URL: https://naturalremedynow.com/
Submission Tags: phishingrod
Submission: On October 18 via api from DE — Scanned from DE

Summary

This website contacted 6 IPs in 3 countries across 5 domains to perform 25 HTTP transactions. The main IP is 104.245.36.199, located in United States and belongs to ATLANTIC-NET-1, US. The main domain is naturalremedynow.com.
TLS certificate: Issued by R11 on July 27th 2024. Valid for: 3 months.
This is the only time naturalremedynow.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 15 104.245.36.199 6364 (ATLANTIC-...)
1 2a00:1450:400... 15169 (GOOGLE)
2 2a06:98c1:312... 13335 (CLOUDFLAR...)
4 188.114.96.3 13335 (CLOUDFLAR...)
3 142.250.185.67 15169 (GOOGLE)
25 6
Apex Domain
Subdomains
Transfer
15 naturalremedynow.com
naturalremedynow.com
199 KB
5 belmont-fan.com
www.belmont-fan.com
254 KB
3 gstatic.com
fonts.gstatic.com
100 KB
1 topregalsteel.com
www.topregalsteel.com
12 KB
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 30
3 KB
25 5
Domain Requested by
15 naturalremedynow.com 1 redirects naturalremedynow.com
5 www.belmont-fan.com naturalremedynow.com
3 fonts.gstatic.com fonts.googleapis.com
1 www.topregalsteel.com naturalremedynow.com
1 fonts.googleapis.com naturalremedynow.com
25 5

This site contains links to these domains. Also see Links.

Domain
www.topregalsteel.com
www.belmont-fan.com
en.wikipedia.org
colorlib.com
wordpress.org
Subject Issuer Validity Valid
naturalremedynow.com
R11
2024-07-27 -
2024-10-25
3 months crt.sh
upload.video.google.com
WR2
2024-09-30 -
2024-12-23
3 months crt.sh
topregalsteel.com
WE1
2024-08-27 -
2024-11-25
3 months crt.sh
belmont-fan.com
WE1
2024-10-06 -
2025-01-04
3 months crt.sh
*.gstatic.com
WR2
2024-09-30 -
2024-12-23
3 months crt.sh

This page contains 1 frames:

Primary Page: https://naturalremedynow.com/
Frame ID: 97673E6773DB2C295DC996FC08013A6E
Requests: 24 HTTP requests in this frame

Screenshot

Page Title

blog

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
  • /wp-(?:content|includes)/

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Overall confidence: 100%
Detected patterns
  • jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

25
Requests

92 %
HTTPS

40 %
IPv6

5
Domains

5
Subdomains

6
IPs

3
Countries

566 kB
Transfer

1038 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 23
  • https://naturalremedynow.com/favicon.ico HTTP 302
  • https://naturalremedynow.com/wp-includes/images/w-logo-blue-white-bg.png

25 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
naturalremedynow.com/
72 KB
17 KB
Document
General
Full URL
https://naturalremedynow.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.245.36.199 , United States, ASN6364 (ATLANTIC-NET-1, US),
Reverse DNS
Software
Apache/2.4.54 (Ubuntu) /
Resource Hash
734bdca174b94741f4b5f5f71fafb70dc0acef60281ef1765e63c91717d93508

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges
bytes
age
8534
content-encoding
gzip
content-length
17250
content-type
text/html; charset=UTF-8
date
Thu, 17 Oct 2024 23:40:45 GMT
link
<https://naturalremedynow.com/wp-json/>; rel="https://api.w.org/"
sameorig
X-Frame-Options: SAMEORIGIN
server
Apache/2.4.54 (Ubuntu)
ssl
Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
vary
X-Forwarded-Proto,Accept-Encoding
style.min.css
naturalremedynow.com/wp-includes/css/dist/block-library/
110 KB
15 KB
Stylesheet
General
Full URL
https://naturalremedynow.com/wp-includes/css/dist/block-library/style.min.css?ver=6.6.2
Requested by
Host: naturalremedynow.com
URL: https://naturalremedynow.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.245.36.199 , United States, ASN6364 (ATLANTIC-NET-1, US),
Reverse DNS
Software
Apache/2.4.54 (Ubuntu) /
Resource Hash
fb3a89cc6347e098063bd15f285bc90411846ddce6f17812364feedab67a67f5

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://naturalremedynow.com/

Response headers

content-encoding
gzip
etag
"1b72b-621ca5895539a-gzip"
age
12849
sameorig
X-Frame-Options: SAMEORIGIN
accept-ranges
bytes
content-length
14840
date
Thu, 17 Oct 2024 22:28:50 GMT
ssl
Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
last-modified
Tue, 10 Sep 2024 21:13:33 GMT
vary
X-Forwarded-Proto,Accept-Encoding
server
Apache/2.4.54 (Ubuntu)
content-type
text/css
bootstrap.min.css
naturalremedynow.com/wp-content/themes/sparkling/assets/css/
118 KB
20 KB
Stylesheet
General
Full URL
https://naturalremedynow.com/wp-content/themes/sparkling/assets/css/bootstrap.min.css?ver=6.6.2
Requested by
Host: naturalremedynow.com
URL: https://naturalremedynow.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.245.36.199 , United States, ASN6364 (ATLANTIC-NET-1, US),
Reverse DNS
Software
Apache/2.4.54 (Ubuntu) /
Resource Hash
5a3d8c05785485d36ee5c94d4681e5b1d9e4b94c5be8b5bd7b0f3168fff1bd9a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://naturalremedynow.com/

Response headers

content-encoding
gzip
etag
"1d975-5d7f6d7ac1d0b-gzip"
age
12849
sameorig
X-Frame-Options: SAMEORIGIN
accept-ranges
bytes
content-length
19749
date
Thu, 17 Oct 2024 22:28:50 GMT
ssl
Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
last-modified
Mon, 14 Feb 2022 09:14:23 GMT
vary
X-Forwarded-Proto,Accept-Encoding
server
Apache/2.4.54 (Ubuntu)
content-type
text/css
fontawesome-all.min.css
naturalremedynow.com/wp-content/themes/sparkling/assets/css/
38 KB
9 KB
Stylesheet
General
Full URL
https://naturalremedynow.com/wp-content/themes/sparkling/assets/css/fontawesome-all.min.css?ver=5.1.1.
Requested by
Host: naturalremedynow.com
URL: https://naturalremedynow.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.245.36.199 , United States, ASN6364 (ATLANTIC-NET-1, US),
Reverse DNS
Software
Apache/2.4.54 (Ubuntu) /
Resource Hash
1fb4e5837d9acc69824236d43a2329ac7682219256699559d17f420a090a8743

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://naturalremedynow.com/

Response headers

content-encoding
gzip
etag
"969b-5d7f6d7ac1923-gzip"
age
12849
sameorig
X-Frame-Options: SAMEORIGIN
accept-ranges
bytes
content-length
8408
date
Thu, 17 Oct 2024 22:28:50 GMT
ssl
Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
last-modified
Mon, 14 Feb 2022 09:14:23 GMT
vary
X-Forwarded-Proto,Accept-Encoding
server
Apache/2.4.54 (Ubuntu)
content-type
text/css
css
fonts.googleapis.com/
30 KB
3 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Open+Sans%3A400italic%2C400%2C600%2C700%7CRoboto+Slab%3A400%2C300%2C700&ver=6.6.2
Requested by
Host: naturalremedynow.com
URL: https://naturalremedynow.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
f0ad52d2020722946706beb427a207a7518d9c1689e2bf0811e9ad4bab4b082a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://naturalremedynow.com/

Response headers

content-encoding
gzip
x-content-type-options
nosniff
expires
Fri, 18 Oct 2024 02:03:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Fri, 18 Oct 2024 02:03:00 GMT
content-type
text/css; charset=utf-8
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified
Fri, 18 Oct 2024 00:28:59 GMT
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
x-xss-protection
0
server
ESF
style.css
naturalremedynow.com/wp-content/themes/sparkling/
57 KB
10 KB
Stylesheet
General
Full URL
https://naturalremedynow.com/wp-content/themes/sparkling/style.css?ver=2.4.2
Requested by
Host: naturalremedynow.com
URL: https://naturalremedynow.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.245.36.199 , United States, ASN6364 (ATLANTIC-NET-1, US),
Reverse DNS
Software
Apache/2.4.54 (Ubuntu) /
Resource Hash
7ae7c56a2cf61c8a9098e837ffd72950e843fb91437d4bae9f03b4baf63d0256

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://naturalremedynow.com/

Response headers

content-encoding
gzip
etag
"e2ec-5d7f6d7abf9e3-gzip"
age
12849
sameorig
X-Frame-Options: SAMEORIGIN
accept-ranges
bytes
content-length
10355
date
Thu, 17 Oct 2024 22:28:50 GMT
ssl
Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
last-modified
Mon, 14 Feb 2022 09:14:23 GMT
vary
X-Forwarded-Proto,Accept-Encoding
server
Apache/2.4.54 (Ubuntu)
content-type
text/css
jquery.min.js
naturalremedynow.com/wp-includes/js/jquery/
86 KB
30 KB
Script
General
Full URL
https://naturalremedynow.com/wp-includes/js/jquery/jquery.min.js?ver=3.7.1
Requested by
Host: naturalremedynow.com
URL: https://naturalremedynow.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.245.36.199 , United States, ASN6364 (ATLANTIC-NET-1, US),
Reverse DNS
Software
Apache/2.4.54 (Ubuntu) /
Resource Hash
cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://naturalremedynow.com/

Response headers

content-encoding
gzip
etag
"15601-60a059440af92-gzip"
age
12849
sameorig
X-Frame-Options: SAMEORIGIN
accept-ranges
bytes
content-length
30368
date
Thu, 17 Oct 2024 22:28:50 GMT
ssl
Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
last-modified
Mon, 13 Nov 2023 09:48:58 GMT
vary
X-Forwarded-Proto,Accept-Encoding
server
Apache/2.4.54 (Ubuntu)
content-type
text/javascript
jquery-migrate.min.js
naturalremedynow.com/wp-includes/js/jquery/
13 KB
5 KB
Script
General
Full URL
https://naturalremedynow.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1
Requested by
Host: naturalremedynow.com
URL: https://naturalremedynow.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.245.36.199 , United States, ASN6364 (ATLANTIC-NET-1, US),
Reverse DNS
Software
Apache/2.4.54 (Ubuntu) /
Resource Hash
5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://naturalremedynow.com/

Response headers

content-encoding
gzip
etag
"3509-602dfc4e2eaa8-gzip"
age
12849
sameorig
X-Frame-Options: SAMEORIGIN
accept-ranges
bytes
content-length
4872
date
Thu, 17 Oct 2024 22:28:50 GMT
ssl
Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
last-modified
Mon, 14 Aug 2023 10:46:04 GMT
vary
X-Forwarded-Proto,Accept-Encoding
server
Apache/2.4.54 (Ubuntu)
content-type
text/javascript
bootstrap.min.js
naturalremedynow.com/wp-content/themes/sparkling/assets/js/vendor/
66 KB
19 KB
Script
General
Full URL
https://naturalremedynow.com/wp-content/themes/sparkling/assets/js/vendor/bootstrap.min.js?ver=6.6.2
Requested by
Host: naturalremedynow.com
URL: https://naturalremedynow.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.245.36.199 , United States, ASN6364 (ATLANTIC-NET-1, US),
Reverse DNS
Software
Apache/2.4.54 (Ubuntu) /
Resource Hash
7be207e7e86e6d2afbd6c0ccbf22cbaade35236e410964181f5dba05fd55d958

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://naturalremedynow.com/

Response headers

content-encoding
gzip
etag
"108a4-5d7f6d7ac1153-gzip"
age
12849
sameorig
X-Frame-Options: SAMEORIGIN
accept-ranges
bytes
content-length
19256
date
Thu, 17 Oct 2024 22:28:50 GMT
ssl
Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
last-modified
Mon, 14 Feb 2022 09:14:23 GMT
vary
X-Forwarded-Proto,Accept-Encoding
server
Apache/2.4.54 (Ubuntu)
content-type
text/javascript
functions.js
naturalremedynow.com/wp-content/themes/sparkling/assets/js/
3 KB
1 KB
Script
General
Full URL
https://naturalremedynow.com/wp-content/themes/sparkling/assets/js/functions.js?ver=20180503
Requested by
Host: naturalremedynow.com
URL: https://naturalremedynow.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.245.36.199 , United States, ASN6364 (ATLANTIC-NET-1, US),
Reverse DNS
Software
Apache/2.4.54 (Ubuntu) /
Resource Hash
eb06cd7f877bbf9f769b717e1625d1389aa9290f2f46d27d6ef2ae5fecf38ce5

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://naturalremedynow.com/

Response headers

content-encoding
gzip
etag
"a0b-5d7f6d7ac0d6b-gzip"
age
12849
sameorig
X-Frame-Options: SAMEORIGIN
accept-ranges
bytes
content-length
998
date
Thu, 17 Oct 2024 22:28:50 GMT
ssl
Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
last-modified
Mon, 14 Feb 2022 09:14:23 GMT
vary
X-Forwarded-Proto,Accept-Encoding
server
Apache/2.4.54 (Ubuntu)
content-type
text/javascript
Hfa991617faf94c2d8cffff85e8f75f4fP.webp
www.topregalsteel.com/wp-content/uploads/2024/07/
11 KB
12 KB
Image
General
Full URL
https://www.topregalsteel.com/wp-content/uploads/2024/07/Hfa991617faf94c2d8cffff85e8f75f4fP.webp
Requested by
Host: naturalremedynow.com
URL: https://naturalremedynow.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
35f1b082902084113c6878fce0954411210f4e4a0267668d045e14717db9da38
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://naturalremedynow.com/

Response headers

cf-cache-status
MISS
etag
"6687703b-2c10"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uYni6uXzU1PlikvPX0iQpoOlX7t%2BOei%2BfhXBKVWUazi%2FPYiSttskbCWOzkQtR7kR5Hs2GaYa2pVY0%2BENzb7Cp%2BfDNVqD7DTK0DSXJRlO4uKVbeaZ7dUGGf42fecu1nwQ1oRVIzTuXEdt67AAhlIMWcS1BC0%3D"}],"group":"cf-nel","max_age":604800}
expires
Sat, 18 Oct 2025 02:03:00 GMT
alt-svc
h3=":443"; ma=86400
date
Fri, 18 Oct 2024 02:03:01 GMT
content-type
image/webp
last-modified
Fri, 05 Jul 2024 04:02:03 GMT
vary
Accept-Encoding
strict-transport-security
max-age=31536000
cache-control
max-age=31536000
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
8d44f30f9b799060-FRA
accept-ranges
bytes
content-length
11280
server
cloudflare
EC-Backward-Curved-Centrifugal-Fan-BMF225.webp
www.belmont-fan.com/wp-content/uploads/2024/08/
22 KB
22 KB
Image
General
Full URL
https://www.belmont-fan.com/wp-content/uploads/2024/08/EC-Backward-Curved-Centrifugal-Fan-BMF225.webp
Requested by
Host: naturalremedynow.com
URL: https://naturalremedynow.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1fd7063753c6a98a3a39dc01987e3a8c46a8917fd9e65e2c589f99227f028817

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://naturalremedynow.com/

Response headers

cache-control
max-age=31536000, public, no-transform
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status
BYPASS
etag
"66d0018b-5668"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Y7vihCPm8s1IO8si8rSoN48q3dULUtJlHBnQC5tSSo%2FSjA1b0PF3LNBharnd6JmGW2wMtAmMoG7yUCh4qYYxZKnAjyuJ17j5fiL3FEwZRWCoWgiAea8nFabcSeC38WGe9gfwuhQLtZpuTgL%2FB5pPOIik"}],"group":"cf-nel","max_age":604800}
cf-ray
8d44f30fa9b3dbff-FRA
expires
Sat, 18 Oct 2025 02:03:00 GMT
accept-ranges
bytes
alt-svc
h3=":443"; ma=86400
content-length
22120
date
Fri, 18 Oct 2024 02:03:01 GMT
content-type
image/webp
last-modified
Thu, 29 Aug 2024 05:05:15 GMT
vary
Accept-Encoding
server
cloudflare
AC-Forward-Curved-Centrifugal-Fan-BMF355.webp
www.belmont-fan.com/wp-content/uploads/2023/10/
28 KB
29 KB
Image
General
Full URL
https://www.belmont-fan.com/wp-content/uploads/2023/10/AC-Forward-Curved-Centrifugal-Fan-BMF355.webp
Requested by
Host: naturalremedynow.com
URL: https://naturalremedynow.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
47709c484a411094834a750bae1c9047a6f01109a1556741eec21a97ffc115d0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://naturalremedynow.com/

Response headers

cf-cache-status
MISS
etag
"6524f912-71ec"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xmYMA6VO56rqU6KgvrMEQAdiUyEwROQ7Fx8YAWnIF%2BQcuvi0bTKI7BeG0UGztqw%2B2W1OBcVcmjLersCFS1UiyAsLUAAXKiA51k6FqGIF4Ie0zRZgPGxGrYXxeRJXx0GMHx14BbF7"}],"group":"cf-nel","max_age":604800}
expires
Sat, 18 Oct 2025 02:03:01 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Fri, 18 Oct 2024 02:03:01 GMT
content-type
image/webp
last-modified
Tue, 10 Oct 2023 07:11:14 GMT
vary
Accept-Encoding
cache-control
public, max-age=31536000, no-transform
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
8d44f3126f501e69-AMS
accept-ranges
bytes
content-length
29164
server
cloudflare
178c2c7a-1f33-4e56-8ecf-87fc01f68ef4
https://naturalremedynow.com/
0
0

radial-plug-fan-1.webp
www.belmont-fan.com/wp-content/uploads/2023/10/
77 KB
77 KB
Image
General
Full URL
https://www.belmont-fan.com/wp-content/uploads/2023/10/radial-plug-fan-1.webp
Requested by
Host: naturalremedynow.com
URL: https://naturalremedynow.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c71696f03b46fa28a2f084403be979996b0574c66bf51d76aaf9251c9405fd42

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://naturalremedynow.com/

Response headers

cf-cache-status
MISS
etag
"6526561b-13354"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=86QFMgBLrtMDyXted7lauWK1pQsF%2BH4KlWou9KCxcoPN9M%2BkK6vO085I8wlFEhtCwLXhDYISnpBxU1jvI9voBG2NrCyjiz3JWNU29njUaYkHWmwx8ZKbHusbOnH90etBXf73C9tX"}],"group":"cf-nel","max_age":604800}
expires
Sat, 18 Oct 2025 02:03:01 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Fri, 18 Oct 2024 02:03:01 GMT
content-type
image/webp
last-modified
Wed, 11 Oct 2023 08:00:27 GMT
vary
Accept-Encoding
cache-control
public, max-age=31536000, no-transform
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
8d44f3126f511e69-AMS
accept-ranges
bytes
content-length
78676
server
cloudflare
EC-Axial-Fan-BMF300.webp
www.belmont-fan.com/wp-content/uploads/2023/07/
47 KB
48 KB
Image
General
Full URL
https://www.belmont-fan.com/wp-content/uploads/2023/07/EC-Axial-Fan-BMF300.webp
Requested by
Host: naturalremedynow.com
URL: https://naturalremedynow.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0fb17809f5d341842bb721a018a9d01e4774e98b1b2d809c957bc91340e714fa

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://naturalremedynow.com/

Response headers

cf-cache-status
MISS
etag
"64bf1ea8-bd7c"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Hk%2BYlIFPopGABQLeUDetDjhD6I6pi%2Fz2ox6fgILcTgovc1oo60Vb56f1TUd9Zc5UJlFCqjGlT4Ksr7t6%2BaoB3WtAr%2BOZ0chFgSpLjCCEkj2gLNmSjEXsDNxLQmVArpUC9BKaNiYD"}],"group":"cf-nel","max_age":604800}
expires
Sat, 18 Oct 2025 02:03:01 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Fri, 18 Oct 2024 02:03:01 GMT
content-type
image/webp
last-modified
Tue, 25 Jul 2023 01:00:24 GMT
vary
Accept-Encoding
cache-control
public, max-age=31536000, no-transform
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
8d44f3126f521e69-AMS
accept-ranges
bytes
content-length
48508
server
cloudflare
radial-plug-fan-1.webp
www.belmont-fan.com/wp-content/uploads/2023/07/
77 KB
77 KB
Image
General
Full URL
https://www.belmont-fan.com/wp-content/uploads/2023/07/radial-plug-fan-1.webp
Requested by
Host: naturalremedynow.com
URL: https://naturalremedynow.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c71696f03b46fa28a2f084403be979996b0574c66bf51d76aaf9251c9405fd42

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://naturalremedynow.com/

Response headers

cf-cache-status
MISS
etag
"650bf230-13354"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MnmO0ooqxTDPZFf3EigW6Mw4kWSE%2F3FmtVG9C5LBj%2BWFp1sggTjdD7CMwpF1ngyVwbt2DMIasZPPwBAGGchef1Pny0fHNcOPfO1pDREcY2X7JuIiNagyge8wDWTl5arPJPqtRjDG"}],"group":"cf-nel","max_age":604800}
expires
Sat, 18 Oct 2025 02:03:01 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Fri, 18 Oct 2024 02:03:01 GMT
content-type
image/webp
last-modified
Thu, 21 Sep 2023 07:35:12 GMT
vary
Accept-Encoding
cache-control
public, max-age=31536000, no-transform
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
8d44f3126f531e69-AMS
accept-ranges
bytes
content-length
78676
server
cloudflare
skip-link-focus-fix.min.js
naturalremedynow.com/wp-content/themes/sparkling/assets/js/
489 B
616 B
Script
General
Full URL
https://naturalremedynow.com/wp-content/themes/sparkling/assets/js/skip-link-focus-fix.min.js?ver=20140222
Requested by
Host: naturalremedynow.com
URL: https://naturalremedynow.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.245.36.199 , United States, ASN6364 (ATLANTIC-NET-1, US),
Reverse DNS
Software
Apache/2.4.54 (Ubuntu) /
Resource Hash
2c547b2ccdef706767ac9b480926a3918a58e7ecf1d84b4f49718f414fe7f1c5

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://naturalremedynow.com/

Response headers

content-encoding
gzip
etag
"1e9-5d7f6d7ac0983-gzip"
age
12850
sameorig
X-Frame-Options: SAMEORIGIN
accept-ranges
bytes
content-length
293
date
Thu, 17 Oct 2024 22:28:50 GMT
ssl
Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
last-modified
Mon, 14 Feb 2022 09:14:23 GMT
vary
X-Forwarded-Proto,Accept-Encoding
server
Apache/2.4.54 (Ubuntu)
content-type
text/javascript
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v40/
47 KB
47 KB
Font
General
Full URL
https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans%3A400italic%2C400%2C600%2C700%7CRoboto+Slab%3A400%2C300%2C700&ver=6.6.2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.67 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f3.1e100.net
Software
sffe /
Resource Hash
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin
https://naturalremedynow.com
Referer
https://fonts.googleapis.com/

Response headers

age
273817
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Tue, 14 Oct 2025 21:59:23 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 14 Oct 2024 21:59:23 GMT
last-modified
Thu, 14 Dec 2023 02:08:40 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
48236
x-xss-protection
0
server
sffe
BngMUXZYTXPIvIBgJJSb6ufN5qU.woff2
fonts.gstatic.com/s/robotoslab/v34/
34 KB
34 KB
Font
General
Full URL
https://fonts.gstatic.com/s/robotoslab/v34/BngMUXZYTXPIvIBgJJSb6ufN5qU.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans%3A400italic%2C400%2C600%2C700%7CRoboto+Slab%3A400%2C300%2C700&ver=6.6.2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.67 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f3.1e100.net
Software
sffe /
Resource Hash
a8e429611131e3fdc2018ec943a36100dbabb4aaa788c8dead6bdcf927917293
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin
https://naturalremedynow.com
Referer
https://fonts.googleapis.com/

Response headers

age
237703
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Wed, 15 Oct 2025 08:01:17 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 15 Oct 2024 08:01:17 GMT
last-modified
Tue, 24 Oct 2023 01:54:50 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
34328
x-xss-protection
0
server
sffe
fa-solid-900.woff2
naturalremedynow.com/wp-content/themes/sparkling/assets/fonts/
44 KB
44 KB
Font
General
Full URL
https://naturalremedynow.com/wp-content/themes/sparkling/assets/fonts/fa-solid-900.woff2
Requested by
Host: naturalremedynow.com
URL: https://naturalremedynow.com/wp-content/themes/sparkling/assets/css/fontawesome-all.min.css?ver=5.1.1.
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.245.36.199 , United States, ASN6364 (ATLANTIC-NET-1, US),
Reverse DNS
Software
Apache/2.4.54 (Ubuntu) /
Resource Hash
79279c8900d692d54bd3468993728088da3a33f5eabe667637554d3811000837

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin
https://naturalremedynow.com
Referer
https://naturalremedynow.com/wp-content/themes/sparkling/assets/css/fontawesome-all.min.css?ver=5.1.1.

Response headers

etag
"b048-5d7f6d7ac347b"
age
12848
sameorig
X-Frame-Options: SAMEORIGIN
accept-ranges
bytes
content-length
45128
date
Thu, 17 Oct 2024 22:28:52 GMT
ssl
Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
last-modified
Mon, 14 Feb 2022 09:14:23 GMT
vary
X-Forwarded-Proto,Accept-Encoding
server
Apache/2.4.54 (Ubuntu)
content-type
font/woff2
memQYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWq8tWZ0Pw86hd0Rk8ZkWVAewA.woff2
fonts.gstatic.com/s/opensans/v40/
19 KB
19 KB
Font
General
Full URL
https://fonts.gstatic.com/s/opensans/v40/memQYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWq8tWZ0Pw86hd0Rk8ZkWVAewA.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans%3A400italic%2C400%2C600%2C700%7CRoboto+Slab%3A400%2C300%2C700&ver=6.6.2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.67 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f3.1e100.net
Software
sffe /
Resource Hash
b4855cc8ec721cbaf27f3c907345e101b1524858221c14faa79df34cb2f84991
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin
https://naturalremedynow.com
Referer
https://fonts.googleapis.com/

Response headers

age
167037
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Thu, 16 Oct 2025 03:39:03 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 16 Oct 2024 03:39:03 GMT
last-modified
Thu, 14 Dec 2023 02:02:23 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
19280
x-xss-protection
0
server
sffe
glyphicons-halflings-regular.woff2
naturalremedynow.com/wp-content/themes/sparkling/assets/fonts/
18 KB
18 KB
Font
General
Full URL
https://naturalremedynow.com/wp-content/themes/sparkling/assets/fonts/glyphicons-halflings-regular.woff2
Requested by
Host: naturalremedynow.com
URL: https://naturalremedynow.com/wp-content/themes/sparkling/assets/css/bootstrap.min.css?ver=6.6.2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.245.36.199 , United States, ASN6364 (ATLANTIC-NET-1, US),
Reverse DNS
Software
Apache/2.4.54 (Ubuntu) /
Resource Hash
fe185d11a49676890d47bb783312a0cda5a44c4039214094e7957b4c040ef11c

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin
https://naturalremedynow.com
Referer
https://naturalremedynow.com/wp-content/themes/sparkling/assets/css/bootstrap.min.css?ver=6.6.2

Response headers

etag
"466c-5d7f6d7ac441a"
age
12848
sameorig
X-Frame-Options: SAMEORIGIN
accept-ranges
bytes
content-length
18028
date
Thu, 17 Oct 2024 22:28:52 GMT
ssl
Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
last-modified
Mon, 14 Feb 2022 09:14:23 GMT
vary
X-Forwarded-Proto,Accept-Encoding
server
Apache/2.4.54 (Ubuntu)
content-type
font/woff2
wp-emoji-release.min.js
naturalremedynow.com/wp-includes/js/
18 KB
5 KB
Script
General
Full URL
https://naturalremedynow.com/wp-includes/js/wp-emoji-release.min.js?ver=6.6.2
Requested by
Host: naturalremedynow.com
URL: https://naturalremedynow.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.245.36.199 , United States, ASN6364 (ATLANTIC-NET-1, US),
Reverse DNS
Software
Apache/2.4.54 (Ubuntu) /
Resource Hash
4e6ce5444c7f396cef0eb1fa3611034151e485dd06fbe5573a5583e1eebc98c3

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://naturalremedynow.com/

Response headers

content-encoding
gzip
etag
"4926-615238d7fe8d9-gzip"
age
12849
sameorig
X-Frame-Options: SAMEORIGIN
accept-ranges
bytes
content-length
5062
date
Thu, 17 Oct 2024 22:28:52 GMT
ssl
Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
last-modified
Tue, 02 Apr 2024 21:11:42 GMT
vary
X-Forwarded-Proto,Accept-Encoding
server
Apache/2.4.54 (Ubuntu)
content-type
text/javascript
w-logo-blue-white-bg.png
naturalremedynow.com/wp-includes/images/
Redirect Chain
  • https://naturalremedynow.com/favicon.ico
  • https://naturalremedynow.com/wp-includes/images/w-logo-blue-white-bg.png
4 KB
4 KB
Other
General
Full URL
https://naturalremedynow.com/wp-includes/images/w-logo-blue-white-bg.png
Protocol
H2
Server
104.245.36.199 , United States, ASN6364 (ATLANTIC-NET-1, US),
Reverse DNS
Software
Apache/2.4.54 (Ubuntu) /
Resource Hash
6bdb369337ac2496761c6f063bffea0aa6a91d4662279c399071a468251f51f0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://naturalremedynow.com/

Response headers

etag
"1017-5c39cb1cb4dc6"
age
0
sameorig
X-Frame-Options: SAMEORIGIN
accept-ranges
bytes
content-length
4119
date
Fri, 18 Oct 2024 02:03:01 GMT
ssl
Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
last-modified
Mon, 31 May 2021 09:17:28 GMT
vary
X-Forwarded-Proto
server
Apache/2.4.54 (Ubuntu)
content-type
image/png

Redirect headers

x-redirect-by
WordPress
link
<https://naturalremedynow.com/wp-json/>; rel="https://api.w.org/"
location
https://naturalremedynow.com/wp-includes/images/w-logo-blue-white-bg.png
age
0
sameorig
X-Frame-Options: SAMEORIGIN
content-length
0
date
Fri, 18 Oct 2024 02:03:01 GMT
ssl
Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
content-type
text/html; charset=UTF-8
vary
X-Forwarded-Proto,Accept-Encoding
server
Apache/2.4.54 (Ubuntu)

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
naturalremedynow.com
URL
blob:https://naturalremedynow.com/178c2c7a-1f33-4e56-8ecf-87fc01f68ef4

Verdicts & Comments Add Verdict or Comment

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| _wpemojiSettings function| jQuery object| bootstrap function| SparklingIsMobile function| generateMobileMenu object| twemoji object| wp

0 Cookies

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
fonts.gstatic.com
naturalremedynow.com
www.belmont-fan.com
www.topregalsteel.com
naturalremedynow.com
104.245.36.199
142.250.185.67
188.114.96.3
2a00:1450:4001:82a::200a
2a06:98c1:3121::3
0fb17809f5d341842bb721a018a9d01e4774e98b1b2d809c957bc91340e714fa
1fb4e5837d9acc69824236d43a2329ac7682219256699559d17f420a090a8743
1fd7063753c6a98a3a39dc01987e3a8c46a8917fd9e65e2c589f99227f028817
2c547b2ccdef706767ac9b480926a3918a58e7ecf1d84b4f49718f414fe7f1c5
35f1b082902084113c6878fce0954411210f4e4a0267668d045e14717db9da38
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa
47709c484a411094834a750bae1c9047a6f01109a1556741eec21a97ffc115d0
4e6ce5444c7f396cef0eb1fa3611034151e485dd06fbe5573a5583e1eebc98c3
5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89
5a3d8c05785485d36ee5c94d4681e5b1d9e4b94c5be8b5bd7b0f3168fff1bd9a
6bdb369337ac2496761c6f063bffea0aa6a91d4662279c399071a468251f51f0
734bdca174b94741f4b5f5f71fafb70dc0acef60281ef1765e63c91717d93508
79279c8900d692d54bd3468993728088da3a33f5eabe667637554d3811000837
7ae7c56a2cf61c8a9098e837ffd72950e843fb91437d4bae9f03b4baf63d0256
7be207e7e86e6d2afbd6c0ccbf22cbaade35236e410964181f5dba05fd55d958
a8e429611131e3fdc2018ec943a36100dbabb4aaa788c8dead6bdcf927917293
b4855cc8ec721cbaf27f3c907345e101b1524858221c14faa79df34cb2f84991
c71696f03b46fa28a2f084403be979996b0574c66bf51d76aaf9251c9405fd42
cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf
eb06cd7f877bbf9f769b717e1625d1389aa9290f2f46d27d6ef2ae5fecf38ce5
f0ad52d2020722946706beb427a207a7518d9c1689e2bf0811e9ad4bab4b082a
fb3a89cc6347e098063bd15f285bc90411846ddce6f17812364feedab67a67f5
fe185d11a49676890d47bb783312a0cda5a44c4039214094e7957b4c040ef11c