urlscan.io logo urlscan.io
SecurityTrails logo

topeditsolutions.com Open in urlscan Pro
2a06:98c1:3121::3  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://storage.googleapis.com/cezayin/maurisio.html#wepmvh3c4me6.4l1808h01?cbbbbcccRnkbcyp94cdcKxc8c5CPxckzFcbbbbc
Effective URL: https://topeditsolutions.com/dLtykv3tsrI0zu3YkELo-RiazqrXZ_jLh1jnO51uqUk/?clck=5yxeouwrj4cq3suhsivqck8g0,16693442,5,4379&sid=...
Submission: On May 16 via api from BE — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 17 IPs in 3 countries across 13 domains to perform 28 HTTP transactions. The main IP is 2a06:98c1:3121::3, located in and belongs to . The main domain is topeditsolutions.com.
TLS certificate: Issued by E1 on April 30th 2023. Valid for: 3 months.
This is the only time topeditsolutions.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

1    2a00:1450:4001:829::2010 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
storage.googleapis.com
1    203.210.17.2 (Korea, Republic Of)

ASN138195 (MOACKCOLTD-AS-AP MOACK.Co.LTD, KR)
dischargebackhanded.com
1    50.115.172.137 (United States)

ASN32875 (VIRP, US)
PTR: matcherreal.com
empathysymphony.com
1    38.102.245.195 (Redondo Beach, United States)

ASN174 (COGENT-174, US)
offer-connect.com
1    2a00:1450:4001:812::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
ajax.googleapis.com
1    2a00:1450:4001:829::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
2    2606:4700::6812:bcf (United States)

ASN13335 (CLOUDFLARENET, US)
maxcdn.bootstrapcdn.com
2    13.32.99.22 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-99-22.fra60.r.cloudfront.net
api.pushnami.com
1    2a00:1450:4001:80f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
2    52.21.164.9 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-21-164-9.compute-1.amazonaws.com
trc.pushnami.com
2    52.21.2.69 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-21-2-69.compute-1.amazonaws.com
psp.pushnami.com
4    2606:4700:3032::6815:1cae (None, )

ASN- ()
lynku.jukminung.com
1    2606:4700:3030::6815:4a8d (None, )

ASN- ()
cdn.addlnk.com
1    94.237.103.119 (None, )

ASN- ()
1d706b4e081.megatrffc.com
2    2a06:98c1:3121::3 (None, )

ASN- ()
topeditsolutions.com
2    172.67.197.244 (None, )

ASN- ()
feed.cn-rtb.com
t.cn-rtb.com
4    2606:4700:20::681a:7e4 (None, )

ASN- ()
sdk.ocmhood.com
cdn.ocmhood.com
t.ocmhood.com
Apex Domain
Subdomains		 Transfer
6 pushnami.com
api.pushnami.com — Cisco Umbrella Rank: 5388
trc.pushnami.com — Cisco Umbrella Rank: 5650
psp.pushnami.com — Cisco Umbrella Rank: 19614
20 KB
4 ocmhood.com
sdk.ocmhood.com
cdn.ocmhood.com
t.ocmhood.com
13 KB
4 jukminung.com
lynku.jukminung.com
19 KB
3 googleapis.com
storage.googleapis.com — Cisco Umbrella Rank: 393
ajax.googleapis.com — Cisco Umbrella Rank: 385
fonts.googleapis.com — Cisco Umbrella Rank: 50
32 KB
2 cn-rtb.com
feed.cn-rtb.com
t.cn-rtb.com
860 B
2 topeditsolutions.com
topeditsolutions.com
14 KB
2 bootstrapcdn.com
maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 960
83 KB
1 megatrffc.com
1d706b4e081.megatrffc.com
1 KB
1 addlnk.com
cdn.addlnk.com
1 KB
1 gstatic.com
fonts.gstatic.com
47 KB
1 offer-connect.com
offer-connect.com
10 KB
1 empathysymphony.com
empathysymphony.com
582 B
1 dischargebackhanded.com
dischargebackhanded.com
296 B
28 13
Domain Requested by
4 lynku.jukminung.com 1 redirects offer-connect.com
lynku.jukminung.com
2 t.ocmhood.com sdk.ocmhood.com
2 topeditsolutions.com topeditsolutions.com
2 psp.pushnami.com api.pushnami.com
2 trc.pushnami.com api.pushnami.com
2 api.pushnami.com offer-connect.com
api.pushnami.com
2 maxcdn.bootstrapcdn.com offer-connect.com
maxcdn.bootstrapcdn.com
1 t.cn-rtb.com topeditsolutions.com
1 cdn.ocmhood.com sdk.ocmhood.com
1 sdk.ocmhood.com topeditsolutions.com
1 feed.cn-rtb.com topeditsolutions.com
1 1d706b4e081.megatrffc.com lynku.jukminung.com
1 cdn.addlnk.com lynku.jukminung.com
1 fonts.gstatic.com fonts.googleapis.com
1 fonts.googleapis.com offer-connect.com
1 ajax.googleapis.com offer-connect.com
1 offer-connect.com empathysymphony.com
1 empathysymphony.com storage.googleapis.com
1 dischargebackhanded.com 1 redirects
1 storage.googleapis.com
28 20

This site contains no links.

Subject Issuer Validity Valid
empathysymphony.com
Sectigo RSA Domain Validation Secure Server CA		 2023-02-21 -
2024-03-18		 a year crt.sh
offer-connect.com
Sectigo RSA Domain Validation Secure Server CA		 2022-06-28 -
2023-07-23		 a year crt.sh
upload.video.google.com
GTS CA 1C3		 2023-04-24 -
2023-07-17		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2022-12-30 -
2023-12-30		 a year crt.sh
*.pushnami.com
Amazon RSA 2048 M01		 2023-03-04 -
2024-04-02		 a year crt.sh
*.gstatic.com
GTS CA 1C3		 2023-04-24 -
2023-07-17		 3 months crt.sh
addlnk.com
GTS CA 1P5		 2023-04-15 -
2023-07-14		 3 months crt.sh
*.megatrffc.com
R3		 2023-05-12 -
2023-08-10		 3 months crt.sh
topeditsolutions.com
E1		 2023-04-30 -
2023-07-29		 3 months crt.sh
cn-rtb.com
GTS CA 1P5		 2023-04-22 -
2023-07-21		 3 months crt.sh
ocmhood.com
Cloudflare Inc ECC CA-3		 2023-04-04 -
2024-04-03		 a year crt.sh

This page contains 3 frames:

Primary Page: https://topeditsolutions.com/dLtykv3tsrI0zu3YkELo-RiazqrXZ_jLh1jnO51uqUk/?clck=5yxeouwrj4cq3suhsivqck8g0,16693442,5,4379&sid=4379
Frame ID: 5E45BC824E339B2EA4F10C71A74C60F7
Requests: 24 HTTP requests in this frame

Frame: https://api.pushnami.com/scripts/v1/hub
Frame ID: C022BBE4D0AEFD3F8583535B827A0554
Requests: 1 HTTP requests in this frame

Frame: https://lynku.jukminung.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/27ac9c8d/invisible.js
Frame ID: 024221F90AED9BAD5DD4BD1AB5989432
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

offer-connect

Page URL History Show full URLs

  1. http://storage.googleapis.com/cezayin/maurisio.html Page URL
  2. http://dischargebackhanded.com/anchorwepmvh3c4me6.4l1808h01?cbbbbcccRnkbcyp94cdcKxc8c5CPxckzFcbbbbc HTTP 302
    https://empathysymphony.com/1761a857f8685517000/N0xXHsnG0U6iOOmhc55ohNs6t3a7EPhQmXyHm3Q/XXWBjHJoI3Hqbaud... Page URL
  3. https://offer-connect.com/?&__pt__=all&__cm__=Welcome%3A%20Access%20Our%20Best%20Offers%20Available%21... Page URL
  4. https://lynku.jukminung.com/rc/9e8aef8068?affclick=1344138053&pshnm_src=690099&pubid=690099 Page URL
  5. https://1d706b4e081.megatrffc.com/?p=4379&media_type=mainstream&sub_id=pubbd61548781b84e87a87ebfc6bb48abb7&pub... Page URL
  6. https://topeditsolutions.com/dLtykv3tsrI0zu3YkELo-RiazqrXZ_jLh1jnO51uqUk/?clck=5yxeouwrj4cq3suhsivqck8g0,... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
  • <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Overall confidence: 100%
Detected patterns
  • api\.pushnami\.com
Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

28
Requests

89 %
HTTPS

53 %
IPv6

13
Domains

20
Subdomains

17
IPs

3
Countries

242 kB
Transfer

449 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://storage.googleapis.com/cezayin/maurisio.html Page URL
  2. http://dischargebackhanded.com/anchorwepmvh3c4me6.4l1808h01?cbbbbcccRnkbcyp94cdcKxc8c5CPxckzFcbbbbc HTTP 302
    https://empathysymphony.com/1761a857f8685517000/N0xXHsnG0U6iOOmhc55ohNs6t3a7EPhQmXyHm3Q/XXWBjHJoI3HqbaudLyjzvhYDadFE/ZE~QADMBAJUE Page URL
  3. https://offer-connect.com/?&__pt__=all&__cm__=Welcome%3A%20Access%20Our%20Best%20Offers%20Available%21&pshnm_src=690099&__destUrl__=https://lynku.jukminung.com/rc/9e8aef8068?affclick=1344138053&pubid=690099 Page URL
  4. https://lynku.jukminung.com/rc/9e8aef8068?affclick=1344138053&pshnm_src=690099&pubid=690099 Page URL
  5. https://1d706b4e081.megatrffc.com/?p=4379&media_type=mainstream&sub_id=pubbd61548781b84e87a87ebfc6bb48abb7&pubid=690099&pi=690099 Page URL
  6. https://topeditsolutions.com/dLtykv3tsrI0zu3YkELo-RiazqrXZ_jLh1jnO51uqUk/?clck=5yxeouwrj4cq3suhsivqck8g0,16693442,5,4379&sid=4379 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1
  • http://dischargebackhanded.com/anchorwepmvh3c4me6.4l1808h01?cbbbbcccRnkbcyp94cdcKxc8c5CPxckzFcbbbbc HTTP 302
  • https://empathysymphony.com/1761a857f8685517000/N0xXHsnG0U6iOOmhc55ohNs6t3a7EPhQmXyHm3Q/XXWBjHJoI3HqbaudLyjzvhYDadFE/ZE~QADMBAJUE
Request Chain 16
  • https://lynku.jukminung.com/cdn-cgi/challenge-platform/scripts/invisible.js HTTP 302
  • https://lynku.jukminung.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/27ac9c8d/invisible.js

28 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
maurisio.html
storage.googleapis.com/cezayin/ 		117 B
807 B 		Document
General
Check archive.org
Download Go to
Full URL
http://storage.googleapis.com/cezayin/maurisio.html
Protocol
HTTP/1.1
Server
2a00:1450:4001:829::2010 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
UploadServer /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Accept-Ranges
bytes
Age
833
Cache-Control
public, max-age=3600
Content-Length
117
Content-Type
text/html
Date
Tue, 16 May 2023 19:14:38 GMT
ETag
"8b91320949ba565a91951a397b8a7554"
Expires
Tue, 16 May 2023 20:14:38 GMT
Last-Modified
Mon, 27 Jun 2022 09:32:51 GMT
Server
UploadServer
X-GUploader-UploadID
ADPycdu0qPlx3PsS-G2f51eWEt9R3m8tF7LJNMXJA3lfNpCEvekV9fBW1l01APKmw0tzAUHroxBGioXLxEo7anNokpjiL9uMYaa0
x-goog-generation
1656322371552499
x-goog-hash
crc32c=JgA0VQ== md5=i5EyCUm6VlqRlRo5e4p1VA==
x-goog-metageneration
6
x-goog-storage-class
STANDARD
x-goog-stored-content-encoding
identity
x-goog-stored-content-length
117
ZE~QADMBAJUE
empathysymphony.com/1761a857f8685517000/N0xXHsnG0U6iOOmhc55ohNs6t3a7EPhQmXyHm3Q/XXWBjHJoI3HqbaudLyjzvhYDadFE/
Redirect Chain
  • http://dischargebackhanded.com/anchorwepmvh3c4me6.4l1808h01?cbbbbcccRnkbcyp94cdcKxc8c5CPxckzFcbbbbc
  • https://empathysymphony.com/1761a857f8685517000/N0xXHsnG0U6iOOmhc55ohNs6t3a7EPhQmXyHm3Q/XXWBjHJoI3HqbaudLyjzvhYDadFE/ZE~QADMBAJUE
269 B
582 B 		Document
General
Check archive.org
Download Go to
Full URL
https://empathysymphony.com/1761a857f8685517000/N0xXHsnG0U6iOOmhc55ohNs6t3a7EPhQmXyHm3Q/XXWBjHJoI3HqbaudLyjzvhYDadFE/ZE~QADMBAJUE
Requested by
Host: storage.googleapis.com
URL: http://storage.googleapis.com/cezayin/maurisio.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
50.115.172.137 , United States, ASN32875 (VIRP, US),
Reverse DNS
matcherreal.com
Software
Apache /
Resource Hash

Request headers

Referer
http://storage.googleapis.com/cezayin/maurisio.html#wepmvh3c4me6.4l1808h01?cbbbbcccRnkbcyp94cdcKxc8c5CPxckzFcbbbbc
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Connection
close
Content-Length
269
Content-Type
text/html; charset=UTF-8
Date
Tue, 16 May 2023 19:28:33 GMT
Server
Apache

Redirect headers

Connection
close
Content-Length
0
Content-Type
text/html; charset=UTF-8
Date
Tue, 16 May 2023 19:28:31 GMT
Location
https://empathysymphony.com/1761a857f8685517000/N0xXHsnG0U6iOOmhc55ohNs6t3a7EPhQmXyHm3Q/XXWBjHJoI3HqbaudLyjzvhYDadFE/ZE%7EQADMBAJUE
Server
Apache
/
offer-connect.com/ 		10 KB
10 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://offer-connect.com/?&__pt__=all&__cm__=Welcome%3A%20Access%20Our%20Best%20Offers%20Available%21&pshnm_src=690099&__destUrl__=https://lynku.jukminung.com/rc/9e8aef8068?affclick=1344138053&pubid=690099
Requested by
Host: empathysymphony.com
URL: https://empathysymphony.com/1761a857f8685517000/N0xXHsnG0U6iOOmhc55ohNs6t3a7EPhQmXyHm3Q/XXWBjHJoI3HqbaudLyjzvhYDadFE/ZE~QADMBAJUE
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
38.102.245.195 Redondo Beach, United States, ASN174 (COGENT-174, US),
Reverse DNS
Software
nginx/1.10.2 /
Resource Hash
42fa66b97e0ca198bfa261e2398544d9b3dbe31a60ebb010f1afd102d851df5d

Request headers

Referer
https://empathysymphony.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Accept-Ranges
bytes
Content-Length
10008
Content-Type
text/html
Date
Tue, 16 May 2023 22:56:30 GMT
ETag
"63efd888-2718"
Last-Modified
Fri, 17 Feb 2023 19:42:00 GMT
Server
nginx/1.10.2
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.1.1/ 		85 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/3.1.1/jquery.min.js
Requested by
Host: offer-connect.com
URL: https://offer-connect.com/?&__pt__=all&__cm__=Welcome%3A%20Access%20Our%20Best%20Offers%20Available%21&pshnm_src=690099&__destUrl__=https://lynku.jukminung.com/rc/9e8aef8068?affclick=1344138053&pubid=690099
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://offer-connect.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Wed, 10 May 2023 17:07:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
526846
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
30244
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 19:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
vary
Accept-Encoding
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 09 May 2024 17:07:48 GMT
css
fonts.googleapis.com/ 		7 KB
966 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Work+Sans:400,300,500,700,600,800
Requested by
Host: offer-connect.com
URL: https://offer-connect.com/?&__pt__=all&__cm__=Welcome%3A%20Access%20Our%20Best%20Offers%20Available%21&pshnm_src=690099&__destUrl__=https://lynku.jukminung.com/rc/9e8aef8068?affclick=1344138053&pubid=690099
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
cbdcee06341939e7e0e536596649fcd6d54ae2d139bbecd1c4115cd179ef3b2c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://offer-connect.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Tue, 16 May 2023 19:28:34 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Tue, 16 May 2023 19:22:15 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Tue, 16 May 2023 19:28:34 GMT
font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/ 		30 KB
7 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css
Requested by
Host: offer-connect.com
URL: https://offer-connect.com/?&__pt__=all&__cm__=Welcome%3A%20Access%20Our%20Best%20Offers%20Available%21&pshnm_src=690099&__destUrl__=https://lynku.jukminung.com/rc/9e8aef8068?affclick=1344138053&pubid=690099
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://offer-connect.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Tue, 16 May 2023 19:28:34 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
cdn-edgestorageid
871
age
12483724
cdn-cachedat
07/07/2022 17:49:34
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Mon, 25 Jan 2021 22:04:55 GMT
cdn-proxyver
1.02
cdn-requestpullcode
200
server
cloudflare
etag
W/"269550530cc127b6aa5a35925a7de6ce"
vary
Accept-Encoding
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cache-control
public, max-age=31919000
cdn-requestid
53050069f7634df6ba0426ea6471d136
timing-allow-origin
*
cdn-requestcountrycode
US
cdn-status
200
cf-ray
7c86064aab8a2bcb-FRA
cdn-requestpullsuccess
True
63ed63298591f2001320edcc
api.pushnami.com/scripts/v1/pushnami-adv/ 		88 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://api.pushnami.com/scripts/v1/pushnami-adv/63ed63298591f2001320edcc
Requested by
Host: offer-connect.com
URL: https://offer-connect.com/?&__pt__=all&__cm__=Welcome%3A%20Access%20Our%20Best%20Offers%20Available%21&pshnm_src=690099&__destUrl__=https://lynku.jukminung.com/rc/9e8aef8068?affclick=1344138053&pubid=690099
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.99.22 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-99-22.fra60.r.cloudfront.net
Software
/
Resource Hash
ee607772e922f816ff318576900b4a7ca92449cd3f15881481a11fe30d934cdc

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://offer-connect.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Tue, 16 May 2023 19:24:00 GMT
content-encoding
gzip
via
1.1 b43c04a791e8dcb8ddb6bb0847fcf95a.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA60-P3
age
275
vary
accept-encoding
x-cache
Hit from cloudfront
content-type
application/javascript; charset=utf-8
cache-control
no-cache
x-amz-cf-id
qZLBzfq_wQU3An0V03cZIbUVF4jteOgXQvqbZZ8pgfsAYp4ulMCmUg==
fontawesome-webfont.woff2
maxcdn.bootstrapcdn.com/font-awesome/4.7.0/fonts/ 		75 KB
76 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0
Requested by
Host: maxcdn.bootstrapcdn.com
URL: https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css
Origin
https://offer-connect.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Tue, 16 May 2023 19:28:35 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
cdn-edgestorageid
752
age
6142178
cdn-cachedat
08/17/2022 18:20:14
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
77160
last-modified
Mon, 25 Jan 2021 22:04:55 GMT
cdn-proxyver
1.02
cdn-requestpullcode
200
server
cloudflare
etag
"af7ae505a9eed503f8b8e6982036873e"
vary
Accept-Encoding
content-type
font/woff2
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cache-control
public, max-age=31919000
cdn-requestid
746933e61529be8366407880fd47077a
accept-ranges
bytes
timing-allow-origin
*
cdn-requestcountrycode
DE
cdn-status
200
cf-ray
7c86064b4cc83807-FRA
cdn-requestpullsuccess
True
QGYsz_wNahGAdqQ43Rh_fKDp.woff2
fonts.gstatic.com/s/worksans/v18/ 		47 KB
47 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/worksans/v18/QGYsz_wNahGAdqQ43Rh_fKDp.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Work+Sans:400,300,500,700,600,800
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
97e82d8eac8d106b28abf1b716982c40c06fffe49cc2f34cd1c299266745ef73
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://offer-connect.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Sat, 13 May 2023 16:15:02 GMT
x-content-type-options
nosniff
age
270813
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
47728
x-xss-protection
0
last-modified
Tue, 23 Aug 2022 17:55:22 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 12 May 2024 16:15:02 GMT
track
trc.pushnami.com/api/push/ 		2 B
168 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://trc.pushnami.com/api/push/track
Requested by
Host: api.pushnami.com
URL: https://api.pushnami.com/scripts/v1/pushnami-adv/63ed63298591f2001320edcc
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.21.164.9 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-21-164-9.compute-1.amazonaws.com
Software
/
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

accept
application/json, text/plain, */*
Referer
https://offer-connect.com/
accept-language
de-DE,de;q=0.9
key
63ed63298591f2001320edcc
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
content-type
application/x-www-form-urlencoded

Response headers

access-control-allow-origin
*
date
Tue, 16 May 2023 19:28:35 GMT
access-control-expose-headers
WWW-Authenticate,Server-Authorization
cache-control
no-cache
content-length
2
content-type
text/html; charset=utf-8
track
trc.pushnami.com/api/push/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://trc.pushnami.com/api/push/track
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.21.164.9 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-21-164-9.compute-1.amazonaws.com
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
key
Access-Control-Request-Method
POST
Origin
https://offer-connect.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-headers
Accept,Authorization,Content-Type,If-None-Match,key
access-control-allow-methods
POST
access-control-allow-origin
*
access-control-expose-headers
WWW-Authenticate,Server-Authorization
access-control-max-age
86400
cache-control
no-cache
date
Tue, 16 May 2023 19:28:35 GMT
hub
api.pushnami.com/scripts/v1/ Frame C022 		2 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://api.pushnami.com/scripts/v1/hub
Requested by
Host: api.pushnami.com
URL: https://api.pushnami.com/scripts/v1/pushnami-adv/63ed63298591f2001320edcc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.99.22 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-99-22.fra60.r.cloudfront.net
Software
/
Resource Hash
2843128d287da3614565182de89a84deb0e43fd049be6a4ed4d3a682bdd186c4
Security Headers
Name Value
Content-Security-Policy default-src 'unsafe-inline' *
X-Content-Security-Policy default-src 'unsafe-inline' *

Request headers

Referer
https://offer-connect.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-headers
X-Requested-With
access-control-allow-methods
GET,PUT,POST,DELETE
access-control-allow-origin
*
age
1831
cache-control
no-cache
content-encoding
gzip
content-security-policy
default-src 'unsafe-inline' *
content-type
text/html; charset=utf-8
date
Tue, 16 May 2023 18:58:04 GMT
vary
accept-encoding
via
1.1 b43c04a791e8dcb8ddb6bb0847fcf95a.cloudfront.net (CloudFront)
x-amz-cf-id
zH-MMY02NA_ki57kA7KKx0WKuNnqM_w_pmqP5AArTeKceKOOBnYZNw==
x-amz-cf-pop
FRA60-P3
x-cache
Hit from cloudfront
x-content-security-policy
default-src 'unsafe-inline' *
x-webkit-csp
default-src 'unsafe-inline' *
psp
psp.pushnami.com/api/ 		2 B
224 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://psp.pushnami.com/api/psp
Requested by
Host: api.pushnami.com
URL: https://api.pushnami.com/scripts/v1/pushnami-adv/63ed63298591f2001320edcc
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.21.2.69 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-21-2-69.compute-1.amazonaws.com
Software
/
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

accept
application/json, text/plain, */*
Referer
https://offer-connect.com/
accept-language
de-DE,de;q=0.9
key
63ed63298591f2001320edcc
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
content-type
application/x-www-form-urlencoded

Response headers

access-control-allow-origin
https://offer-connect.com
date
Tue, 16 May 2023 19:28:36 GMT
cache-control
no-cache
access-control-allow-credentials
true
content-encoding
gzip
vary
accept-encoding
content-type
text/html; charset=utf-8
psp
psp.pushnami.com/api/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://psp.pushnami.com/api/psp
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.21.2.69 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-21-2-69.compute-1.amazonaws.com
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
key
Access-Control-Request-Method
POST
Origin
https://offer-connect.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
key
access-control-allow-methods
POST
access-control-allow-origin
https://offer-connect.com
access-control-expose-headers
content-type, content-length, etag
access-control-max-age
600
cache-control
no-cache
content-encoding
gzip
content-type
application/json; charset=utf-8
date
Tue, 16 May 2023 19:28:35 GMT
vary
accept-encoding
9e8aef8068
lynku.jukminung.com/rc/ 		2 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://lynku.jukminung.com/rc/9e8aef8068?affclick=1344138053&pshnm_src=690099&pubid=690099
Requested by
Host: offer-connect.com
URL: https://offer-connect.com/?&__pt__=all&__cm__=Welcome%3A%20Access%20Our%20Best%20Offers%20Available%21&pshnm_src=690099&__destUrl__=https://lynku.jukminung.com/rc/9e8aef8068?affclick=1344138053&pubid=690099
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3032::6815:1cae -, , ASN (),
Reverse DNS
Software
cloudflare /
Resource Hash
86397bfb92b7eb8adec12ae258d11ab6ada6ffd6003870cf9e6991f23e9b084e

Request headers

Referer
https://offer-connect.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
7c86066f1ee91d9e-FRA
content-encoding
br
content-language
en-us
content-type
text/html; charset=utf-8
date
Tue, 16 May 2023 19:28:40 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TxkQ%2Fby%2BS2HpA%2Frwtc7JGZ7K0i%2F1GbqVtVWfs7HrZRUphWTKXHY723QNCuE3KU48XhKp4lii0%2FZUo1ybZ2diFI27ixdlIn1LUazLt3vsXtwp8Q3w2ElKWsk7x79pPBeA8uQy76GjKIw3eFYTIBiXe6KP"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding, Accept-Language, Cookie
redirect.css
cdn.addlnk.com/ 		1 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdn.addlnk.com/redirect.css
Requested by
Host: lynku.jukminung.com
URL: https://lynku.jukminung.com/rc/9e8aef8068?affclick=1344138053&pshnm_src=690099&pubid=690099
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3030::6815:4a8d -, , ASN (),
Reverse DNS
Software
cloudflare /
Resource Hash
7817748dc7354950bf4943388276db534474269c0cd0ed6a629841ca3d7b81a1

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Tue, 16 May 2023 19:28:41 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id
NG3WEQ5NJ4PQVZ4F
age
5747
cf-polished
origSize=1680
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-id-2
QxX22n6jD9gBrjBZ6ohlWbPu+une0ezSYrlZ/gpY7cQk926tnR/U/t0VdL75pShx4aODRqNqN5k=
cf-bgj
minify
last-modified
Wed, 13 Mar 2019 00:03:12 GMT
server
cloudflare
etag
W/"3ae56d32551602b41f9046c14d1cfde2"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nsMhL%2Fc4581MQNMgVPfg4eHMS6oDycuA9EX1utJFjEaU%2B2QFZowNJtr%2FzJnhTNEWGSoMRuIek78dcXiAzGfoMD94EnVthPzYA5tzytm1deTrvj%2BXBexU08eIyy%2F0BDfhAQv3quipL%2B1tmMvZeQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cf-ray
7c8606707bc392c5-FRA
invisible.js
lynku.jukminung.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/27ac9c8d/ Frame 0242
Redirect Chain
  • https://lynku.jukminung.com/cdn-cgi/challenge-platform/scripts/invisible.js
  • https://lynku.jukminung.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/27ac9c8d/invisible.js
29 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://lynku.jukminung.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/27ac9c8d/invisible.js
Protocol
H2
Server
2606:4700:3032::6815:1cae -, , ASN (),
Reverse DNS
Software
cloudflare /
Resource Hash
0e43a5244a33d685a709e7820ec1c5f8d7aa3685858f396c4a4bf8f5a98c60fd
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Tue, 16 May 2023 19:28:41 GMT
content-encoding
br
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
accept-encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oXTenHBeS7Pv8wX23aiVAvYQL5wJo53WMeRoOCk9ECJx8ID0qqVAblp1pY65dXNpZe3M240HDeY8iWnaPnLdT714kzQQcAqiojCtDyQ7xde211WykB7GWeS4b1PI7nRCnlz1CLOYvZjq8xBrsIRIzxfJ"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=UTF-8
cache-control
max-age=14400, public
cf-ray
7c860670e9431d9e-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400

Redirect headers

date
Tue, 16 May 2023 19:28:41 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
accept-encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6zE%2BrnakySWNw0LDb6squF9bAidYCyOTIIxFAKH3F7QVRy0ONWyxIR%2F8y5V34jlRbcVveGq6kgWKDxC%2FERn0m9m1ysPinqkS9CVbNYCaIDjTg9W8vYXhPocnddbNcpOijBHsbEcw2G8RLJCQIOGp01iF"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
location
/cdn-cgi/challenge-platform/h/b/scripts/jsd/27ac9c8d/invisible.js
cache-control
max-age=300, public
cf-ray
7c860670b9041d9e-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
pica.js
lynku.jukminung.com/cdn-cgi/challenge-platform/h/b/scripts/ Frame 0242 		6 KB
4 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://lynku.jukminung.com/cdn-cgi/challenge-platform/h/b/scripts/pica.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::6815:1cae -, , ASN (),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Tue, 16 May 2023 19:28:41 GMT
content-encoding
br
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
accept-encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JOIeckX%2FcPHec7nntZGrE3GKYYbZf3zj%2FoWcUNFk4GcRGUjy7JT6rX9hK8SK01Qn%2Bzb9RCNe7R60OYNd%2FxpFjy9bMkOLZAPbrpL%2BY90tC3Mt317h7%2FZYac%2F5Ox8XBjt3eNG8xzS%2B3MViDv%2FWakxIuUJV"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=UTF-8
cache-control
max-age=14400, public
cf-ray
7c860671288e926e-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
/
1d706b4e081.megatrffc.com/ 		972 B
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://1d706b4e081.megatrffc.com/?p=4379&media_type=mainstream&sub_id=pubbd61548781b84e87a87ebfc6bb48abb7&pubid=690099&pi=690099
Requested by
Host: lynku.jukminung.com
URL: https://lynku.jukminung.com/rc/9e8aef8068?affclick=1344138053&pshnm_src=690099&pubid=690099
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
94.237.103.119 -, , ASN (),
Reverse DNS
Software
/
Resource Hash
508d86d567e484f5f1ceef12c9694fbfa1578194a8a4ac9641a77df6acb06e61

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
no-store, no-cache, must-revalidate post-check=0, pre-check=0
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 16 May 2023 19:28:41 GMT
expires
Tue, 16 May 2023 19:28:41 GMT
last-modified
Tue, 16 May 2023 19:28:41 GMT
pragma
no-cache
vary
Accept-Encoding
x-robots-tag
noindex, nofollow
7c86066f1ee91d9e
lynku.jukminung.com/cdn-cgi/challenge-platform/h/b/cv/result/ Frame 0242 		0
0
Primary Request /
topeditsolutions.com/dLtykv3tsrI0zu3YkELo-RiazqrXZ_jLh1jnO51uqUk/ 		32 KB
14 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://topeditsolutions.com/dLtykv3tsrI0zu3YkELo-RiazqrXZ_jLh1jnO51uqUk/?clck=5yxeouwrj4cq3suhsivqck8g0,16693442,5,4379&sid=4379
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::3 -, , ASN (),
Reverse DNS
Software
cloudflare /
Resource Hash
bce640d603b8eb2194786ae4d3c499a8ab8fc3cf88204267aab874fbfafb7e14

Request headers

Referer
https://1d706b4e081.megatrffc.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ch
Sec-CH-UA,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
7c86067309fdbb89-FRA
content-encoding
br
content-type
text/html
date
Tue, 16 May 2023 19:28:41 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6Tzw6WBiA6ZX%2BSsHUr%2Bw1tHj7nqZG4ZSmmBZnWhme3Y5Vupi5Tw5UbRU6v0gimiiP%2F1Dp8ISwnK2dUYs8mxs5MUKYDKlRixe3moAgunh%2Fox%2B1PkspRSmZuw07E0xwhP6Yq1F0iJtNUdgUL4tw7LcWNfbTw%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
truncated
/ 		3 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ee3df69641a083faeda162fce068aef31075856f15c43c74eada446496b865f2

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type
image/png
AFU1kAAPatM
feed.cn-rtb.com/v1/native/ 		652 B
860 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://feed.cn-rtb.com/v1/native/AFU1kAAPatM?subid=58784&uid=9e9c88c4-7e20-4b02-9864-64d934255e16&kw=download%20install
Requested by
Host: topeditsolutions.com
URL: https://topeditsolutions.com/dLtykv3tsrI0zu3YkELo-RiazqrXZ_jLh1jnO51uqUk/?clck=5yxeouwrj4cq3suhsivqck8g0,16693442,5,4379&sid=4379
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.197.244 -, , ASN (),
Reverse DNS
Software
cloudflare /
Resource Hash
9fb58ece3398bd36c645a55a985eb40ac72f2b4ca4e5aad03f3c21b43cb0d518

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://topeditsolutions.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Tue, 16 May 2023 19:28:42 GMT
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
model
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IeH35keHlNecH2Rg5wNzh5JlUrHgDYw%2FMpmj5HbWApJ4uNQ8%2BKIjgt1THWgYxAxA3jSSD0YIYt7DATkPOvJHhtTQmoBbMQZlMwkFyAHOdq5%2B%2BL9%2F2bNDlWpMfMIlFGA%2Bv24%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/json; charset=utf-8
access-control-allow-origin
*
cache-control
no-cache
cf-ray
7c860674d9f59001-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
conf.json
topeditsolutions.com/hood/dG9wZWRpdHNvbHV0aW9ucy5jb20=/ 		49 B
416 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://topeditsolutions.com/hood/dG9wZWRpdHNvbHV0aW9ucy5jb20=/conf.json
Requested by
Host: topeditsolutions.com
URL: https://topeditsolutions.com/dLtykv3tsrI0zu3YkELo-RiazqrXZ_jLh1jnO51uqUk/?clck=5yxeouwrj4cq3suhsivqck8g0,16693442,5,4379&sid=4379
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::3 -, , ASN (),
Reverse DNS
Software
cloudflare /
Resource Hash
206df5733e9d16e6737f803f60634387180561c7c06580ddb666d5d71bc8bf12

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://topeditsolutions.com/dLtykv3tsrI0zu3YkELo-RiazqrXZ_jLh1jnO51uqUk/?clck=5yxeouwrj4cq3suhsivqck8g0,16693442,5,4379&sid=4379
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Tue, 16 May 2023 19:28:41 GMT
content-encoding
gzip
cf-cache-status
DYNAMIC
last-modified
Fri, 04 Nov 2022 13:48:52 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"63651844-31"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FalCJDmgGQRNtCqHSoKP1p7unPKD11ixUFXTgVcRt7EMRRpNDjk3bOTFP5PH08c1zWyf4SQmXO7DCxenXKfP9rzkbE0u3J9OQNf0Q2GEIypSZZxcjk0QNG59AQein%2BukngetmYyM3zkDJUP%2Btubj8%2BJW6A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/json
cf-ray
7c8606748bfbbb89-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
truncated
/ 		748 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a5308b7decd6fc2d5e8438fb037c4a822125135db832c05437d754655ff2fc23

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type
image/svg+xml
ht.js
sdk.ocmhood.com/sdk/ 		29 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://sdk.ocmhood.com/sdk/ht.js?tag=NjY4ZwSkNAFfmDQ2NUkxNDY4MjE0NhON
Requested by
Host: topeditsolutions.com
URL: https://topeditsolutions.com/dLtykv3tsrI0zu3YkELo-RiazqrXZ_jLh1jnO51uqUk/?clck=5yxeouwrj4cq3suhsivqck8g0,16693442,5,4379&sid=4379
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:7e4 -, , ASN (),
Reverse DNS
Software
cloudflare /
Resource Hash
21665b9600ac889b2ba06e3af0a300b2ecdd03e4f48e9de954f7ab04d0ff9c6d

Request headers

Referer
https://topeditsolutions.com/
Origin
https://topeditsolutions.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Tue, 16 May 2023 19:28:41 GMT
content-encoding
br
cf-cache-status
REVALIDATED
last-modified
Tue, 04 Apr 2023 11:17:27 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"642c0747-2e62"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mGVtAFknNgTtMEwozjtc21PPhH94RXweVAU6pMJFbHjIm0UXuBb2rmtcnKYDW2RxFi%2Fe%2Fxproa2SVUNrFou0snGtinpzPR91E%2B3nkY76RENkI0HVxsOc5BfW1nT8VOq7PP%2F8OHcwyLxGQYyxgQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=14400
cf-ray
7c860675bd8c1cc9-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
service-worker-allowed
/
NjY4ZwSkNAFfmDQ2NUkxNDY4MjE0NhON.js
cdn.ocmhood.com/tag/ 		191 B
711 B 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ocmhood.com/tag/NjY4ZwSkNAFfmDQ2NUkxNDY4MjE0NhON.js
Requested by
Host: sdk.ocmhood.com
URL: https://sdk.ocmhood.com/sdk/ht.js?tag=NjY4ZwSkNAFfmDQ2NUkxNDY4MjE0NhON
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:7e4 -, , ASN (),
Reverse DNS
Software
cloudflare /
Resource Hash
7029c531c54c17f9c35d066b0208cd36a93b409ad46e35a3a294feb57291b259

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://topeditsolutions.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Tue, 16 May 2023 19:28:42 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
3379
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
service-worker-allowed
/
last-modified
Tue, 01 Nov 2022 15:05:01 GMT
server
cloudflare
etag
W/"6361359d-bf"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gycYcHUFIr7H5xtQ5ba7XxRJMS0fIUJqWRXa780NygEH1g62txSWwPH%2FympWEgmZ4QMN9CsRqmWcqvhxBvgSyTSZiD34uEbiXRXzN23Rf4vbPiFOBbmxPmV12iDvMZ4sgmiQUV%2BFYEbgBOeXrQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=300
cf-ray
7c8606767da7910c-FRA
activity
t.ocmhood.com/v2/ 		0
263 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://t.ocmhood.com/v2/activity
Requested by
Host: sdk.ocmhood.com
URL: https://sdk.ocmhood.com/sdk/ht.js?tag=NjY4ZwSkNAFfmDQ2NUkxNDY4MjE0NhON
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:7e4 -, , ASN (),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://topeditsolutions.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Tue, 16 May 2023 19:28:42 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9cGbNbnekYJNaL9SrA3shQMh%2BSdYv5d3M4UT6PhBrfKo9iWL3kD0Bd7l9MNGraX5sbOWfbOg88iPcwuu1RZf9dCpD5SLKi6h7P0iSn1swdZ%2F9Bu9yUcx7KgMKbbCaCYpdffDMGULHpQPWx4%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/octet-stream
cache-control
no-cache
cf-ray
7c860676cdf1910c-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
activity
t.ocmhood.com/v2/ 		0
302 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://t.ocmhood.com/v2/activity
Requested by
Host: sdk.ocmhood.com
URL: https://sdk.ocmhood.com/sdk/ht.js?tag=NjY4ZwSkNAFfmDQ2NUkxNDY4MjE0NhON
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:7e4 -, , ASN (),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://topeditsolutions.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Tue, 16 May 2023 19:28:42 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7wAf8PTZTM%2FkcSMpX0%2F7t1kdW76o6SVS0e5FiBRYjjwxUwu%2BxT6Z8bJbjPDym4knjtR25sF1dGotSFvh%2Fdn8ZK5vyOBdv5hMTySaAeuJRpGbtq9nKZH4wbClZ6kbMsmpjmw7RaeO7dOg9jI%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/octet-stream
cache-control
no-cache
cf-ray
7c860676cdf3910c-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
imp
t.cn-rtb.com/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://t.cn-rtb.com/imp?l2=3c7-Y01LMAE2qx7WLandp-zrdYUTnxVLHRzLJXuPkyS4u1YC1xQ_ZGp3PIbl4QM6kgnVGLjlpYurIN4f52OmiMkCMU-BTRM3448oyz3uJk-SN4FzND-38Is5jaLf9PUkTbEzqf28w5u47FVaMUEihUWxlH6uLQJGhYaZSGSWyREm0h3M8htGlc-Kqdud8-yj
Requested by
Host: topeditsolutions.com
URL: https://topeditsolutions.com/dLtykv3tsrI0zu3YkELo-RiazqrXZ_jLh1jnO51uqUk/?clck=5yxeouwrj4cq3suhsivqck8g0,16693442,5,4379&sid=4379
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.197.244 -, , ASN (),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://topeditsolutions.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Tue, 16 May 2023 19:28:42 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7lDN4DQD7RLcEVU7zqQE%2FfVUWgtv4RuqVvK2CdQ8orv35HhwAErhvX%2BM0Xm2I9WvWvLe4m4M5W3IKNTCD%2FFMsIOtIWKxiNzw%2F6K2r6GnQCRJQd5FbGF0CG1FX7gtT6A%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
cache-control
no-cache
cf-ray
7c8606773ca99001-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
lynku.jukminung.com
URL
https://lynku.jukminung.com/cdn-cgi/challenge-platform/h/b/cv/result/7c86066f1ee91d9e

Verdicts & Comments Add Verdict or Comment

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 boolean| credentialless function| $ function| jQuery function| showSecondStep boolean| isRollbar object| pushWrap function| showFbChkOptIn object| mailnamiPromptModule undefined| o object| mailnami object| Pushnami function| CrossStorageClient object| pushnamiStorage function| uuid

1 Cookies

Domain/Path Name / Value
empathysymphony.com/ Name: uid15295
Value: 1344138053-20230516152833-dc334be24bea215196c5c92058a9a865-

1 Console Messages

Source Level URL
Text
other error URL: https://offer-connect.com/?&__pt__=all&__cm__=Welcome%3A%20Access%20Our%20Best%20Offers%20Available%21&pshnm_src=690099&__destUrl__=https://lynku.jukminung.com/rc/9e8aef8068?affclick=1344138053&pubid=690099
Message:
Chrome currently does not support the Push API in incognito mode (https://crbug.com/401439). There is deliberately no way to feature-detect this, since incognito mode needs to be undetectable by websites.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

1d706b4e081.megatrffc.com
ajax.googleapis.com
api.pushnami.com
cdn.addlnk.com
cdn.ocmhood.com
dischargebackhanded.com
empathysymphony.com
feed.cn-rtb.com
fonts.googleapis.com
fonts.gstatic.com
lynku.jukminung.com
maxcdn.bootstrapcdn.com
offer-connect.com
psp.pushnami.com
sdk.ocmhood.com
storage.googleapis.com
t.cn-rtb.com
t.ocmhood.com
topeditsolutions.com
trc.pushnami.com
lynku.jukminung.com
13.32.99.22
172.67.197.244
203.210.17.2
2606:4700:20::681a:7e4
2606:4700:3030::6815:4a8d
2606:4700:3032::6815:1cae
2606:4700::6812:bcf
2a00:1450:4001:80f::2003
2a00:1450:4001:812::200a
2a00:1450:4001:829::200a
2a00:1450:4001:829::2010
2a06:98c1:3121::3
38.102.245.195
50.115.172.137
52.21.164.9
52.21.2.69
94.237.103.119
0e43a5244a33d685a709e7820ec1c5f8d7aa3685858f396c4a4bf8f5a98c60fd
206df5733e9d16e6737f803f60634387180561c7c06580ddb666d5d71bc8bf12
21665b9600ac889b2ba06e3af0a300b2ecdd03e4f48e9de954f7ab04d0ff9c6d
2843128d287da3614565182de89a84deb0e43fd049be6a4ed4d3a682bdd186c4
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
42fa66b97e0ca198bfa261e2398544d9b3dbe31a60ebb010f1afd102d851df5d
508d86d567e484f5f1ceef12c9694fbfa1578194a8a4ac9641a77df6acb06e61
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
7029c531c54c17f9c35d066b0208cd36a93b409ad46e35a3a294feb57291b259
7817748dc7354950bf4943388276db534474269c0cd0ed6a629841ca3d7b81a1
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
86397bfb92b7eb8adec12ae258d11ab6ada6ffd6003870cf9e6991f23e9b084e
97e82d8eac8d106b28abf1b716982c40c06fffe49cc2f34cd1c299266745ef73
9fb58ece3398bd36c645a55a985eb40ac72f2b4ca4e5aad03f3c21b43cb0d518
a5308b7decd6fc2d5e8438fb037c4a822125135db832c05437d754655ff2fc23
bce640d603b8eb2194786ae4d3c499a8ab8fc3cf88204267aab874fbfafb7e14
cbdcee06341939e7e0e536596649fcd6d54ae2d139bbecd1c4115cd179ef3b2c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ee3df69641a083faeda162fce068aef31075856f15c43c74eada446496b865f2
ee607772e922f816ff318576900b4a7ca92449cd3f15881481a11fe30d934cdc