urlscan.io logo urlscan.io
SecurityTrails logo

cd.usedealer.click Open in urlscan Pro
198.54.117.242  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://qbqd20067.submittrk5.com/
Effective URL: https://cd.usedealer.click/?utm_medium=4451766718d6d6af6232cd3e772ffb5117e3cb21&utm_campaign=Main&1=35429&cid=d1d77588c9a94...
Submission: On December 21 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 4 countries across 7 domains to perform 16 HTTP transactions. The main IP is 198.54.117.242, located in United States and belongs to NAMECHEAP-NET, US. The main domain is cd.usedealer.click.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on November 11th 2024. Valid for: a year.
This is the only time cd.usedealer.click was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 2 34.22.240.62 396982 (GOOGLE-CL...)
1 1 104.21.32.1 13335 (CLOUDFLAR...)
1 1 2a05:d018:e36... 16509 (AMAZON-02)
1 198.54.117.242 22612 (NAMECHEAP...)
14 2606:4700::68... 13335 (CLOUDFLAR...)
1 104.16.100.56 13335 (CLOUDFLAR...)
16 4
2    34.22.240.62 (Brussels, Belgium)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 62.240.22.34.bc.googleusercontent.com
qbqd20067.submittrk5.com
duct.infralead.net
1    104.21.32.1 (None, )

ASN13335 (CLOUDFLARENET, US)
offer-select.com
1    2a05:d018:e36:3910:1d4c:9919:7871:728a (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
cddtsecure.com
1    198.54.117.242 (United States)

ASN22612 (NAMECHEAP-NET, US)
cd.usedealer.click
14    2606:4700::6812:ad39 (United States)

ASN13335 (CLOUDFLARENET, US)
static.nc-img.com
1    104.16.100.56 (None, )

ASN13335 (CLOUDFLARENET, US)
www.namecheap.com
Apex Domain
Subdomains		 Transfer
14 nc-img.com
static.nc-img.com — Cisco Umbrella Rank: 237052
410 KB
1 namecheap.com
www.namecheap.com — Cisco Umbrella Rank: 173852
2 KB
1 usedealer.click
cd.usedealer.click
61 KB
1 cddtsecure.com
cddtsecure.com
4 KB
1 offer-select.com
offer-select.com
902 B
1 infralead.net
duct.infralead.net
572 B
1 submittrk5.com
qbqd20067.submittrk5.com
820 B
16 7
Domain Requested by
14 static.nc-img.com cd.usedealer.click
static.nc-img.com
1 www.namecheap.com
1 cd.usedealer.click
1 cddtsecure.com 1 redirects
1 offer-select.com 1 redirects
1 duct.infralead.net 1 redirects
1 qbqd20067.submittrk5.com 1 redirects
16 7

This site contains links to these domains. Also see Links.

Domain
www.namecheap.com
ap.www.namecheap.com
Subject Issuer Validity Valid
raa.namecheap.com
Sectigo RSA Domain Validation Secure Server CA		 2024-11-11 -
2025-11-29		 a year crt.sh
static.nc-img.com
WE1		 2024-11-16 -
2025-02-14		 3 months crt.sh
www.namecheap.com
Sectigo ECC Extended Validation Secure Server CA		 2023-12-08 -
2025-01-07		 a year crt.sh

This page contains 1 frames:

Primary Page: https://cd.usedealer.click/?utm_medium=4451766718d6d6af6232cd3e772ffb5117e3cb21&utm_campaign=Main&1=35429&cid=d1d77588c9a94b6f88556690d33c9a3322b88
Frame ID: 21781105C526B3146685492CC0736493
Requests: 21 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

cd.usedealer.click - ICANN Verification Needed | Namecheap.com

Page URL History Show full URLs

  1. http://qbqd20067.submittrk5.com/ HTTP 307
    https://qbqd20067.submittrk5.com/ HTTP 302
    https://duct.infralead.net/tools/SetRedirect/?pos=f_de1&reason=Missing%20offer_id&aff_code=&vl_ph_resul... HTTP 302
    https://offer-select.com/5529cebd-836b-4cfb-80e5-c9670cd773ce?cookie=&externalid=;;;;;;;;;;;;;;&ld_fi... HTTP 302
    https://cddtsecure.com/?a=35429&c=354212&co=32526&mt=18&s1=&s2=w484plmirqrnl9f6je693oia HTTP 302
    https://cd.usedealer.click/?utm_medium=4451766718d6d6af6232cd3e772ffb5117e3cb21&utm_campaign=Main&1=354... Page URL

Page Statistics

16
Requests

94 %
HTTPS

33 %
IPv6

7
Domains

7
Subdomains

4
IPs

4
Countries

472 kB
Transfer

1406 kB
Size

15
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://qbqd20067.submittrk5.com/ HTTP 307
    https://qbqd20067.submittrk5.com/ HTTP 302
    https://duct.infralead.net/tools/SetRedirect/?pos=f_de1&reason=Missing%20offer_id&aff_code=&vl_ph_result=&imsi=&ld_first_name=&ld_last_name=&ld_zip_code=&ld_email=&ld_gender=&ld_address_line1=&ld_phone_cell=&ld_age=&ld_dob=&aff_inc=&externalid=;;;;;;;;;;;;;; HTTP 302
    https://offer-select.com/5529cebd-836b-4cfb-80e5-c9670cd773ce?cookie=&externalid=;;;;;;;;;;;;;;&ld_first_name=&ld_last_name=&ld_zip_code=&ld_email=&ld_gender=&ld_address_line1=&ld_phone_cell=&aff_source=&aff_subsource=&operator=NotMapped&mnc=&ld_dob=&aff_inc=&ld_region_code= HTTP 302
    https://cddtsecure.com/?a=35429&c=354212&co=32526&mt=18&s1=&s2=w484plmirqrnl9f6je693oia HTTP 302
    https://cd.usedealer.click/?utm_medium=4451766718d6d6af6232cd3e772ffb5117e3cb21&utm_campaign=Main&1=35429&cid=d1d77588c9a94b6f88556690d33c9a3322b88 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
cd.usedealer.click/
Redirect Chain
  • http://qbqd20067.submittrk5.com/
  • https://qbqd20067.submittrk5.com/
  • https://duct.infralead.net/tools/SetRedirect/?pos=f_de1&reason=Missing%20offer_id&aff_code=&vl_ph_result=&imsi=&ld_first_name=&ld_last_name=&ld_zip_code=&ld_email=&ld_gender=&ld_address_line1=&ld_p...
  • https://offer-select.com/5529cebd-836b-4cfb-80e5-c9670cd773ce?cookie=&externalid=;;;;;;;;;;;;;;&ld_first_name=&ld_last_name=&ld_zip_code=&ld_email=&ld_gender=&ld_address_line1=&ld_phone_cell=&aff_s...
  • https://cddtsecure.com/?a=35429&c=354212&co=32526&mt=18&s1=&s2=w484plmirqrnl9f6je693oia
  • https://cd.usedealer.click/?utm_medium=4451766718d6d6af6232cd3e772ffb5117e3cb21&utm_campaign=Main&1=35429&cid=d1d77588c9a94b6f88556690d33c9a3322b88
179 KB
61 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://cd.usedealer.click/?utm_medium=4451766718d6d6af6232cd3e772ffb5117e3cb21&utm_campaign=Main&1=35429&cid=d1d77588c9a94b6f88556690d33c9a3322b88
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
198.54.117.242 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
Software
namecheap-nginx /
Resource Hash
65b343bf3820ddc65a1aa86602c83b102421b4999dd0e8cc8229c92a1ec9fc50

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
content-type, x-ncpl-rcsrf
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Sat, 21 Dec 2024 09:53:07 GMT
server
namecheap-nginx
vary
Accept-Encoding
x-proxy-cache
HIT

Redirect headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With,X-Auth,Pasha-Jlob
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin
*
content-language
en-US
content-type
text/html;charset=ISO-8859-1
date
Sat, 21 Dec 2024 09:53:07 GMT
location
https://cd.usedealer.click/?utm_medium=4451766718d6d6af6232cd3e772ffb5117e3cb21&utm_campaign=Main&1=35429&cid=d1d77588c9a94b6f88556690d33c9a3322b88
server
nginx
museo-sans-300-webfont.96dd56ebb50aa0150f6630360d8d69cf.woff2
static.nc-img.com/pp/nc-ui-globalenv/ 		20 KB
20 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://static.nc-img.com/pp/nc-ui-globalenv/museo-sans-300-webfont.96dd56ebb50aa0150f6630360d8d69cf.woff2
Requested by
Host: cd.usedealer.click
URL: https://cd.usedealer.click/?utm_medium=4451766718d6d6af6232cd3e772ffb5117e3cb21&utm_campaign=Main&1=35429&cid=d1d77588c9a94b6f88556690d33c9a3322b88
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:ad39 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
93467f75842330c3502fc0268a7a62151f3744221ca7ffa6dc5057dac4a64cee

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin
https://cd.usedealer.click
Referer
https://cd.usedealer.click/

Response headers

cache-control
public, max-age=31536000, immutable
cf-cache-status
HIT
etag
"6645c3d0-5170"
age
147121
cf-ray
8f56fbba2e1dd27d-FRA
accept-ranges
bytes
access-control-allow-origin
*
content-length
20848
date
Sat, 21 Dec 2024 09:53:08 GMT
content-type
font/woff2
last-modified
Thu, 16 May 2024 08:29:04 GMT
vary
Origin, Accept-Encoding
server
cloudflare
museo-sans-500-webfont.5d9883d92e2eaa724e4e6beb0ef6728a.woff2
static.nc-img.com/pp/nc-ui-globalenv/ 		20 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://static.nc-img.com/pp/nc-ui-globalenv/museo-sans-500-webfont.5d9883d92e2eaa724e4e6beb0ef6728a.woff2
Requested by
Host: cd.usedealer.click
URL: https://cd.usedealer.click/?utm_medium=4451766718d6d6af6232cd3e772ffb5117e3cb21&utm_campaign=Main&1=35429&cid=d1d77588c9a94b6f88556690d33c9a3322b88
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:ad39 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9c0749dc1deb3275e1846a462c0dcb83df2b5fec30112eacdf5530fa51e3160f

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin
https://cd.usedealer.click
Referer
https://cd.usedealer.click/

Response headers

cache-control
public, max-age=31536000, immutable
cf-cache-status
HIT
etag
"6645c3d0-51b8"
age
147122
cf-ray
8f56fbba2e1fd27d-FRA
accept-ranges
bytes
access-control-allow-origin
*
content-length
20920
date
Sat, 21 Dec 2024 09:53:08 GMT
content-type
font/woff2
last-modified
Thu, 16 May 2024 08:29:04 GMT
vary
Origin, Accept-Encoding
server
cloudflare
museo-sans-700-webfont.b125dc012841fa8a23b98c37499ca5e8.woff2
static.nc-img.com/pp/nc-ui-globalenv/ 		18 KB
18 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://static.nc-img.com/pp/nc-ui-globalenv/museo-sans-700-webfont.b125dc012841fa8a23b98c37499ca5e8.woff2
Requested by
Host: cd.usedealer.click
URL: https://cd.usedealer.click/?utm_medium=4451766718d6d6af6232cd3e772ffb5117e3cb21&utm_campaign=Main&1=35429&cid=d1d77588c9a94b6f88556690d33c9a3322b88
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:ad39 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
177c4f2826cbc2cc24a9d8018e6c9848ed73178a76fd3aabe99b44ee9458514c

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin
https://cd.usedealer.click
Referer
https://cd.usedealer.click/

Response headers

cache-control
public, max-age=31536000, immutable
cf-cache-status
HIT
etag
"6645c3d0-46d0"
age
147122
cf-ray
8f56fbba2e20d27d-FRA
accept-ranges
bytes
access-control-allow-origin
*
content-length
18128
date
Sat, 21 Dec 2024 09:53:08 GMT
content-type
font/woff2
last-modified
Thu, 16 May 2024 08:29:04 GMT
vary
Origin, Accept-Encoding
server
cloudflare
mainLegacy.6eb4134f13e2f1d3b205b790d90acbc5.css
static.nc-img.com/pp/nc-ui-globalenv/ 		169 KB
43 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://static.nc-img.com/pp/nc-ui-globalenv/mainLegacy.6eb4134f13e2f1d3b205b790d90acbc5.css
Requested by
Host: cd.usedealer.click
URL: https://cd.usedealer.click/?utm_medium=4451766718d6d6af6232cd3e772ffb5117e3cb21&utm_campaign=Main&1=35429&cid=d1d77588c9a94b6f88556690d33c9a3322b88
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:ad39 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9436e0161212285124586ace8780b12fe73d8145f7d3d7b73ef2f352f0e934e4

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin
https://cd.usedealer.click
Referer
https://cd.usedealer.click/

Response headers

cache-control
public, max-age=31536000, immutable
content-encoding
gzip
cf-cache-status
HIT
etag
W/"6645c3d0-2a5d0"
age
146975
cf-ray
8f56fbba2e1ad27d-FRA
access-control-allow-origin
*
date
Sat, 21 Dec 2024 09:53:08 GMT
content-type
text/css
last-modified
Thu, 16 May 2024 08:29:04 GMT
vary
Accept-Encoding, Origin
server
cloudflare
app.ab29bfd164428d10f32bc34df1cad4ed.css
static.nc-img.com/uiraa/ 		31 KB
15 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://static.nc-img.com/uiraa/app.ab29bfd164428d10f32bc34df1cad4ed.css
Requested by
Host: cd.usedealer.click
URL: https://cd.usedealer.click/?utm_medium=4451766718d6d6af6232cd3e772ffb5117e3cb21&utm_campaign=Main&1=35429&cid=d1d77588c9a94b6f88556690d33c9a3322b88
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:ad39 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1c4e83808bf28a02416bfb12ee9fab3c5c55e075376a472d64fcfdbbfab01a51

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin
https://cd.usedealer.click
Referer
https://cd.usedealer.click/

Response headers

cache-control
public, max-age=31536000, immutable
content-encoding
gzip
cf-cache-status
HIT
etag
W/"67504317-7cb1"
age
147122
cf-ray
8f56fbba2e1bd27d-FRA
access-control-allow-origin
*
date
Sat, 21 Dec 2024 09:53:08 GMT
content-type
text/css
last-modified
Wed, 04 Dec 2024 11:55:03 GMT
vary
Accept-Encoding, Origin
server
cloudflare
app.987bc2c8f8959bbb732c.js
static.nc-img.com/uiraa/ 		74 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.nc-img.com/uiraa/app.987bc2c8f8959bbb732c.js
Requested by
Host: cd.usedealer.click
URL: https://cd.usedealer.click/?utm_medium=4451766718d6d6af6232cd3e772ffb5117e3cb21&utm_campaign=Main&1=35429&cid=d1d77588c9a94b6f88556690d33c9a3322b88
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:ad39 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
59b3cf18fcdb1242d5bc5e02b6d7537ea50c9bec9b8eb818a35da80ebca3696e

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin
https://cd.usedealer.click
Referer
https://cd.usedealer.click/

Response headers

cache-control
public, max-age=31536000, immutable
content-encoding
gzip
cf-cache-status
HIT
etag
W/"67504317-12992"
age
147122
cf-ray
8f56fbba2e21d27d-FRA
access-control-allow-origin
*
date
Sat, 21 Dec 2024 09:53:08 GMT
content-type
application/javascript
last-modified
Wed, 04 Dec 2024 11:55:03 GMT
vary
Accept-Encoding, Origin
server
cloudflare
polyfills_469970f8ffedace1b5b8.js
static.nc-img.com/uiraa/libs/ 		183 KB
57 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.nc-img.com/uiraa/libs/polyfills_469970f8ffedace1b5b8.js
Requested by
Host: cd.usedealer.click
URL: https://cd.usedealer.click/?utm_medium=4451766718d6d6af6232cd3e772ffb5117e3cb21&utm_campaign=Main&1=35429&cid=d1d77588c9a94b6f88556690d33c9a3322b88
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:ad39 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9c0bd44b3d16140158eb5f52b28e48cbdfdb7215b06dfeeb2cd07078361e1016

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin
https://cd.usedealer.click
Referer
https://cd.usedealer.click/

Response headers

cache-control
public, max-age=31536000, immutable
content-encoding
gzip
cf-cache-status
HIT
etag
W/"67504317-2dbad"
age
119634
cf-ray
8f56fbbabed6d27d-FRA
access-control-allow-origin
*
date
Sat, 21 Dec 2024 09:53:08 GMT
content-type
application/javascript
last-modified
Wed, 04 Dec 2024 11:55:03 GMT
vary
Accept-Encoding, Origin
server
cloudflare
museo-sans-300-webfont.79d75c0208e298dce66a21f77de03ef7.woff
static.nc-img.com/pp/nc-ui-globalenv/ 		34 KB
35 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://static.nc-img.com/pp/nc-ui-globalenv/museo-sans-300-webfont.79d75c0208e298dce66a21f77de03ef7.woff
Requested by
Host: static.nc-img.com
URL: https://static.nc-img.com/pp/nc-ui-globalenv/mainLegacy.6eb4134f13e2f1d3b205b790d90acbc5.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:ad39 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6a382a283c77b7e93e7bb5b0b1902242082a4800dac20da3334d641093b33005

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin
https://cd.usedealer.click
Referer
https://static.nc-img.com/pp/nc-ui-globalenv/mainLegacy.6eb4134f13e2f1d3b205b790d90acbc5.css

Response headers

cache-control
public, max-age=31536000, immutable
cf-cache-status
HIT
etag
"6645c3d0-89a9"
age
108819
cf-ray
8f56fbbabedad27d-FRA
accept-ranges
bytes
access-control-allow-origin
*
content-length
35241
date
Sat, 21 Dec 2024 09:53:08 GMT
content-type
font/woff
last-modified
Thu, 16 May 2024 08:29:04 GMT
vary
Origin, Accept-Encoding
server
cloudflare
vendors_70ac76496c2b0e5ed06c.js
static.nc-img.com/uiraa/libs/ 		598 KB
130 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.nc-img.com/uiraa/libs/vendors_70ac76496c2b0e5ed06c.js
Requested by
Host: cd.usedealer.click
URL: https://cd.usedealer.click/?utm_medium=4451766718d6d6af6232cd3e772ffb5117e3cb21&utm_campaign=Main&1=35429&cid=d1d77588c9a94b6f88556690d33c9a3322b88
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:ad39 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1230ad30ea6bbcc22f8e08d8a496c66aac8266db7a4b72b2c465e0ec89c2c658

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin
https://cd.usedealer.click
Referer
https://cd.usedealer.click/

Response headers

cache-control
public, max-age=31536000, immutable
content-encoding
gzip
cf-cache-status
HIT
etag
W/"67504317-95896"
age
147120
cf-ray
8f56fbbaef34d27d-FRA
access-control-allow-origin
*
date
Sat, 21 Dec 2024 09:53:08 GMT
content-type
application/javascript
last-modified
Wed, 04 Dec 2024 11:55:03 GMT
vary
Accept-Encoding, Origin
server
cloudflare
logo.4072d8d7bfca34be693eb0e573c3b7fe.png
static.nc-img.com/uiraa/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.nc-img.com/uiraa/logo.4072d8d7bfca34be693eb0e573c3b7fe.png
Requested by
Host: cd.usedealer.click
URL: https://cd.usedealer.click/?utm_medium=4451766718d6d6af6232cd3e772ffb5117e3cb21&utm_campaign=Main&1=35429&cid=d1d77588c9a94b6f88556690d33c9a3322b88
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:ad39 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9b69072496fa454b46c2e91ea0bcfeeedc8a47b268a07863c9eee88082aa6937

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://cd.usedealer.click/

Response headers

cache-control
public, max-age=31536000, immutable
cf-cache-status
HIT
etag
"66842699-58a"
age
3554600
cf-ray
8f56fbbb9923dcc5-FRA
accept-ranges
bytes
content-length
1418
date
Sat, 21 Dec 2024 09:53:08 GMT
content-type
image/png
last-modified
Tue, 02 Jul 2024 16:11:05 GMT
vary
Origin, Accept-Encoding
server
cloudflare
hero.369b97593fa5f939cfc8fd458c458737.png
static.nc-img.com/uiraa/ 		19 KB
19 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.nc-img.com/uiraa/hero.369b97593fa5f939cfc8fd458c458737.png
Requested by
Host: cd.usedealer.click
URL: https://cd.usedealer.click/?utm_medium=4451766718d6d6af6232cd3e772ffb5117e3cb21&utm_campaign=Main&1=35429&cid=d1d77588c9a94b6f88556690d33c9a3322b88
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:ad39 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f9b75086bd476abd93292b689dff7eef57d037834e7d0926107421492e22fa2c

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://cd.usedealer.click/

Response headers

cache-control
public, max-age=31536000, immutable
cf-cache-status
HIT
etag
"63c54f11-4aee"
age
3212826
cf-ray
8f56fbbb9925dcc5-FRA
accept-ranges
bytes
content-length
19182
date
Sat, 21 Dec 2024 09:53:08 GMT
content-type
image/png
last-modified
Mon, 16 Jan 2023 13:20:17 GMT
vary
Origin, Accept-Encoding
server
cloudflare
truncated
/ 		4 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
3ccf7ed93b7cc4f085a183a1e86548e6dca77902145f4bf11d5746b08ff6eb9a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml
email.168aa475ec312d6c7a976ba66ef4e982.png
static.nc-img.com/uiraa/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.nc-img.com/uiraa/email.168aa475ec312d6c7a976ba66ef4e982.png
Requested by
Host: cd.usedealer.click
URL: https://cd.usedealer.click/?utm_medium=4451766718d6d6af6232cd3e772ffb5117e3cb21&utm_campaign=Main&1=35429&cid=d1d77588c9a94b6f88556690d33c9a3322b88
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:ad39 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cbbda36462bd705a3377cc1a607db2382c033161e16c56a8aadfe93f292874e0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://cd.usedealer.click/

Response headers

cache-control
public, max-age=31536000, immutable
cf-cache-status
HIT
etag
"67409c46-cd6"
age
1402867
cf-ray
8f56fbbb9927dcc5-FRA
accept-ranges
bytes
content-length
3286
date
Sat, 21 Dec 2024 09:53:08 GMT
content-type
image/png
last-modified
Fri, 22 Nov 2024 14:59:18 GMT
vary
Origin, Accept-Encoding
server
cloudflare
user.9c3b83fd37ab617bbe55d0fdc0222fa9.png
static.nc-img.com/uiraa/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.nc-img.com/uiraa/user.9c3b83fd37ab617bbe55d0fdc0222fa9.png
Requested by
Host: cd.usedealer.click
URL: https://cd.usedealer.click/?utm_medium=4451766718d6d6af6232cd3e772ffb5117e3cb21&utm_campaign=Main&1=35429&cid=d1d77588c9a94b6f88556690d33c9a3322b88
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:ad39 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7307ff8fce6be70dbd3c6ec226910961f863b26f4abce662a7f757821e7b9b1f

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://cd.usedealer.click/

Response headers

cache-control
public, max-age=31536000, immutable
cf-cache-status
HIT
etag
"65cf7279-d38"
age
1739236
cf-ray
8f56fbbb9926dcc5-FRA
accept-ranges
bytes
content-length
3384
date
Sat, 21 Dec 2024 09:53:08 GMT
content-type
image/png
last-modified
Fri, 16 Feb 2024 14:34:33 GMT
vary
Origin, Accept-Encoding
server
cloudflare
truncated
/ 		3 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
cf480b9e53faa747671f7ba85c948ba05063714567a12b083594c8c1adb87a81

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml
truncated
/ 		10 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
f04a3e5df37639d827f031e7028bea5a3ebbaacb21252e0427fae1f1c6d32592

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/png
truncated
/ 		967 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ad05ef3b436c4d0b92331ec02d8c63e3b3d8f4144249abf095eebefaf4af56cf

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml
truncated
/ 		1 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
89bedb78cb157a573d0ae0ba0aadf8b7fb584d323e4c5e9e536d84bd67f5ceb5

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml
gb-icon.c1d44d108721dddbcc98281fe137cda6.woff2
static.nc-img.com/pp/nc-ui-globalenv/ 		26 KB
26 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://static.nc-img.com/pp/nc-ui-globalenv/gb-icon.c1d44d108721dddbcc98281fe137cda6.woff2
Requested by
Host: static.nc-img.com
URL: https://static.nc-img.com/pp/nc-ui-globalenv/mainLegacy.6eb4134f13e2f1d3b205b790d90acbc5.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:ad39 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7be1913e58996bc81cb052e9914cb492d0acf125434ed1ddf0144d8a93189dff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin
https://cd.usedealer.click
Referer
https://static.nc-img.com/pp/nc-ui-globalenv/mainLegacy.6eb4134f13e2f1d3b205b790d90acbc5.css

Response headers

cache-control
public, max-age=31536000, immutable
cf-cache-status
HIT
etag
"6645c3d0-6644"
age
147118
cf-ray
8f56fbbb8ffed27d-FRA
accept-ranges
bytes
access-control-allow-origin
*
content-length
26180
date
Sat, 21 Dec 2024 09:53:08 GMT
content-type
font/woff2
last-modified
Thu, 16 May 2024 08:29:04 GMT
vary
Origin, Accept-Encoding
server
cloudflare
favicon.ico
www.namecheap.com/assets/img/nc-icon/ 		8 KB
2 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://www.namecheap.com/assets/img/nc-icon/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.100.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8625166490607fd513aef4a7b29927f616b8537d2602cb6b4aa00935cd5639f6
Security Headers
Name Value
Strict-Transport-Security max-age=16000000; includeSubDomains
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://cd.usedealer.click/

Response headers

content-encoding
gzip
cf-cache-status
HIT
age
3192
access-control-allow-methods
GET, POST
expires
Sat, 21 Dec 2024 13:53:08 GMT
date
Sat, 21 Dec 2024 09:53:08 GMT
last-modified
Sat, 21 Dec 2024 08:59:56 GMT
content-type
image/x-icon
vary
Accept-Encoding
x-inst
21
x-frame-options
SAMEORIGIN
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, _NcCompliance
strict-transport-security
max-age=16000000; includeSubDomains
cache-control
public, max-age=14400
access-control-allow-credentials
true
cf-ray
8f56fbbc1b5318e1-FRA
x-xss-protection
1; mode=block
server
cloudflare

Verdicts & Comments Add Verdict or Comment

35 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| nc_mainLegacy object| core object| __core-js_shared__ object| IntlPolyfill object| NC object| nc_scriptLoader object| ncScriptLoader function| __nc_polyfills function| vendors_70ac76496c2b0e5ed06c function| Zone function| __zone_symbol__Promise function| __zone_symbol__setTimeout function| __zone_symbol__clearTimeout function| __zone_symbol__setInterval function| __zone_symbol__clearInterval function| __zone_symbol__requestAnimationFrame function| __zone_symbol__cancelAnimationFrame function| __zone_symbol__webkitRequestAnimationFrame function| __zone_symbol__webkitCancelAnimationFrame function| __zone_symbol__alert function| __zone_symbol__prompt function| __zone_symbol__confirm function| __zone_symbol__MutationObserver function| __zone_symbol__WebKitMutationObserver function| __zone_symbol__FileReader boolean| __ncpolyfillsInitialized object| nc_uiraa object| __zone_symbol__eventTasks object| ng function| getAngularTestability function| getAllAngularTestabilities function| getAllAngularRootElements object| frameworkStabilizers function| __zone_symbol__addEventListener function| __zone_symbol__removeEventListener

15 Cookies

Domain/Path Name / Value
duct.infralead.net/tools/SetRedirect Name: _frmld
Value: 1
qbqd20067.submittrk5.com/ Name: hexa.sid
Value: s%3AEeJrssearFEJSLxZgdx95X1fvItKQpoo.Ie3msIvHGznTggQ8REIl0fOxwrIFaBygftayraypm0M
.offer-select.com/ Name: 5529cebd-836b-4cfb-80e5-c9670cd773ce-v4
Value: wsERSx800DcC6410amUvzni-AhUA1d0TDUpAv3WsyUE
.offer-select.com/ Name: cc-v4
Value: y0jJSDpaknqfvdYpLrINOgSivztOJoS8AjIiU5%2F03uLkXeVTaWsD1CFXs8Rb6HYuosVmz1Q%2B44yVMFvgO48TBP7S7Yxr6TQbpGqWrk%2F9Cn1p15A9fEbABwe0YP9RImlZfLJ7nn%2BVu0MDuoIjNbsHNg%3D%3D
.cddtsecure.com/ Name: gdm_click_adv_freq_v2_1_001
Value: 9aM1XGpWxsbm63MOQbJksAI66DPxw/X6Y1J18UniRzar3uAqy6rY/pD0OP9G8e9n
.cddtsecure.com/ Name: gdm_click_freq_v1_1_001
Value: ZWFbVBCG/uLROGhVmLdDlxnT29GTqJT8G9GPL6JA5dhG39YOcQgwuH+yfsfYii9p
.cddtsecure.com/ Name: gdm_sid_v2_3_001
Value: wMziSXEuMVTUrWP82V94QypW8qEf5yAXBMaYbKvmeZ9mEf6IYcaaVQwtFlIQj9HAL0Ew9DlZVuhwmojs52acHfgtV8Ub3G2eNbAguIihXMiV8FC6q+qWcx0VjaqSRESWBV3gawsGhw0dtDjJCo2B2NI/C5m24gH3MLeOQL6yf9kbB1GQuE8LKKn8pn8Uz7ieT00nELozyOnvAjDM0csATVebjYWtnzXOj59DXuIklZc64pM5kKOXhtqCW8GickyAU6a/qz6m6hyUb9VRYJjBey/iyk1dBSohHjWrH/AinRVjFJ1RNdEyY63FXKjA96Oofaq0a5aY64VHom9eKD1G26a5f1VfPPop3n0zcBwbzZz+E7czwzdxP9EyBFMZ+pTz6BU2T5WRQHZ6IPtvuhyiwzapgCeZY+cTKDcSAu8l0Z3Z3ugNfWWBpW3a4EIQRDHPVSfU3RFPwT1lIeT3Rf72ToPwcNSzRsF9X4mq/sQks785Xe3VnpWhc1gGsjZun9R1vU1gvCQEgRoh8roiDV8kp2jxgDadNXQcDBqvH1pEhKUn/Q8lBWS/VrC92pZBitKkwoxD+N21GKsy2FXQuHvjlPvrBJD6ocpT9eAkCllPKhLWQ+Aiy3K9widCwMiOiw783Wt4s52G09yEUAhXGX6OeUzrenZDW3ani4nkRF9YWCoH8CvNUZdkiwmMPXLL93VjMq/+68rKWTk353HgWwyICX2BJimi3A0RbduTL5j++7vuTBSOjeEQuY3HX8+oh7Vn/WJwWCXDJauXD9BBoo2buBf4EcXRgJRC2PL6OuZFmYsjml4FfFgb8L3Y4hWTRUk/+IyAHP97CrfkEADzODFmS1+90b+HDE6a97nrBer5SQfYtG6rCtAtbNUwLJpyhUtRG+5PGIlUvTFJz0xb78gxQgO71PokoK9oKmGADrVY7zrDMxXlLgs5eZdRHfLHyUW7Ggbr2MGz8BmM6KhBuhlMS4Kqxu+EeWpXORjJzIOmlDysYGBUkqNi9fofXH5/G07aAHLGfC0QdFOHsVkyqH3OsoXtrx8tLnlgf1/9Ajsy+jGvgMlClZcdN8BcyqWLSLotKQnmCHzJfNzrqvlWc1rOuw==
.cddtsecure.com/ Name: gdm_click_adv_freq_v1_1_001
Value: 9aM1XGpWxsbm63MOQbJksAI66DPxw/X6Y1J18UniRzar3uAqy6rY/pD0OP9G8e9n
.cddtsecure.com/ Name: gdm_sid_v1_3_001
Value: wMziSXEuMVTUrWP82V94QypW8qEf5yAXBMaYbKvmeZ9mEf6IYcaaVQwtFlIQj9HAL0Ew9DlZVuhwmojs52acHfgtV8Ub3G2eNbAguIihXMiV8FC6q+qWcx0VjaqSRESWBV3gawsGhw0dtDjJCo2B2NI/C5m24gH3MLeOQL6yf9kbB1GQuE8LKKn8pn8Uz7ieT00nELozyOnvAjDM0csATVebjYWtnzXOj59DXuIklZc64pM5kKOXhtqCW8GickyAU6a/qz6m6hyUb9VRYJjBey/iyk1dBSohHjWrH/AinRVjFJ1RNdEyY63FXKjA96Oofaq0a5aY64VHom9eKD1G26a5f1VfPPop3n0zcBwbzZz+E7czwzdxP9EyBFMZ+pTz6BU2T5WRQHZ6IPtvuhyiwzapgCeZY+cTKDcSAu8l0Z3Z3ugNfWWBpW3a4EIQRDHPVSfU3RFPwT1lIeT3Rf72ToPwcNSzRsF9X4mq/sQks785Xe3VnpWhc1gGsjZun9R1vU1gvCQEgRoh8roiDV8kp2jxgDadNXQcDBqvH1pEhKUn/Q8lBWS/VrC92pZBitKkwoxD+N21GKsy2FXQuHvjlPvrBJD6ocpT9eAkCllPKhLWQ+Aiy3K9widCwMiOiw783Wt4s52G09yEUAhXGX6OeUzrenZDW3ani4nkRF9YWCoH8CvNUZdkiwmMPXLL93VjMq/+68rKWTk353HgWwyICX2BJimi3A0RbduTL5j++7vuTBSOjeEQuY3HX8+oh7Vn/WJwWCXDJauXD9BBoo2buBf4EcXRgJRC2PL6OuZFmYsjml4FfFgb8L3Y4hWTRUk/+IyAHP97CrfkEADzODFmS1+90b+HDE6a97nrBer5SQfYtG6rCtAtbNUwLJpyhUtRG+5PGIlUvTFJz0xb78gxQgO71PokoK9oKmGADrVY7zrDMxXlLgs5eZdRHfLHyUW7Ggbr2MGz8BmM6KhBuhlMS4Kqxu+EeWpXORjJzIOmlDysYGBUkqNi9fofXH5/G07aAHLGfC0QdFOHsVkyqH3OsoXtrx8tLnlgf1/9Ajsy+jGvgMlClZcdN8BcyqWLSLotKQnmCHzJfNzrqvlWc1rOuw==
.cddtsecure.com/ Name: gdm_uid_v1_1_001
Value: Vu1S1L5LIqe/tRGp9qgGm08uzUOd9jSAn2iHhHeua0Wg6dpCVkIFOSUMeldlKLhq
.cddtsecure.com/ Name: gdm_suid_v2_1_001
Value: HPfHs3OFxkaNOwO68jCjbQ==
.cddtsecure.com/ Name: gdm_suid_v1_1_001
Value: HPfHs3OFxkaNOwO68jCjbQ==
.cddtsecure.com/ Name: gdm_uid_v2_1_001
Value: Vu1S1L5LIqe/tRGp9qgGm08uzUOd9jSAn2iHhHeua0Wg6dpCVkIFOSUMeldlKLhq
.cddtsecure.com/ Name: gdm_click_freq_v2_1_001
Value: ZWFbVBCG/uLROGhVmLdDlxnT29GTqJT8G9GPL6JA5dhG39YOcQgwuH+yfsfYii9p
.namecheap.com/ Name: _cfuvid
Value: zZgwSaalv1gs7JTuBz6Y4PylhnkaBaR24etZAdGUxy0-1734774788509-0.0.1.1-604800000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cd.usedealer.click
cddtsecure.com
duct.infralead.net
offer-select.com
qbqd20067.submittrk5.com
static.nc-img.com
www.namecheap.com
104.16.100.56
104.21.32.1
198.54.117.242
2606:4700::6812:ad39
2a05:d018:e36:3910:1d4c:9919:7871:728a
34.22.240.62
1230ad30ea6bbcc22f8e08d8a496c66aac8266db7a4b72b2c465e0ec89c2c658
177c4f2826cbc2cc24a9d8018e6c9848ed73178a76fd3aabe99b44ee9458514c
1c4e83808bf28a02416bfb12ee9fab3c5c55e075376a472d64fcfdbbfab01a51
3ccf7ed93b7cc4f085a183a1e86548e6dca77902145f4bf11d5746b08ff6eb9a
59b3cf18fcdb1242d5bc5e02b6d7537ea50c9bec9b8eb818a35da80ebca3696e
65b343bf3820ddc65a1aa86602c83b102421b4999dd0e8cc8229c92a1ec9fc50
6a382a283c77b7e93e7bb5b0b1902242082a4800dac20da3334d641093b33005
7307ff8fce6be70dbd3c6ec226910961f863b26f4abce662a7f757821e7b9b1f
7be1913e58996bc81cb052e9914cb492d0acf125434ed1ddf0144d8a93189dff
8625166490607fd513aef4a7b29927f616b8537d2602cb6b4aa00935cd5639f6
89bedb78cb157a573d0ae0ba0aadf8b7fb584d323e4c5e9e536d84bd67f5ceb5
93467f75842330c3502fc0268a7a62151f3744221ca7ffa6dc5057dac4a64cee
9436e0161212285124586ace8780b12fe73d8145f7d3d7b73ef2f352f0e934e4
9b69072496fa454b46c2e91ea0bcfeeedc8a47b268a07863c9eee88082aa6937
9c0749dc1deb3275e1846a462c0dcb83df2b5fec30112eacdf5530fa51e3160f
9c0bd44b3d16140158eb5f52b28e48cbdfdb7215b06dfeeb2cd07078361e1016
ad05ef3b436c4d0b92331ec02d8c63e3b3d8f4144249abf095eebefaf4af56cf
cbbda36462bd705a3377cc1a607db2382c033161e16c56a8aadfe93f292874e0
cf480b9e53faa747671f7ba85c948ba05063714567a12b083594c8c1adb87a81
f04a3e5df37639d827f031e7028bea5a3ebbaacb21252e0427fae1f1c6d32592
f9b75086bd476abd93292b689dff7eef57d037834e7d0926107421492e22fa2c