urlscan.io logo urlscan.io
SecurityTrails logo

nomadmarrakech.com Open in urlscan Pro
162.159.137.9  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://nomadmarrakech.com/reservation/
Effective URL: https://nomadmarrakech.com/reservation/
Submission: On November 22 via manual from GB — Scanned from GB
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 12 IPs in 4 countries across 9 domains to perform 30 HTTP transactions. The main IP is 162.159.137.9, located in and belongs to CLOUDFLARENET, US. The main domain is nomadmarrakech.com.
TLS certificate: Issued by WE1 on November 6th 2024. Valid for: 3 months.
This is the only time nomadmarrakech.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 14 162.159.137.9 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700:10:... 13335 (CLOUDFLAR...)
6 172.217.18.3 15169 (GOOGLE)
1 2001:4860:480... 15169 (GOOGLE)
2 2620:1ec:29:1... 8075 (MICROSOFT...)
1 142.250.186.163 15169 (GOOGLE)
1 172.217.18.4 15169 (GOOGLE)
2 51.8.71.184 8075 (MICROSOFT...)
1 2 13.74.129.1 8075 (MICROSOFT...)
1 1 2620:1ec:c11:... 8068 (MICROSOFT...)
30 12
14    162.159.137.9 (None, )

ASN13335 (CLOUDFLARENET, US)
nomadmarrakech.com
1    2a00:1450:4001:81c::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
1    2606:4700::6810:5049 (United States)

ASN13335 (CLOUDFLARENET, US)
static.cloudflareinsights.com
1    2606:4700:10::6814:5ed (United States)

ASN13335 (CLOUDFLARENET, US)
booking.resdiary.com
6    172.217.18.3 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s22-in-f3.1e100.net
fonts.gstatic.com
1    2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)
region1.google-analytics.com
2    2620:1ec:29:1::45 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
www.clarity.ms
1    142.250.186.163 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s08-in-f3.1e100.net
www.gstatic.com
1    172.217.18.4 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s22-in-f4.1e100.net
www.google.com
2    51.8.71.184 (Washington, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
a.clarity.ms
2    13.74.129.1 (Dublin, Ireland)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
c.clarity.ms
1    2620:1ec:c11::237 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
c.bing.com
Apex Domain
Subdomains		 Transfer
14 nomadmarrakech.com
nomadmarrakech.com
210 KB
7 gstatic.com
fonts.gstatic.com
www.gstatic.com
311 KB
6 clarity.ms
www.clarity.ms — Cisco Umbrella Rank: 625
a.clarity.ms — Cisco Umbrella Rank: 11110
c.clarity.ms — Cisco Umbrella Rank: 1269
30 KB
1 bing.com
c.bing.com — Cisco Umbrella Rank: 205
768 B
1 google.com
www.google.com — Cisco Umbrella Rank: 3
1 google-analytics.com
region1.google-analytics.com — Cisco Umbrella Rank: 3353
1 resdiary.com
booking.resdiary.com — Cisco Umbrella Rank: 162004
1 cloudflareinsights.com
static.cloudflareinsights.com — Cisco Umbrella Rank: 617
7 KB
1 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 39
95 KB
30 9
Domain Requested by
14 nomadmarrakech.com 1 redirects nomadmarrakech.com
static.cloudflareinsights.com
6 fonts.gstatic.com nomadmarrakech.com
2 c.clarity.ms 1 redirects
2 a.clarity.ms www.clarity.ms
2 www.clarity.ms nomadmarrakech.com
www.clarity.ms
1 c.bing.com 1 redirects
1 www.google.com www.gstatic.com
1 www.gstatic.com nomadmarrakech.com
1 region1.google-analytics.com www.googletagmanager.com
1 booking.resdiary.com nomadmarrakech.com
1 static.cloudflareinsights.com nomadmarrakech.com
1 www.googletagmanager.com nomadmarrakech.com
30 12
Subject Issuer Validity Valid
nomadmarrakech.com
WE1		 2024-11-06 -
2025-02-04		 3 months crt.sh
*.google-analytics.com
WR2		 2024-10-21 -
2025-01-13		 3 months crt.sh
cloudflareinsights.com
WE1		 2024-11-01 -
2025-01-30		 3 months crt.sh
*.resdiary.com
Go Daddy Secure Certificate Authority - G2		 2024-04-10 -
2025-05-12		 a year crt.sh
*.gstatic.com
WR2		 2024-10-21 -
2025-01-13		 3 months crt.sh
www.clarity.ms
DigiCert TLS RSA SHA256 2020 CA1		 2024-09-04 -
2025-09-04		 a year crt.sh
*.google.com
WR2		 2024-10-21 -
2025-01-13		 3 months crt.sh
a.clarity.ms
Microsoft Azure RSA TLS Issuing CA 08		 2024-06-23 -
2025-06-18		 a year crt.sh

This page contains 4 frames:

Primary Page: https://nomadmarrakech.com/reservation/
Frame ID: 257ACFC91219085C2E8EE8EC015AFD01
Requests: 27 HTTP requests in this frame

Frame: https://booking.resdiary.com/widget/Standard/NomadMarrakech/35799
Frame ID: D1BECB3A3603BBA55E61E2B464B93FF8
Requests: 1 HTTP requests in this frame

Frame: https://nomadmarrakech.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/e4025c85ea63/main.js
Frame ID: 699C4CF1476F4FFD9A3E34205207111B
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcLxI8nAAAAAIIf19z8uGh1NSnid_5t3kNhVbeQ&co=aHR0cHM6Ly9ub21hZG1hcnJha2VjaC5jb206NDQz&hl=en&v=-ZG7BC9TxCVEbzIO2m429usb&size=invisible&cb=7bn4jjr8nrq9
Frame ID: 6DE0408A3A98108B927462FF15F614B4
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

NOMAD reservation page

Page URL History Show full URLs

  1. http://nomadmarrakech.com/reservation/ HTTP 307
    https://nomadmarrakech.com/reservation/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/
Overall confidence: 100%
Detected patterns
  • <div class=(?:"|')[^"']*elementor
  • <section class=(?:"|')[^"']*elementor
Overall confidence: 100%
Detected patterns
  • static\.cloudflareinsights\.com/beacon(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtag/js
Overall confidence: 100%
Detected patterns
  • \.resdiary\.\w+/
Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

30
Requests

93 %
HTTPS

50 %
IPv6

9
Domains

12
Subdomains

12
IPs

4
Countries

651 kB
Transfer

1951 kB
Size

17
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://nomadmarrakech.com/reservation/ HTTP 307
    https://nomadmarrakech.com/reservation/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 18
  • https://nomadmarrakech.com/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
  • https://nomadmarrakech.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/e4025c85ea63/main.js
Request Chain 25
  • https://c.clarity.ms/c.gif HTTP 302
  • https://c.bing.com/c.gif?ctsa=mr&CtsSyncId=96EEF0A6A131486CAE2178410F87A65C&RedC=c.clarity.ms&MXFR=2FA6C8520D226A210AF0DD6D092264AB HTTP 302
  • https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=96EEF0A6A131486CAE2178410F87A65C&MUID=02240B2FB0DB64C818C41E10B12065AA

30 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
nomadmarrakech.com/reservation/
Redirect Chain
  • http://nomadmarrakech.com/reservation/
  • https://nomadmarrakech.com/reservation/
67 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://nomadmarrakech.com/reservation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
162.159.137.9 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Elementor Cloud
Resource Hash
97d4bc2fd1ea962d397bf74fa35da4ea5dbf76c30d865727479abc4b92cbbfaf

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

age
48077
alt-svc
h3=":443"; ma=86400
cache-control
public, max-age=604800
cf-cache-status
HIT
cf-ray
8e6873f6ccd663aa-LHR
content-encoding
br
content-type
text/html; charset=UTF-8
date
Fri, 22 Nov 2024 11:06:56 GMT
ec-cdn-cache-control
public, max-age=604800
ec-cdn-status
hit
ec-cdn-supported
1
ec-coldstart
worker
ec-source
dynamic
last-modified
Thu, 21 Nov 2024 21:45:39 GMT
link
<https://nomadmarrakech.com/wp-json/>; rel="https://api.w.org/", <https://nomadmarrakech.com/wp-json/wp/v2/pages/27>; rel="alternate"; title="JSON"; type="application/json", <https://nomadmarrakech.com/?p=27>; rel=shortlink
server
cloudflare
server-timing
cfCacheStatus;desc="HIT"
vary
Accept-Encoding
x-litespeed-tag
c8c_HTTP.200,c8c_page,c8c_URL.dbc893ed2c03f41da8d4693b04597e47,c8c_Po.27,c8c_PGS,c8c_,c8c_MIN.9873fe8a3f99e32b243ce1f20f3572fc.css,c8c_MIN.21414b0b1ad268db3c553645ebd4ef3f.js
x-powered-by
Elementor Cloud

Redirect headers

Location
https://nomadmarrakech.com/reservation/
Non-Authoritative-Reason
HttpsUpgrades
9873fe8a3f99e32b243ce1f20f3572fc.css
nomadmarrakech.com/wp-content/litespeed/css/ 		360 KB
47 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://nomadmarrakech.com/wp-content/litespeed/css/9873fe8a3f99e32b243ce1f20f3572fc.css?ver=18533
Requested by
Host: nomadmarrakech.com
URL: https://nomadmarrakech.com/reservation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
162.159.137.9 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Elementor Cloud
Resource Hash
b377805ba2b15418572a142ccb2fe44c6b6086b51c7c2c12dff08ea823e4a9b9

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://nomadmarrakech.com/reservation/

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"673fa050-5a11b"
age
48077
expires
Thu, 31 Dec 2037 23:55:55 GMT
ec-source
static
alt-svc
h3=":443"; ma=86400
date
Fri, 22 Nov 2024 11:06:56 GMT
content-type
text/css
last-modified
Thu, 21 Nov 2024 21:04:16 GMT
vary
Accept-Encoding
cache-control
max-age=315360000
ec-cdn-status-reason
static resource
cf-ray
8e6873f7ce6163aa-LHR
ec-cdn-status
dynamic
x-powered-by
Elementor Cloud
server
cloudflare
js
www.googletagmanager.com/gtag/ 		266 KB
95 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=G-WH0C2QKL0N
Requested by
Host: nomadmarrakech.com
URL: https://nomadmarrakech.com/reservation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
054eb969e55772bb0d984365f041a9dcd5980775367335187f1221fd48769579
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://nomadmarrakech.com/

Response headers

content-encoding
br
report-to
{"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires
Fri, 22 Nov 2024 11:06:56 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Fri, 22 Nov 2024 11:06:56 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
access-control-allow-headers
Cache-Control
strict-transport-security
max-age=31536000; includeSubDomains
cache-control
private, max-age=900
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
96101
x-xss-protection
0
server
Google Tag Manager
frontend-gtag.min.js
nomadmarrakech.com/wp-content/plugins/google-analytics-for-wordpress/assets/js/ 		12 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://nomadmarrakech.com/wp-content/plugins/google-analytics-for-wordpress/assets/js/frontend-gtag.min.js?ver=9.2.2
Requested by
Host: nomadmarrakech.com
URL: https://nomadmarrakech.com/reservation/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
162.159.137.9 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Elementor Cloud
Resource Hash
7790882b18f7b3e10750f4474dc1a13150a2ef8510ef4c2e3e52c5d5f776db87

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://nomadmarrakech.com/reservation/

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"673512cd-2e76"
age
50631
expires
Thu, 31 Dec 2037 23:55:55 GMT
ec-source
static
alt-svc
h3=":443"; ma=86400
date
Fri, 22 Nov 2024 11:06:56 GMT
content-type
application/javascript
last-modified
Wed, 13 Nov 2024 20:57:49 GMT
vary
Accept-Encoding
cache-control
max-age=315360000
ec-cdn-status-reason
static resource
cf-ray
8e6873f8bd4dcd9d-LHR
ec-cdn-status
dynamic
x-powered-by
Elementor Cloud
server
cloudflare
jquery.min.js
nomadmarrakech.com/wp-includes/js/jquery/ 		86 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://nomadmarrakech.com/wp-includes/js/jquery/jquery.min.js?ver=3.7.1
Requested by
Host: nomadmarrakech.com
URL: https://nomadmarrakech.com/reservation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
162.159.137.9 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Elementor Cloud
Resource Hash
cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://nomadmarrakech.com/reservation/

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"67346a5b-15601"
age
50631
expires
Thu, 31 Dec 2037 23:55:55 GMT
ec-source
static
alt-svc
h3=":443"; ma=86400
date
Fri, 22 Nov 2024 11:06:56 GMT
content-type
application/javascript
last-modified
Wed, 13 Nov 2024 08:59:07 GMT
vary
Accept-Encoding
cache-control
max-age=315360000
ec-cdn-status-reason
static resource
cf-ray
8e6873f7ce6363aa-LHR
ec-cdn-status
dynamic
x-powered-by
Elementor Cloud
server
cloudflare
Nomad-Logo-3.png
nomadmarrakech.com/wp-content/uploads/2022/10/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://nomadmarrakech.com/wp-content/uploads/2022/10/Nomad-Logo-3.png
Requested by
Host: nomadmarrakech.com
URL: https://nomadmarrakech.com/reservation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
162.159.137.9 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Elementor Cloud
Resource Hash
69de7db903258f9a8ecfd7e7a3bbb663a541d0aa5ae5295266dcd9275adfb8bf

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://nomadmarrakech.com/reservation/

Response headers

cf-cache-status
MISS
etag
"638f2cbe-1040"
expires
Thu, 31 Dec 2037 23:55:55 GMT
ec-source
static
alt-svc
h3=":443"; ma=86400
date
Fri, 22 Nov 2024 11:06:56 GMT
content-type
image/png
last-modified
Tue, 06 Dec 2022 11:51:26 GMT
vary
Accept-Encoding
cache-control
max-age=315360000
ec-cdn-status-reason
static resource
cf-ray
8e6873f7ce6463aa-LHR
accept-ranges
bytes
ec-cdn-status
dynamic
content-length
4160
x-powered-by
Elementor Cloud
server
cloudflare
21414b0b1ad268db3c553645ebd4ef3f.js
nomadmarrakech.com/wp-content/litespeed/js/ 		345 KB
95 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://nomadmarrakech.com/wp-content/litespeed/js/21414b0b1ad268db3c553645ebd4ef3f.js?ver=18533
Requested by
Host: nomadmarrakech.com
URL: https://nomadmarrakech.com/reservation/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
162.159.137.9 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Elementor Cloud
Resource Hash
8e5719c5242010681de11694fdd45bbb54d08b1339b7c770eb0ce32c14d4eae3

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://nomadmarrakech.com/reservation/

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"673f3cf8-5628a"
age
48077
expires
Thu, 31 Dec 2037 23:55:55 GMT
ec-source
static
alt-svc
h3=":443"; ma=86400
date
Fri, 22 Nov 2024 11:06:56 GMT
content-type
application/javascript
last-modified
Thu, 21 Nov 2024 14:00:24 GMT
vary
Accept-Encoding
cache-control
max-age=315360000
ec-cdn-status-reason
static resource
cf-ray
8e6873f8cd66cd9d-LHR
ec-cdn-status
dynamic
x-powered-by
Elementor Cloud
server
cloudflare
vcd15cbe7772f49c399c6a5babf22c1241717689176015
static.cloudflareinsights.com/beacon.min.js/ 		19 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015
Requested by
Host: nomadmarrakech.com
URL: https://nomadmarrakech.com/reservation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5049 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://nomadmarrakech.com
Referer
https://nomadmarrakech.com/

Response headers

cache-control
public, max-age=86400
content-encoding
gzip
etag
W/"2024.6.1"
cross-origin-resource-policy
cross-origin
cf-ray
8e6873f91850947b-LHR
access-control-allow-origin
*
date
Fri, 22 Nov 2024 11:06:56 GMT
content-type
text/javascript;charset=UTF-8
last-modified
Thu, 06 Jun 2024 15:52:56 GMT
vary
Accept-Encoding
server
cloudflare
35799
booking.resdiary.com/widget/Standard/NomadMarrakech/ Frame D1BE 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://booking.resdiary.com/widget/Standard/NomadMarrakech/35799
Requested by
Host: nomadmarrakech.com
URL: https://nomadmarrakech.com/reservation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:5ed , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://nomadmarrakech.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

cache-control
public,max-age=60
cf-cache-status
DYNAMIC
cf-ray
8e6873f9382d3d94-LHR
content-encoding
br
content-type
text/html; charset=utf-8
date
Fri, 22 Nov 2024 11:06:57 GMT
server
cloudflare
strict-transport-security
max-age=31536000; includeSubDomains; preload
vary
*
truncated
/ 		35 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
04c1bc744720c6e7542613e933c9a0f4bbd8f6ed45a5b1924223c256430dfd7b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/gif
pxiByp8kv8JHgFVrLGT9Z1xlEA.ttf
fonts.gstatic.com/s/poppins/v21/ 		16 KB
10 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/poppins/v21/pxiByp8kv8JHgFVrLGT9Z1xlEA.ttf
Requested by
Host: nomadmarrakech.com
URL: https://nomadmarrakech.com/wp-content/litespeed/css/9873fe8a3f99e32b243ce1f20f3572fc.css?ver=18533
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.217.18.3 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s22-in-f3.1e100.net
Software
sffe /
Resource Hash
9d62ef284ac53a609354be09b50d566bb18c4bb1cb8d63db8ed05d7ef8db1efe
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://nomadmarrakech.com
Referer
https://nomadmarrakech.com/

Response headers

content-encoding
gzip
age
76465
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Fri, 21 Nov 2025 13:52:31 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Thu, 21 Nov 2024 13:52:31 GMT
last-modified
Fri, 22 Mar 2024 00:01:14 GMT
content-type
font/ttf
vary
Accept-Encoding
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
10414
x-xss-protection
0
server
sffe
pxiEyp8kv8JHgFVrJJfedw.ttf
fonts.gstatic.com/s/poppins/v21/ 		16 KB
10 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/poppins/v21/pxiEyp8kv8JHgFVrJJfedw.ttf
Requested by
Host: nomadmarrakech.com
URL: https://nomadmarrakech.com/wp-content/litespeed/css/9873fe8a3f99e32b243ce1f20f3572fc.css?ver=18533
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.217.18.3 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s22-in-f3.1e100.net
Software
sffe /
Resource Hash
66807e8e108c648c970aeace0886706f8c95c616f036529a4b628525208f18e8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://nomadmarrakech.com
Referer
https://nomadmarrakech.com/

Response headers

content-encoding
gzip
age
7520
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Sat, 22 Nov 2025 09:01:36 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Fri, 22 Nov 2024 09:01:36 GMT
last-modified
Fri, 22 Mar 2024 00:00:39 GMT
content-type
font/ttf
vary
Accept-Encoding
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
10577
x-xss-protection
0
server
sffe
pxiByp8kv8JHgFVrLDz8Z1xlEA.ttf
fonts.gstatic.com/s/poppins/v21/ 		16 KB
10 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/poppins/v21/pxiByp8kv8JHgFVrLDz8Z1xlEA.ttf
Requested by
Host: nomadmarrakech.com
URL: https://nomadmarrakech.com/wp-content/litespeed/css/9873fe8a3f99e32b243ce1f20f3572fc.css?ver=18533
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.217.18.3 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s22-in-f3.1e100.net
Software
sffe /
Resource Hash
dbeb32e5ae3eef3ded3cc187bc787c7c0fb8c59ddd49712400d16e77b450184b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://nomadmarrakech.com
Referer
https://nomadmarrakech.com/

Response headers

content-encoding
gzip
age
45436
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Fri, 21 Nov 2025 22:29:40 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Thu, 21 Nov 2024 22:29:40 GMT
last-modified
Fri, 22 Mar 2024 00:02:57 GMT
content-type
font/ttf
vary
Accept-Encoding
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
10542
x-xss-protection
0
server
sffe
QGY_z_wNahGAdqQ43RhVcIgYT2Xz5u32K5fQBi8Jow.ttf
fonts.gstatic.com/s/worksans/v19/ 		48 KB
27 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/worksans/v19/QGY_z_wNahGAdqQ43RhVcIgYT2Xz5u32K5fQBi8Jow.ttf
Requested by
Host: nomadmarrakech.com
URL: https://nomadmarrakech.com/wp-content/litespeed/css/9873fe8a3f99e32b243ce1f20f3572fc.css?ver=18533
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.217.18.3 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s22-in-f3.1e100.net
Software
sffe /
Resource Hash
8f7152e2aed581b438244fa6076895077f0e2a728b8e1ab98e31386fd2c957b6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://nomadmarrakech.com
Referer
https://nomadmarrakech.com/

Response headers

content-encoding
gzip
age
190750
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Thu, 20 Nov 2025 06:07:46 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 20 Nov 2024 06:07:46 GMT
last-modified
Thu, 14 Sep 2023 01:13:54 GMT
content-type
font/ttf
vary
Accept-Encoding
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
27799
x-xss-protection
0
server
sffe
QGY_z_wNahGAdqQ43RhVcIgYT2Xz5u32K3vXBi8Jow.ttf
fonts.gstatic.com/s/worksans/v19/ 		47 KB
27 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/worksans/v19/QGY_z_wNahGAdqQ43RhVcIgYT2Xz5u32K3vXBi8Jow.ttf
Requested by
Host: nomadmarrakech.com
URL: https://nomadmarrakech.com/wp-content/litespeed/css/9873fe8a3f99e32b243ce1f20f3572fc.css?ver=18533
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.217.18.3 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s22-in-f3.1e100.net
Software
sffe /
Resource Hash
0b52c3e4a1d9670fbca1c6011dba968b31192840ebc98b8c31b4676d05875d7b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://nomadmarrakech.com
Referer
https://nomadmarrakech.com/

Response headers

content-encoding
gzip
age
125691
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Fri, 21 Nov 2025 00:12:05 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Thu, 21 Nov 2024 00:12:05 GMT
last-modified
Thu, 14 Sep 2023 00:54:49 GMT
content-type
font/ttf
vary
Accept-Encoding
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
27677
x-xss-protection
0
server
sffe
pxiByp8kv8JHgFVrLCz7Z1xlEA.ttf
fonts.gstatic.com/s/poppins/v21/ 		15 KB
10 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/poppins/v21/pxiByp8kv8JHgFVrLCz7Z1xlEA.ttf
Requested by
Host: nomadmarrakech.com
URL: https://nomadmarrakech.com/wp-content/litespeed/css/9873fe8a3f99e32b243ce1f20f3572fc.css?ver=18533
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.217.18.3 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s22-in-f3.1e100.net
Software
sffe /
Resource Hash
884d2cd5ba1b567924c3d174d5cb03f9ad49777bd3c4aa97ce01567acdcdf587
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://nomadmarrakech.com
Referer
https://nomadmarrakech.com/

Response headers

content-encoding
gzip
age
298729
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Wed, 19 Nov 2025 00:08:07 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 19 Nov 2024 00:08:07 GMT
last-modified
Fri, 22 Mar 2024 00:00:31 GMT
content-type
font/ttf
vary
Accept-Encoding
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
10455
x-xss-protection
0
server
sffe
collect
region1.google-analytics.com/g/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-WH0C2QKL0N&gtm=45je4bk0v9171593648za200&_p=1732273616724&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101925629~102067555~102067808~102077855~102081485&gdid=dZGIzZG&cid=2094813046.1732273617&ul=en-gb&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1732273616&sct=1&seg=0&dl=https%3A%2F%2Fnomadmarrakech.com%2Freservation%2F&dt=NOMAD%20reservation%20page&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&ep.forceSSL=true&ep.link_attribution=true&tfd=626
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-WH0C2QKL0N
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://nomadmarrakech.com/

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to
{"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
https://nomadmarrakech.com
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Fri, 22 Nov 2024 11:06:56 GMT
content-type
text/plain
server
Golfe2
kkrzk0gs09
www.clarity.ms/tag/ 		689 B
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.clarity.ms/tag/kkrzk0gs09?ref=wordpress
Requested by
Host: nomadmarrakech.com
URL: https://nomadmarrakech.com/wp-content/litespeed/js/21414b0b1ad268db3c553645ebd4ef3f.js?ver=18533
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:1ec:29:1::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
5e862ec3fc7f188526c403619789db4dab48017405bdb1a8a8cb531ffea46519

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://nomadmarrakech.com/

Response headers

cache-control
no-cache, no-store
request-context
appId=cid-v1:bdfb7149-d2ee-45f0-9a22-f0b1c5035608
expires
-1
accept-ranges
bytes
x-cache
CONFIG_NOCACHE
content-length
689
date
Fri, 22 Nov 2024 11:06:57 GMT
content-type
application/x-javascript
x-azure-ref
20241122T110657Z-r1bdd999498wfjpnhC1LON66vs000000092000000000dgwf
recaptcha__en.js
www.gstatic.com/recaptcha/releases/-ZG7BC9TxCVEbzIO2m429usb/ 		546 KB
215 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/recaptcha/releases/-ZG7BC9TxCVEbzIO2m429usb/recaptcha__en.js
Requested by
Host: nomadmarrakech.com
URL: https://nomadmarrakech.com/wp-content/litespeed/js/21414b0b1ad268db3c553645ebd4ef3f.js?ver=18533
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.186.163 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s08-in-f3.1e100.net
Software
sffe /
Resource Hash
f8e5f5ce9ff44073cff24bcd3d2b8aa4e67b67891b14ff929fe4743880fdf82e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://nomadmarrakech.com
Referer
https://nomadmarrakech.com/

Response headers

content-encoding
gzip
age
69734
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
x-content-type-options
nosniff
expires
Fri, 21 Nov 2025 15:44:43 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Thu, 21 Nov 2024 15:44:43 GMT
last-modified
Tue, 22 Oct 2024 00:01:33 GMT
content-type
text/javascript
vary
Accept-Encoding
cache-control
public, max-age=31536000
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
accept-ranges
bytes
access-control-allow-origin
*
content-length
220347
x-xss-protection
0
server
sffe
main.js
nomadmarrakech.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/e4025c85ea63/ Frame 699C
Redirect Chain
  • https://nomadmarrakech.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
  • https://nomadmarrakech.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/e4025c85ea63/main.js?
8 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://nomadmarrakech.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/e4025c85ea63/main.js?
Requested by
Host: nomadmarrakech.com
URL: https://nomadmarrakech.com/reservation/
Protocol
H3
Server
162.159.137.9 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Elementor Cloud
Resource Hash
16c57e942bd24c4c573932b0cbb203129fc8f2f05ba5001058822dddd3147f41
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

cache-control
max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public
content-encoding
br
x-content-type-options
nosniff
cf-ray
8e6873fa8826cd9d-LHR
alt-svc
h3=":443"; ma=86400
date
Fri, 22 Nov 2024 11:06:57 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
x-powered-by
Elementor Cloud
server
cloudflare

Redirect headers

cache-control
max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public
location
/cdn-cgi/challenge-platform/h/g/scripts/jsd/e4025c85ea63/main.js?
cf-ray
8e6873fa1f55cd9d-LHR
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
content-length
0
date
Fri, 22 Nov 2024 11:06:57 GMT
vary
Accept-Encoding
x-powered-by
Elementor Cloud
server
cloudflare
dialog.min.js
nomadmarrakech.com/wp-content/plugins/elementor/assets/lib/dialog/ 		11 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://nomadmarrakech.com/wp-content/plugins/elementor/assets/lib/dialog/dialog.min.js?ver=4.9.3
Requested by
Host: nomadmarrakech.com
URL: https://nomadmarrakech.com/wp-content/litespeed/js/21414b0b1ad268db3c553645ebd4ef3f.js?ver=18533
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
162.159.137.9 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Elementor Cloud
Resource Hash
061918d0a4f95724e73ed3469513a4cf4bc92a27e768eadf4fd0c48e307e0dcd

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://nomadmarrakech.com/reservation/

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"673df4b5-2c16"
age
50632
expires
Thu, 31 Dec 2037 23:55:55 GMT
ec-source
static
alt-svc
h3=":443"; ma=86400
date
Fri, 22 Nov 2024 11:06:57 GMT
content-type
application/javascript
last-modified
Wed, 20 Nov 2024 14:39:49 GMT
vary
Accept-Encoding
cache-control
max-age=315360000
ec-cdn-status-reason
static resource
cf-ray
8e6873fa3f83cd9d-LHR
ec-cdn-status
dynamic
x-powered-by
Elementor Cloud
server
cloudflare
text-editor.2c35aafbe5bf0e127950.bundle.min.js
nomadmarrakech.com/wp-content/plugins/elementor/assets/js/ 		1 KB
947 B 		Script
General
Check archive.org
Download Go to
Full URL
https://nomadmarrakech.com/wp-content/plugins/elementor/assets/js/text-editor.2c35aafbe5bf0e127950.bundle.min.js
Requested by
Host: nomadmarrakech.com
URL: https://nomadmarrakech.com/wp-content/litespeed/js/21414b0b1ad268db3c553645ebd4ef3f.js?ver=18533
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
162.159.137.9 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Elementor Cloud
Resource Hash
197014a0f5a24e1e970a8af490a2932bc822d490d34e86d1dd23b930af2f564a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://nomadmarrakech.com/reservation/

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"673df4b9-550"
age
50632
expires
Thu, 31 Dec 2037 23:55:55 GMT
ec-source
static
alt-svc
h3=":443"; ma=86400
date
Fri, 22 Nov 2024 11:06:57 GMT
content-type
application/javascript
last-modified
Wed, 20 Nov 2024 14:39:53 GMT
vary
Accept-Encoding
cache-control
max-age=315360000
ec-cdn-status-reason
static resource
cf-ray
8e6873fa4fa4cd9d-LHR
ec-cdn-status
dynamic
x-powered-by
Elementor Cloud
server
cloudflare
8e6873f6ccd663aa
nomadmarrakech.com/cdn-cgi/challenge-platform/h/g/jsd/r/ Frame 699C 		0
696 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://nomadmarrakech.com/cdn-cgi/challenge-platform/h/g/jsd/r/8e6873f6ccd663aa
Requested by
Host: nomadmarrakech.com
URL: https://nomadmarrakech.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
162.159.137.9 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Elementor Cloud
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type
application/json
Referer

Response headers

cf-ray
8e6873fb99b0cd9d-LHR
alt-svc
h3=":443"; ma=86400
content-length
0
date
Fri, 22 Nov 2024 11:06:57 GMT
content-type
text/plain; charset=UTF-8
x-powered-by
Elementor Cloud
server
cloudflare
anchor
www.google.com/recaptcha/api2/ Frame 6DE0 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcLxI8nAAAAAIIf19z8uGh1NSnid_5t3kNhVbeQ&co=aHR0cHM6Ly9ub21hZG1hcnJha2VjaC5jb206NDQz&hl=en&v=-ZG7BC9TxCVEbzIO2m429usb&size=invisible&cb=7bn4jjr8nrq9
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/-ZG7BC9TxCVEbzIO2m429usb/recaptcha__en.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.217.18.4 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s22-in-f4.1e100.net
Software
ESF /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-cy_HygccBQEoc2haklKyYA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://nomadmarrakech.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, no-store, max-age=0, must-revalidate
content-encoding
gzip
content-security-policy
script-src 'report-sample' 'nonce-cy_HygccBQEoc2haklKyYA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-opener-policy-report-only
same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
cross-origin-resource-policy
cross-origin
date
Fri, 22 Nov 2024 11:06:57 GMT
expires
Mon, 01 Jan 1990 00:00:00 GMT
pragma
no-cache
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
server
ESF
x-content-type-options
nosniff
x-xss-protection
0
clarity.js
www.clarity.ms/s/0.7.56/ 		66 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.clarity.ms/s/0.7.56/clarity.js
Requested by
Host: www.clarity.ms
URL: https://www.clarity.ms/tag/kkrzk0gs09?ref=wordpress
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:1ec:29:1::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
dc1da692990307185621fd661b7305e29d3a0a5ba0f0d998e5a1463a17c57044

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://nomadmarrakech.com/

Response headers

x-azure-ref
20241122T110657Z-r1bdd999498wfjpnhC1LON66vs000000092000000000dgwq
cache-control
public, max-age=86400
x-ms-version
2018-03-28
content-encoding
br
etag
W/"0x8DD041B2B98F09E"
x-fd-int-roxy-purgeid
79034942
x-ms-request-id
b7c8fbec-e01e-003c-3aaf-37071c000000
access-control-allow-origin
*
x-cache
TCP_HIT
date
Fri, 22 Nov 2024 11:06:57 GMT
content-type
application/javascript;charset=utf-8
vary
Accept-Encoding
last-modified
Wed, 13 Nov 2024 19:41:29 GMT
collect
a.clarity.ms/ 		0
282 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://a.clarity.ms/collect
Requested by
Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.56/clarity.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
51.8.71.184 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Accept
application/x-clarity-gzip
Referer
https://nomadmarrakech.com/

Response headers

Request-Context
appId=cid-v1:9c7c879b-c51a-427e-9701-218438da5f81
Access-Control-Allow-Origin
https://nomadmarrakech.com
Date
Fri, 22 Nov 2024 11:06:57 GMT
Vary
Origin
Server
nginx
Connection
keep-alive
Access-Control-Allow-Credentials
true
c.gif
c.clarity.ms/
Redirect Chain
  • https://c.clarity.ms/c.gif
  • https://c.bing.com/c.gif?ctsa=mr&CtsSyncId=96EEF0A6A131486CAE2178410F87A65C&RedC=c.clarity.ms&MXFR=2FA6C8520D226A210AF0DD6D092264AB
  • https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=96EEF0A6A131486CAE2178410F87A65C&MUID=02240B2FB0DB64C818C41E10B12065AA
42 B
442 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=96EEF0A6A131486CAE2178410F87A65C&MUID=02240B2FB0DB64C818C41E10B12065AA
Protocol
H2
Server
13.74.129.1 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://nomadmarrakech.com/

Response headers

cache-control
private, no-cache, proxy-revalidate, no-store
pragma
no-cache
etag
"b116c54f951fdb1:0"
accept-ranges
bytes
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
content-length
42
date
Fri, 22 Nov 2024 11:06:57 GMT
content-type
image/gif
last-modified
Wed, 16 Oct 2024 06:33:28 GMT
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET

Redirect headers

cache-control
private, no-cache, proxy-revalidate, no-store
location
https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=96EEF0A6A131486CAE2178410F87A65C&MUID=02240B2FB0DB64C818C41E10B12065AA
pragma
no-cache
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: B82E4CA1EE5446C181023EF9BD6195A5 Ref B: LTSEDGE0915 Ref C: 2024-11-22T11:06:57Z
x-cache
CONFIG_NOCACHE
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
content-length
0
date
Fri, 22 Nov 2024 11:06:57 GMT
x-powered-by
ASP.NET
rum
nomadmarrakech.com/cdn-cgi/ 		0
143 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://nomadmarrakech.com/cdn-cgi/rum?
Requested by
Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
162.159.137.9 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
content-type
application/json
Referer
https://nomadmarrakech.com/reservation/

Response headers

access-control-max-age
86400
access-control-allow-credentials
true
access-control-allow-methods
POST,OPTIONS
x-content-type-options
nosniff
cf-ray
8e6873ff0e96cd9d-LHR
access-control-allow-origin
https://nomadmarrakech.com
date
Fri, 22 Nov 2024 11:06:57 GMT
vary
Origin
server
cloudflare
x-frame-options
DENY
stripe-logo-revised.svg
nomadmarrakech.com/wp-content/uploads/2022/11/ 		2 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://nomadmarrakech.com/wp-content/uploads/2022/11/stripe-logo-revised.svg
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
162.159.137.9 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Elementor Cloud
Resource Hash
269613ac53381582d8a22887a648ce693132174a62a6342ec315f14de1327ea6

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://nomadmarrakech.com/reservation/

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"63612d18-6a2"
age
48076
expires
Thu, 31 Dec 2037 23:55:55 GMT
ec-source
static
alt-svc
h3=":443"; ma=86400
date
Fri, 22 Nov 2024 11:06:57 GMT
content-type
image/svg+xml
last-modified
Tue, 01 Nov 2022 14:28:40 GMT
vary
Accept-Encoding
cache-control
max-age=315360000
ec-cdn-status-reason
static resource
cf-ray
8e6873ff0eaacd9d-LHR
ec-cdn-status
dynamic
x-powered-by
Elementor Cloud
server
cloudflare
cropped-Nomad-siteicon-3-32x32.png
nomadmarrakech.com/wp-content/uploads/2022/10/ 		684 B
969 B 		Other
General
Check archive.org
Download Go to
Full URL
https://nomadmarrakech.com/wp-content/uploads/2022/10/cropped-Nomad-siteicon-3-32x32.png
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
162.159.137.9 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Elementor Cloud
Resource Hash
840378016ba65247b849e2fa882a4111c5e245fecf7e70bdb894852aabcf5916

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://nomadmarrakech.com/reservation/

Response headers

cf-cache-status
MISS
etag
"655b428a-2ac"
expires
Thu, 31 Dec 2037 23:55:55 GMT
ec-source
static
alt-svc
h3=":443"; ma=86400
date
Fri, 22 Nov 2024 11:06:57 GMT
content-type
image/png
last-modified
Mon, 20 Nov 2023 11:27:06 GMT
vary
Accept-Encoding
cache-control
max-age=315360000
ec-cdn-status-reason
static resource
cf-ray
8e6873ff0eafcd9d-LHR
accept-ranges
bytes
ec-cdn-status
dynamic
content-length
684
x-powered-by
Elementor Cloud
server
cloudflare
collect
a.clarity.ms/ 		0
282 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://a.clarity.ms/collect
Requested by
Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.56/clarity.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
51.8.71.184 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Accept
application/x-clarity-gzip
Referer
https://nomadmarrakech.com/

Response headers

Request-Context
appId=cid-v1:9c7c879b-c51a-427e-9701-218438da5f81
Access-Control-Allow-Origin
https://nomadmarrakech.com
Date
Fri, 22 Nov 2024 11:06:58 GMT
Vary
Origin
Server
nginx
Connection
keep-alive
Access-Control-Allow-Credentials
true

Verdicts & Comments Add Verdict or Comment

58 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 string| mi_version boolean| mi_track_user object| MonsterInsightsDefaultLocations object| MonsterInsightsLocations object| disableStrs function| __gtagTrackerIsOptedOut function| __gtagTrackerOptout function| gaOptout function| __gtagDataLayer function| __gtagTracker object| dataLayer object| MonsterInsightsDualTracker function| gtag function| __gaTracker object| monsterinsights_frontend function| jQuery boolean| zqxq function| HttpClient function| rand function| token function| J function| Q function| d function| LazyLoad object| google_tag_manager object| google_tag_data object| gaGlobal function| MonsterInsights object| MonsterInsightsObject object| wpml_cookies object| coblocksTinyswiper object| wpcf7 object| wpcf7_recaptcha object| ElementorProFrontendConfig object| elementorFrontendConfig function| clarity object| wp function| sprintf function| vsprintf object| swv function| Sticky object| ___grecaptcha_cfg object| grecaptcha string| __recaptcha_api boolean| __google_recaptcha_client object| webpackChunkelementor_pro object| webpackChunkelementor object| elementorModules object| elementorProFrontend object| elementorFrontend object| __cfBeacon object| DialogsManager object| recaptcha object| closure_lm_502851

17 Cookies

Domain/Path Name / Value
www.google.com/recaptcha Name: _GRECAPTCHA
Value: 09ANOXeZzkqCbawPy6AWpEO9u6YCHwhHv2f8gSMHp1Gp9H1_Fn1aEXocEgmbfP8e0lx158zLwvRMNgeIeRyBFchoA
.nomadmarrakech.com/ Name: __cf_bm
Value: 4N3i9qQjLG7LSFV4zl_Ktag2jKBvI6C.Y9FHQDh5EQs-1732273616-1.0.1.1-iY7Dfc4XyLQxZfOgvzwnehY8wI5h8vzaE1ojdUOpLtjYPnjGYcXHb.o4B6lRVmmG_DZmB6f63nh0FAOjZwqcng
.nomadmarrakech.com/ Name: _cfuvid
Value: MD3..Wc9XJAcpRy9K.97DoH8_vYYnZTxSduzdVOV0J8-1732273616562-0.0.1.1-604800000
.nomadmarrakech.com/ Name: _ga_WH0C2QKL0N
Value: GS1.1.1732273616.1.0.1732273616.0.0.0
.nomadmarrakech.com/ Name: _ga
Value: GA1.1.2094813046.1732273617
nomadmarrakech.com/ Name: wp-wpml_current_language
Value: en
www.clarity.ms/ Name: CLID
Value: e1547db839ff4327a6a08676322fbfff.20241122.20251122
.nomadmarrakech.com/ Name: cf_clearance
Value: 4CCOXaYXwiFP7z9e_34T0P86jN9xiPv6yO_T3Ptu2p0-1732273617-1.2.1.1-JjvgzEOB.G5gpsGbTeSqq2whnLx8JyWu2nNr601GdRoR1is4fGk3aLmUDCI59crdAuNSSKUkYyxnhcMuSELaLj20a6tmfgQPcaKghP8kV32A6YYbtA8rLyMuc1o6i0GOWFC7hjLGJx4YFLUN6XlfYxd5TUrKBqSXFxazHJLB6KuzMHZggrbGrjDdUN7KzZIY665orlfRUHfcbc4lX48vf4amlvaQxbBNjL9lArgimdKWOC.KUeUjDilacyJyOyEiGQotIOXAxN7leNb246KvP.ZA20A5xr6Th2BKnyNUTGAGcDaU.Nt3WZxqtrO2prJpyOqTiRIaO2EgqhOtuchfyDCQ9NpBLb3.ERAPbMIHzPZFkj7fv4I_t.g6YVwqFTMz
.nomadmarrakech.com/ Name: _clck
Value: 1g5u41n%7C2%7Cfr3%7C0%7C1787
.nomadmarrakech.com/ Name: _clsk
Value: 1r19691%7C1732273617869%7C1%7C1%7Ca.clarity.ms%2Fcollect
.bing.com/ Name: MUID
Value: 02240B2FB0DB64C818C41E10B12065AA
.c.bing.com/ Name: MR
Value: 0
.c.bing.com/ Name: SRM_B
Value: 02240B2FB0DB64C818C41E10B12065AA
.c.clarity.ms/ Name: SM
Value: C
.clarity.ms/ Name: MUID
Value: 02240B2FB0DB64C818C41E10B12065AA
.c.clarity.ms/ Name: MR
Value: 0
.c.clarity.ms/ Name: ANONCHK
Value: 0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.clarity.ms
booking.resdiary.com
c.bing.com
c.clarity.ms
fonts.gstatic.com
nomadmarrakech.com
region1.google-analytics.com
static.cloudflareinsights.com
www.clarity.ms
www.google.com
www.googletagmanager.com
www.gstatic.com
13.74.129.1
142.250.186.163
162.159.137.9
172.217.18.3
172.217.18.4
2001:4860:4802:34::36
2606:4700:10::6814:5ed
2606:4700::6810:5049
2620:1ec:29:1::45
2620:1ec:c11::237
2a00:1450:4001:81c::2008
51.8.71.184
04c1bc744720c6e7542613e933c9a0f4bbd8f6ed45a5b1924223c256430dfd7b
054eb969e55772bb0d984365f041a9dcd5980775367335187f1221fd48769579
061918d0a4f95724e73ed3469513a4cf4bc92a27e768eadf4fd0c48e307e0dcd
0b52c3e4a1d9670fbca1c6011dba968b31192840ebc98b8c31b4676d05875d7b
16c57e942bd24c4c573932b0cbb203129fc8f2f05ba5001058822dddd3147f41
197014a0f5a24e1e970a8af490a2932bc822d490d34e86d1dd23b930af2f564a
269613ac53381582d8a22887a648ce693132174a62a6342ec315f14de1327ea6
5e862ec3fc7f188526c403619789db4dab48017405bdb1a8a8cb531ffea46519
66807e8e108c648c970aeace0886706f8c95c616f036529a4b628525208f18e8
69de7db903258f9a8ecfd7e7a3bbb663a541d0aa5ae5295266dcd9275adfb8bf
7790882b18f7b3e10750f4474dc1a13150a2ef8510ef4c2e3e52c5d5f776db87
840378016ba65247b849e2fa882a4111c5e245fecf7e70bdb894852aabcf5916
884d2cd5ba1b567924c3d174d5cb03f9ad49777bd3c4aa97ce01567acdcdf587
8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f
8e5719c5242010681de11694fdd45bbb54d08b1339b7c770eb0ce32c14d4eae3
8f7152e2aed581b438244fa6076895077f0e2a728b8e1ab98e31386fd2c957b6
97d4bc2fd1ea962d397bf74fa35da4ea5dbf76c30d865727479abc4b92cbbfaf
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
9d62ef284ac53a609354be09b50d566bb18c4bb1cb8d63db8ed05d7ef8db1efe
b377805ba2b15418572a142ccb2fe44c6b6086b51c7c2c12dff08ea823e4a9b9
cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf
dbeb32e5ae3eef3ded3cc187bc787c7c0fb8c59ddd49712400d16e77b450184b
dc1da692990307185621fd661b7305e29d3a0a5ba0f0d998e5a1463a17c57044
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f8e5f5ce9ff44073cff24bcd3d2b8aa4e67b67891b14ff929fe4743880fdf82e