urlscan.io logo urlscan.io
SecurityTrails logo

hsv-rapidremedy.com Open in urlscan Pro
69.16.236.216  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://tinyurl.com/y6zr8hza#OC
Effective URL: http://hsv-rapidremedy.com/get.php?aff_id=1814&subid2=5836_sessid20200914120127173&subid=223
Submission: On September 14 via api from BE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 16 IPs in 4 countries across 18 domains to perform 28 HTTP transactions. The main IP is 69.16.236.216, located in Lansing, United States and belongs to LIQUIDWEB, US. The main domain is hsv-rapidremedy.com.
This is the only time hsv-rapidremedy.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

2    2606:4700:10::6814:8a41 (United States)

ASN13335 (CLOUDFLARENET, US)
tinyurl.com
1    2a05:d018:244:5200::ab (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
www.testroma.me.uk
1    50.23.130.135 (Seattle, United States)

ASN36351 (SOFTLAYER, US)
PTR: 87.82.1732.ip4.static.sl-reverse.com
bliss-mw.net
6    69.16.236.216 (Lansing, United States)

ASN32244 (LIQUIDWEB, US)
PTR: host.brandmatica.com
hsv-rapidremedy.com
3    2001:4de0:ac19::1:b:2a (Netherlands)

ASN20446 (HIGHWINDS3, US)
maxcdn.bootstrapcdn.com
code.jquery.com
stackpath.bootstrapcdn.com
1    2a00:1450:4001:819::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
1    2a00:1450:4001:821::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
1    2606:4700::6812:e134 (United States)

ASN13335 (CLOUDFLARENET, US)
cdn.onesignal.com
1    50.23.130.133 (Seattle, United States)

ASN36351 (SOFTLAYER, US)
PTR: 85.82.1732.ip4.static.sl-reverse.com
echo.spapi.com
1    2606:4700::6811:4e6b (United States)

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
2    2a03:2880:f01c:8012:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK, US)
connect.facebook.net
3    2a00:1450:4001:81d::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
2    2a00:1450:4001:821::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
2    2a03:2880:f11c:8183:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK, US)
www.facebook.com
1    2a00:1450:4001:802::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.youtube.com
1    173.192.183.237 (Seattle, United States)

ASN36351 (SOFTLAYER, US)
PTR: ed.b7.c0ad.ip4.static.sl-reverse.com
tracking.buygoods.com
1    173.192.183.235 (Seattle, United States)

ASN36351 (SOFTLAYER, US)
PTR: buygoods.com
www.buygoods.com
1    2a00:1450:4001:820::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
s.ytimg.com
1    2a00:1450:4001:81f::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.youtube.com
Domain Requested by
6 hsv-rapidremedy.com hsv-rapidremedy.com
3 fonts.gstatic.com fonts.googleapis.com
2 www.youtube.com hsv-rapidremedy.com
s.ytimg.com
2 www.facebook.com hsv-rapidremedy.com
2 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
2 connect.facebook.net hsv-rapidremedy.com
connect.facebook.net
2 tinyurl.com 2 redirects
1 s.ytimg.com www.youtube.com
1 www.buygoods.com hsv-rapidremedy.com
1 tracking.buygoods.com hsv-rapidremedy.com
1 stackpath.bootstrapcdn.com hsv-rapidremedy.com
1 cdnjs.cloudflare.com hsv-rapidremedy.com
1 code.jquery.com hsv-rapidremedy.com
1 echo.spapi.com hsv-rapidremedy.com
1 cdn.onesignal.com hsv-rapidremedy.com
1 www.googletagmanager.com hsv-rapidremedy.com
1 fonts.googleapis.com hsv-rapidremedy.com
1 maxcdn.bootstrapcdn.com hsv-rapidremedy.com
1 bliss-mw.net 1 redirects
1 www.testroma.me.uk 1 redirects
28 20

This site contains links to these domains. Also see Links.

Domain
www.buygoods.com
www.fasebj.org
www.ncbi.nlm.nih.gov
www.nature.com
Subject Issuer Validity Valid
*.bootstrapcdn.com
Sectigo RSA Domain Validation Secure Server CA		 2019-09-14 -
2020-10-13		 a year crt.sh
upload.video.google.com
GTS CA 1O1		 2020-08-26 -
2020-11-18		 3 months crt.sh
*.google-analytics.com
GTS CA 1O1		 2020-08-26 -
2020-11-18		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2020-08-04 -
2021-08-04		 a year crt.sh
*.spapi.com
Go Daddy Secure Certificate Authority - G2		 2019-07-15 -
2021-07-15		 2 years crt.sh
jquery.org
COMODO RSA Domain Validation Secure Server CA		 2018-10-17 -
2020-10-16		 2 years crt.sh
cdnjs.cloudflare.com
DigiCert ECC Secure Server CA		 2020-08-12 -
2022-08-17		 2 years crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2020-07-21 -
2020-10-12		 3 months crt.sh
*.gstatic.com
GTS CA 1O1		 2020-08-26 -
2020-11-18		 3 months crt.sh
*.google.com
GTS CA 1O1		 2020-08-26 -
2020-11-18		 3 months crt.sh
clickcrm.com
DigiCert SHA2 Secure Server CA		 2020-08-25 -
2021-11-03		 a year crt.sh

This page contains 2 frames:

Primary Page: http://hsv-rapidremedy.com/get.php?aff_id=1814&subid2=5836_sessid20200914120127173&subid=223
Frame ID: 8683E61C492519248D6F702913A040C1
Requests: 27 HTTP requests in this frame

Frame: https://www.youtube.com/embed/Nyk3a2NadJI?autoplay=0&controls=0&rel=0&modestbranding=1&showinfo=0&wmode=transparent&enablejsapi=1&origin=http%3A%2F%2Fhsv-rapidremedy.com&widgetid=1
Frame ID: B443EFFDED3BA27C207ED1DE1A15C7C6
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://tinyurl.com/y6zr8hza HTTP 301
    http://www.testroma.me.uk/c/a638eafde6aecd96 HTTP 302
    https://tinyurl.com/y569dovg?tid=kgzjf5f5f5ba1c07ee569195248 HTTP 301
    https://bliss-mw.net/5836/223/2/?tid=kgzjf5f5f5ba1c07ee569195248 HTTP 302
    http://hsv-rapidremedy.com/get.php?aff_id=1814&subid2=5836_sessid20200914120127173&subid=223 Page URL

Page Statistics

28
Requests

79 %
HTTPS

74 %
IPv6

18
Domains

20
Subdomains

16
IPs

4
Countries

1247 kB
Transfer

2123 kB
Size

12
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://tinyurl.com/y6zr8hza HTTP 301
    http://www.testroma.me.uk/c/a638eafde6aecd96 HTTP 302
    https://tinyurl.com/y569dovg?tid=kgzjf5f5f5ba1c07ee569195248 HTTP 301
    https://bliss-mw.net/5836/223/2/?tid=kgzjf5f5f5ba1c07ee569195248 HTTP 302
    http://hsv-rapidremedy.com/get.php?aff_id=1814&subid2=5836_sessid20200914120127173&subid=223 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

28 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request get.php
hsv-rapidremedy.com/
Redirect Chain
  • https://tinyurl.com/y6zr8hza
  • http://www.testroma.me.uk/c/a638eafde6aecd96
  • https://tinyurl.com/y569dovg?tid=kgzjf5f5f5ba1c07ee569195248
  • https://bliss-mw.net/5836/223/2/?tid=kgzjf5f5f5ba1c07ee569195248
  • http://hsv-rapidremedy.com/get.php?aff_id=1814&subid2=5836_sessid20200914120127173&subid=223
14 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://hsv-rapidremedy.com/get.php?aff_id=1814&subid2=5836_sessid20200914120127173&subid=223
Protocol
HTTP/1.1
Server
69.16.236.216 Lansing, United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
host.brandmatica.com
Software
Apache / PHP/7.0.33
Resource Hash
c44bdd031e7db20e4703cd2704c7ae22151396a92146c9d96efe9b41176ecd9d

Request headers

Host
hsv-rapidremedy.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 14 Sep 2020 12:01:39 GMT
Server
Apache
X-Powered-By
PHP/7.0.33
Cache-Control
max-age=600
Expires
Mon, 14 Sep 2020 12:11:39 GMT
Vary
Accept-Encoding,User-Agent
Content-Encoding
gzip
Content-Length
5499
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8

Redirect headers

server
nginx
date
Mon, 14 Sep 2020 12:01:39 GMT
content-type
text/html; charset=UTF-8
transfer-encoding
chunked
keep-alive
timeout=2
cache-control
max-age=3600 private
pragma
no-cache
location
http://hsv-rapidremedy.com/get.php?aff_id=1814&subid2=5836_sessid20200914120127173&subid=223
expires
Mon, 14 Sep 2020 13:01:39 GMT
access-control-allow-origin
*
access-control-allow-credentials
true
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/ 		141 KB
20 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css
Requested by
Host: hsv-rapidremedy.com
URL: http://hsv-rapidremedy.com/get.php?aff_id=1814&subid2=5836_sessid20200914120127173&subid=223
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac19::1:b:2a , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
/
Resource Hash
2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Origin
http://hsv-rapidremedy.com
Referer
http://hsv-rapidremedy.com/get.php?aff_id=1814&subid2=5836_sessid20200914120127173&subid=223
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 14 Sep 2020 12:01:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 12 Dec 2018 18:34:10 GMT
status
200
etag
"1544639650"
vary
Accept-Encoding
x-cache
HIT
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
timing-allow-origin
*
content-length
20563
css
fonts.googleapis.com/ 		8 KB
895 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Montserrat:400,500,700|Roboto
Requested by
Host: hsv-rapidremedy.com
URL: http://hsv-rapidremedy.com/get.php?aff_id=1814&subid2=5836_sessid20200914120127173&subid=223
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:819::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
dfc97d3e33271afa5cbade119a240a8875992a6e5facdf20b6a9828cf32bc027
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
http://hsv-rapidremedy.com/get.php?aff_id=1814&subid2=5836_sessid20200914120127173&subid=223
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
status
200
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Mon, 14 Sep 2020 12:01:06 GMT
server
ESF
date
Mon, 14 Sep 2020 12:01:39 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Mon, 14 Sep 2020 12:01:39 GMT
video.css
hsv-rapidremedy.com/css/ 		5 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://hsv-rapidremedy.com/css/video.css
Requested by
Host: hsv-rapidremedy.com
URL: http://hsv-rapidremedy.com/get.php?aff_id=1814&subid2=5836_sessid20200914120127173&subid=223
Protocol
HTTP/1.1
Server
69.16.236.216 Lansing, United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
host.brandmatica.com
Software
Apache /
Resource Hash
a18042a8860768dd9608ef198dbe9bd328a5561151f50a23275155c61c432e06

Request headers

Referer
http://hsv-rapidremedy.com/get.php?aff_id=1814&subid2=5836_sessid20200914120127173&subid=223
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 14 Sep 2020 12:01:39 GMT
Content-Encoding
gzip
Last-Modified
Wed, 19 Jun 2019 12:48:49 GMT
Server
Apache
Vary
Accept-Encoding,User-Agent
Content-Type
text/css
Cache-Control
max-age=2592000
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
1538
Expires
Wed, 14 Oct 2020 12:01:39 GMT
js
www.googletagmanager.com/gtag/ 		88 KB
35 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=UA-138713396-29
Requested by
Host: hsv-rapidremedy.com
URL: http://hsv-rapidremedy.com/get.php?aff_id=1814&subid2=5836_sessid20200914120127173&subid=223
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:821::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
270581cabc84e8d1eb5ba294c186e5924004e789ea4c05844ea43df1dd07936e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
http://hsv-rapidremedy.com/get.php?aff_id=1814&subid2=5836_sessid20200914120127173&subid=223
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 14 Sep 2020 12:01:39 GMT
content-encoding
br
server
Google Tag Manager
access-control-allow-headers
Cache-Control
status
200
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35665
x-xss-protection
0
expires
Mon, 14 Sep 2020 12:01:39 GMT
OneSignalSDK.js
cdn.onesignal.com/sdks/ 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.onesignal.com/sdks/OneSignalSDK.js
Requested by
Host: hsv-rapidremedy.com
URL: http://hsv-rapidremedy.com/get.php?aff_id=1814&subid2=5836_sessid20200914120127173&subid=223
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6812:e134 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
96e3623b4080d2a019664c7f4e55cb1536a45fb84c3b34aeaede4c04b4bae373

Request headers

Referer
http://hsv-rapidremedy.com/get.php?aff_id=1814&subid2=5836_sessid20200914120127173&subid=223
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 14 Sep 2020 12:01:39 GMT
content-encoding
gzip
cf-cache-status
HIT
server
cloudflare
age
3317
etag
W/"f9d3ce9829dac0f7e3861df96a993d72"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=43200
cf-ray
5d29f45e1850c2c7-FRA
cf-request-id
052e170ed10000c2c717af9200000001
expires
Tue, 15 Sep 2020 00:01:39 GMT
button-2.png
hsv-rapidremedy.com/img/ 		49 KB
49 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://hsv-rapidremedy.com/img/button-2.png
Requested by
Host: hsv-rapidremedy.com
URL: http://hsv-rapidremedy.com/get.php?aff_id=1814&subid2=5836_sessid20200914120127173&subid=223
Protocol
HTTP/1.1
Server
69.16.236.216 Lansing, United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
host.brandmatica.com
Software
Apache /
Resource Hash
941d6a69ad948de5b9388c664ffc1ac0c97361d67d079716c57edc82a7fcecfb

Request headers

Referer
http://hsv-rapidremedy.com/get.php?aff_id=1814&subid2=5836_sessid20200914120127173&subid=223
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 14 Sep 2020 12:01:39 GMT
Last-Modified
Wed, 19 Jun 2019 12:48:54 GMT
Server
Apache
Content-Type
image/png
Cache-Control
max-age=2592000
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
50113
Expires
Wed, 14 Oct 2020 12:01:39 GMT
disclaimer
echo.spapi.com/v1/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://echo.spapi.com/v1/disclaimer?id=disclaimer&account_id=5773
Requested by
Host: hsv-rapidremedy.com
URL: http://hsv-rapidremedy.com/get.php?aff_id=1814&subid2=5836_sessid20200914120127173&subid=223
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
50.23.130.133 Seattle, United States, ASN36351 (SOFTLAYER, US),
Reverse DNS
85.82.1732.ip4.static.sl-reverse.com
Software
/ Express
Resource Hash
c5f0e8e6c915a6b700d7c19ddc7abd1c595b1f1f8e211284b71526d021422967
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;

Request headers

Referer
http://hsv-rapidremedy.com/get.php?aff_id=1814&subid2=5836_sessid20200914120127173&subid=223
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 14 Sep 2020 12:01:39 GMT
cache-control
private
access-control-allow-credentials
true
x-powered-by
Express
content-length
1127
strict-transport-security
max-age=31536000;
access-control-allow-methods
GET, POST, OPTIONS, PUT, PATCH, DELETE
jquery-3.2.1.min.js
code.jquery.com/ 		85 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.2.1.min.js
Requested by
Host: hsv-rapidremedy.com
URL: http://hsv-rapidremedy.com/get.php?aff_id=1814&subid2=5836_sessid20200914120127173&subid=223
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac19::1:b:2a , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
nginx /
Resource Hash
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de

Request headers

Referer
http://hsv-rapidremedy.com/get.php?aff_id=1814&subid2=5836_sessid20200914120127173&subid=223
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 14 Sep 2020 12:01:39 GMT
content-encoding
gzip
last-modified
Mon, 20 Mar 2017 19:01:15 GMT
server
nginx
status
200
etag
W/"58d026fb-15283"
vary
Accept-Encoding
x-hw
1600084899.dop002.fr8.t,1600084899.cds268.fr8.hc,1600084899.cds133.fr8.c
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
30125
popper.min.js
cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.3/umd/ 		20 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.3/umd/popper.min.js
Requested by
Host: hsv-rapidremedy.com
URL: http://hsv-rapidremedy.com/get.php?aff_id=1814&subid2=5836_sessid20200914120127173&subid=223
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:4e6b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f7cbc01a310318defd4e31e4616543e2cf3baef5a47562c73ece4c0b716f157e
Security Headers
Name Value
Strict-Transport-Security max-age=15780000; includeSubDomains

Request headers

Origin
http://hsv-rapidremedy.com
Referer
http://hsv-rapidremedy.com/get.php?aff_id=1814&subid2=5836_sessid20200914120127173&subid=223
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 14 Sep 2020 12:01:39 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
397167
x-via
cfworker/kv
status
200
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
6451
cf-request-id
052e170ecf00002b41828c0200000001
timing-allow-origin
*
last-modified
Mon, 04 May 2020 16:15:37 GMT
server
cloudflare
etag
"5eb03fa9-4f71"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000; includeSubDomains
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
cf-ray
5d29f45e1ab92b41-FRA
expires
Sat, 04 Sep 2021 12:01:39 GMT
bootstrap.min.js
stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/ 		50 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js
Requested by
Host: hsv-rapidremedy.com
URL: http://hsv-rapidremedy.com/get.php?aff_id=1814&subid2=5836_sessid20200914120127173&subid=223
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac19::1:b:2a , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
/
Resource Hash
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Origin
http://hsv-rapidremedy.com
Referer
http://hsv-rapidremedy.com/get.php?aff_id=1814&subid2=5836_sessid20200914120127173&subid=223
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 14 Sep 2020 12:01:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 12 Dec 2018 18:33:54 GMT
status
200
etag
"1544639634"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
timing-allow-origin
*
content-length
14090
fbevents.js
connect.facebook.net/en_US/ 		135 KB
34 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: hsv-rapidremedy.com
URL: http://hsv-rapidremedy.com/get.php?aff_id=1814&subid2=5836_sessid20200914120127173&subid=223
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
097afea517679d2e0b986d77cb3fe7808026882b52ca074a050e03e7a4a6996b
Security Headers
Name Value
Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
http://hsv-rapidremedy.com/get.php?aff_id=1814&subid2=5836_sessid20200914120127173&subid=223
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
status
200
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
34302
x-xss-protection
0
pragma
public
x-fb-debug
St8sF0rDmFd9wM8RctdBVbROI/dK3iHbs8r52s5eb8Y1t1TkYniRFWaXRno1fHBn5DNJigeHdybjuU8tTQtTXg==
x-fb-trip-id
664085054
x-frame-options
DENY
date
Mon, 14 Sep 2020 12:01:39 GMT
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
cache-control
public, max-age=1200
content-security-policy
default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires
Sat, 01 Jan 2000 00:00:00 GMT
body-bg.jpg
hsv-rapidremedy.com/img/ 		106 KB
106 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://hsv-rapidremedy.com/img/body-bg.jpg
Requested by
Host: hsv-rapidremedy.com
URL: http://hsv-rapidremedy.com/css/video.css
Protocol
HTTP/1.1
Server
69.16.236.216 Lansing, United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
host.brandmatica.com
Software
Apache /
Resource Hash
96e488c8b123c4bf15fe29ee76166d23867488a02c2843cb138a04dcc3e2b691

Request headers

Referer
http://hsv-rapidremedy.com/css/video.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 14 Sep 2020 12:01:39 GMT
Last-Modified
Wed, 19 Jun 2019 12:48:52 GMT
Server
Apache
Content-Type
image/jpeg
Cache-Control
max-age=2592000
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
108329
Expires
Wed, 14 Oct 2020 12:01:39 GMT
arrow-down-vsl.png
hsv-rapidremedy.com/img/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://hsv-rapidremedy.com/img/arrow-down-vsl.png
Requested by
Host: hsv-rapidremedy.com
URL: http://hsv-rapidremedy.com/css/video.css
Protocol
HTTP/1.1
Server
69.16.236.216 Lansing, United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
host.brandmatica.com
Software
Apache /
Resource Hash
df41e5916a5f0b5fa0f1a0e1ddf67ff073cf3738e0bb356fb9e6b3a31b9e5ab8

Request headers

Referer
http://hsv-rapidremedy.com/css/video.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 14 Sep 2020 12:01:39 GMT
Last-Modified
Wed, 19 Jun 2019 12:48:59 GMT
Server
Apache
Content-Type
image/png
Cache-Control
max-age=2592000
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
1325
Expires
Wed, 14 Oct 2020 12:01:39 GMT
tap-cover.jpg
hsv-rapidremedy.com/img/ 		697 KB
697 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://hsv-rapidremedy.com/img/tap-cover.jpg
Requested by
Host: hsv-rapidremedy.com
URL: http://hsv-rapidremedy.com/css/video.css
Protocol
HTTP/1.1
Server
69.16.236.216 Lansing, United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
host.brandmatica.com
Software
Apache /
Resource Hash
1848757fe76cdf609a4dc9f87fa1b73db321f26efed84673bd4abe75e9bb5c66

Request headers

Referer
http://hsv-rapidremedy.com/css/video.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 14 Sep 2020 12:01:39 GMT
Last-Modified
Wed, 19 Jun 2019 12:48:57 GMT
Server
Apache
Content-Type
image/jpeg
Cache-Control
max-age=2592000
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
713293
Expires
Wed, 14 Oct 2020 12:01:39 GMT
JTURjIg1_i6t8kCHKm45_dJE3gnD_vx3rCs.woff2
fonts.gstatic.com/s/montserrat/v14/ 		13 KB
13 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/montserrat/v14/JTURjIg1_i6t8kCHKm45_dJE3gnD_vx3rCs.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Montserrat:400,500,700|Roboto
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
4c6cf0709b8e52572cae1fb57128acd0a5a453c9ce99dc3712a1860ff90c6bf8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
http://hsv-rapidremedy.com
Referer
https://fonts.googleapis.com/css?family=Montserrat:400,500,700|Roboto
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 14 Sep 2020 11:04:03 GMT
x-content-type-options
nosniff
last-modified
Tue, 23 Jul 2019 03:47:06 GMT
server
sffe
age
3456
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13612
x-xss-protection
0
expires
Tue, 14 Sep 2021 11:04:03 GMT
JTURjIg1_i6t8kCHKm45_ZpC3gnD_vx3rCs.woff2
fonts.gstatic.com/s/montserrat/v14/ 		13 KB
13 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/montserrat/v14/JTURjIg1_i6t8kCHKm45_ZpC3gnD_vx3rCs.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Montserrat:400,500,700|Roboto
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
cedb226bd7759d04b58baa1a609e1aeecc1aa5c6c3280c4db153019f426f3de0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
http://hsv-rapidremedy.com
Referer
https://fonts.googleapis.com/css?family=Montserrat:400,500,700|Roboto
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 14 Sep 2020 11:04:03 GMT
x-content-type-options
nosniff
last-modified
Tue, 23 Jul 2019 03:46:41 GMT
server
sffe
age
3456
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13640
x-xss-protection
0
expires
Tue, 14 Sep 2021 11:04:03 GMT
JTUSjIg1_i6t8kCHKm459WlhyyTh89Y.woff2
fonts.gstatic.com/s/montserrat/v14/ 		13 KB
13 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/montserrat/v14/JTUSjIg1_i6t8kCHKm459WlhyyTh89Y.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Montserrat:400,500,700|Roboto
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
0ce5a460ace775560c3344a43245687bdbec5cb8ee20d209ab9fa67f4e09a3e8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
http://hsv-rapidremedy.com
Referer
https://fonts.googleapis.com/css?family=Montserrat:400,500,700|Roboto
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 14 Sep 2020 11:04:02 GMT
x-content-type-options
nosniff
last-modified
Tue, 23 Jul 2019 03:46:48 GMT
server
sffe
age
3457
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13708
x-xss-protection
0
expires
Tue, 14 Sep 2021 11:04:02 GMT
2012392055737333
connect.facebook.net/signals/config/ 		524 KB
132 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/signals/config/2012392055737333?v=2.9.24&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
b34278ec04d1b4e121a2f3b50c95a31cd69f12e91f90e9098b12a61650dd5a85
Security Headers
Name Value
Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
http://hsv-rapidremedy.com/get.php?aff_id=1814&subid2=5836_sessid20200914120127173&subid=223
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
status
200
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
134846
x-xss-protection
0
pragma
public
x-fb-debug
xsfvi6kK7vS8uHygU/N6I5IgVgBB4mTMUCAaUbItyNn2p2vrvMpY4JzXkrxSqGdf4S1GYqa0K+/L4E7makaUcQ==
x-fb-trip-id
664085054
x-frame-options
DENY
date
Mon, 14 Sep 2020 12:01:39 GMT
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
cache-control
public, max-age=1200
content-security-policy
default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires
Sat, 01 Jan 2000 00:00:00 GMT
analytics.js
www.google-analytics.com/ 		45 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-138713396-29
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:821::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
1fbd06d98ff87713eb030669571c929ab75539f05252f04ae1df807c28b20e95
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
http://hsv-rapidremedy.com/get.php?aff_id=1814&subid2=5836_sessid20200914120127173&subid=223
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 19 Aug 2020 20:46:40 GMT
server
Golfe2
age
2759
date
Mon, 14 Sep 2020 11:15:40 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
18323
expires
Mon, 14 Sep 2020 13:15:40 GMT
collect
www.google-analytics.com/j/ 		1 B
66 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j85&a=1779341219&t=pageview&_s=1&dl=http%3A%2F%2Fhsv-rapidremedy.com%2Fget.php%3Faff_id%3D1814%26subid2%3D5836_sessid20200914120127173%26subid%3D223&ul=en-us&de=UTF-8&dt=HSV%20Rapid%20Remedy%20-%20Video&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAUABAAAAAC~&jid=378325648&gjid=53071359&cid=19557255.1600084900&tid=UA-138713396-29&_gid=986138112.1600084900&_r=1&gtm=2ou920&z=101245112
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:821::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
http://hsv-rapidremedy.com/get.php?aff_id=1814&subid2=5836_sessid20200914120127173&subid=223
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Mon, 14 Sep 2020 12:01:39 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
status
200
content-type
text/plain
access-control-allow-origin
http://hsv-rapidremedy.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.facebook.com/tr/ 		44 B
376 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=2012392055737333&ev=PageView&dl=http%3A%2F%2Fhsv-rapidremedy.com%2Fget.php%3Faff_id%3D1814%26subid2%3D5836_sessid20200914120127173%26subid%3D223%23000&rl=&if=false&ts=1600084899637&sw=1600&sh=1200&v=2.9.24&r=stable&ec=0&o=30&fbp=fb.1.1600084899636.1927379085&it=1600084899583&coo=false&rqm=GET
Requested by
Host: hsv-rapidremedy.com
URL: http://hsv-rapidremedy.com/get.php?aff_id=1814&subid2=5836_sessid20200914120127173&subid=223
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
http://hsv-rapidremedy.com/get.php?aff_id=1814&subid2=5836_sessid20200914120127173&subid=223
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 14 Sep 2020 12:01:39 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
status
200
cache-control
no-cache, must-revalidate, max-age=0
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
44
expires
Mon, 14 Sep 2020 12:01:39 GMT
iframe_api
www.youtube.com/ 		859 B
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/iframe_api
Requested by
Host: hsv-rapidremedy.com
URL: http://hsv-rapidremedy.com/get.php?aff_id=1814&subid2=5836_sessid20200914120127173&subid=223
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
YouTube Frontend Proxy /
Resource Hash
7303fd4521b231bad4280672d36b7a4486a47a3bc0248da7df8c28989e462400
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
http://hsv-rapidremedy.com/get.php?aff_id=1814&subid2=5836_sessid20200914120127173&subid=223
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 14 Sep 2020 12:01:40 GMT
x-content-type-options
nosniff
server
YouTube Frontend Proxy
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
status
200
cache-control
no-cache
content-type
application/javascript
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
859
x-xss-protection
0
expires
Tue, 27 Apr 1971 19:44:06 GMT
/
tracking.buygoods.com/track/ 		4 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tracking.buygoods.com/track/?a=5773&firstcookie=0&tracking_redirect=&referrer=&sessid2=&product=hsv_rapid_remedy&caller_url=http%3A%2F%2Fhsv-rapidremedy.com%2Fget.php%3Faff_id%3D1814%26subid2%3D5836_sessid20200914120127173%26subid%3D223%23000
Requested by
Host: hsv-rapidremedy.com
URL: http://hsv-rapidremedy.com/get.php?aff_id=1814&subid2=5836_sessid20200914120127173&subid=223
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
173.192.183.237 Seattle, United States, ASN36351 (SOFTLAYER, US),
Reverse DNS
ed.b7.c0ad.ip4.static.sl-reverse.com
Software
nginx / PHP/7.1.3
Resource Hash
a816883dd6a942706864a2f156576ba8bb1bcc69d59ff270b8b887bf54cac01d

Request headers

Referer
http://hsv-rapidremedy.com/get.php?aff_id=1814&subid2=5836_sessid20200914120127173&subid=223
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 14 Sep 2020 12:01:41 GMT
server
nginx
x-powered-by
PHP/7.1.3
transfer-encoding
chunked
p3p
CP="CAO COR CURa ADMa DEVa OUR IND ONL COM DEM PRE"
cache-control
no-cache, must-revalidate
content-type
application/javascript
keep-alive
timeout=2
expires
Tue, Jan 12 1999 01:01:01 GMT
buygoods_black.png
www.buygoods.com/images/ 		9 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.buygoods.com/images/buygoods_black.png
Requested by
Host: hsv-rapidremedy.com
URL: http://hsv-rapidremedy.com/get.php?aff_id=1814&subid2=5836_sessid20200914120127173&subid=223
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
173.192.183.235 Seattle, United States, ASN36351 (SOFTLAYER, US),
Reverse DNS
buygoods.com
Software
nginx /
Resource Hash
ff275d0907ee3185c117355cad64b0ded33ff9b98422ba6877fc50e7c1f7bb52
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;

Request headers

Referer
http://hsv-rapidremedy.com/get.php?aff_id=1814&subid2=5836_sessid20200914120127173&subid=223
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 14 Sep 2020 12:01:40 GMT
last-modified
Tue, 12 Sep 2017 06:30:00 GMT
server
nginx
etag
"59b77ee8-257c"
strict-transport-security
max-age=31536000;
content-type
image/png
cache-control
max-age=315360000
accept-ranges
bytes
keep-alive
timeout=2
content-length
9596
expires
Thu, 31 Dec 2037 23:55:55 GMT
www-widgetapi.js
s.ytimg.com/yts/jsbin/www-widgetapi-vflOyhzcj/ 		93 KB
34 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s.ytimg.com/yts/jsbin/www-widgetapi-vflOyhzcj/www-widgetapi.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/iframe_api
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f03e882b29d452040b26578e5612d8708fe2940d5009d6ba60988413275562de
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
http://hsv-rapidremedy.com/get.php?aff_id=1814&subid2=5836_sessid20200914120127173&subid=223
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sun, 13 Sep 2020 23:58:33 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
43387
status
200
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
33990
x-xss-protection
0
last-modified
Thu, 10 Sep 2020 18:21:18 GMT
server
sffe
vary
Accept-Encoding, Origin
content-type
text/javascript
cache-control
public, max-age=691200
accept-ranges
bytes
timing-allow-origin
https://www.youtube.com
expires
Mon, 21 Sep 2020 23:58:33 GMT
Nyk3a2NadJI
www.youtube.com/embed/ Frame B443 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/embed/Nyk3a2NadJI?autoplay=0&controls=0&rel=0&modestbranding=1&showinfo=0&wmode=transparent&enablejsapi=1&origin=http%3A%2F%2Fhsv-rapidremedy.com&widgetid=1
Requested by
Host: s.ytimg.com
URL: https://s.ytimg.com/yts/jsbin/www-widgetapi-vflOyhzcj/www-widgetapi.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:81f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
YouTube Frontend Proxy /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
www.youtube.com
:scheme
https
:path
/embed/Nyk3a2NadJI?autoplay=0&controls=0&rel=0&modestbranding=1&showinfo=0&wmode=transparent&enablejsapi=1&origin=http%3A%2F%2Fhsv-rapidremedy.com&widgetid=1
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
http://hsv-rapidremedy.com/get.php?aff_id=1814&subid2=5836_sessid20200914120127173&subid=223
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
YSC=UuCNnhl-nW4; VISITOR_INFO1_LIVE=M6tKqgi3s7M
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
http://hsv-rapidremedy.com/get.php?aff_id=1814&subid2=5836_sessid20200914120127173&subid=223

Response headers

status
200
x-content-type-options
nosniff
content-length
10807
cache-control
no-cache
content-encoding
br
strict-transport-security
max-age=31536000
content-type
text/html; charset=utf-8
expires
Tue, 27 Apr 1971 19:44:06 GMT
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
date
Mon, 14 Sep 2020 12:01:40 GMT
server
YouTube Frontend Proxy
x-xss-protection
0
set-cookie
GPS=1; path=/; domain=.youtube.com; expires=Mon, 14-Sep-2020 12:31:40 GMT
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
/
www.facebook.com/tr/ 		44 B
146 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=2012392055737333&ev=Microdata&dl=http%3A%2F%2Fhsv-rapidremedy.com%2Fget.php%3Faff_id%3D1814%26subid2%3D5836_sessid20200914120127173%26subid%3D223%23000&rl=&if=false&ts=1600084901140&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22HSV%20Rapid%20Remedy%20-%20Video%22%7D&cd[OpenGraph]=%7B%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.24&r=stable&ec=1&o=30&fbp=fb.1.1600084899636.1927379085&it=1600084899583&coo=false&es=automatic&tm=3&rqm=GET
Requested by
Host: hsv-rapidremedy.com
URL: http://hsv-rapidremedy.com/get.php?aff_id=1814&subid2=5836_sessid20200914120127173&subid=223
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
http://hsv-rapidremedy.com/get.php?aff_id=1814&subid2=5836_sessid20200914120127173&subid=223
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 14 Sep 2020 12:01:41 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
status
200
cache-control
no-cache, must-revalidate, max-age=0
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
44
expires
Mon, 14 Sep 2020 12:01:41 GMT

Verdicts & Comments Add Verdict or Comment

69 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| trustedTypes function| gtag object| dataLayer function| fbq function| _fbq object| OneSignal object| google_tag_manager object| google_tag_data string| GoogleAnalyticsObject function| ga object| gaplugins object| gaGlobal object| gaData function| $ function| jQuery function| Popper object| bootstrap object| tag object| firstScriptTag object| player boolean| youtube boolean| videoStarted function| onYouTubePlayerAPIReady function| onPlayerReady boolean| done function| onPlayerStateChange function| handleNewViewer function| handleReturningViewer function| createCookie function| getCookie function| stopVideo string| mysrc object| newScript object| s function| ReadCookie object| YT object| YTConfig function| onYTReady object| yt function| ytDomDomGetNextId object| ytEventsEventsListeners object| ytEventsEventsCounter object| ytPubsubPubsubInstance object| ytPubsubPubsubTopicToKeys object| ytPubsubPubsubIsSynchronous object| ytPubsubPubsubSubscribedKeys object| ytLoggingTransportLogPayloadsQueue_ object| ytLoggingTransportGELQueue_ object| ytLoggingTransportTokensToCttTargetIds_ object| ytLoggingGelSequenceIdObj_ object| spitoday object| spiexpire function| SPIGetDomainName string| hostname object| spi_myNodelist number| spi_i string| spi_pattern_enc_bg string| spi_pattern_base_bg string| spi_replace_str_bg string| spi_pattern_enc_spi string| spi_pattern_base_spi string| spi_replace_str_spi string| spi_pattern_enc_cbd string| spi_pattern_base_cbd string| spi_replace_str_cbd string| spi_replace_enc_cbd string| spi_replace_enc_bg string| spi_replace_enc_spi string| spi_track_link

12 Cookies

Domain/Path Name / Value
.youtube.com/ Name: YSC
Value: UuCNnhl-nW4
.hsv-rapidremedy.com/ Name: _gid
Value: GA1.2.986138112.1600084900
.hsv-rapidremedy.com/ Name: spi_funnel_codename
Value:
.hsv-rapidremedy.com/ Name: sid
Value: 223%7C5836_sessid20200914120127173
.hsv-rapidremedy.com/ Name: aff_id
Value: 1814
.hsv-rapidremedy.com/ Name: campaign_id
Value:
.hsv-rapidremedy.com/ Name: sessid2
Value: sessid20200914120111227
.hsv-rapidremedy.com/ Name: referrer
Value: 82.102.18.114::hsv-rapidremedy.com%2Fget
.hsv-rapidremedy.com/ Name: _fbp
Value: fb.1.1600084899636.1927379085
.hsv-rapidremedy.com/ Name: _gat_gtag_UA_138713396_29
Value: 1
.youtube.com/ Name: VISITOR_INFO1_LIVE
Value: M6tKqgi3s7M
.hsv-rapidremedy.com/ Name: _ga
Value: GA1.2.19557255.1600084900

1 Console Messages

Source Level URL
Text
console-api log URL: https://cdn.onesignal.com/sdks/OneSignalSDK.js(Line 1)
Message:
OneSignal: Using fallback ES5 Stub for backwards compatibility.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bliss-mw.net
cdn.onesignal.com
cdnjs.cloudflare.com
code.jquery.com
connect.facebook.net
echo.spapi.com
fonts.googleapis.com
fonts.gstatic.com
hsv-rapidremedy.com
maxcdn.bootstrapcdn.com
s.ytimg.com
stackpath.bootstrapcdn.com
tinyurl.com
tracking.buygoods.com
www.buygoods.com
www.facebook.com
www.google-analytics.com
www.googletagmanager.com
www.testroma.me.uk
www.youtube.com
173.192.183.235
173.192.183.237
2001:4de0:ac19::1:b:2a
2606:4700:10::6814:8a41
2606:4700::6811:4e6b
2606:4700::6812:e134
2a00:1450:4001:802::200e
2a00:1450:4001:819::200a
2a00:1450:4001:81d::2003
2a00:1450:4001:81f::200e
2a00:1450:4001:820::200e
2a00:1450:4001:821::2008
2a00:1450:4001:821::200e
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
2a05:d018:244:5200::ab
50.23.130.133
50.23.130.135
69.16.236.216
097afea517679d2e0b986d77cb3fe7808026882b52ca074a050e03e7a4a6996b
0ce5a460ace775560c3344a43245687bdbec5cb8ee20d209ab9fa67f4e09a3e8
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
1848757fe76cdf609a4dc9f87fa1b73db321f26efed84673bd4abe75e9bb5c66
1fbd06d98ff87713eb030669571c929ab75539f05252f04ae1df807c28b20e95
270581cabc84e8d1eb5ba294c186e5924004e789ea4c05844ea43df1dd07936e
2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d
4c6cf0709b8e52572cae1fb57128acd0a5a453c9ce99dc3712a1860ff90c6bf8
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
7303fd4521b231bad4280672d36b7a4486a47a3bc0248da7df8c28989e462400
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
941d6a69ad948de5b9388c664ffc1ac0c97361d67d079716c57edc82a7fcecfb
96e3623b4080d2a019664c7f4e55cb1536a45fb84c3b34aeaede4c04b4bae373
96e488c8b123c4bf15fe29ee76166d23867488a02c2843cb138a04dcc3e2b691
a18042a8860768dd9608ef198dbe9bd328a5561151f50a23275155c61c432e06
a816883dd6a942706864a2f156576ba8bb1bcc69d59ff270b8b887bf54cac01d
b34278ec04d1b4e121a2f3b50c95a31cd69f12e91f90e9098b12a61650dd5a85
c44bdd031e7db20e4703cd2704c7ae22151396a92146c9d96efe9b41176ecd9d
c5f0e8e6c915a6b700d7c19ddc7abd1c595b1f1f8e211284b71526d021422967
cedb226bd7759d04b58baa1a609e1aeecc1aa5c6c3280c4db153019f426f3de0
df41e5916a5f0b5fa0f1a0e1ddf67ff073cf3738e0bb356fb9e6b3a31b9e5ab8
dfc97d3e33271afa5cbade119a240a8875992a6e5facdf20b6a9828cf32bc027
f03e882b29d452040b26578e5612d8708fe2940d5009d6ba60988413275562de
f7cbc01a310318defd4e31e4616543e2cf3baef5a47562c73ece4c0b716f157e
ff275d0907ee3185c117355cad64b0ded33ff9b98422ba6877fc50e7c1f7bb52