URL: https://medisawa.com/
Submission Tags: @ecarlesi possiblethreat phishing Search All
Submission: On November 22 via api from IT — Scanned from IT

Summary

This website contacted 6 IPs in 1 countries across 4 domains to perform 18 HTTP transactions. The main IP is 172.67.178.137, located in United States and belongs to CLOUDFLARENET, US. The main domain is medisawa.com.
TLS certificate: Issued by WE1 on November 21st 2024. Valid for: 3 months.
This is the only time medisawa.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
12 172.67.178.137 13335 (CLOUDFLAR...)
1 172.217.18.10 15169 (GOOGLE)
2 18.66.112.111 16509 (AMAZON-02)
1 172.217.18.3 15169 (GOOGLE)
2 18.66.112.61 16509 (AMAZON-02)
18 6
Apex Domain
Subdomains
Transfer
12 medisawa.com
medisawa.com
3 MB
4 stripe.com
js.stripe.com — Cisco Umbrella Rank: 1073
181 KB
1 gstatic.com
fonts.gstatic.com
30 KB
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 29
1 KB
18 4
Domain Requested by
12 medisawa.com medisawa.com
4 js.stripe.com medisawa.com
js.stripe.com
1 fonts.gstatic.com fonts.googleapis.com
1 fonts.googleapis.com medisawa.com
18 4

This site contains no links.

Subject Issuer Validity Valid
medisawa.com
WE1
2024-11-21 -
2025-02-19
3 months crt.sh
upload.video.google.com
WR2
2024-10-21 -
2025-01-13
3 months crt.sh
a.stripecdn.com
DigiCert SHA2 Extended Validation Server CA
2024-10-30 -
2025-02-06
3 months crt.sh
*.gstatic.com
WR2
2024-10-21 -
2025-01-13
3 months crt.sh

This page contains 3 frames:

Primary Page: https://medisawa.com/
Frame ID: 0DC1B875CC3C21BDF39D4C05159C5DC6
Requests: 20 HTTP requests in this frame

Frame: https://js.stripe.com/v3/controller-with-preconnect-4f3f42a6bcd32d24da8f002897093f7d.html
Frame ID: 259834BB0F94016A9263AACCFF005F6A
Requests: 1 HTTP requests in this frame

Frame: https://js.stripe.com/v3/m-outer-3437aaddcdf6922d623e172c2d6f9278.html
Frame ID: 15351C92F1A9B7E5566C5FB57693E3A9
Requests: 1 HTTP requests in this frame

Screenshot

Page Title

Medisawa | Empowering Healthcare Businesses

Detected technologies

Overall confidence: 100%
Detected patterns
  • js\.stripe\.com

Page Statistics

18
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

6
IPs

1
Countries

3025 kB
Transfer

6274 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

18 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
medisawa.com/
2 KB
1 KB
Document
General
Full URL
https://medisawa.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.178.137 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
58d9373d93bd14c57d2a5bccb0518a32dc0c709cd5fc0797b4c0dd05124b9e94
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
cache-control
public, max-age=0, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
8e66a5083d3cdbd2-FRA
content-encoding
br
content-type
text/html; charset=utf-8
date
Fri, 22 Nov 2024 05:50:54 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy
strict-origin-when-cross-origin
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iRr6KA7zBAI%2Bi%2FiMUzrw9541Z6SFbVeCvsoTodYoMMzM5UNG6j3aqc2Ht%2BFXNYPwSX9lhaq7FCTjJValbU%2BLHhoAgzIhZ4%2Fnui5gGlfS3OaOEfSqur64sdMYe00RePg%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
server-timing
cfL4;desc="?proto=TCP&rtt=49582&sent=6&recv=11&lost=0&retrans=0&sent_bytes=3953&recv_bytes=2255&delivery_rate=83650&cwnd=250&unsent_bytes=0&cid=ecae900c86f1bb5c&ts=157&x=0"
vary
Accept-Encoding
x-content-type-options
nosniff
main.dfb26568.js
medisawa.com/static/js/
3 MB
1017 KB
Script
General
Full URL
https://medisawa.com/static/js/main.dfb26568.js
Requested by
Host: medisawa.com
URL: https://medisawa.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.178.137 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2119c3e0a9435a7adeafde4260d8a192ada8fbe8873eeeb1e5669ff3184e8ba0
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://medisawa.com/

Response headers

content-encoding
gzip
cf-cache-status
REVALIDATED
etag
W/"9cbcd575f576140b2df594c60c3ebe81"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oVqLhz0wKQ42qknEczzLjQKA2%2BsvmLI7DrdYDfoJXikor6%2F78vL7k37fysovTjD%2B4GCHrSeQdNnSFbuStp770%2BNKvXJnYXVZPyajNy%2FcSIeE5%2Brg%2BLXAkM1Gp7WERsmkRAvcQCPKmW%2BjTOc%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=TCP&rtt=46334&sent=49&recv=16&lost=0&retrans=0&sent_bytes=48370&recv_bytes=2494&delivery_rate=96660&cwnd=253&unsent_bytes=21896&cid=ecae900c86f1bb5c&ts=297&x=0"
date
Fri, 22 Nov 2024 05:50:54 GMT
content-type
application/javascript
vary
Accept-Encoding
cache-control
public, max-age=14400, must-revalidate
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy
strict-origin-when-cross-origin
cf-ray
8e66a5093f42dbd2-FRA
access-control-allow-origin
*
server
cloudflare
main.6f73c091.css
medisawa.com/static/css/
252 KB
67 KB
Stylesheet
General
Full URL
https://medisawa.com/static/css/main.6f73c091.css
Requested by
Host: medisawa.com
URL: https://medisawa.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.178.137 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
84d63aa6091e6757bc62c85c660575916d6d7ade8968e576882d6a671e6e184a
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://medisawa.com/

Response headers

content-encoding
gzip
cf-cache-status
HIT
etag
W/"3736f0601f661efce9fd75168f66eebf"
age
3872
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TOcbEbyzTlBb8KcGLPK5OypYB2YDIQbQdMWukNkzSEI0efusQyBo3TeIi4xXTQHn3ZPyfelKLCB%2FoHhETQMJAD5oAViCoa%2FOLIEdBDJGvpXkLtZFmz8WvR4OEHX63rwf5Oc0yMYMk8%2F3M78%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=TCP&rtt=46334&sent=11&recv=16&lost=0&retrans=0&sent_bytes=5362&recv_bytes=2494&delivery_rate=96660&cwnd=253&unsent_bytes=0&cid=ecae900c86f1bb5c&ts=278&x=0"
date
Fri, 22 Nov 2024 05:50:54 GMT
content-type
text/css; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=14400, must-revalidate
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy
strict-origin-when-cross-origin
cf-ray
8e66a5093f3fdbd2-FRA
access-control-allow-origin
*
server
cloudflare
css2
fonts.googleapis.com/
6 KB
1 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css2?family=Instrument+Sans:ital,wght@0,400..700;1,400..700&family=Overpass:ital,wght@0,100..900;1,100..900&display=swap
Requested by
Host: medisawa.com
URL: https://medisawa.com/static/css/main.6f73c091.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.18.10 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra02s19-in-f10.1e100.net
Software
ESF /
Resource Hash
4bd0666d88ead839c618f10d5f78aa8589536a72ce08782bc163d79e1c1f3683
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://medisawa.com/

Response headers

content-encoding
gzip
x-content-type-options
nosniff
expires
Fri, 22 Nov 2024 05:50:55 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Fri, 22 Nov 2024 05:50:55 GMT
content-type
text/css; charset=utf-8
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified
Fri, 22 Nov 2024 05:50:55 GMT
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
x-xss-protection
0
server
ESF
v3
js.stripe.com/
690 KB
180 KB
Script
General
Full URL
https://js.stripe.com/v3
Requested by
Host: medisawa.com
URL: https://medisawa.com/static/js/main.dfb26568.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-111.fra56.r.cloudfront.net
Software
Cloudfront /
Resource Hash
06b9fda0c662d424da46caa0d3bb8e1b946d3730ae97b0a83b96c21c6bf957da
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://medisawa.com/

Response headers

content-encoding
br
etag
W/"55e508d7370f031ed0a39542306d7e3d"
age
54
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
x-cache
Hit from cloudfront
x-amz-cf-id
iaeIDt739tCNWEnTwD2bkN7K5TyZwP3DM3XgHGLW8kSb728g7P9uyA==
date
Fri, 22 Nov 2024 05:50:03 GMT
content-type
text/javascript; charset=utf-8
last-modified
Thu, 21 Nov 2024 22:21:51 GMT
vary
Accept-Encoding
strict-transport-security
max-age=31556926; includeSubDomains; preload
cache-control
max-age=60
timing-allow-origin
*
via
1.1 b6be6ee8d445cfa291adcacd75a3fb12.cloudfront.net (CloudFront)
access-control-allow-origin
*
x-amz-cf-pop
FRA56-P5
server
Cloudfront
logo.109ac9b173e60f5446eca73d98792d54.svg
medisawa.com/static/media/
26 KB
11 KB
Image
General
Full URL
https://medisawa.com/static/media/logo.109ac9b173e60f5446eca73d98792d54.svg
Requested by
Host: medisawa.com
URL: https://medisawa.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.178.137 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cca11a76ddeb0888d18a9d63168aa86cb95b2a6ca66a2fa59873f889bade4cd6
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://medisawa.com/

Response headers

content-encoding
gzip
cf-cache-status
MISS
etag
W/"2ded1f9b8f306dab0bdcf5e524e51e6e"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZS92vwQMf%2Baod2kESxNoMi%2BLCX9oDlnxkhqtD%2FpaldamsUT4lwEEpRIoZmb1x7k71J7ePVgu3U3lraYOCZiRNF7zFnZs1zi9ZfSzLNhw2CCu5Y1cM8Y1MSQKxUYtjDA%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=TCP&rtt=31657&sent=928&recv=181&lost=0&retrans=0&sent_bytes=1168306&recv_bytes=3381&delivery_rate=11627721&cwnd=899&unsent_bytes=10969&cid=ecae900c86f1bb5c&ts=2077&x=0"
date
Fri, 22 Nov 2024 05:50:56 GMT
content-type
image/svg+xml
vary
Accept-Encoding
cache-control
public, max-age=14400, must-revalidate
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy
strict-origin-when-cross-origin
cf-ray
8e66a51358d3dbd2-FRA
access-control-allow-origin
*
server
cloudflare
banner.5f8c4539ddae28755335.png
medisawa.com/static/media/
500 KB
501 KB
Image
General
Full URL
https://medisawa.com/static/media/banner.5f8c4539ddae28755335.png
Requested by
Host: medisawa.com
URL: https://medisawa.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.178.137 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8d987104afa4f6769da34b7e834a6ac3dbc474cf55ed922fb8e8b3929bca44b4
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://medisawa.com/

Response headers

cf-cache-status
MISS
etag
"98398d0f822e3905a1a0a5ab18aee03e"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6ZurYzSTgxtJ5r88UjCScdeEbRvJoHVi6nMS2Wu1bvGkHkx3o%2FkESvlfv%2BAAHne7Wfs96vOLT3vSuMS9kyW1AbBlA7pFANyyFbz0UupkQKdEhV9YRGxXVWl3D113uBI%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=TCP&rtt=19985&sent=1867&recv=248&lost=0&retrans=0&sent_bytes=2373952&recv_bytes=3381&delivery_rate=13919393&cwnd=899&unsent_bytes=0&cid=ecae900c86f1bb5c&ts=2121&x=0"
date
Fri, 22 Nov 2024 05:50:56 GMT
content-type
image/png
vary
Accept-Encoding
cache-control
public, max-age=14400, must-revalidate
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy
strict-origin-when-cross-origin
cf-ray
8e66a51358d6dbd2-FRA
accept-ranges
bytes
access-control-allow-origin
*
content-length
512022
server
cloudflare
approach.8140786efb9f5d051874.png
medisawa.com/static/media/
680 KB
681 KB
Image
General
Full URL
https://medisawa.com/static/media/approach.8140786efb9f5d051874.png
Requested by
Host: medisawa.com
URL: https://medisawa.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.178.137 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3df26733a51fa524ea84236b9d0eea7fdcf41c294165d596a13818f2af06254a
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://medisawa.com/

Response headers

cf-cache-status
MISS
etag
"6df72584fd7ab846aaa11b69b3f51711"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZRVwjIjUNPk%2BDohqP4x9JduCxB%2FhsmSs%2B4kHwqbxERGJTcMjLprJlCmeQdDY9h32gQOOpIxwn8hII54WS7BrhsT7MilpgR0SkwLABpAbym9dsySYRfSBLTvNKBa5LVw%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=TCP&rtt=31657&sent=946&recv=181&lost=0&retrans=0&sent_bytes=1190767&recv_bytes=3381&delivery_rate=11627721&cwnd=899&unsent_bytes=0&cid=ecae900c86f1bb5c&ts=2085&x=0"
date
Fri, 22 Nov 2024 05:50:56 GMT
content-type
image/png
vary
Accept-Encoding
cache-control
public, max-age=14400, must-revalidate
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy
strict-origin-when-cross-origin
cf-ray
8e66a51358d7dbd2-FRA
accept-ranges
bytes
access-control-allow-origin
*
content-length
695966
server
cloudflare
truncated
/
9 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
86ce1d1135f9de8e25b3e5d8aaca2da62c6020b6129073749d617bd7e0fe4f50

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/png
patients.3154825f7395d7e139d9.png
medisawa.com/static/media/
58 KB
58 KB
Image
General
Full URL
https://medisawa.com/static/media/patients.3154825f7395d7e139d9.png
Requested by
Host: medisawa.com
URL: https://medisawa.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.178.137 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
924994de2bb48e1f0ffafecafc2ff020c07436c62d6ffdca048fc8f81c2b25e6
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://medisawa.com/

Response headers

cf-cache-status
MISS
etag
"c73128e96293603982c1f1651437c700"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=smnfRRpb6HbPqACr9n3wBoR6u24Xiz%2FxtT0G%2FQkU84wRLnjjTAZnRBlEJNIrH3EQ5BuKI7bPhlwFaM6%2FFmOdAMJpbS3sTDvLtOxoNC32m4qYSxnk0f4gyP6zF8vtUW0%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=TCP&rtt=31657&sent=888&recv=181&lost=0&retrans=0&sent_bytes=1119468&recv_bytes=3381&delivery_rate=11627721&cwnd=899&unsent_bytes=0&cid=ecae900c86f1bb5c&ts=2077&x=0"
date
Fri, 22 Nov 2024 05:50:56 GMT
content-type
image/png
vary
Accept-Encoding
cache-control
public, max-age=14400, must-revalidate
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy
strict-origin-when-cross-origin
cf-ray
8e66a51358d8dbd2-FRA
accept-ranges
bytes
access-control-allow-origin
*
content-length
59132
server
cloudflare
digital-wallet.7844cb4870f83bd3344d.png
medisawa.com/static/media/
20 KB
20 KB
Image
General
Full URL
https://medisawa.com/static/media/digital-wallet.7844cb4870f83bd3344d.png
Requested by
Host: medisawa.com
URL: https://medisawa.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.178.137 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5fafda0071d56746839cb2eaca6052a39cfbb3e50990c32b2c33b11394bd3f14
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://medisawa.com/

Response headers

cf-cache-status
MISS
etag
"927f31cbd9a8a09c0da90ac0a9a5acc6"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IM9fE9D2v4F209dZUliM615v9h%2FMxNY5YhN4i3oA0rS7lzAZeMWm4sDeRRuA9wiGiJc%2Fq5rAGr1%2BNoCNwLEyEgeS56BLKoSjVJjP6uUwfFiQdnaYltJ5wyKlqOut4SU%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=TCP&rtt=31657&sent=1286&recv=181&lost=0&retrans=0&sent_bytes=1626122&recv_bytes=3381&delivery_rate=11627721&cwnd=899&unsent_bytes=32200&cid=ecae900c86f1bb5c&ts=2096&x=0"
date
Fri, 22 Nov 2024 05:50:56 GMT
content-type
image/png
vary
Accept-Encoding
cache-control
public, max-age=14400, must-revalidate
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy
strict-origin-when-cross-origin
cf-ray
8e66a51368dbdbd2-FRA
accept-ranges
bytes
access-control-allow-origin
*
content-length
20146
server
cloudflare
countries.fcf86fa1a0487215011a.png
medisawa.com/static/media/
26 KB
27 KB
Image
General
Full URL
https://medisawa.com/static/media/countries.fcf86fa1a0487215011a.png
Requested by
Host: medisawa.com
URL: https://medisawa.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.178.137 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6e3686c962833c67bf35db6b927f49b1f0ec7e3a322b599ef27ab1e819e06965
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://medisawa.com/

Response headers

cf-cache-status
MISS
etag
"91d78da32d1ce9fc98aa450dbaf0c6ef"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YOUYrZTymBnRx9NyRJTw1YOLbW9GUVoixzrzZ1%2FabqUXGgZqX7K%2FTGTnX0ngHQtQGsH3kY%2F3q8Wk91EZhrhJ7E%2BBVRqCP%2BwuplkycjHhUPqZ5jm3N3c60NLrkMo9JAw%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=TCP&rtt=28148&sent=1411&recv=185&lost=0&retrans=0&sent_bytes=1787122&recv_bytes=3381&delivery_rate=11627721&cwnd=899&unsent_bytes=64400&cid=ecae900c86f1bb5c&ts=2101&x=0"
date
Fri, 22 Nov 2024 05:50:56 GMT
content-type
image/png
vary
Accept-Encoding
cache-control
public, max-age=14400, must-revalidate
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy
strict-origin-when-cross-origin
cf-ray
8e66a51368dedbd2-FRA
accept-ranges
bytes
access-control-allow-origin
*
content-length
26971
server
cloudflare
truncated
/
3 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
0fa02dec15245759addccb912c12510d0ae1ec0235ac75144a2950e884684b08

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/png
truncated
/
4 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
501bb5015932525214beaf580503528b32745b54539b357716917682660b64d9

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/png
truncated
/
5 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
29ec233fb698588612f0b1e2baebc0f3439e22671dc3db99f8948d5e6718bde8

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/png
providing-healthcare.b63ef1ce527285874e70.png
medisawa.com/static/media/
254 KB
255 KB
Image
General
Full URL
https://medisawa.com/static/media/providing-healthcare.b63ef1ce527285874e70.png
Requested by
Host: medisawa.com
URL: https://medisawa.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.178.137 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
02f0533d9adb0dd089d5a1fb2076c8c2cb6ecce2183a37fbbafaf99a0fd90ce4
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://medisawa.com/

Response headers

cf-cache-status
MISS
etag
"5bc5d251181a546d971b82b170479913"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Klqkf3%2BOt1RzFF07oUZWBF3UVbwSyp1ieT5v6a0m0VEUTUlcniohxv8QpHKCEVzEjP5mQ94JfHMog6xANL2Nhhx3zxHC%2FfNFDNruQHxZgSygO6MFQti65LS98y6VwEE%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=TCP&rtt=29643&sent=1411&recv=183&lost=0&retrans=0&sent_bytes=1787122&recv_bytes=3381&delivery_rate=11627721&cwnd=899&unsent_bytes=64400&cid=ecae900c86f1bb5c&ts=2100&x=0"
date
Fri, 22 Nov 2024 05:50:56 GMT
content-type
image/png
vary
Accept-Encoding
cache-control
public, max-age=14400, must-revalidate
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy
strict-origin-when-cross-origin
cf-ray
8e66a51368e0dbd2-FRA
accept-ranges
bytes
access-control-allow-origin
*
content-length
260434
server
cloudflare
footer-bg.9540c8f3f1092194a492.png
medisawa.com/static/media/
170 KB
170 KB
Image
General
Full URL
https://medisawa.com/static/media/footer-bg.9540c8f3f1092194a492.png
Requested by
Host: medisawa.com
URL: https://medisawa.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.178.137 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5304a44de8ac68d123ea01adf0b9619b3e8777baa37cc74e5242f35fe9da1474
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://medisawa.com/

Response headers

cf-cache-status
MISS
etag
"042f55ce46c4d30f02c207f1ec41dcb7"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ABye4Meus8gGtSqJkJOqCHD5dsxHuE5uAv19veAS0q%2BWRwgYz3cK97PoMTC2zVJaSOQbvQ8k4UYYmmoCvpIwguEj6SMccGtO2fmKfCSufgBaVa%2FqyQ27p10emPPmARI%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=TCP&rtt=31657&sent=1286&recv=181&lost=0&retrans=0&sent_bytes=1626122&recv_bytes=3381&delivery_rate=11627721&cwnd=899&unsent_bytes=32200&cid=ecae900c86f1bb5c&ts=2096&x=0"
date
Fri, 22 Nov 2024 05:50:56 GMT
content-type
image/png
vary
Accept-Encoding
cache-control
public, max-age=14400, must-revalidate
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy
strict-origin-when-cross-origin
cf-ray
8e66a51368e1dbd2-FRA
accept-ranges
bytes
access-control-allow-origin
*
content-length
173951
server
cloudflare
pxiTypc9vsFDm051Uf6KVwgkfoSxQ0GsQv8ToedPibnr0SZe1Q.woff2
fonts.gstatic.com/s/instrumentsans/v1/
29 KB
30 KB
Font
General
Full URL
https://fonts.gstatic.com/s/instrumentsans/v1/pxiTypc9vsFDm051Uf6KVwgkfoSxQ0GsQv8ToedPibnr0SZe1Q.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Instrument+Sans:ital,wght@0,400..700;1,400..700&family=Overpass:ital,wght@0,100..900;1,100..900&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.18.3 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra02s19-in-f3.1e100.net
Software
sffe /
Resource Hash
5a50d6683916c714be16096899c4fd900ebe7ef7da0c6928a625fd90f2669619
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://medisawa.com
Referer
https://fonts.googleapis.com/

Response headers

age
277880
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Wed, 19 Nov 2025 00:39:37 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 19 Nov 2024 00:39:37 GMT
last-modified
Mon, 08 May 2023 22:56:10 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
30044
x-xss-protection
0
server
sffe
controller-with-preconnect-4f3f42a6bcd32d24da8f002897093f7d.html
js.stripe.com/v3/ Frame 2598
0
0
Document
General
Full URL
https://js.stripe.com/v3/controller-with-preconnect-4f3f42a6bcd32d24da8f002897093f7d.html
Requested by
Host: js.stripe.com
URL: https://js.stripe.com/v3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.61 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-61.fra56.r.cloudfront.net
Software
Cloudfront /
Resource Hash
Security Headers
Name Value
Content-Security-Policy base-uri 'none'; connect-src 'self' https://api.stripe.com https://merchant-ui-api.stripe.com https://stripe.com/cookie-settings/enforcement-mode https://errors.stripe.com https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src 'self'; img-src 'self' https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'sha256-0hAheEzaMe6uXIKV4EehS9pu1am1lj/KnnzrOYqckXk='; worker-src 'none'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security max-age=31556926; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://medisawa.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

accept-ranges
bytes
access-control-allow-origin
*
age
50
alt-svc
h3=":443"; ma=86400
cache-control
max-age=60, stale-while-revalidate=900
content-length
651
content-security-policy
base-uri 'none'; connect-src 'self' https://api.stripe.com https://merchant-ui-api.stripe.com https://stripe.com/cookie-settings/enforcement-mode https://errors.stripe.com https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src 'self'; img-src 'self' https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'sha256-0hAheEzaMe6uXIKV4EehS9pu1am1lj/KnnzrOYqckXk='; worker-src 'none'; report-uri https://q.stripe.com/csp-report
content-type
text/html; charset=utf-8
date
Fri, 22 Nov 2024 05:50:10 GMT
etag
"4f3f42a6bcd32d24da8f002897093f7d"
last-modified
Thu, 21 Nov 2024 21:38:10 GMT
origin-agent-cluster
?1
server
Cloudfront
strict-transport-security
max-age=31556926; includeSubDomains; preload
timing-allow-origin
*
vary
Accept-Encoding
via
1.1 604f8ac78ed3ba5235c1a14794f2ac64.cloudfront.net (CloudFront)
x-amz-cf-id
Aw9il6eCA7IxdXCCncsKrWvAGwxMQg-AWmR_dXWDRo6-Sg-fjjjOxA==
x-amz-cf-pop
FRA56-P5
x-cache
Hit from cloudfront
x-content-type-options
nosniff
favicon.ico
medisawa.com/
2 KB
3 KB
Other
General
Full URL
https://medisawa.com/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.178.137 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
491d8d38a9fc4e7474a057ccf77275f48414db09e39daf4c8cf927bd429a73ec
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://medisawa.com/

Response headers

content-encoding
gzip
cf-cache-status
REVALIDATED
etag
W/"eccbffffb5658a44fcd3444fb4cf4891"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jju5P%2FS91BrbZ%2BjKM53K%2F%2B0LfOeb512r%2BRgdkYJM19K8Pajlc%2F2pWO83bCGVZktcQCiUMReCR8em%2FkDQosVrOdBLF9uQg5zq2%2B16R5ddpJccIJkGaAvMLfo8vdB6SR%2FJwsMcSO2vgCMd2L4%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=TCP&rtt=31574&sent=2271&recv=375&lost=0&retrans=0&sent_bytes=2888025&recv_bytes=3446&delivery_rate=28670068&cwnd=1536&unsent_bytes=0&cid=ecae900c86f1bb5c&ts=4308&x=0"
date
Fri, 22 Nov 2024 05:50:58 GMT
content-type
image/vnd.microsoft.icon
vary
Accept-Encoding
cache-control
public, max-age=14400, must-revalidate
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy
strict-origin-when-cross-origin
cf-ray
8e66a5224c3fdbd2-FRA
access-control-allow-origin
*
server
cloudflare
m-outer-3437aaddcdf6922d623e172c2d6f9278.html
js.stripe.com/v3/ Frame 1535
0
0
Document
General
Full URL
https://js.stripe.com/v3/m-outer-3437aaddcdf6922d623e172c2d6f9278.html
Requested by
Host: js.stripe.com
URL: https://js.stripe.com/v3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.61 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-61.fra56.r.cloudfront.net
Software
Cloudfront /
Resource Hash
Security Headers
Name Value
Content-Security-Policy base-uri 'none'; connect-src 'self' https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src https://m.stripe.network; img-src https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security max-age=31556926; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://medisawa.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

accept-ranges
bytes
access-control-allow-origin
*
age
2807
alt-svc
h3=":443"; ma=86400
cache-control
max-age=31536000
content-length
200
content-security-policy
base-uri 'none'; connect-src 'self' https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src https://m.stripe.network; img-src https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
content-security-policy-report-only
base-uri 'none'; connect-src 'self' https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src https://m.stripe.network; img-src https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
content-type
text/html; charset=utf-8
date
Fri, 22 Nov 2024 05:04:18 GMT
etag
"3437aaddcdf6922d623e172c2d6f9278"
last-modified
Fri, 15 Nov 2024 21:14:25 GMT
origin-agent-cluster
?1
server
Cloudfront
strict-transport-security
max-age=31556926; includeSubDomains; preload
timing-allow-origin
*
vary
Accept-Encoding
via
1.1 604f8ac78ed3ba5235c1a14794f2ac64.cloudfront.net (CloudFront)
x-amz-cf-id
oIKQBZ-CFrPapu_hJq-F3jrLAhjwaYq875FPJPizeLiejDjkpKS6Tg==
x-amz-cf-pop
FRA56-P5
x-cache
Hit from cloudfront
x-content-type-options
nosniff
trusted-types-checker-efd8cf45ce422659c098993bfc62531b.js
js.stripe.com/v3/fingerprinted/js/
176 B
693 B
Script
General
Full URL
https://js.stripe.com/v3/fingerprinted/js/trusted-types-checker-efd8cf45ce422659c098993bfc62531b.js
Requested by
Host: js.stripe.com
URL: https://js.stripe.com/v3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-111.fra56.r.cloudfront.net
Software
Cloudfront /
Resource Hash
07b6b3d899dd69c0e9eb463e23e10e30e82588eddf95d15d45bb505c6703a813
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://medisawa.com/

Response headers

etag
"96f5b26d366f47393b3ff36fe7471474"
age
3370
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
x-cache
Hit from cloudfront
x-amz-cf-id
QGnbu2iuVbGR6dU84bKaXBFE2w3cwa_dM-2TVJ4wZpJGxS67lA1Ysw==
date
Fri, 22 Nov 2024 04:54:54 GMT
content-type
text/javascript; charset=utf-8
last-modified
Fri, 15 Nov 2024 21:14:24 GMT
vary
Accept-Encoding
strict-transport-security
max-age=31556926; includeSubDomains; preload
cache-control
max-age=31536000
timing-allow-origin
*
via
1.1 b6be6ee8d445cfa291adcacd75a3fb12.cloudfront.net (CloudFront)
accept-ranges
bytes
access-control-allow-origin
*
content-length
176
x-amz-cf-pop
FRA56-P5
server
Cloudfront

Verdicts & Comments Add Verdict or Comment

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| webpackChunkmedisawa function| setImmediate function| clearImmediate object| L boolean| MotionIsMounted object| webpackChunkStripeJSouter function| noop function| Stripe

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
fonts.gstatic.com
js.stripe.com
medisawa.com
172.217.18.10
172.217.18.3
172.67.178.137
18.66.112.111
18.66.112.61
02f0533d9adb0dd089d5a1fb2076c8c2cb6ecce2183a37fbbafaf99a0fd90ce4
06b9fda0c662d424da46caa0d3bb8e1b946d3730ae97b0a83b96c21c6bf957da
07b6b3d899dd69c0e9eb463e23e10e30e82588eddf95d15d45bb505c6703a813
0fa02dec15245759addccb912c12510d0ae1ec0235ac75144a2950e884684b08
2119c3e0a9435a7adeafde4260d8a192ada8fbe8873eeeb1e5669ff3184e8ba0
29ec233fb698588612f0b1e2baebc0f3439e22671dc3db99f8948d5e6718bde8
3df26733a51fa524ea84236b9d0eea7fdcf41c294165d596a13818f2af06254a
491d8d38a9fc4e7474a057ccf77275f48414db09e39daf4c8cf927bd429a73ec
4bd0666d88ead839c618f10d5f78aa8589536a72ce08782bc163d79e1c1f3683
501bb5015932525214beaf580503528b32745b54539b357716917682660b64d9
5304a44de8ac68d123ea01adf0b9619b3e8777baa37cc74e5242f35fe9da1474
58d9373d93bd14c57d2a5bccb0518a32dc0c709cd5fc0797b4c0dd05124b9e94
5a50d6683916c714be16096899c4fd900ebe7ef7da0c6928a625fd90f2669619
5fafda0071d56746839cb2eaca6052a39cfbb3e50990c32b2c33b11394bd3f14
6e3686c962833c67bf35db6b927f49b1f0ec7e3a322b599ef27ab1e819e06965
84d63aa6091e6757bc62c85c660575916d6d7ade8968e576882d6a671e6e184a
86ce1d1135f9de8e25b3e5d8aaca2da62c6020b6129073749d617bd7e0fe4f50
8d987104afa4f6769da34b7e834a6ac3dbc474cf55ed922fb8e8b3929bca44b4
924994de2bb48e1f0ffafecafc2ff020c07436c62d6ffdca048fc8f81c2b25e6
cca11a76ddeb0888d18a9d63168aa86cb95b2a6ca66a2fa59873f889bade4cd6