urlscan.io logo urlscan.io
SecurityTrails logo

www1.mesdasmaesemais.com Open in urlscan Pro
2606:4700:30::681c:be3  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://www1.mesdasmaesemais.com/
Effective URL: https://www1.mesdasmaesemais.com/oferta-do-dia=chave=5446594/
Submission Tags: 6037432
Submission: On May 09 via api from GB
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 8 IPs in 3 countries across 5 domains to perform 18 HTTP transactions. The main IP is 2606:4700:30::681c:be3, located in United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is www1.mesdasmaesemais.com.
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on May 8th 2019. Valid for: a year.
This is the only time www1.mesdasmaesemais.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Lojas Americanas (Retail)

Domain & IP information

IP Address AS Autonomous System
2 4 2606:4700:30:... 13335 (CLOUDFLAR...)
1 1 2606:4700:30:... 13335 (CLOUDFLAR...)
11 151.80.204.61 16276 (OVH)
1 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
1 151.101.194.110 54113 (FASTLY)
1 162.247.242.18 23467 (NEWRELIC-...)
1 2600:9000:20b... 16509 (AMAZON-02)
1 2600:9000:20b... 16509 (AMAZON-02)
18 8
4    2606:4700:30::681c:be3 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
www1.mesdasmaesemais.com
1    2606:4700:30::681c:ae3 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
www1.mesdasmaesemais.com
11    151.80.204.61 (Italy)

ASN16276 (OVH, FR)
PTR: ip61.ip-151-80-204.eu
statics-americanas.b2w.io
images-americanas.b2w.io
1    2a02:26f0:6c00:28f::19fe (European Union)

ASN20940 (AKAMAI-ASN1, US)
spacey-api-v2-americanas.b2w.io
1    151.101.194.110 (San Francisco, United States)

ASN54113 (FASTLY - Fastly, US)
js-agent.newrelic.com
1    162.247.242.18 (United States)

ASN23467 (NEWRELIC-AS-1 - New Relic, US)
PTR: bam-6.nr-data.net
bam.nr-data.net
1    2600:9000:20bb:6200:0:ee2:240:93a1 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
selo.siteblindado.com
1    2600:9000:20bb:d400:a:d6c9:2ec0:93a1 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
api.siteblindado.com
Domain Requested by
6 statics-americanas.b2w.io www1.mesdasmaesemais.com
5 images-americanas.b2w.io www1.mesdasmaesemais.com
5 www1.mesdasmaesemais.com 3 redirects www1.mesdasmaesemais.com
1 api.siteblindado.com selo.siteblindado.com
1 selo.siteblindado.com statics-americanas.b2w.io
1 bam.nr-data.net js-agent.newrelic.com
1 js-agent.newrelic.com www1.mesdasmaesemais.com
1 spacey-api-v2-americanas.b2w.io statics-americanas.b2w.io
18 8
Subject Issuer Validity Valid
sni.cloudflaressl.com
CloudFlare Inc ECC CA-2		 2019-05-08 -
2020-05-08		 a year crt.sh
*.b2w.io
SSL Blindado 2		 2018-07-10 -
2019-08-25		 a year crt.sh
b2wdigital.com
DigiCert SHA2 Secure Server CA		 2018-11-05 -
2020-02-04		 a year crt.sh
f4.shared.global.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3		 2019-04-10 -
2020-03-21		 a year crt.sh
*.nr-data.net
GeoTrust RSA CA 2018		 2018-01-11 -
2020-03-17		 2 years crt.sh
*.siteblindado.com
SSL Blindado 2		 2017-07-28 -
2019-08-22		 2 years crt.sh

This page contains 1 frames:

Primary Page: https://www1.mesdasmaesemais.com/oferta-do-dia=chave=5446594/
Frame ID: 2A4F545F317691938DFC30173BB161ED
Requests: 19 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://www1.mesdasmaesemais.com/ HTTP 302
    https://www1.mesdasmaesemais.com/oferta-do-dia=chave=5446594 HTTP 301
    http://www1.mesdasmaesemais.com/oferta-do-dia=chave=5446594/ HTTP 301
    https://www1.mesdasmaesemais.com/oferta-do-dia=chave=5446594/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • html /<[^>]+data-react/i
Overall confidence: 100%
Detected patterns
  • headers server /cloudflare/i
Overall confidence: 100%
Detected patterns
  • env /^NREUM/i

Page Statistics

18
Requests

100 %
HTTPS

63 %
IPv6

5
Domains

8
Subdomains

8
IPs

3
Countries

3410 kB
Transfer

3928 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://www1.mesdasmaesemais.com/ HTTP 302
    https://www1.mesdasmaesemais.com/oferta-do-dia=chave=5446594 HTTP 301
    http://www1.mesdasmaesemais.com/oferta-do-dia=chave=5446594/ HTTP 301
    https://www1.mesdasmaesemais.com/oferta-do-dia=chave=5446594/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

18 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
www1.mesdasmaesemais.com/oferta-do-dia=chave=5446594/
Redirect Chain
  • https://www1.mesdasmaesemais.com/
  • https://www1.mesdasmaesemais.com/oferta-do-dia=chave=5446594
  • http://www1.mesdasmaesemais.com/oferta-do-dia=chave=5446594/
  • https://www1.mesdasmaesemais.com/oferta-do-dia=chave=5446594/
373 KB
81 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www1.mesdasmaesemais.com/oferta-do-dia=chave=5446594/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681c:be3 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / PHP/7.3.4
Resource Hash
20f09bbfa616770ad279170280c6f8438d19ce40ceeba5630f4a4190ae363786
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

:method
GET
:authority
www1.mesdasmaesemais.com
:scheme
https
:path
/oferta-do-dia=chave=5446594/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
accept-encoding
gzip, deflate, br
cookie
__cfduid=d871aaccbf4fa861ae7ab288f0bdb632a1557376202; PHPSESSID=holpnf4vf6i1rustd6sfbtf1f2
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status
200
date
Thu, 09 May 2019 04:30:04 GMT
content-type
text/html; charset=UTF-8
x-powered-by
PHP/7.3.4
strict-transport-security
max-age=0; includeSubDomains; preload
x-content-type-options
nosniff
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
4d40ef9a0ae1973c-FRA
content-encoding
br

Redirect headers

Date
Thu, 09 May 2019 04:30:03 GMT
Transfer-Encoding
chunked
Connection
keep-alive
Cache-Control
max-age=3600
Expires
Thu, 09 May 2019 05:30:03 GMT
Location
https://www1.mesdasmaesemais.com/oferta-do-dia=chave=5446594/
X-Content-Type-Options
nosniff
Vary
Accept-Encoding
Server
cloudflare
CF-RAY
4d40ef99ee69bece-FRA
theme.css
statics-americanas.b2w.io/zion/1.71.1-garage.0/theme/stylesheets/ 		471 KB
472 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://statics-americanas.b2w.io/zion/1.71.1-garage.0/theme/stylesheets/theme.css
Requested by
Host: www1.mesdasmaesemais.com
URL: https://www1.mesdasmaesemais.com/oferta-do-dia=chave=5446594/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.80.204.61 , Italy, ASN16276 (OVH, FR),
Reverse DNS
ip61.ip-151-80-204.eu
Software
nginx /
Resource Hash
848914eebba0c3a527d6ed7c97fcd7a5c59eefbb9ea532b47bd9ea478c65fdbc

Request headers

Referer
https://www1.mesdasmaesemais.com/oferta-do-dia=chave=5446594/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 09 May 2019 04:30:04 GMT
x-cache-status
MISS
status
200
x-haproxy-ip
x-haproxy-hostname
lb-soubarato-gl-10-13-12-67
x-public
true
last-modified
Thu, 30 Aug 2018 20:46:31 GMT
server
nginx
etag
"75b5e-574ad2b77faa8-gzip"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
content-type
text/css
access-control-allow-origin
*
access-control-expose-headers
DNT, X-CustomHeader, Keep-Alive, User-Agent, X-Requested-With, If-Modified-Since, Cache-Control, Content-Type, Authorization, charset, Content-Encoding, Location, Allow, X-TID, WWW-Authenticate, X-Access-Control-Realm, Host, Origin
cache-control
max-age=86400
access-control-allow-headers
DNT, X-CustomHeader, Keep-Alive, User-Agent, X-Requested-With, If-Modified-Since, Cache-Control, Content-Type, Authorization, charset, Content-Encoding, Location, Allow, X-TID, WWW-Authenticate, X-Access-Control-Realm, Host, Origin
expires
Fri, 10 May 2019 04:30:04 GMT
3868dfb588de6d0589aa66ddec0f0916.main.css
statics-americanas.b2w.io/zion/stylesheets// 		14 KB
14 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://statics-americanas.b2w.io/zion/stylesheets//3868dfb588de6d0589aa66ddec0f0916.main.css
Requested by
Host: www1.mesdasmaesemais.com
URL: https://www1.mesdasmaesemais.com/oferta-do-dia=chave=5446594/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.80.204.61 , Italy, ASN16276 (OVH, FR),
Reverse DNS
ip61.ip-151-80-204.eu
Software
nginx /
Resource Hash
8e6e7f0adbbcc9477a1cea6d9b06b9b1d1f922352cb232d66898cbce5c72774f

Request headers

Referer
https://www1.mesdasmaesemais.com/oferta-do-dia=chave=5446594/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 09 May 2019 04:30:04 GMT
x-cache-status
MISS
status
200
x-haproxy-ip
x-haproxy-hostname
lb-soubarato-gl-10-13-12-67
x-public
true
last-modified
Thu, 30 Aug 2018 20:46:21 GMT
server
nginx
etag
"3685-574ad2adf7449-gzip"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
content-type
text/css
access-control-allow-origin
*
access-control-expose-headers
DNT, X-CustomHeader, Keep-Alive, User-Agent, X-Requested-With, If-Modified-Since, Cache-Control, Content-Type, Authorization, charset, Content-Encoding, Location, Allow, X-TID, WWW-Authenticate, X-Access-Control-Realm, Host, Origin
cache-control
max-age=86400
access-control-allow-headers
DNT, X-CustomHeader, Keep-Alive, User-Agent, X-Requested-With, If-Modified-Since, Cache-Control, Content-Type, Authorization, charset, Content-Encoding, Location, Allow, X-TID, WWW-Authenticate, X-Access-Control-Realm, Host, Origin
expires
Fri, 10 May 2019 04:30:04 GMT
vendor.js
statics-americanas.b2w.io/zion/1.71.1-garage.0/ 		845 KB
847 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://statics-americanas.b2w.io/zion/1.71.1-garage.0/vendor.js
Requested by
Host: www1.mesdasmaesemais.com
URL: https://www1.mesdasmaesemais.com/oferta-do-dia=chave=5446594/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.80.204.61 , Italy, ASN16276 (OVH, FR),
Reverse DNS
ip61.ip-151-80-204.eu
Software
nginx /
Resource Hash
29dd0e912e1c7092e7271f1f198486b8f90c62bf2f3f3af957aa7e0afca1cbd6

Request headers

Referer
https://www1.mesdasmaesemais.com/oferta-do-dia=chave=5446594/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 09 May 2019 04:30:04 GMT
x-cache-status
MISS
status
200
x-haproxy-ip
x-haproxy-hostname
lb-soubarato-gl-10-13-12-67
x-public
true
last-modified
Thu, 30 Aug 2018 20:46:10 GMT
server
nginx
etag
"d35c0-574ad2a3788cd-gzip"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
content-type
application/javascript
access-control-allow-origin
*
access-control-expose-headers
DNT, X-CustomHeader, Keep-Alive, User-Agent, X-Requested-With, If-Modified-Since, Cache-Control, Content-Type, Authorization, charset, Content-Encoding, Location, Allow, X-TID, WWW-Authenticate, X-Access-Control-Realm, Host, Origin
cache-control
max-age=86400
access-control-allow-headers
DNT, X-CustomHeader, Keep-Alive, User-Agent, X-Requested-With, If-Modified-Since, Cache-Control, Content-Type, Authorization, charset, Content-Encoding, Location, Allow, X-TID, WWW-Authenticate, X-Access-Control-Realm, Host, Origin
expires
Fri, 10 May 2019 04:30:04 GMT
main.js
statics-americanas.b2w.io/zion/1.71.1-garage.0/ 		2 MB
2 MB 		Script
General
Check archive.org
Download Go to
Full URL
https://statics-americanas.b2w.io/zion/1.71.1-garage.0/main.js
Requested by
Host: www1.mesdasmaesemais.com
URL: https://www1.mesdasmaesemais.com/oferta-do-dia=chave=5446594/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.80.204.61 , Italy, ASN16276 (OVH, FR),
Reverse DNS
ip61.ip-151-80-204.eu
Software
nginx /
Resource Hash
57297b2e08386af73e1f823f5ce0b66fa5d41e6c40804aea6eb5760e0146d65e

Request headers

Referer
https://www1.mesdasmaesemais.com/oferta-do-dia=chave=5446594/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 09 May 2019 04:30:04 GMT
x-cache-status
MISS
status
200
x-haproxy-ip
x-haproxy-hostname
lb-soubarato-gl-10-13-12-67
x-public
true
last-modified
Thu, 30 Aug 2018 20:46:12 GMT
server
nginx
etag
"1b541f-574ad2a560e33-gzip"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
content-type
application/javascript
access-control-allow-origin
*
access-control-expose-headers
DNT, X-CustomHeader, Keep-Alive, User-Agent, X-Requested-With, If-Modified-Since, Cache-Control, Content-Type, Authorization, charset, Content-Encoding, Location, Allow, X-TID, WWW-Authenticate, X-Access-Control-Realm, Host, Origin
cache-control
max-age=86400
access-control-allow-headers
DNT, X-CustomHeader, Keep-Alive, User-Agent, X-Requested-With, If-Modified-Since, Cache-Control, Content-Type, Authorization, charset, Content-Encoding, Location, Allow, X-TID, WWW-Authenticate, X-Access-Control-Realm, Host, Origin
expires
Fri, 10 May 2019 04:30:04 GMT
header.min.js
statics-americanas.b2w.io/statics-header/1.23.21.1405/ 		129 KB
34 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://statics-americanas.b2w.io/statics-header/1.23.21.1405/header.min.js
Requested by
Host: www1.mesdasmaesemais.com
URL: https://www1.mesdasmaesemais.com/oferta-do-dia=chave=5446594/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.80.204.61 , Italy, ASN16276 (OVH, FR),
Reverse DNS
ip61.ip-151-80-204.eu
Software
nginx /
Resource Hash
76ee30e38f1e4b832a8661fcce2c67004da3a067563363422fc366c85e4215c0

Request headers

Referer
https://www1.mesdasmaesemais.com/oferta-do-dia=chave=5446594/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 09 May 2019 04:30:04 GMT
content-encoding
gzip
x-cache-status
MISS
status
200
x-haproxy-ip
x-haproxy-hostname
lb-soubarato-gl-10-13-12-67
x-public
true
content-length
33784
last-modified
Tue, 28 Aug 2018 14:00:42 GMT
server
nginx
etag
"20233-5747f4478f6f9-gzip"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
content-type
application/javascript
access-control-allow-origin
*
access-control-expose-headers
DNT, X-CustomHeader, Keep-Alive, User-Agent, X-Requested-With, If-Modified-Since, Cache-Control, Content-Type, Authorization, charset, Content-Encoding, Location, Allow, X-TID, WWW-Authenticate, X-Access-Control-Realm, Host, Origin
cache-control
max-age=86400
accept-ranges
bytes
access-control-allow-headers
DNT, X-CustomHeader, Keep-Alive, User-Agent, X-Requested-With, If-Modified-Since, Cache-Control, Content-Type, Authorization, charset, Content-Encoding, Location, Allow, X-TID, WWW-Authenticate, X-Access-Control-Realm, Host, Origin
expires
Fri, 10 May 2019 04:30:04 GMT
133718358_1GG.png
images-americanas.b2w.io/produtos/01/00/offers/01/00/item/133718/3/ 		74 KB
75 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images-americanas.b2w.io/produtos/01/00/offers/01/00/item/133718/3/133718358_1GG.png
Requested by
Host: www1.mesdasmaesemais.com
URL: https://www1.mesdasmaesemais.com/oferta-do-dia=chave=5446594/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.80.204.61 , Italy, ASN16276 (OVH, FR),
Reverse DNS
ip61.ip-151-80-204.eu
Software
nginx /
Resource Hash
effbb7c77e7148bae57907a8f02a5af12de632e3a50e5ced74c29b29f1e583d9

Request headers

Referer
https://www1.mesdasmaesemais.com/oferta-do-dia=chave=5446594/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 09 May 2019 04:30:05 GMT
server
nginx
access-control-allow-origin
*
x-cache-status
HIT
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
content-type
image/png
status
200
access-control-expose-headers
DNT, X-CustomHeader, Keep-Alive, User-Agent, X-Requested-With, If-Modified-Since, Cache-Control, Content-Type, Authorization, charset, Content-Encoding, Location, Allow, X-TID, WWW-Authenticate, X-Access-Control-Realm, Host, Origin
cache-control
max-age=604800
access-control-allow-headers
DNT, X-CustomHeader, Keep-Alive, User-Agent, X-Requested-With, If-Modified-Since, Cache-Control, Content-Type, Authorization, charset, Content-Encoding, Location, Allow, X-TID, WWW-Authenticate, X-Access-Control-Realm, Host, Origin
content-length
75924
expires
Thu, 16 May 2019 04:30:05 GMT
132370265_1GG.jpg
images-americanas.b2w.io/produtos/01/00/item/132370/2/ 		24 KB
25 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images-americanas.b2w.io/produtos/01/00/item/132370/2/132370265_1GG.jpg
Requested by
Host: www1.mesdasmaesemais.com
URL: https://www1.mesdasmaesemais.com/oferta-do-dia=chave=5446594/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.80.204.61 , Italy, ASN16276 (OVH, FR),
Reverse DNS
ip61.ip-151-80-204.eu
Software
nginx /
Resource Hash
8fdf63843af0ecf18537b9aff141fef147a9c3b9e909a3e6d5f0196cff273467

Request headers

Referer
https://www1.mesdasmaesemais.com/oferta-do-dia=chave=5446594/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 09 May 2019 04:30:05 GMT
server
nginx
access-control-allow-origin
*
x-cache-status
HIT
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
content-type
image/jpeg
status
200
access-control-expose-headers
DNT, X-CustomHeader, Keep-Alive, User-Agent, X-Requested-With, If-Modified-Since, Cache-Control, Content-Type, Authorization, charset, Content-Encoding, Location, Allow, X-TID, WWW-Authenticate, X-Access-Control-Realm, Host, Origin
cache-control
max-age=604800
access-control-allow-headers
DNT, X-CustomHeader, Keep-Alive, User-Agent, X-Requested-With, If-Modified-Since, Cache-Control, Content-Type, Authorization, charset, Content-Encoding, Location, Allow, X-TID, WWW-Authenticate, X-Access-Control-Realm, Host, Origin
content-length
24506
expires
Thu, 16 May 2019 04:30:05 GMT
29558759_2GG.jpg
images-americanas.b2w.io/produtos/01/00/oferta/29558/7/ 		22 KB
22 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images-americanas.b2w.io/produtos/01/00/oferta/29558/7/29558759_2GG.jpg
Requested by
Host: www1.mesdasmaesemais.com
URL: https://www1.mesdasmaesemais.com/oferta-do-dia=chave=5446594/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.80.204.61 , Italy, ASN16276 (OVH, FR),
Reverse DNS
ip61.ip-151-80-204.eu
Software
nginx /
Resource Hash
8e15412a9d42cb102f6552a78f7fe2cd79a47493e009357b7fe7a00989c11d4b

Request headers

Referer
https://www1.mesdasmaesemais.com/oferta-do-dia=chave=5446594/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 09 May 2019 04:30:05 GMT
server
nginx
access-control-allow-origin
*
x-cache-status
HIT
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
content-type
image/jpeg
status
200
access-control-expose-headers
DNT, X-CustomHeader, Keep-Alive, User-Agent, X-Requested-With, If-Modified-Since, Cache-Control, Content-Type, Authorization, charset, Content-Encoding, Location, Allow, X-TID, WWW-Authenticate, X-Access-Control-Realm, Host, Origin
cache-control
max-age=604800
access-control-allow-headers
DNT, X-CustomHeader, Keep-Alive, User-Agent, X-Requested-With, If-Modified-Since, Cache-Control, Content-Type, Authorization, charset, Content-Encoding, Location, Allow, X-TID, WWW-Authenticate, X-Access-Control-Realm, Host, Origin
content-length
22160
expires
Thu, 16 May 2019 04:30:05 GMT
132610871_1GG.jpg
images-americanas.b2w.io/produtos/01/00/item/132610/8/ 		26 KB
26 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images-americanas.b2w.io/produtos/01/00/item/132610/8/132610871_1GG.jpg
Requested by
Host: www1.mesdasmaesemais.com
URL: https://www1.mesdasmaesemais.com/oferta-do-dia=chave=5446594/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.80.204.61 , Italy, ASN16276 (OVH, FR),
Reverse DNS
ip61.ip-151-80-204.eu
Software
nginx /
Resource Hash
98b031e411a9123e491e2a705cfc51e69c5afcd84cd8aaf5004ed16241da6cdb

Request headers

Referer
https://www1.mesdasmaesemais.com/oferta-do-dia=chave=5446594/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 09 May 2019 04:30:05 GMT
server
nginx
access-control-allow-origin
*
x-cache-status
HIT
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
content-type
image/jpeg
status
200
access-control-expose-headers
DNT, X-CustomHeader, Keep-Alive, User-Agent, X-Requested-With, If-Modified-Since, Cache-Control, Content-Type, Authorization, charset, Content-Encoding, Location, Allow, X-TID, WWW-Authenticate, X-Access-Control-Realm, Host, Origin
cache-control
max-age=604800
access-control-allow-headers
DNT, X-CustomHeader, Keep-Alive, User-Agent, X-Requested-With, If-Modified-Since, Cache-Control, Content-Type, Authorization, charset, Content-Encoding, Location, Allow, X-TID, WWW-Authenticate, X-Access-Control-Realm, Host, Origin
content-length
26454
expires
Thu, 16 May 2019 04:30:05 GMT
feather
spacey-api-v2-americanas.b2w.io/v2/spacey-api/publications/desktop/ 		138 KB
16 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://spacey-api-v2-americanas.b2w.io/v2/spacey-api/publications/desktop/feather
Requested by
Host: statics-americanas.b2w.io
URL: https://statics-americanas.b2w.io/statics-header/1.23.21.1405/header.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:6c00:28f::19fe , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
nginx /
Resource Hash
e3516c9f0b4a3ffe7a8bd88de25f0187bd4a29df447fe4ca6c2f7e0fb5844cf1

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www1.mesdasmaesemais.com/oferta-do-dia=chave=5446594/
Origin
https://www1.mesdasmaesemais.com

Response headers

date
Thu, 09 May 2019 04:30:05 GMT
content-encoding
gzip
vary
Accept-Encoding
x-tid
e858fa9b-d4d1-45ec-b0eb-ec8ee1913dbd
x-cache-status
HIT
status
200
x-haproxy-ip
x-haproxy-hostname
us-east-1e-public-haproxy-americanas-10-238-43-14.atlas.b2w
x-public
true
content-length
16212
server
nginx
etag
W/"22940-lLVC1QSQk8gBTNB8BODG/Xj8/tM"
access-control-max-age
86400
access-control-allow-methods
GET,OPTIONS
content-type
application/json; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
X-TID
cache-control
max-age=164, s-maxage=300
access-control-allow-credentials
false
access-control-allow-headers
*
TOPINHO_GALAXYM_DESK_v4.png
images-americanas.b2w.io/spacey/2019/05/03/ 		7 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images-americanas.b2w.io/spacey/2019/05/03/TOPINHO_GALAXYM_DESK_v4.png
Requested by
Host: www1.mesdasmaesemais.com
URL: https://www1.mesdasmaesemais.com/oferta-do-dia=chave=5446594/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.80.204.61 , Italy, ASN16276 (OVH, FR),
Reverse DNS
ip61.ip-151-80-204.eu
Software
nginx /
Resource Hash
eb526bbc4dd023cc6b296a1d57019369cfbe413e29b8dfde2218c5d274e9eeac

Request headers

Referer
https://www1.mesdasmaesemais.com/oferta-do-dia=chave=5446594/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 09 May 2019 04:30:05 GMT
server
nginx
access-control-allow-origin
*
x-cache-status
HIT
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
content-type
image/png
status
200
access-control-expose-headers
DNT, X-CustomHeader, Keep-Alive, User-Agent, X-Requested-With, If-Modified-Since, Cache-Control, Content-Type, Authorization, charset, Content-Encoding, Location, Allow, X-TID, WWW-Authenticate, X-Access-Control-Realm, Host, Origin
cache-control
max-age=604800
access-control-allow-headers
DNT, X-CustomHeader, Keep-Alive, User-Agent, X-Requested-With, If-Modified-Since, Cache-Control, Content-Type, Authorization, charset, Content-Encoding, Location, Allow, X-TID, WWW-Authenticate, X-Access-Control-Realm, Host, Origin
content-length
7518
expires
Thu, 16 May 2019 04:30:05 GMT
email-decode.min.js
www1.mesdasmaesemais.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 		1 KB
870 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www1.mesdasmaesemais.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
Requested by
Host: www1.mesdasmaesemais.com
URL: https://www1.mesdasmaesemais.com/oferta-do-dia=chave=5446594/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681c:be3 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www1.mesdasmaesemais.com/oferta-do-dia=chave=5446594/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 09 May 2019 04:30:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 03 May 2019 16:17:17 GMT
server
cloudflare
etag
W/"5ccc698d-4d7"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
content-type
application/javascript
status
200
cache-control
max-age=172800, public
strict-transport-security
max-age=0; includeSubDomains; preload
cf-ray
4d40efa2bb5d973c-FRA
vary
Accept-Encoding
expires
Sat, 11 May 2019 04:30:05 GMT
footer.min.js
statics-americanas.b2w.io/statics-footer/1.23.21.1405/ 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://statics-americanas.b2w.io/statics-footer/1.23.21.1405/footer.min.js
Requested by
Host: www1.mesdasmaesemais.com
URL: https://www1.mesdasmaesemais.com/oferta-do-dia=chave=5446594/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.80.204.61 , Italy, ASN16276 (OVH, FR),
Reverse DNS
ip61.ip-151-80-204.eu
Software
nginx /
Resource Hash
8b7543f266c86f2dd36d5742990da8fae5666134bea74baf7aa38d10057f8418

Request headers

Referer
https://www1.mesdasmaesemais.com/oferta-do-dia=chave=5446594/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 09 May 2019 04:30:05 GMT
content-encoding
gzip
x-cache-status
MISS
status
200
x-haproxy-ip
x-haproxy-hostname
lb-soubarato-gl-10-13-12-67
x-public
true
content-length
2448
last-modified
Tue, 28 Aug 2018 14:00:44 GMT
server
nginx
etag
"1a4a-5747f44977b5e-gzip"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
content-type
application/javascript
access-control-allow-origin
*
access-control-expose-headers
DNT, X-CustomHeader, Keep-Alive, User-Agent, X-Requested-With, If-Modified-Since, Cache-Control, Content-Type, Authorization, charset, Content-Encoding, Location, Allow, X-TID, WWW-Authenticate, X-Access-Control-Realm, Host, Origin
cache-control
max-age=86400
accept-ranges
bytes
access-control-allow-headers
DNT, X-CustomHeader, Keep-Alive, User-Agent, X-Requested-With, If-Modified-Since, Cache-Control, Content-Type, Authorization, charset, Content-Encoding, Location, Allow, X-TID, WWW-Authenticate, X-Access-Control-Realm, Host, Origin
expires
Fri, 10 May 2019 04:30:05 GMT
truncated
/ 		22 KB
22 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
bf91fe8cbc4f2d9ef41e522b3d4917a4d2dad4cbb1f133be1119fb3ea1bb6221

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Content-Type
img/png
nr-1071.min.js
js-agent.newrelic.com/ 		23 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js-agent.newrelic.com/nr-1071.min.js
Requested by
Host: www1.mesdasmaesemais.com
URL: https://www1.mesdasmaesemais.com/oferta-do-dia=chave=5446594/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.110 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
56097e8b7ceb27db42a5e102af6d11dfdcaee13d8716477a8e242b4957d7a280

Request headers

Referer
https://www1.mesdasmaesemais.com/oferta-do-dia=chave=5446594/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 09 May 2019 04:30:05 GMT
content-encoding
gzip
x-amz-request-id
4FA97F9146AC1E0C
x-cache
HIT
status
200
content-length
9086
x-amz-id-2
2u+ePBLq0i+86Rc6Ty4s1JjLllOr+DvppPFIKi56RBFSrYzKnBNjQJjsdHXpgMCr0P5LWmRHmOY=
x-served-by
cache-hhn1523-HHN
last-modified
Wed, 28 Feb 2018 23:33:31 GMT
server
AmazonS3
x-timer
S1557376206.613321,VS0,VE0
etag
"a1a545c95f313a230157b47dca555c25"
vary
Accept-Encoding
content-type
application/javascript
via
1.1 varnish
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
48
0699e41a46
bam.nr-data.net/1/ 		57 B
261 B 		Script
General
Check archive.org
Download Go to
Full URL
https://bam.nr-data.net/1/0699e41a46?a=48356373&v=1071.385e752&to=M1NXNxEFXEtRUkRZVgoZdhYQEF1VHx4%3D&rst=3199&ref=https://www1.mesdasmaesemais.com/oferta-do-dia%3Dchave%3D5446594/&ap=100.133716&be=1866&fe=3181&dc=3179&tt=1ec454cc9229be&perf=%7B%22timing%22:%7B%22of%22:1557376202427,%22n%22:0,%22f%22:1411,%22dn%22:1411,%22dne%22:1411,%22c%22:1411,%22ce%22:1411,%22rq%22:1411,%22rp%22:1643,%22rpe%22:3174,%22dl%22:1645,%22di%22:3179,%22ds%22:3179,%22de%22:3179,%22dc%22:3180,%22l%22:3180,%22le%22:3182%7D,%22navigation%22:%7B%7D%7D&jsonp=NREUM.setToken
Requested by
Host: js-agent.newrelic.com
URL: https://js-agent.newrelic.com/nr-1071.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
162.247.242.18 , United States, ASN23467 (NEWRELIC-AS-1 - New Relic, US),
Reverse DNS
bam-6.nr-data.net
Software
/
Resource Hash
f69a13217482dc43f25e74cfcb9391d0f06d22501f10f5cb5e413d2d98a5cd23

Request headers

Referer
https://www1.mesdasmaesemais.com/oferta-do-dia=chave=5446594/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Content-Type
text/javascript;charset=ISO-8859-1
Content-Length
57
Expires
Thu, 01 Jan 1970 00:00:00 GMT
aw.js
selo.siteblindado.com/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://selo.siteblindado.com/aw.js
Requested by
Host: statics-americanas.b2w.io
URL: https://statics-americanas.b2w.io/statics-header/1.23.21.1405/header.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20bb:6200:0:ee2:240:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
8a514bd9a0b0c55fe418abb8e6eb7c1000dfee4aeb13b4e67b72c8fea66015f3

Request headers

Referer
https://www1.mesdasmaesemais.com/oferta-do-dia=chave=5446594/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 09 May 2019 04:02:56 GMT
Content-Encoding
gzip
Last-Modified
Tue, 12 Feb 2019 12:33:42 GMT
Server
AmazonS3
Age
6543
Vary
Accept-Encoding
X-Cache
Hit from cloudfront
Content-Type
application/javascript
Via
1.1 4b35c814a2788c09b015e4cc052e552f.cloudfront.net (CloudFront)
Transfer-Encoding
chunked
Connection
keep-alive
X-Amz-Cf-Id
U_dSTq3aOd0fRonYzgdUpY85WjFyRR19OCwGEAy5qdGJxPxz2CWLBA==
info
api.siteblindado.com/v1/seal/aw/www1.mesdasmaesemais.com/ 		0
384 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.siteblindado.com/v1/seal/aw/www1.mesdasmaesemais.com/info
Requested by
Host: selo.siteblindado.com
URL: https://selo.siteblindado.com/aw.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20bb:d400:a:d6c9:2ec0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
gunicorn/19.9.0 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www1.mesdasmaesemais.com/oferta-do-dia=chave=5446594/
Origin
https://www1.mesdasmaesemais.com

Response headers

Date
Thu, 09 May 2019 04:30:06 GMT
Via
1.1 89934ce37ea0d70a19ace48a847ae306.cloudfront.net (CloudFront)
Server
gunicorn/19.9.0
X-Cache
Error from cloudfront
Content-Type
application/json; charset=UTF-8
access-control-allow-origin
*
Connection
keep-alive
Content-Length
0
X-Amz-Cf-Id
TTl_-BJXS2DnOTOIWPR9w5_w-aJVaSPFm-2extPDjmcetDEAYIG6kg==

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Lojas Americanas (Retail)

24 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask object| NREUM object| newrelic function| __nr_require string| svghash object| featherRenderConfig object| memoryStorage object| feather string| __PRELOADED_STATE__ string| contador function| startTimer object| display2 object| display3 object| display4 object| xmlhttp string| hostname object| languages string| app_path string| url undefined| json undefined| sealSelectors function| insertSeal

2 Cookies

Domain/Path Name / Value
www1.mesdasmaesemais.com/ Name: PHPSESSID
Value: holpnf4vf6i1rustd6sfbtf1f2
.mesdasmaesemais.com/ Name: __cfduid
Value: d871aaccbf4fa861ae7ab288f0bdb632a1557376202

1 Console Messages

Source Level URL
Text
console-api error URL: https://www1.mesdasmaesemais.com/oferta-do-dia=chave=5446594/(Line 227)
Message:
ServiceWorker registration failed:

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=0; includeSubDomains; preload
X-Content-Type-Options nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.siteblindado.com
bam.nr-data.net
images-americanas.b2w.io
js-agent.newrelic.com
selo.siteblindado.com
spacey-api-v2-americanas.b2w.io
statics-americanas.b2w.io
www1.mesdasmaesemais.com
151.101.194.110
151.80.204.61
162.247.242.18
2600:9000:20bb:6200:0:ee2:240:93a1
2600:9000:20bb:d400:a:d6c9:2ec0:93a1
2606:4700:30::681c:ae3
2606:4700:30::681c:be3
2a02:26f0:6c00:28f::19fe
20f09bbfa616770ad279170280c6f8438d19ce40ceeba5630f4a4190ae363786
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
29dd0e912e1c7092e7271f1f198486b8f90c62bf2f3f3af957aa7e0afca1cbd6
56097e8b7ceb27db42a5e102af6d11dfdcaee13d8716477a8e242b4957d7a280
57297b2e08386af73e1f823f5ce0b66fa5d41e6c40804aea6eb5760e0146d65e
76ee30e38f1e4b832a8661fcce2c67004da3a067563363422fc366c85e4215c0
848914eebba0c3a527d6ed7c97fcd7a5c59eefbb9ea532b47bd9ea478c65fdbc
8a514bd9a0b0c55fe418abb8e6eb7c1000dfee4aeb13b4e67b72c8fea66015f3
8b7543f266c86f2dd36d5742990da8fae5666134bea74baf7aa38d10057f8418
8e15412a9d42cb102f6552a78f7fe2cd79a47493e009357b7fe7a00989c11d4b
8e6e7f0adbbcc9477a1cea6d9b06b9b1d1f922352cb232d66898cbce5c72774f
8fdf63843af0ecf18537b9aff141fef147a9c3b9e909a3e6d5f0196cff273467
98b031e411a9123e491e2a705cfc51e69c5afcd84cd8aaf5004ed16241da6cdb
bf91fe8cbc4f2d9ef41e522b3d4917a4d2dad4cbb1f133be1119fb3ea1bb6221
e3516c9f0b4a3ffe7a8bd88de25f0187bd4a29df447fe4ca6c2f7e0fb5844cf1
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eb526bbc4dd023cc6b296a1d57019369cfbe413e29b8dfde2218c5d274e9eeac
effbb7c77e7148bae57907a8f02a5af12de632e3a50e5ced74c29b29f1e583d9
f69a13217482dc43f25e74cfcb9391d0f06d22501f10f5cb5e413d2d98a5cd23