urlscan.io logo urlscan.io
SecurityTrails logo

coronavirusworkfromhomenow.com Open in urlscan Pro
162.255.119.69  Public Scan

Go To Rescan Add Verdict Report
URL: http://coronavirusworkfromhomenow.com/
Submission Tags: falconsandbox
Submission: On May 21 via api from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 12 IPs in 3 countries across 11 domains to perform 29 HTTP transactions. The main IP is 162.255.119.69, located in United States and belongs to NAMECHEAP-NET, US. The main domain is coronavirusworkfromhomenow.com.
This is the only time coronavirusworkfromhomenow.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 162.255.119.69 22612 (NAMECHEAP...)
1 9 2606:4700::68... 13335 (CLOUDFLAR...)
2 23.111.9.35 33438 (HIGHWINDS2)
2 2a00:1450:400... 15169 (GOOGLE)
1 199.116.252.223 46549 (GVO)
1 2606:4700::68... 13335 (CLOUDFLAR...)
5 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
4 2a00:1450:400... 15169 (GOOGLE)
1 52.209.199.113 16509 (AMAZON-02)
1 151.101.114.110 54113 (FASTLY)
2 162.247.243.146 23467 (NEWRELIC-...)
29 12
1    162.255.119.69 (United States)

ASN22612 (NAMECHEAP-NET, US)
coronavirusworkfromhomenow.com
9    2606:4700::6810:10c2 (United States)

ASN13335 (CLOUDFLARENET, US)
www.showmetheshift.com
2    23.111.9.35 (United States)

ASN33438 (HIGHWINDS2, US)
use.fontawesome.com
2    2a00:1450:4001:82f::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
1    199.116.252.223 (United States)

ASN46549 (GVO, US)
PTR: gvo252223.gvodatacenter.com
gogvo.com
1    2606:4700::6810:cc2 (United States)

ASN13335 (CLOUDFLARENET, US)
assets.clickfunnels.com
5    2606:4700::6810:dc2 (United States)

ASN13335 (CLOUDFLARENET, US)
app.clickfunnels.com
1    2606:4700::6810:5e41 (United States)

ASN13335 (CLOUDFLARENET, US)
static.cloudflareinsights.com
4    2a00:1450:4001:802::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
1    52.209.199.113 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-209-199-113.eu-west-1.compute.amazonaws.com
track.addevent.com
1    151.101.114.110 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)
js-agent.newrelic.com
2    162.247.243.146 (United States)

ASN23467 (NEWRELIC-AS-1, US)
bam-cell.nr-data.net
Domain Requested by
9 www.showmetheshift.com 1 redirects coronavirusworkfromhomenow.com
www.showmetheshift.com
static.cloudflareinsights.com
5 app.clickfunnels.com www.showmetheshift.com
4 fonts.gstatic.com fonts.googleapis.com
2 bam-cell.nr-data.net js-agent.newrelic.com
2 fonts.googleapis.com www.showmetheshift.com
2 use.fontawesome.com www.showmetheshift.com
1 js-agent.newrelic.com www.showmetheshift.com
1 track.addevent.com www.showmetheshift.com
1 static.cloudflareinsights.com www.showmetheshift.com
1 assets.clickfunnels.com www.showmetheshift.com
1 gogvo.com www.showmetheshift.com
1 coronavirusworkfromhomenow.com
29 12

This site contains no links.

Subject Issuer Validity Valid
www.showmetheshift.com
Cloudflare Inc ECC CA-3		 2020-07-21 -
2021-07-21		 a year crt.sh
*.fontawesome.com
DigiCert TLS RSA SHA256 2020 CA1		 2020-11-13 -
2021-12-14		 a year crt.sh
upload.video.google.com
GTS CA 1O1		 2021-05-03 -
2021-07-26		 3 months crt.sh
*.gogvo.com
Sectigo RSA Domain Validation Secure Server CA		 2020-05-31 -
2021-08-29		 a year crt.sh
ssl566619.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2		 2021-04-06 -
2021-10-13		 6 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2020-07-11 -
2021-07-11		 a year crt.sh
*.google.com
GTS CA 1O1		 2021-05-03 -
2021-07-26		 3 months crt.sh
addevent.com
Amazon		 2021-02-25 -
2022-03-26		 a year crt.sh
f4.shared.global.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3		 2021-05-21 -
2022-04-10		 a year crt.sh
*.nr-data.net
DigiCert SHA2 Secure Server CA		 2020-02-05 -
2022-02-08		 2 years crt.sh

This page contains 2 frames:

Primary Page: http://coronavirusworkfromhomenow.com/
Frame ID: 98E1412965E3564B076CF2FA5DAE961A
Requests: 1 HTTP requests in this frame

Frame: https://www.showmetheshift.com/ean
Frame ID: 070AB7A05EFE72E076FDC7D997D3AF3B
Requests: 28 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

29
Requests

97 %
HTTPS

50 %
IPv6

11
Domains

12
Subdomains

12
IPs

3
Countries

531 kB
Transfer

1791 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://www.showmetheshift.com/ HTTP 302
  • https://www.showmetheshift.com/ean

29 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
coronavirusworkfromhomenow.com/ 		884 B
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://coronavirusworkfromhomenow.com/
Protocol
HTTP/1.1
Server
162.255.119.69 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
Software
nginx /
Resource Hash
b34cdc06d442631103c10c047034b7892b957fe3b7da32ff89c561c67af19cab

Request headers

Host
coronavirusworkfromhomenow.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Server
nginx
Date
Fri, 21 May 2021 22:02:53 GMT
Content-Type
text/html; charset=utf-8
Content-Length
884
Connection
keep-alive
X-Served-By
Namecheap URL Forward
ean
www.showmetheshift.com/ Frame 070A
Redirect Chain
  • https://www.showmetheshift.com/
  • https://www.showmetheshift.com/ean
62 KB
15 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.showmetheshift.com/ean
Requested by
Host: coronavirusworkfromhomenow.com
URL: http://coronavirusworkfromhomenow.com/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:10c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Phusion Passenger Enterprise 6.0.7
Resource Hash
040ddb9e2004b42eb4b95a39300911d5f3c3c3040d8239e55d35342c6125490b
Security Headers
Name Value
Strict-Transport-Security max-age=0
X-Frame-Options ALLOWALL

Request headers

:method
GET
:authority
www.showmetheshift.com
:scheme
https
:path
/ean
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
frame
referer
http://coronavirusworkfromhomenow.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
__cf_bm=0a735b0f206d8116dbb5aa91c8709b072bcfe562-1621634574-1800-AVDIUq6CWsi9r1shN1OScJ/68FtxBWgunJHNEdeKojgB4kbTr6Eh2TMdbfgTziITVLxrhYOkk+ATYqzVSRPObHxWtnwTwjbXcT4RGzlzgJ3d
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
http://coronavirusworkfromhomenow.com/

Response headers

date
Fri, 21 May 2021 22:02:54 GMT
content-type
text/html; charset=utf-8
set-cookie
__cfduid=d357e0fcb3cd7bd14131d52c8578348d51621634574; expires=Sun, 20-Jun-21 22:02:54 GMT; path=/; domain=.www.showmetheshift.com; HttpOnly; SameSite=Lax
cf-ray
6531177a1a054aaa-FRA
access-control-allow-origin
*
cache-control
max-age=60, public, s-maxage=600, r-maxage=10
last-modified
Fri, 09 Oct 2020 02:00:30 GMT
strict-transport-security
max-age=0
vary
Accept-Encoding
cf-cache-status
MISS
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods
GET, PUT, POST, DELETE, PATCH, OPTIONS
cf-request-id
0a328d005400004aaaf38cd000000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
status
200 OK
x-content-digest
ccc7fe92f101fe5be187da1e32d904b300d938b7
x-frame-options
ALLOWALL
x-powered-by
Phusion Passenger Enterprise 6.0.7
x-rack-cache
stale, valid, store
x-request-id
4730a77d2dd3cff9b5cc98edf11ba479
x-runtime
0.423691
server
cloudflare
content-encoding
br

Redirect headers

date
Fri, 21 May 2021 22:02:54 GMT
content-type
text/html; charset=utf-8
set-cookie
__cfduid=d357e0fcb3cd7bd14131d52c8578348d51621634574; expires=Sun, 20-Jun-21 22:02:54 GMT; path=/; domain=.www.showmetheshift.com; HttpOnly; SameSite=Lax __cf_bm=0a735b0f206d8116dbb5aa91c8709b072bcfe562-1621634574-1800-AVDIUq6CWsi9r1shN1OScJ/68FtxBWgunJHNEdeKojgB4kbTr6Eh2TMdbfgTziITVLxrhYOkk+ATYqzVSRPObHxWtnwTwjbXcT4RGzlzgJ3d; path=/; expires=Fri, 21-May-21 22:32:54 GMT; domain=.www.showmetheshift.com; HttpOnly; Secure; SameSite=None
location
https://www.showmetheshift.com/ean
cf-ray
65311777ad344aaa-FRA
access-control-allow-origin
*
cache-control
no-cache, no-store
strict-transport-security
max-age=0
vary
Accept-Encoding
cf-cache-status
BYPASS
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods
GET, PUT, POST, DELETE, PATCH, OPTIONS
access-control-request-method
*
cf-request-id
0a328cfece00004aaa25a50000000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
pragma
no-cache
status
302 Found
x-frame-options
ALLOWALL
x-powered-by
Phusion Passenger Enterprise 6.0.7
x-rack-cache
miss
x-request-id
381ab3b0701bff79747178eec8372bfa
x-runtime
0.228163
server
cloudflare
lander.css
www.showmetheshift.com/assets/ Frame 070A 		425 KB
65 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.showmetheshift.com/assets/lander.css
Requested by
Host: www.showmetheshift.com
URL: https://www.showmetheshift.com/ean
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:10c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
da352a7b4c5780eb6b96891c48bc403337bb3baaf7ad20674f0311e7988f75fb
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Referer
https://www.showmetheshift.com/ean
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 21 May 2021 22:02:54 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
1170
cf-request-id
0a328d014500004aaa32884000000001
last-modified
Thu, 20 May 2021 19:43:17 GMT
server
cloudflare
etag
W/"60a6bbd5-6a51b"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=0
access-control-allow-methods
GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=1200
access-control-allow-credentials
true
cf-ray
6531177bad404aaa-FRA
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
expires
Fri, 21 May 2021 22:22:54 GMT
all.css
use.fontawesome.com/releases/v5.9.0/css/ Frame 070A 		55 KB
14 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://use.fontawesome.com/releases/v5.9.0/css/all.css
Requested by
Host: www.showmetheshift.com
URL: https://www.showmetheshift.com/ean
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.111.9.35 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software
NetDNA-cache/2.2 /
Resource Hash
533143d96607d94d5d4292838e364aef656d3de58fe74368263776eab9c07542

Request headers

Referer
https://www.showmetheshift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 21 May 2021 22:02:54 GMT
content-encoding
gzip
last-modified
Tue, 04 Jun 2019 20:35:33 GMT
server
NetDNA-cache/2.2
etag
W/"dbf9d822cefe851ba6f66e1ad57e8987"
vary
Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods
GET
content-type
text/css
access-control-allow-origin
*
access-control-max-age
3000
cache-control
max-age=31556926
x-cache
HIT
v4-shims.css
use.fontawesome.com/releases/v5.9.0/css/ Frame 070A 		26 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://use.fontawesome.com/releases/v5.9.0/css/v4-shims.css
Requested by
Host: www.showmetheshift.com
URL: https://www.showmetheshift.com/ean
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.111.9.35 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software
NetDNA-cache/2.2 /
Resource Hash
0d1c5ba4b29db42dadf61f9e7304331fa835fe732bbb02822ada17a9a63c215f

Request headers

Referer
https://www.showmetheshift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 21 May 2021 22:02:54 GMT
content-encoding
gzip
last-modified
Tue, 04 Jun 2019 20:35:35 GMT
server
NetDNA-cache/2.2
etag
W/"e140a7d32f343530f016095df3cc2ae4"
vary
Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods
GET
content-type
text/css
access-control-allow-origin
*
access-control-max-age
3000
cache-control
max-age=31556926
x-cache
HIT
css
fonts.googleapis.com/ Frame 070A 		44 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Open+Sans:400,700%7COswald:400,700%7CDroid+Sans:400,700%7CRoboto:400,700%7CLato:400,700%7CPT+Sans:400,700%7CSource+Sans+Pro:400,600,700%7CNoto+Sans:400,700%7CPT+Sans:400,700%7CUbuntu:400,700%7CBitter:400,700%7CPT+Serif:400,700%7CRokkitt:400,700%7CDroid+Serif:400,700%7CRaleway:400,700%7CInconsolata:400,700
Requested by
Host: www.showmetheshift.com
URL: https://www.showmetheshift.com/ean
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
f76553e0cbb772f7113a3814491ae325e271355e87985e7e4754a8bb75b7dcb4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.showmetheshift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Fri, 21 May 2021 21:52:34 GMT
server
ESF
date
Fri, 21 May 2021 22:02:54 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 21 May 2021 22:02:54 GMT
application.js
www.showmetheshift.com/assets/userevents/ Frame 070A 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.showmetheshift.com/assets/userevents/application.js
Requested by
Host: www.showmetheshift.com
URL: https://www.showmetheshift.com/ean
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:10c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
004e3565fa58bd4ff0cbf31deb5451508a5ec7d46c4480f9bfa23326f187a158
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Referer
https://www.showmetheshift.com/ean
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 21 May 2021 22:02:54 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
1169
cf-request-id
0a328d014600004aaa02bbd000000001
last-modified
Thu, 20 May 2021 19:43:17 GMT
server
cloudflare
etag
W/"60a6bbd5-1353"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=0
access-control-allow-methods
GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
public, max-age=1200
access-control-allow-credentials
true
cf-ray
6531177bad424aaa-FRA
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
expires
Fri, 21 May 2021 22:22:54 GMT
show_form.php
gogvo.com/ Frame 070A 		43 B
379 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://gogvo.com/show_form.php?id=21047410
Requested by
Host: www.showmetheshift.com
URL: https://www.showmetheshift.com/ean
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.116.252.223 , United States, ASN46549 (GVO, US),
Reverse DNS
gvo252223.gvodatacenter.com
Software
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips /
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Referer
https://www.showmetheshift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Fri, 21 May 2021 22:02:55 GMT
Server
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips
P3P
policyref="https://gogvo.com/w3c/p3p.xml", CP="ALL DSP TAIa PSAa PSDa OUR IND UNI COM NAV STA OTC"
Cache-control
private
Connection
Keep-Alive
Content-Type
image/gif
Keep-Alive
timeout=3, max=50
Content-Length
43
closemodal.png
assets.clickfunnels.com/images/ Frame 070A 		672 B
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://assets.clickfunnels.com/images/closemodal.png
Requested by
Host: www.showmetheshift.com
URL: https://www.showmetheshift.com/ean
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:cc2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5216f197f782f4bb872e02a677986af90a488015910f8d3864b796ad68dbd389
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Referer
https://www.showmetheshift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 21 May 2021 22:02:54 GMT
vary
Accept, Accept-Encoding
cf-cache-status
HIT
age
166995
cf-polished
origFmt=png, origSize=788
content-disposition
inline; filename="closemodal.webp"
content-length
672
cf-request-id
0a328d01b000002bd22e92e000000001
last-modified
Tue, 18 May 2021 22:00:36 GMT
server
cloudflare
etag
"60a43904-314"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=0
access-control-allow-methods
GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type
image/webp
access-control-allow-origin
*
expires
Mon, 21 Jun 2021 22:02:54 GMT
cache-control
public, max-age=2678400
access-control-allow-credentials
true
accept-ranges
bytes
cf-ray
6531177c4e162bd2-FRA
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
cf-bgj
imgq:100,h2pri,csam-hash
RedDownArrow.gif
www.showmetheshift.com/hosted/images/90/b13b70564011e8923bbfd19afa32a1/ Frame 070A 		20 KB
20 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.showmetheshift.com/hosted/images/90/b13b70564011e8923bbfd19afa32a1/RedDownArrow.gif
Requested by
Host: www.showmetheshift.com
URL: https://www.showmetheshift.com/ean
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:10c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
20c984df5d294a7cd631e7355493caac2427738d383c3080373529df70a34780

Request headers

Referer
https://www.showmetheshift.com/ean
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 21 May 2021 22:02:54 GMT
cf-cache-status
REVALIDATED
x-amz-cf-pop
FRA50-C1
cf-polished
status=not_needed
content-length
20547
cf-request-id
0a328d019000004aaa602d0000000001
last-modified
Sat, 12 May 2018 23:59:56 GMT
server
cloudflare
etag
"76a78d85b53ee84ce53f2ec66fe2e087"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept, Accept-Encoding
content-type
image/gif
cache-control
max-age=31536000
accept-ranges
bytes
cf-ray
6531177c1e374aaa-FRA
cf-bgj
imgq:85,h2pri,csam-hash
css
fonts.googleapis.com/ Frame 070A 		2 KB
537 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Helvetica+Neue+Helvetica+Arial+sans-serif%7CPassion+One%7CPoppins%7CLato%7Csans-serif%7CLato%7CPoppins%7CLato%7C%7C
Requested by
Host: www.showmetheshift.com
URL: https://www.showmetheshift.com/ean
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
61c66c2684531e8f8f9b9cf33e32aef52adf69151948cf8858530082c542c472
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.showmetheshift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Fri, 21 May 2021 22:02:54 GMT
server
ESF
date
Fri, 21 May 2021 22:02:54 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 21 May 2021 22:02:54 GMT
lander.js
www.showmetheshift.com/assets/ Frame 070A 		985 KB
274 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.showmetheshift.com/assets/lander.js
Requested by
Host: www.showmetheshift.com
URL: https://www.showmetheshift.com/ean
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:10c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b0bbc1c51f2c71cb8dfdeefa681bdc8a0c678d8d94cfbb211d9f48e8175e6706
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Referer
https://www.showmetheshift.com/ean
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 21 May 2021 22:02:54 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
1170
cf-request-id
0a328d018500004aaa3398b000000001
last-modified
Thu, 20 May 2021 19:43:17 GMT
server
cloudflare
etag
W/"60a6bbd5-f6452"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=0
access-control-allow-methods
GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
public, max-age=1200
access-control-allow-credentials
true
cf-ray
6531177c0e0c4aaa-FRA
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
expires
Fri, 21 May 2021 22:22:54 GMT
mailcheck.min.js
app.clickfunnels.com/ Frame 070A 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://app.clickfunnels.com/mailcheck.min.js
Requested by
Host: www.showmetheshift.com
URL: https://www.showmetheshift.com/ean
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:dc2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e0189e16cf01f8149342c9f2de872cfa73571f2a145a830f18b16154bf1d2982
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Referer
https://www.showmetheshift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 21 May 2021 22:02:54 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
21
cf-request-id
0a328d01a20000325ccd8be000000001
last-modified
Thu, 20 May 2021 19:43:17 GMT
server
cloudflare
etag
W/"60a6bbd5-a8d"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=0
access-control-allow-methods
GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type
application/x-javascript
access-control-allow-origin
*
access-control-allow-credentials
true
cf-ray
6531177c3c58325c-FRA
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
pushcrew.js
app.clickfunnels.com/assets/ Frame 070A 		637 B
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://app.clickfunnels.com/assets/pushcrew.js
Requested by
Host: www.showmetheshift.com
URL: https://www.showmetheshift.com/ean
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:dc2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f7464960133d530dfa52ce0ab9a5c33f0a709a946ad16298b000a7560738f422
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Referer
https://www.showmetheshift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 21 May 2021 22:02:54 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
1174
cf-request-id
0a328d01a20000325c94284000000001
last-modified
Thu, 20 May 2021 19:43:16 GMT
server
cloudflare
etag
W/"60a6bbd4-27d"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=0
access-control-allow-methods
GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
public, max-age=1200
access-control-allow-credentials
true
cf-ray
6531177c3c59325c-FRA
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
expires
Fri, 21 May 2021 22:22:54 GMT
beacon.min.js
static.cloudflareinsights.com/ Frame 070A 		13 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.cloudflareinsights.com/beacon.min.js
Requested by
Host: www.showmetheshift.com
URL: https://www.showmetheshift.com/ean
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5e41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
198eedf9d8a1ad8d85e2d631ea8667a47a66b7ce838847359045beb4e8f3a635

Request headers

Referer
https://www.showmetheshift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 21 May 2021 22:02:54 GMT
content-encoding
gzip
last-modified
Thu, 20 May 2021 23:53:29 GMT
server
cloudflare
etag
W/"edaab647-ad35-4f09-a18c-7588cff79e00"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
cf-ray
6531177c395a4e9e-FRA
cf-request-id
0a328d01a000004e9e0e990000000001
ButtonCircle.png
www.showmetheshift.com/hosted/images/83/ea66e0537b11e8a1b2b70d43e2bd08/ Frame 070A 		41 KB
41 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.showmetheshift.com/hosted/images/83/ea66e0537b11e8a1b2b70d43e2bd08/ButtonCircle.png
Requested by
Host: www.showmetheshift.com
URL: https://www.showmetheshift.com/ean
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:10c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
20338eb2257cce3af7d172b4a55f9a7c83f8cb9830bc79effb05451836cee8b3

Request headers

Referer
https://www.showmetheshift.com/ean
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 21 May 2021 22:02:54 GMT
cf-cache-status
HIT
age
955
cf-polished
origSize=41811
content-length
41639
cf-request-id
0a328d019e00004aaa5f905000000001
last-modified
Wed, 09 May 2018 11:24:21 GMT
server
cloudflare
etag
"c04d7f490582473be040b53164d77ff6"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept, Accept-Encoding
content-type
image/png
cache-control
max-age=31536000
x-amz-cf-pop
FRA56-C1
accept-ranges
bytes
cf-ray
6531177c3e6b4aaa-FRA
cf-bgj
imgq:85,h2pri,csam-hash
S6u9w4BMUTPHh6UVSwiPGQ.woff2
fonts.gstatic.com/s/lato/v17/ Frame 070A 		22 KB
23 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/lato/v17/S6u9w4BMUTPHh6UVSwiPGQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:400,700%7COswald:400,700%7CDroid+Sans:400,700%7CRoboto:400,700%7CLato:400,700%7CPT+Sans:400,700%7CSource+Sans+Pro:400,600,700%7CNoto+Sans:400,700%7CPT+Sans:400,700%7CUbuntu:400,700%7CBitter:400,700%7CPT+Serif:400,700%7CRokkitt:400,700%7CDroid+Serif:400,700%7CRaleway:400,700%7CInconsolata:400,700
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
8d3ca80fa271e94b0c36cf3053b0f806b7a42bb3395b424c99dc0bd218f0ac20
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://www.showmetheshift.com
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 18 May 2021 01:32:03 GMT
x-content-type-options
nosniff
last-modified
Tue, 15 Sep 2020 18:12:12 GMT
server
sffe
age
333051
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
22992
x-xss-protection
0
expires
Wed, 18 May 2022 01:32:03 GMT
S6uyw4BMUTPHjx4wXg.woff2
fonts.gstatic.com/s/lato/v17/ Frame 070A 		23 KB
23 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/lato/v17/S6uyw4BMUTPHjx4wXg.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:400,700%7COswald:400,700%7CDroid+Sans:400,700%7CRoboto:400,700%7CLato:400,700%7CPT+Sans:400,700%7CSource+Sans+Pro:400,600,700%7CNoto+Sans:400,700%7CPT+Sans:400,700%7CUbuntu:400,700%7CBitter:400,700%7CPT+Serif:400,700%7CRokkitt:400,700%7CDroid+Serif:400,700%7CRaleway:400,700%7CInconsolata:400,700
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c3c0d3f472358aac78455515c4800771426770c22698e2486d39fdb5505634e1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://www.showmetheshift.com
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 20 May 2021 15:44:07 GMT
x-content-type-options
nosniff
last-modified
Tue, 15 Sep 2020 18:10:46 GMT
server
sffe
age
109127
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
23484
x-xss-protection
0
expires
Fri, 20 May 2022 15:44:07 GMT
PbynFmL8HhTPqbjUzux3JEuR9ls.woff2
fonts.gstatic.com/s/passionone/v11/ Frame 070A 		7 KB
7 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/passionone/v11/PbynFmL8HhTPqbjUzux3JEuR9ls.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Helvetica+Neue+Helvetica+Arial+sans-serif%7CPassion+One%7CPoppins%7CLato%7Csans-serif%7CLato%7CPoppins%7CLato%7C%7C
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
99c1949864ce5857840e26e8f83d0e782eda8032acd8c7f4ee602cb1a16e07ed
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://www.showmetheshift.com
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 20 May 2021 10:20:37 GMT
x-content-type-options
nosniff
last-modified
Tue, 01 Sep 2020 03:49:08 GMT
server
sffe
age
128537
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7528
x-xss-protection
0
expires
Fri, 20 May 2022 10:20:37 GMT
pxiEyp8kv8JHgFVrJJfecg.woff2
fonts.gstatic.com/s/poppins/v15/ Frame 070A 		8 KB
8 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/poppins/v15/pxiEyp8kv8JHgFVrJJfecg.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Helvetica+Neue+Helvetica+Arial+sans-serif%7CPassion+One%7CPoppins%7CLato%7Csans-serif%7CLato%7CPoppins%7CLato%7C%7C
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
41e46faff74c6a77d581689ec35eb040f6c96d17f4d2c5b25dccd42ed498b01c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://www.showmetheshift.com
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 20 May 2021 15:43:44 GMT
x-content-type-options
nosniff
last-modified
Thu, 05 Nov 2020 22:02:01 GMT
server
sffe
age
109150
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7900
x-xss-protection
0
expires
Fri, 20 May 2022 15:43:44 GMT
vendor.js
www.showmetheshift.com/ Frame 070A 		18 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.showmetheshift.com/vendor.js
Requested by
Host: www.showmetheshift.com
URL: https://www.showmetheshift.com/ean
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:10c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Phusion Passenger Enterprise 6.0.7
Resource Hash
7422e50efbaea439fda7ef3b0eb54ee1a9fe73ea2f919d78a33bf6fb9e3e059d
Security Headers
Name Value
Strict-Transport-Security max-age=0
X-Frame-Options ALLOWALL

Request headers

Referer
https://www.showmetheshift.com/ean
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 21 May 2021 22:02:55 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
MISS
x-powered-by
Phusion Passenger Enterprise 6.0.7
status
200 OK
cf-request-id
0a328d02a200004aaaed87f000000001
x-request-id
b633e4d13bf926c28365b0d12b3b4075
x-runtime
0.026704
x-content-digest
581e49c9b7bdd06dab54c00931f4256b223e620e
server
cloudflare
x-frame-options
ALLOWALL
etag
W/"7422e50efbaea439fda7ef3b0eb54ee1"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=0
access-control-allow-methods
GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=900, public
access-control-allow-credentials
true
cf-ray
6531177dc9974aaa-FRA
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache
miss, store
/
app.clickfunnels.com/userevents/ Frame 070A 		0
327 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://app.clickfunnels.com/userevents/?funnel_id=aFhMOHZxM0xSV1F6Vnl5ZEZYcnVOdz09LS1na2lKTWQ3R1QvcEZNYkp6ZWhjSlVRPT0%3D--1de1217b6b9ce60c58b29cbf7cc71fd8eb968a5a&page_id=eHlWcndXemRJVlNQODhYYlVWRTJ2dz09LS1JYTBjODh1eldRTkdSb3dLSis3aHFRPT0%3D--bea6721d256154ee3a15e3d8127eba2f40bad4b1&funnel_step_id=bjhMNkVDQWQ4N3JYand0cUNDMjRnUT09LS1xU1F2NHlLZHBZUzFkRndqUi84bGt3PT0%3D--61b3a7af9a375c2d29acb1833ed5e088fb9c6dd0&user_id=cjZSV1BHazBoSGo2VVpxU3kvdUl6dz09LS1qQUliVkVsTSszTWNlenhoYm45VDZ3PT0%3D--1728df67e4d0993dece7ce73c53433950b39ea78&account_id=SzdkRlNMMGgzK1dZM09vY1VmYVhrdz09LS1LUEkyZmJSSFN6aXhOSzJmNXovZVF3PT0%3D--8a484d685e787a8cdb72d3a294d4629ca58dd3f6&page_code=NDEyODY3NzA%3D&mode_id=1&time_zone=Eastern%20Time%20(US%20%26%20Canada)&app_domain=app.clickfunnels.com&aff_sub2=&aff_sub3=&aff_sub=&affiliate_id=&cf_affiliate_id=&content=&medium=&name=&source=&term=&client_width=1600&type=Userevents::PageviewsCreatedSummary&nonce=b6ea654b-c8f1-465c-aa44-8de55eec2198&url=https%3A%2F%2Fwww.showmetheshift.com%2Fean
Requested by
Host: www.showmetheshift.com
URL: https://www.showmetheshift.com/assets/userevents/application.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:dc2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Phusion Passenger Enterprise 6.0.7
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=0
X-Frame-Options ALLOWALL

Request headers

Referer
https://www.showmetheshift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 21 May 2021 22:02:55 GMT
access-control-request-method
*
vary
Accept-Encoding
cf-cache-status
BYPASS
access-control-allow-origin
*
x-powered-by
Phusion Passenger Enterprise 6.0.7
status
202 Accepted
cf-request-id
0a328d02b8000006107c028000000001
x-request-id
786e84b1714fc8304183b3b409226c1b
x-runtime
0.032759
server
cloudflare
x-frame-options
ALLOWALL
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=0
access-control-allow-methods
GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type
text/html
pragma
no-cache
cache-control
no-cache, no-store
access-control-allow-credentials
true
cf-ray
6531177dfb060610-FRA
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache
miss
/
app.clickfunnels.com/userevents/ Frame 070A 		0
951 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://app.clickfunnels.com/userevents/?funnel_id=aFhMOHZxM0xSV1F6Vnl5ZEZYcnVOdz09LS1na2lKTWQ3R1QvcEZNYkp6ZWhjSlVRPT0%3D--1de1217b6b9ce60c58b29cbf7cc71fd8eb968a5a&page_id=eHlWcndXemRJVlNQODhYYlVWRTJ2dz09LS1JYTBjODh1eldRTkdSb3dLSis3aHFRPT0%3D--bea6721d256154ee3a15e3d8127eba2f40bad4b1&funnel_step_id=bjhMNkVDQWQ4N3JYand0cUNDMjRnUT09LS1xU1F2NHlLZHBZUzFkRndqUi84bGt3PT0%3D--61b3a7af9a375c2d29acb1833ed5e088fb9c6dd0&user_id=cjZSV1BHazBoSGo2VVpxU3kvdUl6dz09LS1qQUliVkVsTSszTWNlenhoYm45VDZ3PT0%3D--1728df67e4d0993dece7ce73c53433950b39ea78&account_id=SzdkRlNMMGgzK1dZM09vY1VmYVhrdz09LS1LUEkyZmJSSFN6aXhOSzJmNXovZVF3PT0%3D--8a484d685e787a8cdb72d3a294d4629ca58dd3f6&page_code=NDEyODY3NzA%3D&mode_id=1&time_zone=Eastern%20Time%20(US%20%26%20Canada)&app_domain=app.clickfunnels.com&aff_sub2=&aff_sub3=&aff_sub=&affiliate_id=&cf_affiliate_id=&content=&medium=&name=&source=&term=&client_width=1600&type=Userevents::UniquePageviewsCreatedSummary&nonce=ee906171-21cd-4715-95fd-540979a8206a&url=https%3A%2F%2Fwww.showmetheshift.com%2Fean
Requested by
Host: www.showmetheshift.com
URL: https://www.showmetheshift.com/assets/userevents/application.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:dc2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Phusion Passenger Enterprise 6.0.7
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=0
X-Frame-Options ALLOWALL

Request headers

Referer
https://www.showmetheshift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 21 May 2021 22:02:55 GMT
access-control-request-method
*
vary
Accept-Encoding
cf-cache-status
BYPASS
access-control-allow-origin
*
x-powered-by
Phusion Passenger Enterprise 6.0.7
status
202 Accepted
cf-request-id
0a328d02b8000006105587d000000001
x-request-id
a57f50567448285d9f621f760e782144
x-runtime
0.035912
server
cloudflare
x-frame-options
ALLOWALL
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=0
access-control-allow-methods
GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type
text/html
pragma
no-cache
cache-control
no-cache, no-store
access-control-allow-credentials
true
cf-ray
6531177dfb090610-FRA
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache
miss
/
app.clickfunnels.com/userevents/ Frame 070A 		0
330 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://app.clickfunnels.com/userevents/?funnel_id=aFhMOHZxM0xSV1F6Vnl5ZEZYcnVOdz09LS1na2lKTWQ3R1QvcEZNYkp6ZWhjSlVRPT0%3D--1de1217b6b9ce60c58b29cbf7cc71fd8eb968a5a&page_id=eHlWcndXemRJVlNQODhYYlVWRTJ2dz09LS1JYTBjODh1eldRTkdSb3dLSis3aHFRPT0%3D--bea6721d256154ee3a15e3d8127eba2f40bad4b1&funnel_step_id=bjhMNkVDQWQ4N3JYand0cUNDMjRnUT09LS1xU1F2NHlLZHBZUzFkRndqUi84bGt3PT0%3D--61b3a7af9a375c2d29acb1833ed5e088fb9c6dd0&user_id=cjZSV1BHazBoSGo2VVpxU3kvdUl6dz09LS1qQUliVkVsTSszTWNlenhoYm45VDZ3PT0%3D--1728df67e4d0993dece7ce73c53433950b39ea78&account_id=SzdkRlNMMGgzK1dZM09vY1VmYVhrdz09LS1LUEkyZmJSSFN6aXhOSzJmNXovZVF3PT0%3D--8a484d685e787a8cdb72d3a294d4629ca58dd3f6&page_code=NDEyODY3NzA%3D&mode_id=1&time_zone=Eastern%20Time%20(US%20%26%20Canada)&app_domain=app.clickfunnels.com&aff_sub2=&aff_sub3=&aff_sub=&affiliate_id=&cf_affiliate_id=&content=&medium=&name=&source=&term=&client_width=1600&type=Userevents::UniqueVisitorsCreatedSummary&nonce=dd432153-b12b-4ee3-bef0-a843a2d9fa90&url=https%3A%2F%2Fwww.showmetheshift.com%2Fean
Requested by
Host: www.showmetheshift.com
URL: https://www.showmetheshift.com/assets/userevents/application.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:dc2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Phusion Passenger Enterprise 6.0.7
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=0
X-Frame-Options ALLOWALL

Request headers

Referer
https://www.showmetheshift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 21 May 2021 22:02:55 GMT
access-control-request-method
*
vary
Accept-Encoding
cf-cache-status
BYPASS
access-control-allow-origin
*
x-powered-by
Phusion Passenger Enterprise 6.0.7
status
202 Accepted
cf-request-id
0a328d02bb0000061088bba000000001
x-request-id
9bc60ae7e73813ae3dc1369c5e11d54d
x-runtime
0.058408
server
cloudflare
x-frame-options
ALLOWALL
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=0
access-control-allow-methods
GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type
text/html
pragma
no-cache
cache-control
no-cache, no-store
access-control-allow-credentials
true
cf-ray
6531177dfb0b0610-FRA
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache
miss
/
track.addevent.com/atc/ Frame 070A 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://track.addevent.com/atc/?trktyp=jsinit&trkcal=&guid=9ea61d52-5941-4962-b783-cd5a04d567ca&url=https%3A%2F%2Fwww.showmetheshift.com%2Fean&cache=1621634575072
Requested by
Host: www.showmetheshift.com
URL: https://www.showmetheshift.com/ean
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.209.199.113 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-209-199-113.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.showmetheshift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, X-Access-Token
Access-Control-Allow-Methods
PUT, GET, POST, DELETE, OPTIONS
nr-1208.min.js
js-agent.newrelic.com/ Frame 070A 		31 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js-agent.newrelic.com/nr-1208.min.js
Requested by
Host: www.showmetheshift.com
URL: https://www.showmetheshift.com/ean
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.110 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
4014ca31d3c8e768608a40ed160a405ae39836a5b2c43f256bee3bdf427dd67f

Request headers

Referer
https://www.showmetheshift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id
RGJXhnJ2IqU3nLrOoxetOoKLCG4kx4sX
content-encoding
gzip
etag
"1a71e4208296f97b465116492f59124d"
x-amz-request-id
YWFD5VP0NXCFHMHP
x-cache
HIT
content-length
11777
x-amz-id-2
FRVHmwo8mdruVdPv7pyPypSHnRIMq13jpejLIyL3OIeoNqYK7sfcuB1+9+zOGtSfLRIs4Ah4xsc=
x-served-by
cache-hhn4047-HHN
last-modified
Wed, 10 Mar 2021 16:24:28 GMT
server
AmazonS3
x-timer
S1621634575.468277,VS0,VE0
date
Fri, 21 May 2021 22:02:55 GMT
vary
Accept-Encoding
content-type
application/javascript
via
1.1 varnish
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
11362
rum
www.showmetheshift.com/cdn-cgi/ Frame 070A 		0
182 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.showmetheshift.com/cdn-cgi/rum?req_id=6531177a1a054aaa
Requested by
Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:10c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Referer
https://www.showmetheshift.com/ean
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
content-type
application/json

Response headers

date
Fri, 21 May 2021 22:02:55 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cloudflare
x-frame-options
DENY
access-control-allow-methods
POST,OPTIONS
content-type
text/plain
access-control-allow-origin
https://www.showmetheshift.com
access-control-max-age
86400
access-control-allow-credentials
true
cf-ray
65311780afec4aaa-FRA
vary
Origin
NRJS-fc902efb332119fff33
bam-cell.nr-data.net/1/ Frame 070A 		49 B
920 B 		Script
General
Check archive.org
Download Go to
Full URL
https://bam-cell.nr-data.net/1/NRJS-fc902efb332119fff33?a=367981416&v=1208.49599aa&to=dFZWTENWVQ9QExdNRlJLSFlWXEpMRQBfXUYYSU1aXVBKC1AF&rst=1508&ck=1&ref=https://www.showmetheshift.com/ean&ap=430&be=692&fe=1483&dc=1042&perf=%7B%22timing%22:%7B%22of%22:1621634573971,%22n%22:0,%22r%22:1,%22re%22:449,%22f%22:449,%22dn%22:449,%22dne%22:449,%22c%22:449,%22ce%22:449,%22rq%22:449,%22rp%22:684,%22rpe%22:688,%22dl%22:686,%22di%22:1040,%22ds%22:1041,%22de%22:1103,%22dc%22:1482,%22l%22:1482,%22le%22:1489%7D,%22navigation%22:%7B%22rc%22:1%7D%7D&fp=854&fcp=854&jsonp=NREUM.setToken
Requested by
Host: js-agent.newrelic.com
URL: https://js-agent.newrelic.com/nr-1208.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
162.247.243.146 , United States, ASN23467 (NEWRELIC-AS-1, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dac715f087720dd7ff7067f5d2ec1988851fa93140ae8a9cbfaa15659dd7fd82

Request headers

Referer
https://www.showmetheshift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Fri, 21 May 2021 22:02:55 GMT
Content-Encoding
gzip
CF-Cache-Status
DYNAMIC
X-NewRelic-App-Data
PxQGQlVTAAQBXFFTFR0VMQFTYkEDCBADUxZRDVZkG3xWEU0YdQhAEgVCVAkDEWQcfgEVFk51XhUUUEJQCgMRQBxSFlIUChoDBlwPJBxVH1BQGhUCX1pbUQBWVwQHUABUUAECEU4AAg5DB2U=
Server
cloudflare
Expect-CT
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, HEAD, OPTIONS
Content-Type
text/javascript
Access-Control-Allow-Origin
*
Transfer-Encoding
chunked
Connection
keep-alive
access-control-allow-credentials
true
CF-Ray
65311780df1b2b29-FRA
cf-request-id
0a328d048800002b2982a7e000000001
NRJS-fc902efb332119fff33
bam-cell.nr-data.net/events/1/ Frame 070A 		24 B
498 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://bam-cell.nr-data.net/events/1/NRJS-fc902efb332119fff33?a=367981416&v=1208.49599aa&to=dFZWTENWVQ9QExdNRlJLSFlWXEpMRQBfXUYYSU1aXVBKC1AF&rst=11508&ck=1&ref=https://www.showmetheshift.com/ean
Requested by
Host: js-agent.newrelic.com
URL: https://js-agent.newrelic.com/nr-1208.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
162.247.243.146 , United States, ASN23467 (NEWRELIC-AS-1, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0c9cf152a0ad00d4f102c93c613c104914be5517ac8f8e0831727f8bfbe8b300

Request headers

Referer
https://www.showmetheshift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
content-type
text/plain

Response headers

Date
Fri, 21 May 2021 22:03:05 GMT
CF-Cache-Status
DYNAMIC
Server
cloudflare
Expect-CT
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Vary
Accept-Encoding
Content-Type
image/gif
Access-Control-Allow-Origin
https://www.showmetheshift.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
CF-Ray
653117bf3fe92b29-FRA
Content-Length
24
cf-request-id
0a328d2b8700002b296b03d000000001

Verdicts & Comments Add Verdict or Comment

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated

1 Cookies

Domain/Path Name / Value
.www.showmetheshift.com/ Name: __cf_bm
Value: 0a735b0f206d8116dbb5aa91c8709b072bcfe562-1621634574-1800-AVDIUq6CWsi9r1shN1OScJ/68FtxBWgunJHNEdeKojgB4kbTr6Eh2TMdbfgTziITVLxrhYOkk+ATYqzVSRPObHxWtnwTwjbXcT4RGzlzgJ3d

1 Console Messages

Source Level URL
Text
console-api log URL: https://www.showmetheshift.com/assets/lander.js(Line 112)
Message:
keen.io could not be loaded

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

app.clickfunnels.com
assets.clickfunnels.com
bam-cell.nr-data.net
coronavirusworkfromhomenow.com
fonts.googleapis.com
fonts.gstatic.com
gogvo.com
js-agent.newrelic.com
static.cloudflareinsights.com
track.addevent.com
use.fontawesome.com
www.showmetheshift.com
151.101.114.110
162.247.243.146
162.255.119.69
199.116.252.223
23.111.9.35
2606:4700::6810:10c2
2606:4700::6810:5e41
2606:4700::6810:cc2
2606:4700::6810:dc2
2a00:1450:4001:802::2003
2a00:1450:4001:82f::200a
52.209.199.113
004e3565fa58bd4ff0cbf31deb5451508a5ec7d46c4480f9bfa23326f187a158
040ddb9e2004b42eb4b95a39300911d5f3c3c3040d8239e55d35342c6125490b
0c9cf152a0ad00d4f102c93c613c104914be5517ac8f8e0831727f8bfbe8b300
0d1c5ba4b29db42dadf61f9e7304331fa835fe732bbb02822ada17a9a63c215f
198eedf9d8a1ad8d85e2d631ea8667a47a66b7ce838847359045beb4e8f3a635
20338eb2257cce3af7d172b4a55f9a7c83f8cb9830bc79effb05451836cee8b3
20c984df5d294a7cd631e7355493caac2427738d383c3080373529df70a34780
4014ca31d3c8e768608a40ed160a405ae39836a5b2c43f256bee3bdf427dd67f
41e46faff74c6a77d581689ec35eb040f6c96d17f4d2c5b25dccd42ed498b01c
5216f197f782f4bb872e02a677986af90a488015910f8d3864b796ad68dbd389
533143d96607d94d5d4292838e364aef656d3de58fe74368263776eab9c07542
61c66c2684531e8f8f9b9cf33e32aef52adf69151948cf8858530082c542c472
7422e50efbaea439fda7ef3b0eb54ee1a9fe73ea2f919d78a33bf6fb9e3e059d
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
8d3ca80fa271e94b0c36cf3053b0f806b7a42bb3395b424c99dc0bd218f0ac20
99c1949864ce5857840e26e8f83d0e782eda8032acd8c7f4ee602cb1a16e07ed
b0bbc1c51f2c71cb8dfdeefa681bdc8a0c678d8d94cfbb211d9f48e8175e6706
b34cdc06d442631103c10c047034b7892b957fe3b7da32ff89c561c67af19cab
c3c0d3f472358aac78455515c4800771426770c22698e2486d39fdb5505634e1
da352a7b4c5780eb6b96891c48bc403337bb3baaf7ad20674f0311e7988f75fb
dac715f087720dd7ff7067f5d2ec1988851fa93140ae8a9cbfaa15659dd7fd82
e0189e16cf01f8149342c9f2de872cfa73571f2a145a830f18b16154bf1d2982
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f7464960133d530dfa52ce0ab9a5c33f0a709a946ad16298b000a7560738f422
f76553e0cbb772f7113a3814491ae325e271355e87985e7e4754a8bb75b7dcb4