
177837.png
s3.amazonaws.com/s3.mmoguildsites.com/s3/favicons/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s3.amazonaws.com/s3.mmoguildsites.com/s3/favicons/177837.png?1508187779
Requested by
Host: dcm.shivtr.com
URL: https://dcm.shivtr.com/forum_threads/3293455
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.216.152.110 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
77244f6cea82d5ace2dffbd5d42729ed6ead29d159a0f6dd05fc6423bed585cf

Request headers

Referer
https://dcm.shivtr.com/forum_threads/3293455
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 18 Jan 2021 16:20:12 GMT
Last-Modified
Mon, 16 Oct 2017 21:03:01 GMT
Server
AmazonS3
x-amz-request-id
C835164B9CADA0E0
ETag
"a731dea707bcb6a8b47c871cb28d3535"
Content-Type
image/png
Accept-Ranges
bytes
Content-Length
1247
x-amz-id-2
ufJryYIYvw8GSxHkGxMmUWOid4qq3VD2Jw7sA3D8wuZc+4bWlMYBJScEp/csEeYBcmHoTYdDLsQ=
home-86c06c5c4747bb6da8d7594ed31b1494459d202ba31ede706bf8f741acedc9b3.png
static.shivtr.com/assets/mobile/toolbar/ 		250 B
533 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.shivtr.com/assets/mobile/toolbar/home-86c06c5c4747bb6da8d7594ed31b1494459d202ba31ede706bf8f741acedc9b3.png
Requested by
Host: dcm.shivtr.com
URL: https://dcm.shivtr.com/forum_threads/3293455
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
45.33.21.148 Dallas, United States, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li975-148.members.linode.com
Software
nginx /
Resource Hash
86c06c5c4747bb6da8d7594ed31b1494459d202ba31ede706bf8f741acedc9b3

Request headers

Referer
https://dcm.shivtr.com/forum_threads/3293455
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 18 Jan 2021 16:20:11 GMT
Server
nginx
Content-Type
image/png
Cache-Control
max-age=31536000, public
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=25
Content-Length
250
Expires
Tue, 18 Jan 2022 16:20:11 GMT
game_class_photo.png
static.shivtr.com/s3/missing/ 		189 B
443 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.shivtr.com/s3/missing/game_class_photo.png
Requested by
Host: dcm.shivtr.com
URL: https://dcm.shivtr.com/forum_threads/3293455
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
45.33.21.148 Dallas, United States, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li975-148.members.linode.com
Software
nginx /
Resource Hash
593f6dcee5b29180c9930ec3a72ce7c79d8f46ec8f1442bbbb503333677865f7

Request headers

Referer
https://dcm.shivtr.com/forum_threads/3293455
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 18 Jan 2021 16:20:11 GMT
Last-Modified
Wed, 03 Apr 2019 16:44:12 GMT
Server
nginx
ETag
"5ca4e2dc-bd"
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=25
Content-Length
189
pixel-5fb3bdb7f966c852579fb6b0574517445d5b2d171c804d66227ee67b1bffca9c.gif
static.shivtr.com/assets/graphics/ 		68 B
350 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.shivtr.com/assets/graphics/pixel-5fb3bdb7f966c852579fb6b0574517445d5b2d171c804d66227ee67b1bffca9c.gif
Requested by
Host: dcm.shivtr.com
URL: https://dcm.shivtr.com/forum_threads/3293455
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
45.33.21.148 Dallas, United States, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li975-148.members.linode.com
Software
nginx /
Resource Hash
5fb3bdb7f966c852579fb6b0574517445d5b2d171c804d66227ee67b1bffca9c

Request headers

Referer
https://dcm.shivtr.com/forum_threads/3293455
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 18 Jan 2021 16:20:11 GMT
Server
nginx
Content-Type
image/gif
Cache-Control
max-age=31536000, public
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=25
Content-Length
68
Expires
Tue, 18 Jan 2022 16:20:11 GMT
NZJ-1l12_normal.jpeg
pbs.twimg.com/profile_images/466608098304475136/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pbs.twimg.com/profile_images/466608098304475136/NZJ-1l12_normal.jpeg
Requested by
Host: dcm.shivtr.com
URL: https://dcm.shivtr.com/forum_threads/3293455
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:1480:4000:e5:: , United States, ASN33905 (AKAMAI-AMS, NL),
Reverse DNS
Software
tsa_b /
Resource Hash
4d8da549f9a0294e587b7251553d334267979ed79aded20a387f1a22e64cc773
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

Referer
https://dcm.shivtr.com/forum_threads/3293455
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=631138519
x-content-type-options
nosniff
x-client-network
EIP
x-cache
"HIT"
server-timing
x-cache;"HIT", x-tw-cdn;"AK"
content-length
1503
x-response-time
22
last-modified
Wed, 14 May 2014 15:54:54 GMT
server
tsa_b
date
Mon, 18 Jan 2021 16:20:11 GMT
x-tw-cdn
"AK"
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
max-age=604800, must-revalidate
x-connection-hash
1e80aaa295825f62b2a7fb08f4eb8fc4
akamai-request-bc
[a=2.20.189.175,b=112116966,c=g,n=DE_HE_FRANKFURT,o=20940],[c=p,n=DE_HE_FRANKFURT,o=20940]
css
fonts.googleapis.com/ 		3 KB
697 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Play:400,700
Requested by
Host: static.shivtr.com
URL: https://static.shivtr.com/css-cache/site_themes/566664-1555346096.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
dfcf2359586fdb6d88b39330943273d7ebf839186091dd514be0dea46dbd0add
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://static.shivtr.com/css-cache/site_themes/566664-1555346096.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Mon, 18 Jan 2021 16:13:18 GMT
server
ESF
date
Mon, 18 Jan 2021 16:20:10 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Mon, 18 Jan 2021 16:20:10 GMT
analytics.js
www.google-analytics.com/ 		46 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: dcm.shivtr.com
URL: https://dcm.shivtr.com/forum_threads/3293455
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://dcm.shivtr.com/forum_threads/3293455
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 23 Oct 2020 03:00:57 GMT
server
Golfe2
age
3639
date
Mon, 18 Jan 2021 15:19:32 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
18817
expires
Mon, 18 Jan 2021 17:19:32 GMT
3658092.jpg
s3.amazonaws.com/cloudfront.shivtr.com/theme_images/ 		524 KB
525 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s3.amazonaws.com/cloudfront.shivtr.com/theme_images/3658092.jpg?1508190910
Requested by
Host: static.shivtr.com
URL: https://static.shivtr.com/css-cache/site_themes/566664-1555346096.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.216.152.110 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
7908b9cec5a2135a668f5d768fc59fc3d78fdaf38d5edc3ba04fa5562312d6a0

Request headers

Referer
https://static.shivtr.com/css-cache/site_themes/566664-1555346096.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 18 Jan 2021 16:20:12 GMT
Last-Modified
Mon, 16 Oct 2017 21:55:11 GMT
Server
AmazonS3
x-amz-request-id
DX4T3WEP7Q0J7VAW
ETag
"dfec4523b9a5fcbd677bc661694b8869"
x-amz-version-id
Dt6XEg1ipTAjM_7RtZWumtObjOexZU4k
Cache-Control
max-age=864000
Accept-Ranges
bytes
Content-Type
image/jpeg
Content-Length
537083
x-amz-id-2
DdOYJb2iuf6r0zgtzMq8Ilu0eP4vA06VdyomujhdJRXiM96wtxFbd6+09UADA5Tx0RYY0zJ42GY=
Expires
Sun, 14 Jan 2018 14:30:19 GMT
6aez4K2oVqwIvtU2H70Q13E.woff2
fonts.gstatic.com/s/play/v12/ 		10 KB
10 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/play/v12/6aez4K2oVqwIvtU2H70Q13E.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Play:400,700
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
4b3d88249f5f8cd1e145faa051534685b784434fa8147299eb02a9609290fe71
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://dcm.shivtr.com
Referer
https://fonts.googleapis.com/css?family=Play:400,700
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 12 Jan 2021 22:37:32 GMT
x-content-type-options
nosniff
last-modified
Tue, 01 Sep 2020 03:49:44 GMT
server
sffe
age
495759
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
9988
x-xss-protection
0
expires
Wed, 12 Jan 2022 22:37:32 GMT
6aez4K2oVqwIvts2H70Q13HqPA.woff2
fonts.gstatic.com/s/play/v12/ 		6 KB
6 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/play/v12/6aez4K2oVqwIvts2H70Q13HqPA.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Play:400,700
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f0cda17591d41f9cf677d78aea4e191548e95fe637331df10c30c5dc9717c8c9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://dcm.shivtr.com
Referer
https://fonts.googleapis.com/css?family=Play:400,700
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 13 Jan 2021 00:26:48 GMT
x-content-type-options
nosniff
last-modified
Tue, 01 Sep 2020 03:49:42 GMT
server
sffe
age
489203
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6484
x-xss-protection
0
expires
Thu, 13 Jan 2022 00:26:48 GMT
show_ads_impl_fy2019.js
pagead2.googlesyndication.com/pagead/js/r20210112/r20190131/ 		226 KB
85 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20210112/r20190131/show_ads_impl_fy2019.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
520c3f5772ade6af389a5cfb08534bbd6dbdaaa68bc2cac9de395efc800f243e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://dcm.shivtr.com/forum_threads/3293455
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 18 Jan 2021 16:20:11 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
86268
x-xss-protection
0
server
cafe
etag
7753973667244452840
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=1209600
timing-allow-origin
*
expires
Mon, 18 Jan 2021 16:20:11 GMT
zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20210112/r20190131/ Frame 0872 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/html/r20210112/r20190131/zrt_lookup.html
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/html/r20210112/r20190131/zrt_lookup.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://dcm.shivtr.com/forum_threads/3293455
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://dcm.shivtr.com/forum_threads/3293455

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
vary
Accept-Encoding
date
Mon, 18 Jan 2021 11:17:30 GMT
expires
Mon, 01 Feb 2021 11:17:30 GMT
content-type
text/html; charset=UTF-8
etag
12197657918578843409
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
4751
x-xss-protection
0
age
18161
cache-control
public, max-age=1209600
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
member_avatar_original.png
dcm.shivtr.com/s3/missing/ 		9 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dcm.shivtr.com/s3/missing/member_avatar_original.png
Requested by
Host: dcm.shivtr.com
URL: https://dcm.shivtr.com/forum_threads/3293455
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
45.33.21.148 Dallas, United States, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li975-148.members.linode.com
Software
nginx /
Resource Hash
08e1b7e4bd3b2660b44cf8fc796cce00b259e3517e0293096dca67305c55e074

Request headers

Referer
https://dcm.shivtr.com/forum_threads/3293455
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 18 Jan 2021 16:20:11 GMT
Last-Modified
Wed, 03 Apr 2019 16:44:12 GMT
Server
nginx
ETag
"5ca4e2dc-2494"
Content-Type
image/png
Cache-Control
max-age=315360000
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=25
Content-Length
9364
Expires
Thu, 31 Dec 2037 23:55:55 GMT
Noci12-3a1bbd03003833a6dfbcc82556fe57bb353c3b7480bfdd133a055b315207a5cc.woff
static.shivtr.com/assets/ 		13 KB
13 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://static.shivtr.com/assets/Noci12-3a1bbd03003833a6dfbcc82556fe57bb353c3b7480bfdd133a055b315207a5cc.woff
Requested by
Host: static.shivtr.com
URL: https://static.shivtr.com/assets/manifests/guild-79e744c44a0dcf82c7e667b73e1e4bcc3ad5421089fe9acebb6068086e703b82.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
45.33.21.148 Dallas, United States, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li975-148.members.linode.com
Software
nginx /
Resource Hash
3a1bbd03003833a6dfbcc82556fe57bb353c3b7480bfdd133a055b315207a5cc

Request headers

Origin
https://dcm.shivtr.com
Referer
https://static.shivtr.com/assets/manifests/guild-79e744c44a0dcf82c7e667b73e1e4bcc3ad5421089fe9acebb6068086e703b82.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 18 Jan 2021 16:20:11 GMT
Last-Modified
Wed, 03 Apr 2019 16:44:11 GMT
Server
nginx
ETag
"5ca4e2db-3414"
Content-Type
application/font-woff
Access-Control-Allow-Origin
*
Cache-Control
max-age=31536000
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=25
Content-Length
13332
Expires
Tue, 18 Jan 2022 16:20:11 GMT
6ae84K2oVqwItm4TCpAy2lvQNTI.woff2
fonts.gstatic.com/s/play/v12/ 		10 KB
10 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/play/v12/6ae84K2oVqwItm4TCpAy2lvQNTI.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Play:400,700
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
940c14c9d24e05484c79b01c7bea21a92c72e361428e791671e99a41f46afa36
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://dcm.shivtr.com
Referer
https://fonts.googleapis.com/css?family=Play:400,700
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 14 Jan 2021 21:19:10 GMT
x-content-type-options
nosniff
last-modified
Tue, 01 Sep 2020 03:49:47 GMT
server
sffe
age
327661
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
9960
x-xss-protection
0
expires
Fri, 14 Jan 2022 21:19:10 GMT
6aez4K2oVqwIvto2H70Q13HqPA.woff2
fonts.gstatic.com/s/play/v12/ 		3 KB
3 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/play/v12/6aez4K2oVqwIvto2H70Q13HqPA.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Play:400,700
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
fca7764891cfa1f4dbc23bc69463eca11c3a68ff1802024396d9d0f7d99f580a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://dcm.shivtr.com
Referer
https://fonts.googleapis.com/css?family=Play:400,700
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 13 Jan 2021 15:18:07 GMT
x-content-type-options
nosniff
last-modified
Tue, 01 Sep 2020 03:49:39 GMT
server
sffe
age
435724
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
3380
x-xss-protection
0
expires
Thu, 13 Jan 2022 15:18:07 GMT
collect
www.google-analytics.com/j/ 		2 B
387 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j87&a=1867673623&t=pageview&_s=1&dl=https%3A%2F%2Fdcm.shivtr.com%2Fforum_threads%2F3293455&ul=en-us&de=UTF-8&dt=watch-nomadland-full-movie-online-for-free%20%7C%20%7C%7C%7CxDCMx%7C%7C%7C&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAAC~&jid=1963330677&gjid=1478468484&cid=1330882260.1610986812&tid=UA-178078-11&_gid=737050905.1610986812&_r=1&_slc=1&z=183025887
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:815::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://dcm.shivtr.com/forum_threads/3293455
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Mon, 18 Jan 2021 16:20:11 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://dcm.shivtr.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
cookie.js
partner.googleadservices.com/gampad/ 		200 B
640 B 		Script
General
Check archive.org
Download Go to
Full URL
https://partner.googleadservices.com/gampad/cookie.js?domain=dcm.shivtr.com&callback=_gfp_s_&client=ca-pub-2367108048287515
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20210112/r20190131/show_ads_impl_fy2019.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s07-in-f2.1e100.net
Software
cafe /
Resource Hash
2e163132e9562233da3a22b2cbb7a5c0ae90bf21e8262bf15bf486fa39314857
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://dcm.shivtr.com/forum_threads/3293455
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 18 Jan 2021 16:20:11 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type
text/javascript; charset=UTF-8
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
192
x-xss-protection
0
integrator.js
adservice.google.de/adsid/ 		109 B
803 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.de/adsid/integrator.js?domain=dcm.shivtr.com
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20210112/r20190131/show_ads_impl_fy2019.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://dcm.shivtr.com/forum_threads/3293455
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Mon, 18 Jan 2021 16:20:11 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
104
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ 		109 B
803 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=dcm.shivtr.com
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20210112/r20190131/show_ads_impl_fy2019.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://dcm.shivtr.com/forum_threads/3293455
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Mon, 18 Jan 2021 16:20:11 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
104
x-xss-protection
0
gen_204
pagead2.googlesyndication.com/pagead/ 		0
88 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=ach_evt&url=https%3A%2F%2Fdcm.shivtr.com%2Fforum_threads%2F3293455&tn=DIV&id=status_bar_position&ign=false
Requested by
Host: dcm.shivtr.com
URL: https://dcm.shivtr.com/forum_threads/3293455
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://dcm.shivtr.com/forum_threads/3293455
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 18 Jan 2021 16:20:11 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ads
googleads.g.doubleclick.net/pagead/ Frame 774C 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/ads?guci=1.2.0.0.2.2.0.0&client=ca-pub-2367108048287515&output=html&adk=1812271804&adf=3025194257&lmt=1610986811&plat=1%3A32776%2C2%3A16809992%2C9%3A32776%2C10%3A32%2C11%3A32%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C40%3A32&format=0x0&url=https%3A%2F%2Fdcm.shivtr.com%2Fforum_threads%2F3293455&ea=0&flash=0&pra=5&wgl=1&dt=1610986811398&bpp=13&bdt=1034&idt=197&shv=r20210112&cbv=r20190131&ptt=9&saldr=aa&abxe=1&nras=1&correlator=3033230473865&frm=20&pv=2&ga_vid=1330882260.1610986812&ga_sid=1610986812&ga_hid=1867673623&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530672%2C21068769&oid=3&pvsid=441842281322571&pem=598&rx=0&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=8192&bc=31&ifi=0&uci=a!0&fsb=1&dtd=219
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20210112/r20190131/show_ads_impl_fy2019.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?guci=1.2.0.0.2.2.0.0&client=ca-pub-2367108048287515&output=html&adk=1812271804&adf=3025194257&lmt=1610986811&plat=1%3A32776%2C2%3A16809992%2C9%3A32776%2C10%3A32%2C11%3A32%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C40%3A32&format=0x0&url=https%3A%2F%2Fdcm.shivtr.com%2Fforum_threads%2F3293455&ea=0&flash=0&pra=5&wgl=1&dt=1610986811398&bpp=13&bdt=1034&idt=197&shv=r20210112&cbv=r20190131&ptt=9&saldr=aa&abxe=1&nras=1&correlator=3033230473865&frm=20&pv=2&ga_vid=1330882260.1610986812&ga_sid=1610986812&ga_hid=1867673623&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530672%2C21068769&oid=3&pvsid=441842281322571&pem=598&rx=0&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=8192&bc=31&ifi=0&uci=a!0&fsb=1&dtd=219
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://dcm.shivtr.com/forum_threads/3293455
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://dcm.shivtr.com/forum_threads/3293455

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Mon, 18 Jan 2021 16:20:11 GMT
server
cafe
content-length
4094
x-xss-protection
0
set-cookie
test_cookie=CheckForPermission; expires=Mon, 18-Jan-2021 16:35:11 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
expires
Mon, 18 Jan 2021 16:20:11 GMT
cache-control
private
osd.js
www.googletagservices.com/activeview/js/current/ 		73 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20210112/r20190131/show_ads_impl_fy2019.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
080da30aa445e67edb9fa3673bf91badd76a12ec0457d3d4d098bf48f62dc7cf
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://dcm.shivtr.com/forum_threads/3293455
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 18 Jan 2021 16:20:11 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1610714114181599"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
28294
x-xss-protection
0
expires
Mon, 18 Jan 2021 16:20:11 GMT
ads
googleads.g.doubleclick.net/pagead/ Frame 03FB 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/ads?guci=1.2.0.0.2.2.0.0&client=ca-pub-2367108048287515&output=html&h=90&slotname=2876344136&adk=4229348686&adf=4046715466&pi=t.ma~as.2876344136&w=728&lmt=1610986811&psa=0&format=728x90&url=https%3A%2F%2Fdcm.shivtr.com%2Fforum_threads%2F3293455&flash=0&wgl=1&dt=1610986811412&bpp=3&bdt=1048&idt=213&shv=r20210112&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=3033230473865&frm=20&pv=1&ga_vid=1330882260.1610986812&ga_sid=1610986812&ga_hid=1867673623&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=436&ady=237&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530672%2C21068769&oid=3&pvsid=441842281322571&pem=598&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=8192&bc=31&ifi=1&uci=a!1&fsb=1&xpc=Zj0hKBZjwR&p=https%3A//dcm.shivtr.com&dtd=218
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20210112/r20190131/show_ads_impl_fy2019.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?guci=1.2.0.0.2.2.0.0&client=ca-pub-2367108048287515&output=html&h=90&slotname=2876344136&adk=4229348686&adf=4046715466&pi=t.ma~as.2876344136&w=728&lmt=1610986811&psa=0&format=728x90&url=https%3A%2F%2Fdcm.shivtr.com%2Fforum_threads%2F3293455&flash=0&wgl=1&dt=1610986811412&bpp=3&bdt=1048&idt=213&shv=r20210112&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=3033230473865&frm=20&pv=1&ga_vid=1330882260.1610986812&ga_sid=1610986812&ga_hid=1867673623&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=436&ady=237&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530672%2C21068769&oid=3&pvsid=441842281322571&pem=598&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=8192&bc=31&ifi=1&uci=a!1&fsb=1&xpc=Zj0hKBZjwR&p=https%3A//dcm.shivtr.com&dtd=218
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://dcm.shivtr.com/forum_threads/3293455
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://dcm.shivtr.com/forum_threads/3293455

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Mon, 18 Jan 2021 16:20:11 GMT
server
cafe
content-length
204
x-xss-protection
0
set-cookie
test_cookie=CheckForPermission; expires=Mon, 18-Jan-2021 16:35:11 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
expires
Mon, 18 Jan 2021 16:20:11 GMT
cache-control
private
sodar
pagead2.googlesyndication.com/getconfig/ 		9 KB
7 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20210112&st=env
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20210112/r20190131/show_ads_impl_fy2019.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
4cf234c0c79c959875746abcbe19db89c5d55512979ea45017cb3ed0ba17ecd4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://dcm.shivtr.com/forum_threads/3293455
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Mon, 18 Jan 2021 16:20:12 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
6651
x-xss-protection
0
sodar2.js
tpc.googlesyndication.com/sodar/ 		16 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20210112/r20190131/show_ads_impl_fy2019.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:825::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
baf04ff369a96d4bb7228e99a65163de20845bf23826295dd3471afd3cee9ee5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://dcm.shivtr.com/forum_threads/3293455
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 18 Jan 2021 16:20:12 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1607463675096825"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6146
x-xss-protection
0
expires
Mon, 18 Jan 2021 16:20:12 GMT
runner.html
tpc.googlesyndication.com/sodar/sodar2/220/ Frame D180 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/220/runner.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:825::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
tpc.googlesyndication.com
:scheme
https
:path
/sodar/sodar2/220/runner.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://dcm.shivtr.com/forum_threads/3293455
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://dcm.shivtr.com/forum_threads/3293455

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
content-length
4868
date
Mon, 18 Jan 2021 16:07:49 GMT
expires
Tue, 18 Jan 2022 16:07:49 GMT
last-modified
Tue, 27 Oct 2020 18:37:37 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
743
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
gen_204
pagead2.googlesyndication.com/pagead/ 		0
46 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=220&t=2&li=gda_r20210112&jk=441842281322571&bg=!TE-lTwzNAAWtJAQVrTsAKQB2-DxaOuh_b5JmjVhfbUsjxuuacK7mfq8xnTURljL-YwTn3OzROv8dAgAAAFhSAAAAEGgBBwoBAzIxeF15vLKUSM0PpEVCZJeYtwhnrUsVVIKt0yPOY3SweuncvflJD3rA8DdM7Od3og7r_Z4r9LlUpGhlZDp5DDjU05Oa6b287Dfrl5EewXbGv1pUcLuv5QhTtaCZjDmsFbm6uOtg0ihH9-D1o4oyVpvZnYQjaa68UMtCvjg_J3Af6kFA8PnzNXZ9OXuAB9PA53Svc9zNW_uN4SbHiEFWphKS8Z38txN53exHc7lQGN6JBKwJ3NfUt4ytYbovERi9oGF8vFo4fhP4I4xnRTFFb0-Oi7951Om5bOwK1GY6Z7AvcfFRbOYI_Yn9ov1L7vO_NTDs35Cl4n90pz_2HxbyUOkRLauZAdhYZ8oKhbAHnIUPKfBOMhRLSNxQQdDW9HZZZlEsCWQzAuggPXTEstnY0773Dr379zpwxt3bA9hetdF58EvCRuG3MNgvLeQ0nYkzJGT5LstGLvge8Mh0R7vQWT_zig5Pmn3dkdUMWj1smttU0-LXuwEBUhS2HNcCcgCMF2X1-Lu7R8klDwwIhlfqIn7mUvY7J-COJpG6gSdDcnJw0YcPq2vfWv-wmsvum52UeRTh7ppXcwpuemdTR3De-lzNhX1UDyOuEviHHBh26WyrRrVvSZblANwHvqHWuzgNscjBRBuWrkTvTgHgqm7F4k9wztZoNOQe3IvyNR4_s0JmnicUmKrJvicVuxIN3E00rlq0s-kooZaZAMNNr0kb3VwByXiGOioTXUtA9W2C4HW6-rujF2onxf2vcNpkPAqEqJUV1z5oKvEQynvbRIq6CoSStLj1K7GsfOgGXujucOX9Psn-I_2uwXSGisttWhlI_A5bgrCcTYh35zQCXWY2qxNDuppnX4JtBy3rocHvR3et2QNXTPZwH2gClLfiFMtu3fMN9jPmvpb8mke-XnbEJ67381isD3h5GW4hpqzfGUXE__dRqu4pee7oxZibioEKM8MeeiL2xrKbFsNHFNLQ
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://dcm.shivtr.com/forum_threads/3293455
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 18 Jan 2021 16:20:12 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

98 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| setCookie function| getCookie function| deleteCookie function| bbcodeHelp function| getVideoParam function| centerModals function| get_time_difference_in_minutes function| get_local_time_for_date function| distance_of_time_in_words object| Duration object| TZTime function| $ function| jQuery object| jQuery112404346999703132308 function| tmpl object| App function| _ function| Class function| Picker object| hopscotch object| bbcodeSettings object| bbcodeSimpleSettings function| positionFooter object| AionItem object| Gw2Item object| RomItem object| VindictusItem object| WowItem object| ClassicItem object| ItemTooltip object| Shivtip object| MainTooltip object| ProgressionTooltip function| Chat object| ChatEmotes function| ChatMessage function| Pusher function| WhosOnline object| twemoji string| GoogleAnalyticsObject function| ga object| adsbygoogle object| google_js_reporting_queue number| google_srt object| google_ad_modifications object| google_logging_queue object| ggeac boolean| google_measure_js_timing object| google_trust_token_operation_status object| google_reactive_ads_global_state boolean| _gfp_a_ object| google_sa_queue object| google_sl_win function| google_process_slots function| google_spfd object| google_sv_map number| google_lpabyc number| google_unique_id object| miuScript object| google_tag_data object| gaplugins object| gaGlobal object| gaData function| Goog_AdSense_getAdAdapterInstance function| Goog_AdSense_OsdAdapter function| google_sa_impl object| google_persistent_state_async object| __google_ad_urls number| google_global_correlator number| __google_ad_urls_id object| googleToken object| googleIMState boolean| _gfp_p_ object| google_image_requests function| processGoogleToken object| google_prev_clients object| google_jobrunner object| ampInaboxIframes object| ampInaboxPendingMessages boolean| google_osd_loaded boolean| google_onload_fired function| Goog_Osd_UnloadAdBlock function| Goog_Osd_UpdateElementToMeasure function| google_osd_amcb object| GoogleGcLKhOms

7 Cookies

Domain/Path Name / Value
.shivtr.com/ Name: __gads
Value: ID=1dfae5def460fc6d-223a200796b9006f:T=1610986811:RT=1610986811:S=ALNI_MZbYJnfySzyaEVcjgtyRYHZpcTjaQ
dcm.shivtr.com/ Name: site_game_id
Value: 175580
.shivtr.com/ Name: _gat
Value: 1
.shivtr.com/ Name: _gid
Value: GA1.2.737050905.1610986812
.shivtr.com/ Name: _ga
Value: GA1.2.1330882260.1610986812
.doubleclick.net/ Name: test_cookie
Value: CheckForPermission
dcm.shivtr.com/ Name: _shivtr_bakery
Value: TTNVY1cwOXNIVmZBZVNlaWhmRnE3ODh0UVE3NEJwTDMzM2ZSMFM0NkZtekRoYjBPUG5LMkszNGtMQUQzQ2s0Y3M3MVRjNjloZXdPcWM4bktML3VnaWsrOXF5b3hHbjVaR2JNaTVGcm9OSjlIZ2gvQTI2ME1zK0ZtQUo0ODk3Z0EwMW5KSE1hcC9EM3B3c1RtNTFxWHdrbEp4UDMycjQ5NzgvWmdncGgwcGVSTjdqK256TkFOeHo5UWMzQmYvOTdoZVdoWXQvd2dxbjFhNTFFOGJMbWdlbkluM1NnMDA0ZEtkNU9jSXJnNHBTWjdod2JxaEpqUUcrR3V0dWhIczNSWHdNNzRIK010VE9QTFBseE50Y0Q3Z2dkd3pnQkY2VGg2TjBycytiUzJwczRSai9YR3luWWNNR3ZzYWF3TVZSZ09Fa0hsQjN4OFhRL0l1L3F4ejgyaHNRPT0tLUNPOTBuOGFFN3M3STN1cmNyQjRuZlE9PQ%3D%3D--a2694b1c0c9d92e8dac59a92e1a6fee92ab59d05

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

adservice.google.com
adservice.google.de
dcm.shivtr.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
pagead2.googlesyndication.com
partner.googleadservices.com
pbs.twimg.com
s3.amazonaws.com
static.shivtr.com
tpc.googlesyndication.com
twemoji.maxcdn.com
www.google-analytics.com
www.googletagservices.com
216.58.210.2
23.111.9.57
2600:1480:4000:e5::
2a00:1450:4001:801::2002
2a00:1450:4001:802::200a
2a00:1450:4001:809::2003
2a00:1450:4001:815::2002
2a00:1450:4001:815::200e
2a00:1450:4001:825::2001
45.33.21.148
52.216.152.110
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
080da30aa445e67edb9fa3673bf91badd76a12ec0457d3d4d098bf48f62dc7cf
08e1b7e4bd3b2660b44cf8fc796cce00b259e3517e0293096dca67305c55e074
1dcb349b80875def2ee5087dda0859fc72a3f1a69780668727df9426761df7ad
2e163132e9562233da3a22b2cbb7a5c0ae90bf21e8262bf15bf486fa39314857
3a1bbd03003833a6dfbcc82556fe57bb353c3b7480bfdd133a055b315207a5cc
3f90c6669df3f46cabe60a3b61daa85df115675d7b20bffc0bd95dd0ac6c80cc
497bdc1daf4f81bc90c9932fdc6dbc4882c821787ebf49a148ae8a0363bc4aef
4b3d88249f5f8cd1e145faa051534685b784434fa8147299eb02a9609290fe71
4cf234c0c79c959875746abcbe19db89c5d55512979ea45017cb3ed0ba17ecd4
4d8da549f9a0294e587b7251553d334267979ed79aded20a387f1a22e64cc773
520c3f5772ade6af389a5cfb08534bbd6dbdaaa68bc2cac9de395efc800f243e
593f6dcee5b29180c9930ec3a72ce7c79d8f46ec8f1442bbbb503333677865f7
5fb3bdb7f966c852579fb6b0574517445d5b2d171c804d66227ee67b1bffca9c
637282f23b8352c04ecc9dd7b4e1ffb23f8102517d010afaa447b2fb889b689e
77244f6cea82d5ace2dffbd5d42729ed6ead29d159a0f6dd05fc6423bed585cf
7908b9cec5a2135a668f5d768fc59fc3d78fdaf38d5edc3ba04fa5562312d6a0
86c06c5c4747bb6da8d7594ed31b1494459d202ba31ede706bf8f741acedc9b3
940c14c9d24e05484c79b01c7bea21a92c72e361428e791671e99a41f46afa36
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
a32f65f7ea8161630acdbbc97dc48750d99f4e0fb11717d1b8fd00333ce6ab41
affb90a9db41ce467b2865015aef28d0e14c1a57b9fe14eed6f68698a03c9bc8
baf04ff369a96d4bb7228e99a65163de20845bf23826295dd3471afd3cee9ee5
dfcf2359586fdb6d88b39330943273d7ebf839186091dd514be0dea46dbd0add
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b
f0cda17591d41f9cf677d78aea4e191548e95fe637331df10c30c5dc9717c8c9
fca7764891cfa1f4dbc23bc69463eca11c3a68ff1802024396d9d0f7d99f580a