urlscan.io logo urlscan.io
SecurityTrails logo

live4.news4more.com Open in urlscan Pro
2606:4700::6812:1b7e  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://tracking.sayhitorachel.com/tracking/click?d=LdT8bX4yDpuVkhjcM4x2R0xPxFRcZb8OV8jyJi9Wm1QsAM-_MYW2Nvq5X4MkBy0EclPmbvQrs-xDmQT...
Effective URL: https://live4.news4more.com/landing/mlp88c?subPublisher=popunder:79&zone=popunder:79&adformat=push&auctionid=642aba9003e88-4...
Submission: On April 03 via manual from US — Scanned from FR
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 4 countries across 8 domains to perform 15 HTTP transactions. The main IP is 2606:4700::6812:1b7e, located in United States and belongs to CLOUDFLARENET, US. The main domain is live4.news4more.com. The Cisco Umbrella rank of the primary domain is 726451.
TLS certificate: Issued by E1 on February 4th 2023. Valid for: 3 months.
This is the only time live4.news4more.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 188.165.1.80 16276 (OVH)
1 1 142.93.114.237 14061 (DIGITALOC...)
1 1 34.107.223.80 396982 (GOOGLE-CL...)
2 2 52.214.17.104 16509 (AMAZON-02)
1 2606:4700::68... 13335 (CLOUDFLAR...)
7 2606:4700::68... 13335 (CLOUDFLAR...)
5 2606:4700::68... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
1 2606:4700::68... 13335 (CLOUDFLAR...)
15 5
1    188.165.1.80 (France)

ASN16276 (OVH, FR)
PTR: api.elasticemail.com
tracking.sayhitorachel.com
1    142.93.114.237 (North Bergen, United States)

ASN14061 (DIGITALOCEAN-ASN, US)
alwaysbeemailing.com
1    34.107.223.80 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 80.223.107.34.bc.googleusercontent.com
www.xn3j2k.com
2    52.214.17.104 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-214-17-104.eu-west-1.compute.amazonaws.com
eu-adsrv.rtbsuperhub.com
1    2606:4700::6812:1b7e (United States)

ASN13335 (CLOUDFLARENET, US)
live4.news4more.com
7    2606:4700::6812:b95 (United States)

ASN13335 (CLOUDFLARENET, US)
lpmedia.servefilesonly.com
5    2606:4700::6812:d63b (United States)

ASN13335 (CLOUDFLARENET, US)
cdn.onesignal.com
onesignal.com
img.onesignal.com
1    2a00:1450:4001:806::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
ajax.googleapis.com
1    2606:4700::6812:d73b (United States)

ASN13335 (CLOUDFLARENET, US)
onesignal.com
Apex Domain
Subdomains		 Transfer
7 servefilesonly.com
lpmedia.servefilesonly.com — Cisco Umbrella Rank: 182885
1 MB
6 onesignal.com
cdn.onesignal.com — Cisco Umbrella Rank: 3575
onesignal.com — Cisco Umbrella Rank: 1243
img.onesignal.com — Cisco Umbrella Rank: 6776
94 KB
2 rtbsuperhub.com
eu-adsrv.rtbsuperhub.com — Cisco Umbrella Rank: 64941
1 KB
1 googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 357
31 KB
1 news4more.com
live4.news4more.com — Cisco Umbrella Rank: 726451
4 KB
1 xn3j2k.com
www.xn3j2k.com
433 B
1 alwaysbeemailing.com
alwaysbeemailing.com
403 B
1 sayhitorachel.com
tracking.sayhitorachel.com
681 B
15 8
Domain Requested by
7 lpmedia.servefilesonly.com live4.news4more.com
3 onesignal.com cdn.onesignal.com
2 cdn.onesignal.com live4.news4more.com
cdn.onesignal.com
2 eu-adsrv.rtbsuperhub.com 2 redirects
1 img.onesignal.com
1 ajax.googleapis.com live4.news4more.com
1 live4.news4more.com
1 www.xn3j2k.com 1 redirects
1 alwaysbeemailing.com 1 redirects
1 tracking.sayhitorachel.com 1 redirects
15 10

This site contains no links.

Subject Issuer Validity Valid
*.news4more.com
E1		 2023-02-04 -
2023-05-05		 3 months crt.sh
*.servefilesonly.com
E1		 2023-02-18 -
2023-05-19		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2022-06-03 -
2023-06-02		 a year crt.sh
upload.video.google.com
GTS CA 1C3		 2023-03-13 -
2023-06-05		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://live4.news4more.com/landing/mlp88c?subPublisher=popunder:79&zone=popunder:79&adformat=push&auctionid=642aba9003e88-431548&uniqueid=36666019fb1de3870456cf3f5dbf5799&name=4259_push_fra_desktop_FilthyAds_Funnel&newservice=true&cmsid=landing--mlp88c--landing--sa8306&tpcampid=9523f9b1-0984-49cb-aa2d-c51de874b777&imp_tagid=4259_push_fra_desktop_FilthyAds_Funnel&uid=TP-642aba9003d9a0.82125175&campaign_lp=2:landing--mlp88c--landing--sa8306&product=grannyzoneweb&zz=true&nextPage=/landing/sa8306&ur-api-fetch-hitid=true
Frame ID: 0AC35A659A904AEA62D328B3781872A1
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

xncounter

Page URL History Show full URLs

  1. http://tracking.sayhitorachel.com/tracking/click?d=LdT8bX4yDpuVkhjcM4x2R0xPxFRcZb8OV8jyJi9Wm1QsAM-_MYW2Nvq5X4M... HTTP 302
    https://alwaysbeemailing.com/campaigns/en2069487gfb8/track-url/ny850v299b4c4/4d66844e86af74884a811c6d4987... HTTP 301
    https://www.xn3j2k.com/cmp/2Z3GP8/25D7F3/?source_id=msp&sub1=en2069487gfb8&sub2=sayhitorachel&sub3=... HTTP 302
    https://eu-adsrv.rtbsuperhub.com/ir/?placement=8ba6f30d-635a-4292-ac16-504de8d18b50&subPublisher=79 HTTP 302
    https://eu-adsrv.rtbsuperhub.com/click/?subPublisher=popunder:79&zone=popunder:79&adformat=push&auctionid=642... HTTP 302
    https://live4.news4more.com/landing/mlp88c?subPublisher=popunder:79&zone=popunder:79&adformat=push&aucti... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • cdn\.onesignal\.com
Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

15
Requests

100 %
HTTPS

56 %
IPv6

8
Domains

10
Subdomains

5
IPs

4
Countries

1224 kB
Transfer

1598 kB
Size

7
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://tracking.sayhitorachel.com/tracking/click?d=LdT8bX4yDpuVkhjcM4x2R0xPxFRcZb8OV8jyJi9Wm1QsAM-_MYW2Nvq5X4MkBy0EclPmbvQrs-xDmQT6CW3a7_IU6h-unc6uk5KolGEeUyR1ry4xmlCESgNbFqSkGyKbIdbePbXu184pGTGn5bQwB77imOBSZBDOOfGBC3a70OE2fvhL-XmYNWsFDoLXXwAgfx0DJxHjmSJD9juAs04z8qc76fwplpVUQRSvfpWV4f1MuSU4zFcQxSgS3wIsOlToW91FgOic1kL5S40eQW3uftQ1 HTTP 302
    https://alwaysbeemailing.com/campaigns/en2069487gfb8/track-url/ny850v299b4c4/4d66844e86af74884a811c6d4987e3303ad20a6c HTTP 301
    https://www.xn3j2k.com/cmp/2Z3GP8/25D7F3/?source_id=msp&sub1=en2069487gfb8&sub2=sayhitorachel&sub3=vos.am@hotmail.com&sub4=abe HTTP 302
    https://eu-adsrv.rtbsuperhub.com/ir/?placement=8ba6f30d-635a-4292-ac16-504de8d18b50&subPublisher=79 HTTP 302
    https://eu-adsrv.rtbsuperhub.com/click/?subPublisher=popunder:79&zone=popunder:79&adformat=push&auctionid=642aba9003e88-431548&uniqueid=36666019fb1de3870456cf3f5dbf5799&name=4259_push_fra_desktop_FilthyAds_Funnel&newservice=true&cmsid=landing--mlp88c--landing--sa8306&tpcampid=9523f9b1-0984-49cb-aa2d-c51de874b777&imp_tagid=4259_push_fra_desktop_FilthyAds_Funnel&uid=TP-642aba9003d9a0.82125175&campaign_lp=2:landing--mlp88c--landing--sa8306&product=grannyzoneweb HTTP 302
    https://live4.news4more.com/landing/mlp88c?subPublisher=popunder:79&zone=popunder:79&adformat=push&auctionid=642aba9003e88-431548&uniqueid=36666019fb1de3870456cf3f5dbf5799&name=4259_push_fra_desktop_FilthyAds_Funnel&newservice=true&cmsid=landing--mlp88c--landing--sa8306&tpcampid=9523f9b1-0984-49cb-aa2d-c51de874b777&imp_tagid=4259_push_fra_desktop_FilthyAds_Funnel&uid=TP-642aba9003d9a0.82125175&campaign_lp=2:landing--mlp88c--landing--sa8306&product=grannyzoneweb&zz=true&nextPage=/landing/sa8306&ur-api-fetch-hitid=true Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request mlp88c
live4.news4more.com/landing/
Redirect Chain
  • http://tracking.sayhitorachel.com/tracking/click?d=LdT8bX4yDpuVkhjcM4x2R0xPxFRcZb8OV8jyJi9Wm1QsAM-_MYW2Nvq5X4MkBy0EclPmbvQrs-xDmQT6CW3a7_IU6h-unc6uk5KolGEeUyR1ry4xmlCESgNbFqSkGyKbIdbePbXu184pGTGn5b...
  • https://alwaysbeemailing.com/campaigns/en2069487gfb8/track-url/ny850v299b4c4/4d66844e86af74884a811c6d4987e3303ad20a6c
  • https://www.xn3j2k.com/cmp/2Z3GP8/25D7F3/?source_id=msp&sub1=en2069487gfb8&sub2=sayhitorachel&sub3=vos.am@hotmail.com&sub4=abe
  • https://eu-adsrv.rtbsuperhub.com/ir/?placement=8ba6f30d-635a-4292-ac16-504de8d18b50&subPublisher=79
  • https://eu-adsrv.rtbsuperhub.com/click/?subPublisher=popunder:79&zone=popunder:79&adformat=push&auctionid=642aba9003e88-431548&uniqueid=36666019fb1de3870456cf3f5dbf5799&name=4259_push_fra_desktop_F...
  • https://live4.news4more.com/landing/mlp88c?subPublisher=popunder:79&zone=popunder:79&adformat=push&auctionid=642aba9003e88-431548&uniqueid=36666019fb1de3870456cf3f5dbf5799&name=4259_push_fra_deskto...
12 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://live4.news4more.com/landing/mlp88c?subPublisher=popunder:79&zone=popunder:79&adformat=push&auctionid=642aba9003e88-431548&uniqueid=36666019fb1de3870456cf3f5dbf5799&name=4259_push_fra_desktop_FilthyAds_Funnel&newservice=true&cmsid=landing--mlp88c--landing--sa8306&tpcampid=9523f9b1-0984-49cb-aa2d-c51de874b777&imp_tagid=4259_push_fra_desktop_FilthyAds_Funnel&uid=TP-642aba9003d9a0.82125175&campaign_lp=2:landing--mlp88c--landing--sa8306&product=grannyzoneweb&zz=true&nextPage=/landing/sa8306&ur-api-fetch-hitid=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1b7e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
356e1997b75ad5283c7367945bd018e532947a0d5e5605e111b31144f6101451

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
accept-language
fr-FR,fr;q=0.9

Response headers

access-control-allow-headers
X-Requested-With, Content-Type, Accept, Origin, Authorization
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS, HEAD
access-control-allow-origin
*
cache-control
max-age=0, private, must-revalidate no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-cache-status
DYNAMIC
cf-ray
7b2105a4e869d71a-CDG
content-encoding
br
content-type
text/html; charset=UTF-8
date
Mon, 03 Apr 2023 11:37:52 GMT
pragma
no-cache
server
cloudflare
vary
Accept-Encoding

Redirect headers

Connection
keep-alive
Content-Length
0
Content-Type
text/html; charset=UTF-8
Date
Mon, 03 Apr 2023 11:37:52 GMT
Location
https://live4.news4more.com/landing/mlp88c?subPublisher=popunder:79&zone=popunder:79&adformat=push&auctionid=642aba9003e88-431548&uniqueid=36666019fb1de3870456cf3f5dbf5799&name=4259_push_fra_desktop_FilthyAds_Funnel&newservice=true&cmsid=landing--mlp88c--landing--sa8306&tpcampid=9523f9b1-0984-49cb-aa2d-c51de874b777&imp_tagid=4259_push_fra_desktop_FilthyAds_Funnel&uid=TP-642aba9003d9a0.82125175&campaign_lp=2:landing--mlp88c--landing--sa8306&product=grannyzoneweb&zz=true&nextPage=/landing/sa8306&ur-api-fetch-hitid=true
Server
nginx/1.20.0
style.css
lpmedia.servefilesonly.com/style/mb/mlp88/ 		4 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://lpmedia.servefilesonly.com/style/mb/mlp88/style.css
Requested by
Host: live4.news4more.com
URL: https://live4.news4more.com/landing/mlp88c?subPublisher=popunder:79&zone=popunder:79&adformat=push&auctionid=642aba9003e88-431548&uniqueid=36666019fb1de3870456cf3f5dbf5799&name=4259_push_fra_desktop_FilthyAds_Funnel&newservice=true&cmsid=landing--mlp88c--landing--sa8306&tpcampid=9523f9b1-0984-49cb-aa2d-c51de874b777&imp_tagid=4259_push_fra_desktop_FilthyAds_Funnel&uid=TP-642aba9003d9a0.82125175&campaign_lp=2:landing--mlp88c--landing--sa8306&product=grannyzoneweb&zz=true&nextPage=/landing/sa8306&ur-api-fetch-hitid=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:b95 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3fd07a0ea5369253ba76769db3d35d8dac7f3fc32d957bc8a9ca7e23ae989ba5

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://live4.news4more.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Mon, 03 Apr 2023 11:37:52 GMT
content-encoding
gzip
cf-cache-status
HIT
cf-bgj
minify
last-modified
Tue, 28 Mar 2023 07:01:42 GMT
server
cloudflare
age
512634
cf-polished
origSize=4882
etag
W/"642290d6-1312"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=691200
cf-ray
7b2105a5ea19d636-CDG
expires
Tue, 11 Apr 2023 11:37:52 GMT
vegas.min.css
lpmedia.servefilesonly.com/style/mb/mlp88/ 		9 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://lpmedia.servefilesonly.com/style/mb/mlp88/vegas.min.css
Requested by
Host: live4.news4more.com
URL: https://live4.news4more.com/landing/mlp88c?subPublisher=popunder:79&zone=popunder:79&adformat=push&auctionid=642aba9003e88-431548&uniqueid=36666019fb1de3870456cf3f5dbf5799&name=4259_push_fra_desktop_FilthyAds_Funnel&newservice=true&cmsid=landing--mlp88c--landing--sa8306&tpcampid=9523f9b1-0984-49cb-aa2d-c51de874b777&imp_tagid=4259_push_fra_desktop_FilthyAds_Funnel&uid=TP-642aba9003d9a0.82125175&campaign_lp=2:landing--mlp88c--landing--sa8306&product=grannyzoneweb&zz=true&nextPage=/landing/sa8306&ur-api-fetch-hitid=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:b95 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6c4ce7fffb10a410f05c76b535c449d11aee36719d7b2a090fce99c87c0af5ba

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://live4.news4more.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Mon, 03 Apr 2023 11:37:52 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Wed, 29 Mar 2023 06:55:00 GMT
server
cloudflare
age
367648
etag
W/"6423e0c4-2541"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=691200
cf-ray
7b2105a5ea1bd636-CDG
expires
Tue, 11 Apr 2023 11:37:52 GMT
OneSignalSDK.js
cdn.onesignal.com/sdks/ 		9 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.onesignal.com/sdks/OneSignalSDK.js
Requested by
Host: live4.news4more.com
URL: https://live4.news4more.com/landing/mlp88c?subPublisher=popunder:79&zone=popunder:79&adformat=push&auctionid=642aba9003e88-431548&uniqueid=36666019fb1de3870456cf3f5dbf5799&name=4259_push_fra_desktop_FilthyAds_Funnel&newservice=true&cmsid=landing--mlp88c--landing--sa8306&tpcampid=9523f9b1-0984-49cb-aa2d-c51de874b777&imp_tagid=4259_push_fra_desktop_FilthyAds_Funnel&uid=TP-642aba9003d9a0.82125175&campaign_lp=2:landing--mlp88c--landing--sa8306&product=grannyzoneweb&zz=true&nextPage=/landing/sa8306&ur-api-fetch-hitid=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:d63b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
194addf8fd862999286b33cf83116babe8c700ba3a28111777f49ca72c429970
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://live4.news4more.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Mon, 03 Apr 2023 11:37:52 GMT
via
1.1 google
content-encoding
br
cf-cache-status
HIT
server
cloudflare
strict-transport-security
max-age=15552000; includeSubDomains
age
1913
etag
W/"06f50014011c1fcd9e21b6b0481979de"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=259200
cf-ray
7b2105a66afcf8c9-CDG
access-control-allow-headers
OneSignal-Subscription-Id
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires
Thu, 06 Apr 2023 11:37:52 GMT
black-white.gif
lpmedia.servefilesonly.com/img/mb/mlp88/ 		902 KB
903 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lpmedia.servefilesonly.com/img/mb/mlp88/black-white.gif
Requested by
Host: live4.news4more.com
URL: https://live4.news4more.com/landing/mlp88c?subPublisher=popunder:79&zone=popunder:79&adformat=push&auctionid=642aba9003e88-431548&uniqueid=36666019fb1de3870456cf3f5dbf5799&name=4259_push_fra_desktop_FilthyAds_Funnel&newservice=true&cmsid=landing--mlp88c--landing--sa8306&tpcampid=9523f9b1-0984-49cb-aa2d-c51de874b777&imp_tagid=4259_push_fra_desktop_FilthyAds_Funnel&uid=TP-642aba9003d9a0.82125175&campaign_lp=2:landing--mlp88c--landing--sa8306&product=grannyzoneweb&zz=true&nextPage=/landing/sa8306&ur-api-fetch-hitid=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:b95 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
696ba8f16ec0e846694532658c52d911bd5d403318f253764eaa2ab4b56d366a

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://live4.news4more.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Mon, 03 Apr 2023 11:37:52 GMT
cf-cache-status
HIT
last-modified
Mon, 27 Mar 2023 08:11:48 GMT
server
cloudflare
age
546650
etag
"64214fc4-e16fe"
vary
Accept-Encoding
content-type
image/gif
access-control-allow-origin
*
cache-control
public, max-age=691200
accept-ranges
bytes
cf-ray
7b2105a61a42d636-CDG
content-length
923390
expires
Tue, 11 Apr 2023 11:37:52 GMT
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.6.0/ 		87 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js
Requested by
Host: live4.news4more.com
URL: https://live4.news4more.com/landing/mlp88c?subPublisher=popunder:79&zone=popunder:79&adformat=push&auctionid=642aba9003e88-431548&uniqueid=36666019fb1de3870456cf3f5dbf5799&name=4259_push_fra_desktop_FilthyAds_Funnel&newservice=true&cmsid=landing--mlp88c--landing--sa8306&tpcampid=9523f9b1-0984-49cb-aa2d-c51de874b777&imp_tagid=4259_push_fra_desktop_FilthyAds_Funnel&uid=TP-642aba9003d9a0.82125175&campaign_lp=2:landing--mlp88c--landing--sa8306&product=grannyzoneweb&zz=true&nextPage=/landing/sa8306&ur-api-fetch-hitid=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://live4.news4more.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 30 Mar 2023 11:27:35 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
346217
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
31017
x-xss-protection
0
last-modified
Wed, 10 Mar 2021 14:28:09 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
vary
Accept-Encoding
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 29 Mar 2024 11:27:35 GMT
vegas.min.js
lpmedia.servefilesonly.com/js/mb/mlp88/ 		10 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://lpmedia.servefilesonly.com/js/mb/mlp88/vegas.min.js
Requested by
Host: live4.news4more.com
URL: https://live4.news4more.com/landing/mlp88c?subPublisher=popunder:79&zone=popunder:79&adformat=push&auctionid=642aba9003e88-431548&uniqueid=36666019fb1de3870456cf3f5dbf5799&name=4259_push_fra_desktop_FilthyAds_Funnel&newservice=true&cmsid=landing--mlp88c--landing--sa8306&tpcampid=9523f9b1-0984-49cb-aa2d-c51de874b777&imp_tagid=4259_push_fra_desktop_FilthyAds_Funnel&uid=TP-642aba9003d9a0.82125175&campaign_lp=2:landing--mlp88c--landing--sa8306&product=grannyzoneweb&zz=true&nextPage=/landing/sa8306&ur-api-fetch-hitid=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:b95 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f429d68fdbafa7014fe049bcae44fdec1e4cdd61c9de788b79c1b0bb57999188

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://live4.news4more.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Mon, 03 Apr 2023 11:37:52 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Tue, 28 Mar 2023 07:01:39 GMT
server
cloudflare
age
516999
etag
W/"642290d3-26ba"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=691200
cf-ray
7b2105a61a3cd636-CDG
expires
Tue, 11 Apr 2023 11:37:52 GMT
app.js
lpmedia.servefilesonly.com/js/mb/mlp88/ 		2 KB
842 B 		Script
General
Check archive.org
Download Go to
Full URL
https://lpmedia.servefilesonly.com/js/mb/mlp88/app.js
Requested by
Host: live4.news4more.com
URL: https://live4.news4more.com/landing/mlp88c?subPublisher=popunder:79&zone=popunder:79&adformat=push&auctionid=642aba9003e88-431548&uniqueid=36666019fb1de3870456cf3f5dbf5799&name=4259_push_fra_desktop_FilthyAds_Funnel&newservice=true&cmsid=landing--mlp88c--landing--sa8306&tpcampid=9523f9b1-0984-49cb-aa2d-c51de874b777&imp_tagid=4259_push_fra_desktop_FilthyAds_Funnel&uid=TP-642aba9003d9a0.82125175&campaign_lp=2:landing--mlp88c--landing--sa8306&product=grannyzoneweb&zz=true&nextPage=/landing/sa8306&ur-api-fetch-hitid=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:b95 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
69d23552cff36fe9da77885ec4560a72de768035011c01fd5e87170f34554925

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://live4.news4more.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Mon, 03 Apr 2023 11:37:52 GMT
content-encoding
gzip
cf-cache-status
HIT
cf-bgj
minify
last-modified
Wed, 29 Mar 2023 06:54:57 GMT
server
cloudflare
age
359598
cf-polished
origSize=3162
etag
W/"6423e0c1-c5a"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=691200
cf-ray
7b2105a61a41d636-CDG
expires
Tue, 11 Apr 2023 11:37:52 GMT
OneSignalPageSDKES6.js
cdn.onesignal.com/sdks/ 		284 KB
68 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151601
Requested by
Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalSDK.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:d63b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c868ebeb22a6d2945834c14da4641969a62e35a6cfa434a974339df068324b6e
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://live4.news4more.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Mon, 03 Apr 2023 11:37:52 GMT
via
1.1 google
content-encoding
br
cf-cache-status
HIT
server
cloudflare
strict-transport-security
max-age=15552000; includeSubDomains
age
1913
etag
W/"2cf94922e2d551e8dc7c38c022a9a3ca"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=259200
cf-ray
7b2105a6ab25f8c9-CDG
access-control-allow-headers
OneSignal-Subscription-Id
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires
Thu, 06 Apr 2023 11:37:52 GMT
slide2.jpg
lpmedia.servefilesonly.com/img/mb/mlp88/ 		96 KB
97 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lpmedia.servefilesonly.com/img/mb/mlp88/slide2.jpg
Requested by
Host: live4.news4more.com
URL: https://live4.news4more.com/landing/mlp88c?subPublisher=popunder:79&zone=popunder:79&adformat=push&auctionid=642aba9003e88-431548&uniqueid=36666019fb1de3870456cf3f5dbf5799&name=4259_push_fra_desktop_FilthyAds_Funnel&newservice=true&cmsid=landing--mlp88c--landing--sa8306&tpcampid=9523f9b1-0984-49cb-aa2d-c51de874b777&imp_tagid=4259_push_fra_desktop_FilthyAds_Funnel&uid=TP-642aba9003d9a0.82125175&campaign_lp=2:landing--mlp88c--landing--sa8306&product=grannyzoneweb&zz=true&nextPage=/landing/sa8306&ur-api-fetch-hitid=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:b95 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3f674d7fe7e74297705055fed8129ab312ff60676c5837d0c8e4d850a59f0124

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://live4.news4more.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Mon, 03 Apr 2023 11:37:52 GMT
cf-cache-status
HIT
cf-bgj
h2pri
last-modified
Tue, 28 Mar 2023 07:01:39 GMT
server
cloudflare
age
512626
etag
"642290d3-1812b"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=691200
accept-ranges
bytes
cf-ray
7b2105a71b42d636-CDG
content-length
98603
expires
Tue, 11 Apr 2023 11:37:52 GMT
web
onesignal.com/api/v1/sync/4ff9937a-386a-4f82-a4cf-967b520ac346/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://onesignal.com/api/v1/sync/4ff9937a-386a-4f82-a4cf-967b520ac346/web?callback=__jp0
Requested by
Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151601
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:d63b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
602cf3374833cabb6c8c0984db72bdb486404ff691ccc7021e522f43edd95ab5
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://live4.news4more.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Mon, 03 Apr 2023 11:37:52 GMT
via
1.1 google
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
x-permitted-cross-domain-policies
none
strict-transport-security
max-age=15552000; includeSubDomains
age
334
cf-polished
origSize=3367
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
x-request-id
6f325f1d-fa6e-4e72-a2a6-b7bdb25737c5
x-runtime
0.021002
referrer-policy
strict-origin-when-cross-origin
cf-bgj
minify
server
cloudflare
etag
W/"3b3fe7128557683b7855ae44c2eaee53"
x-download-options
noopen
vary
Origin, Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=3600
cf-ray
7b2105a73b90f8c9-CDG
access-control-allow-headers
SDK-Version
expires
Mon, 03 Apr 2023 12:37:52 GMT
OneSignalSDKStyles.css
onesignal.com/sdks/ 		82 KB
9 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://onesignal.com/sdks/OneSignalSDKStyles.css?v=2
Requested by
Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151601
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6812:d63b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
db7e0b393e175f19922fefbdcaa2866fca209c521d01cc834ae06cbf8d0f91b7
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://live4.news4more.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Mon, 03 Apr 2023 11:37:52 GMT
via
1.1 google
content-encoding
br
cf-cache-status
HIT
server
cloudflare
strict-transport-security
max-age=15552000; includeSubDomains
age
1913
etag
W/"4e9aaefffd5f8ae7dc83361aa2294190"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=2592000
cf-ray
7b2105a79f0499b6-CDG
access-control-allow-headers
OneSignal-Subscription-Id
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires
Wed, 03 May 2023 11:37:52 GMT
icon
onesignal.com/api/v1/apps/4ff9937a-386a-4f82-a4cf-967b520ac346/ 		184 B
774 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://onesignal.com/api/v1/apps/4ff9937a-386a-4f82-a4cf-967b520ac346/icon
Requested by
Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151601
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6812:d73b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
329b9d0e0d538b88fd37553ebcb281221ea999c905f0040e9ff8554c0d88cce8
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://live4.news4more.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Mon, 03 Apr 2023 11:37:52 GMT
via
1.1 google
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
x-permitted-cross-domain-policies
none
strict-transport-security
max-age=15552000; includeSubDomains
age
4
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
x-request-id
70102c37-736c-4713-8d1b-618cd551daed
x-runtime
0.021489
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
etag
W/"329b9d0e0d538b88fd37553ebcb28122"
x-download-options
noopen
x-frame-options
SAMEORIGIN
vary
Accept, Origin, Accept-Encoding
content-type
application/json; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=0, private, must-revalidate
cf-ray
7b2105a80a690212-CDG
access-control-allow-headers
SDK-Version
39fe712d-7b3f-4c00-aa6e-d4b79c81bf4e
img.onesignal.com/permanent/ 		11 KB
11 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.onesignal.com/permanent/39fe712d-7b3f-4c00-aa6e-d4b79c81bf4e
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:d63b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
afb61b7d333ca96af47d36a167dd0af56d6ab22b70b82869ea19be9a7f8e5438
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://live4.news4more.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

x-goog-encryption-kms-key-name
projects/core-infra-onesignal/locations/europe-west4/keyRings/keyring-kms-onesignal/cryptoKeys/img-persistence-bucket-onesignal/cryptoKeyVersions/1
date
Mon, 03 Apr 2023 11:37:52 GMT
strict-transport-security
max-age=15552000; includeSubDomains
cf-cache-status
HIT
age
2453
x-guploader-uploadid
ADPycdvaW4GjUJEBBFgZ_YYXyXaQ5iTwYjh1TK7ZZiB52m_HacSms0YASkiSoCmKQMwMb2EJN3XTBsMdfH0bxJ2Sit3B7naAOOSa
x-goog-storage-class
STANDARD
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
11075
pragma
no-cache
last-modified
Sun, 26 Mar 2023 06:49:10 GMT
server
cloudflare
etag
"-CMOKzLCA+f0CEAE="
vary
Origin, Accept-Encoding
x-goog-generation
1679813350982979
content-type
application/octet-stream
x-goog-hash
crc32c=sZIMPA==, md5=EkEaIy5aDVKnzC+kE7DJQg==
cache-control
public, max-age=2678400
x-goog-stored-content-length
11075
accept-ranges
bytes
cf-ray
7b2105a85c94f8c9-CDG
expires
Thu, 04 May 2023 11:37:52 GMT
slide3.jpg
lpmedia.servefilesonly.com/img/mb/mlp88/ 		88 KB
88 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lpmedia.servefilesonly.com/img/mb/mlp88/slide3.jpg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:b95 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d9f6061612898550674c7689bee06ade8a8076ad3507f58e5aad29b0245f02eb

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://live4.news4more.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Mon, 03 Apr 2023 11:37:56 GMT
cf-cache-status
HIT
cf-bgj
h2pri
last-modified
Wed, 29 Mar 2023 06:54:57 GMT
server
cloudflare
age
367652
etag
"6423e0c1-15ef7"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=691200
accept-ranges
bytes
cf-ray
7b2105bdda76d636-CDG
content-length
89847
expires
Tue, 11 Apr 2023 11:37:56 GMT

Verdicts & Comments Add Verdict or Comment

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless function| OneSignal function| $ function| jQuery function| loadingText function| populateLinks number| __oneSignalSdkLoadCount function| __jp0

7 Cookies

Domain/Path Name / Value
eu-adsrv.rtbsuperhub.com/ir Name: srtbid
Value: TP-642aba9003d9a0.82125175
www.xn3j2k.com/ Name: uniqueClick_25D7F3
Value: 4044433e-ef52-4325-bfad-d41e52073e8a:1680521871
www.xn3j2k.com/ Name: transaction_id
Value: 4b7f6c69d1934ad9a5be98657011d5b0
live4.news4more.com/ Name: PHPSESSID
Value: ihl3igkvhoeb5dnd4qo1q7k58k
.news4more.com/ Name: __cf_bm
Value: 0kah4ovXYs4l.yktnttAJReijiNYlLOrnLmYxQY3Fn4-1680521872-0-ATdS0ngmUv7qmRTd+nGrBcYnjlCVgsWOsmH+XgqOR+2gTpnjETuWc5CyUHOAhAj/vz1vGcHfAVsAfAV6fgAt4M4=
.servefilesonly.com/ Name: __cf_bm
Value: 3WhfK2GMbBFgtPLZMcl1cxR4Yc0LRbvSLPx3qXzJzbE-1680521872-0-AZjYYaxrOOViaq6FiWx+NiPjTBLUH4uzhLhQopqs4fRGtzJvrVtIGdZ1U5JjY6msA5NdXuEkUG3zlVCba3PtpE8=
.onesignal.com/ Name: __cf_bm
Value: cg0QO253H2TPFhfVOHGMxl9BiiC69sVZVvJOLYdUp4A-1680521872-0-AYpUXJRdUTNUAkPLsR7JASc9zfBccQti2XO5AKRbYtmjWFAgqb2McffegItj8XZAaZyYQGtprWdC5fn/F9ODiUU=

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
alwaysbeemailing.com
cdn.onesignal.com
eu-adsrv.rtbsuperhub.com
img.onesignal.com
live4.news4more.com
lpmedia.servefilesonly.com
onesignal.com
tracking.sayhitorachel.com
www.xn3j2k.com
142.93.114.237
188.165.1.80
2606:4700::6812:1b7e
2606:4700::6812:b95
2606:4700::6812:d63b
2606:4700::6812:d73b
2a00:1450:4001:806::200a
34.107.223.80
52.214.17.104
194addf8fd862999286b33cf83116babe8c700ba3a28111777f49ca72c429970
329b9d0e0d538b88fd37553ebcb281221ea999c905f0040e9ff8554c0d88cce8
356e1997b75ad5283c7367945bd018e532947a0d5e5605e111b31144f6101451
3f674d7fe7e74297705055fed8129ab312ff60676c5837d0c8e4d850a59f0124
3fd07a0ea5369253ba76769db3d35d8dac7f3fc32d957bc8a9ca7e23ae989ba5
602cf3374833cabb6c8c0984db72bdb486404ff691ccc7021e522f43edd95ab5
696ba8f16ec0e846694532658c52d911bd5d403318f253764eaa2ab4b56d366a
69d23552cff36fe9da77885ec4560a72de768035011c01fd5e87170f34554925
6c4ce7fffb10a410f05c76b535c449d11aee36719d7b2a090fce99c87c0af5ba
afb61b7d333ca96af47d36a167dd0af56d6ab22b70b82869ea19be9a7f8e5438
c868ebeb22a6d2945834c14da4641969a62e35a6cfa434a974339df068324b6e
d9f6061612898550674c7689bee06ade8a8076ad3507f58e5aad29b0245f02eb
db7e0b393e175f19922fefbdcaa2866fca209c521d01cc834ae06cbf8d0f91b7
f429d68fdbafa7014fe049bcae44fdec1e4cdd61c9de788b79c1b0bb57999188
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e