Submitted URL: https://s.id/3UYU4
Effective URL: https://s.id/3UYU4?a=confirm
Submission: On April 29 via api from BY — Scanned from DE

Summary

This website contacted 10 IPs in 4 countries across 7 domains to perform 19 HTTP transactions. The main IP is 193.84.85.178, located in Russian Federation and belongs to STORMWALL-AS, SK. The main domain is s.id. The Cisco Umbrella rank of the primary domain is 139929.
TLS certificate: Issued by R3 on March 17th 2024. Valid for: 3 months.
This is the only time s.id was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

Apex Domain
Subdomains
Transfer
7 googlesyndication.com
pagead2.googlesyndication.com — Cisco Umbrella Rank: 104
e8c8fbcbc96c5bd265790eb771c975d4.safeframe.googlesyndication.com
tpc.googlesyndication.com — Cisco Umbrella Rank: 157
43 KB
4 s.id
s.id — Cisco Umbrella Rank: 139929
23 KB
2 google-analytics.com
region1.google-analytics.com — Cisco Umbrella Rank: 2404
300 B
2 protagcdn.com
protagcdn.com — Cisco Umbrella Rank: 133543
adx.protagcdn.com — Cisco Umbrella Rank: 426519
136 KB
2 doubleclick.net
securepubads.g.doubleclick.net — Cisco Umbrella Rank: 207
170 KB
1 gstatic.com
csi.gstatic.com
234 B
1 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 39
99 KB
19 7
Domain Requested by
4 pagead2.googlesyndication.com securepubads.g.doubleclick.net
4 s.id 1 redirects s.id
2 tpc.googlesyndication.com securepubads.g.doubleclick.net
tpc.googlesyndication.com
2 region1.google-analytics.com www.googletagmanager.com
2 securepubads.g.doubleclick.net s.id
securepubads.g.doubleclick.net
1 csi.gstatic.com pagead2.googlesyndication.com
1 e8c8fbcbc96c5bd265790eb771c975d4.safeframe.googlesyndication.com securepubads.g.doubleclick.net
1 adx.protagcdn.com protagcdn.com
1 protagcdn.com s.id
1 www.googletagmanager.com s.id
19 10

This site contains no links.

Subject Issuer Validity Valid
s.id
R3
2024-03-17 -
2024-06-15
3 months crt.sh
*.google-analytics.com
GTS CA 1C3
2024-04-08 -
2024-07-01
3 months crt.sh
*.g.doubleclick.net
GTS CA 1C3
2024-04-08 -
2024-07-01
3 months crt.sh
protagcdn.com
E1
2024-04-21 -
2024-07-20
3 months crt.sh
tpc.googlesyndication.com
GTS CA 1C3
2024-04-08 -
2024-07-01
3 months crt.sh
*.gstatic.com
GTS CA 1C3
2024-04-08 -
2024-07-01
3 months crt.sh

This page contains 3 frames:

Primary Page: https://s.id/3UYU4?a=confirm
Frame ID: B5B93CBFC0DBF27B51C08C0BFFCDFAC4
Requests: 17 HTTP requests in this frame

Frame: https://e8c8fbcbc96c5bd265790eb771c975d4.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 57179F89F0F5C2AA6AF1016DB8254B2E
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: F9632AB59D1DE32EEEE0180B5A8C2C72
Requests: 1 HTTP requests in this frame

Screenshot

Page Title

Confirm redirect action

Page URL History Show full URLs

  1. https://s.id/3UYU4 HTTP 302
    https://s.id/3UYU4?a=confirm Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • googlesyndication\.com/

Overall confidence: 100%
Detected patterns

Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtag/js

Page Statistics

19
Requests

95 %
HTTPS

78 %
IPv6

7
Domains

10
Subdomains

10
IPs

4
Countries

470 kB
Transfer

1445 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://s.id/3UYU4 HTTP 302
    https://s.id/3UYU4?a=confirm Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

19 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request 3UYU4
s.id/
Redirect Chain
  • https://s.id/3UYU4
  • https://s.id/3UYU4?a=confirm
13 KB
5 KB
Document
General
Full URL
https://s.id/3UYU4?a=confirm
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
193.84.85.178 , Russian Federation, ASN59796 (STORMWALL-AS, SK),
Reverse DNS
Software
nginx /
Resource Hash
e5418a81cd7716d739dae9286f08a4d0e1292afa3f3961da195ec62127dfa0f5
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

cache-control
private, max-age=15
content-encoding
br
content-type
text/html; charset=utf-8
date
Mon, 29 Apr 2024 07:07:31 GMT
server
nginx
strict-transport-security
max-age=15724800; includeSubDomains
vary
Accept-Encoding

Redirect headers

cache-control
private, max-age=15
content-length
0
date
Mon, 29 Apr 2024 07:07:31 GMT
location
https://s.id/3UYU4?a=confirm
server
nginx
strict-transport-security
max-age=15724800; includeSubDomains
output.css
s.id/@dist/
6 KB
2 KB
Stylesheet
General
Full URL
https://s.id/@dist/output.css?vbhu23tc634
Requested by
Host: s.id
URL: https://s.id/3UYU4?a=confirm
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
193.84.85.178 , Russian Federation, ASN59796 (STORMWALL-AS, SK),
Reverse DNS
Software
nginx /
Resource Hash
d86c32448881af0e96b6a83c83e12b5fa322415920ba574e5103d88dd70c1103
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://s.id/3UYU4?a=confirm
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 29 Apr 2024 07:07:32 GMT
strict-transport-security
max-age=15724800; includeSubDomains
content-encoding
gzip
last-modified
Mon, 15 Jan 2024 07:44:01 GMT
server
nginx
vary
Accept-Encoding
content-type
text/css; charset=utf-8
js
www.googletagmanager.com/gtag/
294 KB
99 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-5JJTR8XKXM
Requested by
Host: s.id
URL: https://s.id/3UYU4?a=confirm
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
ff245b10e2e09c9a0de5b63d89f2e7853f3b97e38ec8c402d35c4241feb9c1de
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://s.id/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 29 Apr 2024 07:07:32 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
100535
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Mon, 29 Apr 2024 07:07:32 GMT
gpt.js
securepubads.g.doubleclick.net/tag/js/
95 KB
30 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/tag/js/gpt.js
Requested by
Host: s.id
URL: https://s.id/3UYU4?a=confirm
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
c62c0d3923c79336f8fc88d3be3d434b05b8e660dfabe6963aced65d8f8126bc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://s.id/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 29 Apr 2024 07:07:32 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
30284
x-xss-protection
0
server
cafe
etag
859 / 19842 / m202404230101 / config-hash: 8127643254797218485
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
expires
Mon, 29 Apr 2024 07:07:32 GMT
site.js
protagcdn.com/s/s.id/
476 KB
135 KB
Script
General
Full URL
https://protagcdn.com/s/s.id/site.js
Requested by
Host: s.id
URL: https://s.id/3UYU4?a=confirm
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:78e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e1b059c1bada07b7fac2fc625dc687833d6a8928ce4cd217ca258bbc2134e753

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://s.id/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 29 Apr 2024 07:07:32 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
3236
cf-polished
origSize=488596
alt-svc
h3=":443"; ma=86400
pragma
no-cache
cf-bgj
minify
last-modified
Wed, 06 Mar 2024 14:47:11 GMT
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HFb7rUJNCRsqmT594KytOIKOLo37eeNZal9UfiE3flTRINlQIy4SF1BMekizJSPT%2BlHPkqUMJQ46fxZWl%2F0SfDc2tHA7IQYtgjC4I1hQ6F6YNgVwIVefKChQG7g9KU2Z5JiESfyNd5NfncM%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
public, max-age=1800
cf-ray
87bd74a84a6965d3-FRA
expires
Mon, 29 Apr 2024 07:37:32 GMT
collect
region1.google-analytics.com/g/
0
246 B
Ping
General
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-5JJTR8XKXM&gtm=45je44o0v9123215351za200&_p=1714374452407&gcd=13l3l3l2l1&npa=1&dma_cps=sypham&dma=1&cid=775877893.1714374452&ul=de-de&sr=1600x1200&uaa=x86&uab=64&uafvl=Chromium%3B124.0.6367.78%7CGoogle%2520Chrome%3B124.0.6367.78%7CNot-A.Brand%3B99.0.0.0&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&pscdl=noapi&_s=1&sid=1714374452&sct=1&seg=0&dl=https%3A%2F%2Fs.id%2F3UYU4%3Fa%3Dconfirm&dt=Confirm%20redirect%20action&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=3217
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-5JJTR8XKXM
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://s.id/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Mon, 29 Apr 2024 07:07:32 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://s.id
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pubads_impl.js
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202404230101/
448 KB
140 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202404230101/pubads_impl.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e838bb8caf249027ff1236bb9a02e382e21fe497273c1ba28edc4188b1e22873
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://s.id/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sun, 28 Apr 2024 22:22:45 GMT
content-encoding
br
x-content-type-options
nosniff
age
31487
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
142995
x-xss-protection
0
server
cafe
etag
2748456399490205869
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, immutable, max-age=31536000
timing-allow-origin
*
expires
Mon, 28 Apr 2025 22:22:45 GMT
ads.js
adx.protagcdn.com/ads/advertisement/
200 B
621 B
Script
General
Full URL
https://adx.protagcdn.com/ads/advertisement/ads.js
Requested by
Host: protagcdn.com
URL: https://protagcdn.com/s/s.id/site.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:78e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4307a4a83648898a0381fa21222a3670428146cb065186d0ff72449bdafa8140
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://s.id/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-balancer-id
2
date
Mon, 29 Apr 2024 07:07:32 GMT
strict-transport-security
max-age=63072000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
1618
cf-polished
origSize=248
content-encoding
br
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block
cf-bgj
minify
last-modified
Tue, 09 May 2023 13:32:59 GMT
server
cloudflare
etag
W/"f8-5fb42cb349414"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ODhcK7D8VN5VYLsBSXuZXUgabajpViXgo7Z5Qaru4EmJ6G%2BY2sfO6SuasD%2BeZ2yfzoQORjTOHQFgdMWXSqKQp0zOGgOCQbqEsAqfxYNsvtMiVeGxu2xWMSdDpF%2F%2BmBlV1To%2FGwf6dQXT3QoZvA7V"}],"group":"cf-nel","max_age":604800}
cache-control
public, max-age=691200
cf-ray
87bd74a99bdf65d3-FRA
expires
Tue, 07 May 2024 06:40:34 GMT
rum.js
pagead2.googlesyndication.com/pagead/js/
64 KB
24 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/rum.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202404230101/pubads_impl.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s50-in-f2.1e100.net
Software
cafe /
Resource Hash
54fa27f57b4ef66cc6d21997d8f89000721c1024e9e5c47b57b127242ddc0d87
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://s.id/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 29 Apr 2024 06:37:45 GMT
content-encoding
br
x-content-type-options
nosniff
age
1787
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
24233
x-xss-protection
0
server
cafe
etag
5057382965656609286
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=3600
timing-allow-origin
*
expires
Mon, 29 Apr 2024 07:37:45 GMT
gen_204
pagead2.googlesyndication.com/pagead/
0
20 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=ama_stats&su=s.id&doc=complete&pg_h=1200&pg_w=1600&pg_hs=1200&c=0&aa_c=0&d=0&all_d=0&ard=0&all_ard=0&dt=d
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s50-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://s.id/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Mon, 29 Apr 2024 07:07:32 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
favicon.ico
s.id/
15 KB
15 KB
Other
General
Full URL
https://s.id/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
193.84.85.178 , Russian Federation, ASN59796 (STORMWALL-AS, SK),
Reverse DNS
Software
nginx /
Resource Hash
a05789cd9683fb9e396e903f578abe9eabdb590e7968e2224fed9e51809f3993
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://s.id/3UYU4?a=confirm
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 29 Apr 2024 07:07:33 GMT
cache-control
public, max-age=31536000
strict-transport-security
max-age=15724800; includeSubDomains
server
nginx
content-length
15406
vary
Accept-Encoding
content-type
image/x-icon
ads
pagead2.googlesyndication.com/gampad/
496 B
243 B
Fetch
General
Full URL
https://pagead2.googlesyndication.com/gampad/ads?pvsid=4297442987414359&correlator=1527957122131529&eid=31079956%2C31082700%2C31082777%2C31083106%2C95328479%2C31061691%2C31061692&output=ldjh&gdfp_req=1&vrg=202404230101&ptt=17&impl=fifs&ltd_cs=1&iu_parts=162717810%3A22766112657%2Cs.id%2Cin_content&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=468x280%7C336x280%7C320x100%7C320x50%7C300x300%7C300x250&ifi=1&didk=3656045228&sfv=1-0-40&sc=1&abxe=1&dt=1714374452981&lmt=1714374452&adxs=566&adys=721&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=120&dmc=8&bc=31&nvt=1&uach=WyJXaW4zMiIsIjEwLjAuMCIsIng4NiIsIiIsIjEyNC4wLjYzNjcuNzgiLG51bGwsMCxudWxsLCI2NCIsW1siQ2hyb21pdW0iLCIxMjQuMC42MzY3Ljc4Il0sWyJHb29nbGUgQ2hyb21lIiwiMTI0LjAuNjM2Ny43OCJdLFsiTm90LUEuQnJhbmQiLCI5OS4wLjAuMCJdXSwwXQ..&url=https%3A%2F%2Fs.id%2F3UYU4%3Fa%3Dconfirm&rumc=4297442987414359&rume=1&vis=1&psz=592x0&msz=592x0&fws=4&ohw=1600&dlt=1714374452048&idt=668&prev_scp=env%3Dprod%26site%3Ds.id%26referrer%3D-%26protag_env%3Dprod%26protag_page-url%3Dhttps%253A%252F%252Fs.id%252F3UYU4%253Fa%253Dconfirm%26protag_template%3Dsite%26utm_campaign%3D-%26utm_source%3D-%26utm_medium%3D-%26utm_term%3D-%26utm_content%3D-%26protag_ref%3Dother%26protag_ref_group%3Ddirect%26protag_ref_paid%3Dfalse%26protag_segment_20m%3D21%26protag_minutes%3D07%26protag_hours%3D07%26protag_day%3D1%26protag_native%3Dnative%26protag_enable_native%3Dtrue%26pa_upr%3D0.00%26protag_upr%3D0.00%26protag_opt_u%3D0%2CX%26protag_proSlotId%3Dprotag-in_content&cust_params=adBlock%3Dfalse&adks=3108647390&frm=20
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202404230101/pubads_impl.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s50-in-f2.1e100.net
Software
cafe /
Resource Hash
dec05962c4fa5c7185727221be69565d437525c3487983ed2d6788167b2189f7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://s.id/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 29 Apr 2024 07:07:33 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
214
x-xss-protection
0
google-lineitem-id
-2
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
-2
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://s.id
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
sodar
pagead2.googlesyndication.com/getconfig/
16 KB
12 KB
XHR
General
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=m202404230101&st=env
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202404230101/pubads_impl.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s50-in-f2.1e100.net
Software
cafe /
Resource Hash
bcd9a5b5f15caa86d6b7a3926381c21289e71a8b6338417fd3350e0feaa66716
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://s.id/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 29 Apr 2024 07:07:33 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
application/json; charset=UTF-8
access-control-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
12338
x-xss-protection
0
container.html
e8c8fbcbc96c5bd265790eb771c975d4.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 5717
0
0
Document
General
Full URL
https://e8c8fbcbc96c5bd265790eb771c975d4.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202404230101/pubads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://s.id/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, immutable, max-age=31536000
content-encoding
br
content-length
2653
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Mon, 29 Apr 2024 07:07:33 GMT
expires
Tue, 29 Apr 2025 07:07:33 GMT
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
sodar2.js
tpc.googlesyndication.com/sodar/
17 KB
7 KB
Script
General
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202404230101/pubads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://s.id/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 29 Apr 2024 07:07:33 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
6386
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
etag
"1637097310169751"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Mon, 29 Apr 2024 07:07:33 GMT
runner.html
tpc.googlesyndication.com/sodar/sodar2/225/ Frame F963
0
0
Document
General
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://s.id/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

accept-ranges
bytes
age
40766
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
5046
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
date
Sun, 28 Apr 2024 19:48:07 GMT
expires
Mon, 28 Apr 2025 19:48:07 GMT
last-modified
Mon, 21 Jun 2021 20:47:05 GMT
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server
sffe
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
csi
csi.gstatic.com/
0
234 B
Ping
General
Full URL
https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&top=1&puid=1~lvkma9vq&c=4297442987414359&e=31079956%2C31082700%2C31082777%2C31083106%2C95328479%2C31061691%2C31061692&ctx=1&met.9=1.2kt~2.2op~9.0~3_2.2w9~7_2.0~4_2.3c9~5_2.3ca&met.3=112.2sz_1~113.2t4_5&met.1=1.lvkma72r~4.0~5.1pp~6.1pp~7.1pp~8.1pp~9.1pp~10.1pp~12.1pr~13.24h~14.24n~15.265~16.2hn~17.2hn~18.2hn~19.2t1~20.2t1~21.2t1~22.2ht~23.2ht&qqid.2=CMbxqMLu5oUDFf2agwcddG0OJA
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/rum.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c0a::78 Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://s.id/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Mon, 29 Apr 2024 07:07:34 GMT
last-modified
Wed, 21 Jan 2004 19:51:30 GMT
server
Golfe2
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sodar
pagead2.googlesyndication.com/pagead/
0
0

collect
region1.google-analytics.com/g/
0
54 B
Ping
General
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-5JJTR8XKXM&gtm=45je44o0v9123215351za200&_p=1714374452407&gcd=13l3l3l2l1&npa=1&dma_cps=sypham&dma=1&cid=775877893.1714374452&ul=de-de&sr=1600x1200&uaa=x86&uab=64&uafvl=Chromium%3B124.0.6367.78%7CGoogle%2520Chrome%3B124.0.6367.78%7CNot-A.Brand%3B99.0.0.0&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&pscdl=noapi&_eu=AEA&_s=2&sid=1714374452&sct=1&seg=0&dl=https%3A%2F%2Fs.id%2F3UYU4%3Fa%3Dconfirm&dt=Confirm%20redirect%20action&en=scroll&epn.percent_scrolled=90&_et=2&tfd=8221
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-5JJTR8XKXM
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://s.id/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Mon, 29 Apr 2024 07:07:37 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://s.id
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
pagead2.googlesyndication.com
URL
https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_m202404230101&jk=4297442987414359&bg=!SEulSwTNAAYBeExMIXg7ADQBe5WfOKJxBMhPOhtgxXxo5JOAodobqvuVGJw6VVHwQuEr7gA7Fmo4qiL3qxBrKWeociPuAgAAA0NSAAAAAmgBB34ANepkDuMNqlMkpVuOMjJfi8UyBXC9FxS_jVmOVszJyUPWf6jy2723xDjeSkuDi6kFR_wboebrmQKMrOzkV0nUeT1Jl_Eg607oXnuookQt8UsrAZeurF5TWXZpsBugjKuosFqxEr-b46RFPpFnxdrdG69I-WpzhjbfkeBjS088zUwVMk_6EseEIr_QmHqBIg_MXxpEhMmH0oD_FDJgH7ms1SWnuITy54hjfcBHECtrFzBS9psagyF2j8IncvyvfywMWF_g_jwMvF5DzYaE1Qpm04krUQmMz8llE2W0Bog0NO_TKDOP_JBGRQf14To2Q2wEJyzaR8CeYVX2oHBKt5s_QYTghl5w_A6Teip7fnBrOjBKMi4cP1zrVAIlXVHw-vi6MT9mikmUhD1PT6wfqtK_MgtX84uuD_Pu-TworOBl9RXBa3iXKr4BZPfuvxzm4G5AQ0hslz_a9KDcbvDWFBYuMamnIoY0VHxMjtgFT_aXDkA_BdmgyzBm0eZ7KPT6Kj8Gn65u9tPy8_cc7C1--_za0X9h1qcXP9xGIVKjjW6LdMZ1d1aA9xZYvH3UwkmWum1-nPPXfug5sK35wcfZQj2Eq-Y__WoHxueRjb8IMjdGZlvAtsEl-1BWVzWkhzM1pmgSTEcjfVzEXrDRmcRgB8JS3DZ5HFL0cj-onSAUsXH1oo4Jc0STvMHVBhjY9NRzvHcQm12aWbYj-CNPZfDqmA_Eo9ScGWbYavWYGGIb9gPCHkFq_YHf3ZGdbiNd1KQWS_yhA4pDI4bzXrRNCy507MIKowdPlwzPdRj_Vi6dHEI4VUX8VvGLLFoUUuhqKANdAessBPMVVw9GWnzsKcxijoZrDF8yMLOARG5mc6xqS9a2R3ua1eVjNUKS79p9UyXFuPEM8t5eoHbinssgH4TJSxyIdw3po6rIqdDxUqE17uolDRfj-y4hyQ

Verdicts & Comments Add Verdict or Comment

23 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| google_tag_manager object| google_tag_data object| dataLayer function| gtag function| onYouTubeIframeAPIReady object| gaGlobal object| googletag object| protag object| ggeac object| google_js_reporting_queue boolean| google_measure_js_timing object| google_rum_config string| protag_matomo_domain string| protag_matomo_SiteID object| google_reactive_ads_global_state number| google_srt object| _google_rum_ns_ undefined| google_rum_values object| google_image_requests number| google_unique_id object| GoogleGcLKhOms undefined| google_timing_params

2 Cookies

Domain/Path Name / Value
.s.id/ Name: _ga
Value: GA1.1.775877893.1714374452
.s.id/ Name: _ga_5JJTR8XKXM
Value: GS1.1.1714374452.1.0.1714374452.0.0.0

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

adx.protagcdn.com
csi.gstatic.com
e8c8fbcbc96c5bd265790eb771c975d4.safeframe.googlesyndication.com
pagead2.googlesyndication.com
protagcdn.com
region1.google-analytics.com
s.id
securepubads.g.doubleclick.net
tpc.googlesyndication.com
www.googletagmanager.com
pagead2.googlesyndication.com
142.250.185.130
193.84.85.178
2001:4860:4802:34::36
2606:4700:20::681a:78e
2a00:1450:4001:806::2001
2a00:1450:4001:80f::2002
2a00:1450:4001:813::2001
2a00:1450:4001:82f::2008
2a00:1450:400c:c0a::78
4307a4a83648898a0381fa21222a3670428146cb065186d0ff72449bdafa8140
54fa27f57b4ef66cc6d21997d8f89000721c1024e9e5c47b57b127242ddc0d87
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
a05789cd9683fb9e396e903f578abe9eabdb590e7968e2224fed9e51809f3993
bcd9a5b5f15caa86d6b7a3926381c21289e71a8b6338417fd3350e0feaa66716
c62c0d3923c79336f8fc88d3be3d434b05b8e660dfabe6963aced65d8f8126bc
d86c32448881af0e96b6a83c83e12b5fa322415920ba574e5103d88dd70c1103
dec05962c4fa5c7185727221be69565d437525c3487983ed2d6788167b2189f7
e1b059c1bada07b7fac2fc625dc687833d6a8928ce4cd217ca258bbc2134e753
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5418a81cd7716d739dae9286f08a4d0e1292afa3f3961da195ec62127dfa0f5
e838bb8caf249027ff1236bb9a02e382e21fe497273c1ba28edc4188b1e22873
ff245b10e2e09c9a0de5b63d89f2e7853f3b97e38ec8c402d35c4241feb9c1de