my2025medicaresecrets.com Open in urlscan Pro
34.174.228.241  Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

19 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response my2025medicaresecrets.com/	14 KB 4 KB	346ms 62ms	Document text/html	34.174.228.241 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://my2025medicaresecrets.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 34.174.228.241 Dallas, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 241.228.174.34.bc.googleusercontent.com Software nginx / Resource Hash c2a3524538965c87e088898cd6294f29fcb817d086429034e1e878db8b9887a3 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers content-encoding br content-type text/html date Wed, 31 Jul 2024 00:40:16 GMT etag W/"36a0-61e2747c95d4a" host-header 8441280b0c35cbc1147f8ba998a563a7 last-modified Fri, 26 Jul 2024 14:25:17 GMT server nginx vary Accept-Encoding x-httpd-modphp 1 x-proxy-cache HIT
GET H2	200	bootstrap.min.css my2025medicaresecrets.com/assets/bootstrap/css/	227 KB 27 KB	71ms 70ms	Stylesheet text/css	34.174.228.241 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://my2025medicaresecrets.com/assets/bootstrap/css/bootstrap.min.css Requested by Host: my2025medicaresecrets.com URL: https://my2025medicaresecrets.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 34.174.228.241 Dallas, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 241.228.174.34.bc.googleusercontent.com Software nginx / Resource Hash 3c588c4f300ee58e506277fa7aa19bb42869d579b212dafef06778bbee09192e Request headers Referer https://my2025medicaresecrets.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Wed, 31 Jul 2024 00:40:17 GMT content-encoding br last-modified Fri, 26 Jul 2024 13:12:56 GMT server nginx etag W/"66a3a0d8-38d6a" vary Accept-Encoding x-proxy-cache-info DT:1 content-type text/css cache-control max-age=31536000 host-header 8441280b0c35cbc1147f8ba998a563a7 expires Thu, 31 Jul 2025 00:40:17 GMT
GET H2	200	css fonts.googleapis.com/	832 B 815 B	192ms 71ms	Stylesheet text/css	2607:f8b0:4004:c08::5f GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Aguafina+Script&display=swap Requested by Host: my2025medicaresecrets.com URL: https://my2025medicaresecrets.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4004:c08::5f Washington, United States, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 2393d47676078046e363e149a8e879dcdfd4a6213854807b8b3487e08b2d8f5b Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://my2025medicaresecrets.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers strict-transport-security max-age=31536000 date Wed, 31 Jul 2024 00:40:17 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-xss-protection 0 last-modified Wed, 31 Jul 2024 00:40:17 GMT server ESF cross-origin-opener-policy same-origin-allow-popups x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Wed, 31 Jul 2024 00:40:17 GMT
GET H2	200	material-icons.min.css my2025medicaresecrets.com/assets/fonts/	667 B 519 B	133ms 132ms	Stylesheet text/css	34.174.228.241 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://my2025medicaresecrets.com/assets/fonts/material-icons.min.css Requested by Host: my2025medicaresecrets.com URL: https://my2025medicaresecrets.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 34.174.228.241 Dallas, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 241.228.174.34.bc.googleusercontent.com Software nginx / Resource Hash 3b1570b5ff9ff35087c117c63a418199a11c6eeaf6954846b297b7bf95496129 Request headers Referer https://my2025medicaresecrets.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Wed, 31 Jul 2024 00:40:17 GMT content-encoding br last-modified Fri, 26 Jul 2024 13:12:56 GMT server nginx etag W/"66a3a0d8-29b" vary Accept-Encoding x-proxy-cache-info DT:1 content-type text/css cache-control max-age=31536000 host-header 8441280b0c35cbc1147f8ba998a563a7 expires Thu, 31 Jul 2025 00:40:17 GMT
GET H2	200	styles.min.css my2025medicaresecrets.com/assets/css/	3 KB 1 KB	129ms 127ms	Stylesheet text/css	34.174.228.241 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://my2025medicaresecrets.com/assets/css/styles.min.css Requested by Host: my2025medicaresecrets.com URL: https://my2025medicaresecrets.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 34.174.228.241 Dallas, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 241.228.174.34.bc.googleusercontent.com Software nginx / Resource Hash fed3cb3d9e9e20bcbdcfce5e5f36d49f2795838c27ecdc5147836c1b50ad8edb Request headers Referer https://my2025medicaresecrets.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Wed, 31 Jul 2024 00:40:17 GMT content-encoding br last-modified Fri, 26 Jul 2024 13:12:56 GMT server nginx etag W/"66a3a0d8-c8a" vary Accept-Encoding x-proxy-cache-info DT:1 content-type text/css cache-control max-age=31536000 host-header 8441280b0c35cbc1147f8ba998a563a7 expires Thu, 31 Jul 2025 00:40:17 GMT
GET H2	200	animate.min.min.css my2025medicaresecrets.com/assets/css/	28 KB 3 KB	130ms 128ms	Stylesheet text/css	34.174.228.241 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://my2025medicaresecrets.com/assets/css/animate.min.min.css Requested by Host: my2025medicaresecrets.com URL: https://my2025medicaresecrets.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 34.174.228.241 Dallas, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 241.228.174.34.bc.googleusercontent.com Software nginx / Resource Hash 70e5dd124ce6aacee5d161f0e1fd9f45294aaafc9e965948a0ddcb3b799ef8fa Request headers Referer https://my2025medicaresecrets.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Wed, 31 Jul 2024 00:40:17 GMT content-encoding br last-modified Fri, 26 Jul 2024 13:12:56 GMT server nginx etag W/"66a3a0d8-71da" vary Accept-Encoding x-proxy-cache-info DT:1 content-type text/css cache-control max-age=31536000 host-header 8441280b0c35cbc1147f8ba998a563a7 expires Thu, 31 Jul 2025 00:40:17 GMT
GET H2	200	ZZ5H.gif my2025medicaresecrets.com/assets/img/	44 KB 45 KB	125ms 123ms	Image image/gif	34.174.228.241 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://my2025medicaresecrets.com/assets/img/ZZ5H.gif Requested by Host: my2025medicaresecrets.com URL: https://my2025medicaresecrets.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 34.174.228.241 Dallas, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 241.228.174.34.bc.googleusercontent.com Software nginx / Resource Hash ba67f5cbb26d1c913527475815f0c8d4c4519b092a7544f015cc021360240275 Request headers Referer https://my2025medicaresecrets.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Wed, 31 Jul 2024 00:40:17 GMT last-modified Fri, 26 Jul 2024 13:12:56 GMT server nginx etag "66a3a0d8-b15c" x-proxy-cache-info DT:1 content-type image/gif cache-control max-age=31536000 host-header 8441280b0c35cbc1147f8ba998a563a7 accept-ranges bytes content-length 45404 expires Thu, 31 Jul 2025 00:40:17 GMT
GET H2	200	/ Show response api.ipify.org/	30 B 165 B	166ms 73ms	Script application/javascript	172.67.74.152 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://api.ipify.org/?format=jsonp&callback=getIP Requested by Host: my2025medicaresecrets.com URL: https://my2025medicaresecrets.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.67.74.152 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b3a982a4d839310b6913444204128c28a085324112f16d9ec678629d22dab422 Request headers Referer https://my2025medicaresecrets.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Wed, 31 Jul 2024 00:40:17 GMT cf-cache-status DYNAMIC server cloudflare cf-ray 8ab98942ee69a57c-MIA content-length 30 vary Origin content-type application/javascript
GET H2	200	bootstrap.min.js Show response my2025medicaresecrets.com/assets/bootstrap/js/	79 KB 22 KB	68ms 67ms	Script application/javascript	34.174.228.241 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://my2025medicaresecrets.com/assets/bootstrap/js/bootstrap.min.js Requested by Host: my2025medicaresecrets.com URL: https://my2025medicaresecrets.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 34.174.228.241 Dallas, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 241.228.174.34.bc.googleusercontent.com Software nginx / Resource Hash 7fa35d7cf7e0c873461afd8725972fbdad6e032894650cf7442c03846e991aa1 Request headers Referer https://my2025medicaresecrets.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Wed, 31 Jul 2024 00:40:17 GMT content-encoding br last-modified Fri, 26 Jul 2024 13:12:56 GMT server nginx etag W/"66a3a0d8-13aec" vary Accept-Encoding x-proxy-cache-info DT:1 content-type application/javascript cache-control max-age=31536000 host-header 8441280b0c35cbc1147f8ba998a563a7 expires Thu, 31 Jul 2025 00:40:17 GMT
GET H2	200	script.min.js Show response my2025medicaresecrets.com/assets/js/	371 B 433 B	65ms 64ms	Script application/javascript	34.174.228.241 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://my2025medicaresecrets.com/assets/js/script.min.js Requested by Host: my2025medicaresecrets.com URL: https://my2025medicaresecrets.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 34.174.228.241 Dallas, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 241.228.174.34.bc.googleusercontent.com Software nginx / Resource Hash f7221883642441af4230e929b8b27479777b40ab873957eb2d6b000fd49ddc1e Request headers Referer https://my2025medicaresecrets.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Wed, 31 Jul 2024 00:40:17 GMT content-encoding br last-modified Fri, 26 Jul 2024 13:12:56 GMT server nginx etag W/"66a3a0d8-173" vary Accept-Encoding x-proxy-cache-info DT:1 content-type application/javascript cache-control max-age=31536000 host-header 8441280b0c35cbc1147f8ba998a563a7 expires Thu, 31 Jul 2025 00:40:17 GMT
GET H/1.1	200 OK	track.js Show response s3.amazonaws.com/pcomcdn.com/	8 KB 8 KB	274ms 135ms	Script application/javascript	54.231.136.96 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://s3.amazonaws.com/pcomcdn.com/track.js Requested by Host: my2025medicaresecrets.com URL: https://my2025medicaresecrets.com/ Protocol HTTP/1.1 Security TLS 1.3, , CHACHA20_POLY1305 Server 54.231.136.96 Ashburn, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-1.amazonaws.com Software AmazonS3 / Resource Hash fdae98a313f64dc6169b0e6e39e25d31e00010ef88c83e5c9643a224c644cd63 Request headers Referer https://my2025medicaresecrets.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers Date Wed, 31 Jul 2024 00:40:18 GMT Last-Modified Fri, 03 May 2024 13:39:22 GMT Server AmazonS3 x-amz-request-id 4VRX2T61EP2CESPC ETag "87019e0a20b889b75d4136a581887b58" x-amz-server-side-encryption AES256 Content-Type application/javascript Accept-Ranges bytes Content-Length 8235 x-amz-id-2 NKHZm1P+a8msHIE6i2p6AnsbAMzk1Agy+LE/7jGKIIpYyXCog9Q1mfpkvuRDtGAUxVEQLB8PiE4=
GET H2	200	fbevents.js Show response connect.facebook.net/en_US/	224 KB 60 KB	190ms 59ms	Script application/x-javascript	2a03:2880:f003:100:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/fbevents.js Requested by Host: my2025medicaresecrets.com URL: https://my2025medicaresecrets.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f003:100:face:b00c:0:3 Ashburn, United States, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash eaa003d85cb77f94fcae98396e583ce01d0c375b57235402c884ef8a792b951e Security Headers Name Value Content-Security-Policy default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' 'unsafe-eval' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script'; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://my2025medicaresecrets.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers content-security-policy default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' 'unsafe-eval' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; preload; includeSubDomains date Wed, 31 Jul 2024 00:40:17 GMT document-policy force-load-at-top x-fb-server-load 30 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 58677 x-xss-protection 0 reporting-endpoints coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" x-fb-connection-quality GOOD; q=0.7, rtt=55, rtx=0, c=12, mss=1297, tbw=2776, tp=-1, tpl=-1, uplat=0, ullat=-1 pragma public x-fb-debug lZUcf0TU+HsnQ4U5SXgQoRH4lJR07zPdmVY/b115QTddI3aoSkg3bE/xE7BMADb6bms+qvvmk8BfSFhTCBBnKw== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" cross-origin-opener-policy same-origin-allow-popups;report-to="coop_report" vary Accept-Encoding report-to {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} content-type application/x-javascript; charset=utf-8 x-frame-options DENY origin-agent-cluster ?0 cache-control public, max-age=1200 permissions-policy accelerometer=(), attribution-reporting=(), autoplay=(), battery=(self), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), usb-unrestricted=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" timing-allow-origin * expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	If2QXTv_ZzSxGIO30LemWEOmt1b3rcQo.woff2 fonts.gstatic.com/s/aguafinascript/v22/	16 KB 16 KB	196ms 58ms	Font font/woff2	2607:f8b0:4004:c1f::5e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/aguafinascript/v22/If2QXTv_ZzSxGIO30LemWEOmt1b3rcQo.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Aguafina+Script&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4004:c1f::5e Washington, United States, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash af3a47591af635c8607e0035387ba0a1598a5395d39952435a98aeb923af61e9 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://my2025medicaresecrets.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Sat, 27 Jul 2024 15:57:45 GMT x-content-type-options nosniff age 290552 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 15908 x-xss-protection 0 last-modified Thu, 24 Aug 2023 20:53:10 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Sun, 27 Jul 2025 15:57:45 GMT
OPTIONS H2	200	session nrh59ln9za.execute-api.us-east-1.amazonaws.com/latest/	0 0	214ms 59ms	Preflight application/json	44.210.1.92 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://nrh59ln9za.execute-api.us-east-1.amazonaws.com/latest/session Protocol H2 Security TLS 1.3, , AES_128_GCM Server 44.210.1.92 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-44-210-1-92.compute-1.amazonaws.com Software / Resource Hash Request headers Accept */* Access-Control-Request-Headers content-type Access-Control-Request-Method POST Origin https://my2025medicaresecrets.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers access-control-allow-headers Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token access-control-allow-methods OPTIONS,POST access-control-allow-origin * content-length 0 content-type application/json date Wed, 31 Jul 2024 00:40:17 GMT x-amz-apigw-id bwItzGunIAMEpYw= x-amzn-requestid 0afc2ebc-020b-4d12-b003-390a4ae7d626
POST H2	200	session Show response nrh59ln9za.execute-api.us-east-1.amazonaws.com/latest/	0 222 B	896ms 895ms	XHR application/json	44.210.1.92 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://nrh59ln9za.execute-api.us-east-1.amazonaws.com/latest/session Requested by Host: s3.amazonaws.com URL: https://s3.amazonaws.com/pcomcdn.com/track.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 44.210.1.92 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-44-210-1-92.compute-1.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://my2025medicaresecrets.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Content-Type application/json Response headers access-control-allow-origin * x-amzn-trace-id Root=1-66a987f1-4034264a6501db4d16039590;Parent=6c7a9586061f4ba0;Sampled=0;lineage=787e2061:0 date Wed, 31 Jul 2024 00:40:18 GMT x-amzn-requestid 362266a9-f974-4fb8-bd64-8233101b2f49 content-length 0 x-amz-apigw-id bwIt0EMZoAMENKg= content-type application/json
GET H2	200	2505449036265266 Show response connect.facebook.net/signals/config/	61 KB 13 KB	135ms 134ms	Script application/x-javascript	2a03:2880:f003:100:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/2505449036265266?v=2.9.162&r=stable&domain=my2025medicaresecrets.com&hme=e67e7d148043b3a377ad0eb1c82669792a67ba5e3bb5734b69e611ae38f939ca&ex_m=68%2C115%2C102%2C106%2C59%2C3%2C95%2C67%2C15%2C92%2C85%2C49%2C52%2C163%2C166%2C178%2C174%2C175%2C177%2C28%2C96%2C51%2C74%2C176%2C158%2C161%2C171%2C172%2C179%2C124%2C39%2C33%2C136%2C14%2C48%2C184%2C183%2C126%2C17%2C38%2C1%2C41%2C63%2C64%2C65%2C69%2C89%2C16%2C13%2C91%2C88%2C87%2C103%2C50%2C105%2C37%2C104%2C29%2C25%2C159%2C162%2C133%2C27%2C10%2C11%2C12%2C5%2C6%2C24%2C21%2C22%2C55%2C60%2C62%2C72%2C97%2C26%2C73%2C8%2C7%2C77%2C46%2C20%2C99%2C98%2C100%2C93%2C9%2C19%2C18%2C82%2C54%2C80%2C32%2C71%2C0%2C90%2C31%2C79%2C84%2C45%2C44%2C83%2C36%2C4%2C86%2C78%2C42%2C34%2C81%2C2%2C35%2C61%2C40%2C101%2C43%2C76%2C66%2C107%2C58%2C57%2C30%2C94%2C56%2C53%2C47%2C75%2C70%2C23%2C108 Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f003:100:face:b00c:0:3 Ashburn, United States, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash b3776e7b1e404fa6e9a401c14ea78ad06c2ece6bb126d2f1031e59e388c3e4b0 Security Headers Name Value Content-Security-Policy default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' 'unsafe-eval' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script'; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://my2025medicaresecrets.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers content-security-policy default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' 'unsafe-eval' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; preload; includeSubDomains date Wed, 31 Jul 2024 00:40:17 GMT document-policy force-load-at-top x-fb-server-load 20 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 x-xss-protection 0 reporting-endpoints coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" x-fb-connection-quality GOOD; q=0.7, rtt=58, rtx=0, c=64, mss=1297, tbw=64197, tp=-1, tpl=-1, uplat=74, ullat=0 pragma public x-fb-debug 175XAhaoIDcrA/U1IcousmPHyy7QTsxYG3kzgbjnDRPKKAGGRujazjPLT233w4JDmI9pzqPfS7KyZT2wdVRxOA== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" cross-origin-opener-policy same-origin-allow-popups;report-to="coop_report" vary Accept-Encoding report-to {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} content-type application/x-javascript; charset=utf-8 x-frame-options DENY origin-agent-cluster ?0 cache-control public, max-age=1200 permissions-policy accelerometer=(), attribution-reporting=(), autoplay=(), battery=(self), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), usb-unrestricted=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" timing-allow-origin * expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	/ www.facebook.com/tr/	0 269 B	177ms 58ms	Image text/plain	2a03:2880:f103:181:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=2505449036265266&ev=PageView&dl=https%3A%2F%2Fmy2025medicaresecrets.com&rl=&if=false&ts=1722386417713&sw=1600&sh=1200&v=2.9.162&r=stable&ec=0&o=4124&fbp=fb.1.1722386417709.400132017216217633&pm=1&hrl=6827a8&ler=empty&cdl=API_unavailable&it=1722386417551&coo=false&cs_cc=1&cas=7964102243600778%2C7620059974789225&rqm=GET Requested by Host: my2025medicaresecrets.com URL: https://my2025medicaresecrets.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f103:181:face:b00c:0:25de Ashburn, United States, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://my2025medicaresecrets.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers x-fb-connection-quality GOOD; q=0.7, rtt=55, rtx=0, c=10, mss=1297, tbw=2826, tp=-1, tpl=-1, uplat=0, ullat=0 strict-transport-security max-age=31536000; includeSubDomains date Wed, 31 Jul 2024 00:40:17 GMT server proxygen-bolt content-type text/plain access-control-allow-origin access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 0
GET H2	200	/ www.facebook.com/privacy_sandbox/pixel/register/trigger/	67 B 3 KB	357ms 239ms	Image image/png	2a03:2880:f103:181:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=2505449036265266&ev=PageView&dl=https%3A%2F%2Fmy2025medicaresecrets.com&rl=&if=false&ts=1722386417713&sw=1600&sh=1200&v=2.9.162&r=stable&ec=0&o=4124&fbp=fb.1.1722386417709.400132017216217633&pm=1&hrl=6827a8&ler=empty&cdl=API_unavailable&it=1722386417551&coo=false&cs_cc=1&cas=7964102243600778%2C7620059974789225&rqm=FGET Requested by Host: my2025medicaresecrets.com URL: https://my2025medicaresecrets.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f103:181:face:b00c:0:25de Ashburn, United States, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a Security Headers Name Value Content-Security-Policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests; Strict-Transport-Security max-age=15552000; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://my2025medicaresecrets.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers content-security-policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests; content-encoding zstd x-content-type-options nosniff strict-transport-security max-age=15552000; preload date Wed, 31 Jul 2024 00:40:18 GMT document-policy force-load-at-top x-fb-server-load 19 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 x-xss-protection 0 reporting-endpoints coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7397593333969535462", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" x-fb-connection-quality GOOD; q=0.7, rtt=55, rtx=0, c=14, mss=1297, tbw=3139, tp=-1, tpl=-1, uplat=179, ullat=0 pragma no-cache x-fb-debug NZiQZ1kVIuiANGhLtocF2fxpdDhbCeigyfZd8F8mTbdVt6FUmau292H8ZoTZ+hf/M25ZkTttUiYa7zluia04VQ== cross-origin-opener-policy same-origin-allow-popups;report-to="coop_report" vary Accept-Encoding report-to {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7397593333969535462"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} content-type image/png x-frame-options DENY origin-agent-cluster ?0 cache-control private, no-store, no-cache, must-revalidate permissions-policy accelerometer=(), attribution-reporting=(self), autoplay=(), battery=(self), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), usb-unrestricted=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy" expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	404	favicon.ico my2025medicaresecrets.com/	82 KB 14 KB	225ms 224ms	Other text/html	34.174.228.241 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://my2025medicaresecrets.com/favicon.ico Protocol H2 Security TLS 1.3, , AES_256_GCM Server 34.174.228.241 Dallas, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 241.228.174.34.bc.googleusercontent.com Software nginx / Resource Hash b39bdadd90378180927c19f1343682602e430b54f3fc7523c5ac4f46ffd67bc7 Request headers Referer https://my2025medicaresecrets.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Wed, 31 Jul 2024 00:40:18 GMT content-encoding br server nginx vary Accept-Encoding x-proxy-cache-info 0 NC:000000 UP: content-type text/html x-httpd-modphp 1 host-header 6b7412fb82ca5edfd0917e3957f05d89 x-proxy-cache EXPIRED

28 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| fbq function| _fbq object| progBarElem object| progBar object| underCall object| MedYes object| MedNo object| YesAge object| NoAge object| skip1 function| dq function| transition function| countdownClock object| callButtons object| _rgba_tags number| uidEvent object| bootstrap function| ranTag function| uuidMaster function| processParams function| classifyDevice function| fetchUD function| modSite function| getCookie function| placeholderReplacement function| releaseKraken function| newTxid function| recordEvent

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.my2025medicaresecrets.com/	1970-01-21 00:36:02	Name: _fbp Value: fb.1.1722386417709.400132017216217633

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://my2025medicaresecrets.com/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.ipify.org
connect.facebook.net
fonts.googleapis.com
fonts.gstatic.com
my2025medicaresecrets.com
nrh59ln9za.execute-api.us-east-1.amazonaws.com
s3.amazonaws.com
www.facebook.com
172.67.74.152
2607:f8b0:4004:c08::5f
2607:f8b0:4004:c1f::5e
2a03:2880:f003:100:face:b00c:0:3
2a03:2880:f103:181:face:b00c:0:25de
34.174.228.241
44.210.1.92
54.231.136.96
2393d47676078046e363e149a8e879dcdfd4a6213854807b8b3487e08b2d8f5b
3b1570b5ff9ff35087c117c63a418199a11c6eeaf6954846b297b7bf95496129
3c588c4f300ee58e506277fa7aa19bb42869d579b212dafef06778bbee09192e
70e5dd124ce6aacee5d161f0e1fd9f45294aaafc9e965948a0ddcb3b799ef8fa
7fa35d7cf7e0c873461afd8725972fbdad6e032894650cf7442c03846e991aa1
aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a
af3a47591af635c8607e0035387ba0a1598a5395d39952435a98aeb923af61e9
b3776e7b1e404fa6e9a401c14ea78ad06c2ece6bb126d2f1031e59e388c3e4b0
b39bdadd90378180927c19f1343682602e430b54f3fc7523c5ac4f46ffd67bc7
b3a982a4d839310b6913444204128c28a085324112f16d9ec678629d22dab422
ba67f5cbb26d1c913527475815f0c8d4c4519b092a7544f015cc021360240275
c2a3524538965c87e088898cd6294f29fcb817d086429034e1e878db8b9887a3
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eaa003d85cb77f94fcae98396e583ce01d0c375b57235402c884ef8a792b951e
f7221883642441af4230e929b8b27479777b40ab873957eb2d6b000fd49ddc1e
fdae98a313f64dc6169b0e6e39e25d31e00010ef88c83e5c9643a224c644cd63
fed3cb3d9e9e20bcbdcfce5e5f36d49f2795838c27ecdc5147836c1b50ad8edb